Most of us have heard of the GDPR, which covers the use of personal data for living people when it is not for purely personal processes. But what happens to people’s data when they die?
In the UK, the handling of personal information for people after they die is still subject to specific legal frameworks, but there are fewer protections for deceased people than for living individuals. Here’s an overview of how this information is treated:
Contents
Data Protection Laws
Under the Data Protection Act 2018 and the General Data Protection Regulation (GDPR), personal data refers to any information that relates to an identifiable living person. Importantly, these GDPR laws do not apply to deceased individuals. This means that the specific rights that living people have over their personal data (such as the right to access, rectify, or delete data) do not extend beyond death. However, in many instances when someone dies there may be little reason for organisations to keep much data about them.
So what are your postmortem privacy rights?
Confidentiality and Medical Records
While GDPR does not apply to the deceased, the common law duty of confidentiality still continues after death. Healthcare professionals are obligated to keep a deceased person’s medical records confidential, and access to this information is tightly controlled. In general, only certain individuals can request access, such as:
-
The deceased’s personal representative (i.e., an executor or administrator of the estate)
-
Someone with a legal claim arising from the death, for example, in cases of medical negligence.
The Access to Health Records Act 1990 allows these individuals to access a deceased person’s medical records under limited circumstances. Requests for this data must be made formally, and healthcare providers are bound to protect the sensitive nature of the information.
Medical Research and Post-Mortem Data
For medical research access to deceased persons’ health information is allows. Researchers are not bound by the same constraints as they are with the personal data of living individuals. However, researchers are still expected to handle such data with respect and must follow ethical guidelines.
Medical research that uses deceased persons’ data must often receive approval from ethics committees, especially if the research may affect living relatives or involve sensitive data.
Wills and Probate
Wills, probate records, and other documents related to the management of an estate can become public records once they are submitted to a court.
These documents can contain personal information about the deceased, including details about their assets, beneficiaries, and personal wishes. Because these documents become public, anyone can request access to them, usually by paying a small fee.
Next-of-Kin and Sensitive Personal Data
The deceased’s family or next-of-kin often controls access to certain sensitive information after death. Although the law does not offer explicit protection for a deceased person’s data under data protection regulations, organisations, such as hospitals or financial institutions, may still limit access to protect the privacy of surviving family members. For an example of this, read the next section.
Freedom of Information
The Freedom of Information Act does allow the sharing of personal data in some circumstances. The exception is if disclosing it would contravene the GDPR. Since the GDPR does not apply post mortem this should not prevent sharing the data of deceased people.
However, the data of deceased people can reveal information about other people so some restrictions may apply. For example, when working as a data protection officer in a hospital a journalist asked for records relating to maternal deaths. We decided not to share the information because there would be direct and indirect identifiers of other people within the records requested.
Although this decision was not directly related to the deceased people, their data was still protected.
Intellectual Property and Digital Legacy
When people who held intellectual property rights, such as copyrights or trademarks, pass away these rights may continue to be protected after death for a specified period. For example copyright typically lasts for 70 years after the author’s death.
Personal data held within digital accounts, like social media profiles, emails, and cloud storage, may also require special handling after a person dies. The rights to these accounts are typically governed by the platform’s terms of service, and the data could be deleted or managed by family members through legacy or memorialisation processes.
Here’s a general overview of how different platforms handle deceased users’ accounts:
-
Facebook: Facebook offers a “Memorialisation” option for deceased users. When activated, the account becomes a “memorial profile” that is no longer searchable. Friends and family can post messages of condolence on the memorial profile.
-
Instagram: Instagram also offers a memorialisation feature. The account is marked as “Memorialised,” and the profile picture becomes a remembrance photo. Only approved contacts can see the profile.
-
Twitter: Twitter allows for the deactivation of an account. Once deactivated, the account is no longer visible to others. However, it may be possible to reactivate the account within 30 days.
-
LinkedIn: LinkedIn offers a “In Memoriam” setting for deceased users. This setting allows family members or authorised representatives to manage the deceased person’s profile.
It’s important to note that these are general guidelines, and specific policies may vary slightly between platforms. Additionally, individual users may have customised their settings to control what happens to their accounts after they pass away.
Coroner’s Investigations
In cases where a coroner is investigating the circumstances of a person’s death, there may be a legal requirement to disclose some personal information, such as medical history or the events leading up to the death. Coroners have the legal authority to access confidential data for the purpose of determining cause of death, but they are expected to maintain confidentiality regarding this information.
Public Interest Exceptions
There may be cases where personal information about a deceased person is disclosed in the public interest. This can occur, for instance, when a person’s death is of significant public concern, or when the release of information is essential for public health, safety, or legal reasons. In these cases, information might be disclosed to protect the public or in accordance with legal mandates.
Conclusion
In summary, while data protection laws like GDPR do not apply to deceased individuals, confidentiality in medical and personal information can still be preserved through other legal mechanisms. Certain professionals, such as healthcare providers and legal representatives, are bound by confidentiality duties, and access to sensitive information is limited to those with legal or personal authority.