See Using Data Contracts.
New complex types that you create must
have a data contract defined for them
to be serializable. By default, the
DataContractSerializer
infers the data
contract and serializes all publicly
visible types. All public read/write
properties and fields of the type are
serialized. You can opt out members
from serialization by using the
IgnoreDataMemberAttribute
. You can
also explicitly create a data contract
by using DataContractAttribute
and
DataMemberAttribute
attributes. This
is normally done by applying the
DataContractAttribute
attribute to the
type. This attribute can be applied to
classes, structures, and enumerations.
The DataMemberAttribute
attribute must
then be applied to each member of the
data contract type to indicate that it
is a data member, that is, it should
be serialized. For more information,
see Serializable Types.
Like @Terry said, it's probably better to proactively declare which properties you want to expose. This way you could future proof your code from unintentionally exposing fields when the base class adds a public property in the future.