The death of a person is a complex issue from a data protection point of view, as neither the GDPR, the explanatory memorandum to the Data Protection Act, the guidelines of the European Data Protection Board, nor those of the Data Protection Inspectorate address what happens to personal data after the person dies.
The GDPR only protects the data of living people, so member states can restrict the processing of the data of the deceased.
Section 9 of the Data Protection Act specifies the conditions for processing the data of deceased persons. The data of deceased adults are protected for ten years, and the data of deceased minors for 20 years after death. During this period, all data protection principles must be complied with, including finding an appropriate legal basis for the processing. After this period, the data will no longer be subject to data protection and will have to be used in accordance with general principles of research ethics and professional practices.
2.16.1. Protection of deceased persons’ data serves to protect other people
The data of a deceased person may also concern their friends and relatives. It is, therefore, important to remember that the focus of protection is not on the interests and rights of the deceased person but on those of their friends and relatives. If the researcher has access to the deceased person’s files, documents, diaries or other materials, the living persons’ data included in them are still protected.
For example, it may be difficult to process data on the circumstances of death if the death was caused by a person who is still alive or if the cause of death can be used to draw conclusions about the health of other people. There may also be restrictions on using the information on other bases, for example, where it may reveal the adoption secrecy within the meaning of section 164 of the Family Law Act.
2.16.2. After death, the right to give and withdraw consent passes to successors
In the case of consent-based research, it should be borne in mind that the successor can give consent to the processing of the deceased person’s data. If the data are to be collected during the ten-year period of protection after death, this will mean an additional burden for the researcher, who will have to identify and contact the successors. In the case of multiple successors, consent can be given and withdrawn by any of them. Under subsection 18 (1) of the Law of Succession Act, in the absence of successors, inheritable rights are transferred to the local government of the data subject’s place of residence, from which consent can be sought. If it is known in advance that it will be difficult to obtain consent for collecting the data of the deceased person, consideration may be given to whether another legal basis is available.
2.16.3. Other rights of the data subject are not transferred to successors
A somewhat more complex question concerns the extent to which the successors can exercise the rights of the data subject listed in Article 3 of the GDPR. Since the withdrawal of consent may render the processing of the personal data of the deceased unlawful, it could, in turn, follow that the successor could also submit a request for erasure under Article 17 of the GDPR. At the same time, the explanatory memorandum of the Personal Data Protection Act does not mention whether and to what extent other rights of the data subject concerning their data can be inherited. However, if the successor were to request the erasure of the data, it would be possible to rely on the general exceptions mentioned in clause (d) of Article 17 (3) of the GDPR, namely archiving in the public interest, scientific research or historical research (see also 2.9.4).
2.16.4. Researcher is not obliged to keep an account of the life and death of the subjects
Article 11 of the GDPR states that the controller is not obliged to collect additional information in order to identify the data subject for the sole purpose of complying with the GDPR. Although Article 11 does not explicitly refer to identifying whether the data subject is alive, it can be assumed that a similar principle applies, especially since the GDPR does not protect the data of deceased persons. Thus, it can be presumed that a researcher is not obliged to keep an account of who of their subjects is alive and who is dead, only to identify who is entitled to withdraw consent. Moreover, such continuous monitoring of being alive could be seen as a separate objective, which has nothing in common with the objectives of the research and would therefore require a separate justification.
Inevitably, it can happen that, after the data subject’s death, the subject’s friends and family do not know about the person’s participation in the study, and the researchers do not know that the data subject has died. Such situations need to be approached case by case. If the data subject has given consent before death, the research can continue, but if a successor wishes to withdraw consent, this must be taken into account. In this case, the successor must prove that the data subject is deceased and he or she is the successor. A death certificate is a suitable means of proof, but the researcher does not need to retain it anywhere.
There are no clear practices for taking into account the possible death of the data subject. If it is known at the time of planning the research that the death of the data subjects is likely – for example, if very old or terminally ill people are studied or if the subjects do very dangerous work – solutions can be considered for communicating the research information to their families at an early stage.
2.16.5. Data about the deceased may be processed on other legal bases
If the research is carried out on a legal basis other than consent, the death of the data subject does not make much difference to data processing. The 10-year protection of deceased persons’ data (20 years for minors) is only valid with the consent of the data subject, which can be given and withdrawn by the successor after death. Where the legal basis is, for example, a task in the public interest, further processing can be carried out without the consent of the data subject and the successor (see also 2.4). Subsection 9 (4) of the Data Protection Act also exceptionally allows the processing of the name, sex, date of birth and death, the fact of death, and the time and place of burial of a person without the consent of the successor.