Picking up on what Gary said - which I agree with - I seem to remember that one can distinguish between medical records - those kept by healthcare professionals - and medical information - other stuff - and this is relevant when considering whether there is a duty of confidence. But would these watercolours even count as health information? I doubt it. Certainly data protection no longer applies because it protects information relating to living individuals only, and it would be stretching it to say the watercolours contain personal data of descendants of those pictured. . 

All the best 

Susan Healy