Processing of Personal Data of deceased persons

Processing of Personal Data of deceased persons

Recital 27 of the General Data Protection Regulation (hereinafter, “GDPR“), expressly states that said Regulation shall not apply to the protection of personal data of deceased persons. However, the Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights (hereinafter, “LOPDGDD“), does provide for the regulation of this kind of data.

Regulation of the processing of deceased persons’ data

In view of the above, the GDPR leaves it up to the Member States (and their national legislators) to regulate the processing of the personal data of a natural person after death, since, according to Opinion 4/2007 on the concept of personal data of the Article 29 Working Party, information relating to deceased persons should not be considered as “personal data” since deceased persons cease to be natural persons for civil law purposes. 

Notwithstanding the above, the Spanish legislator has deemed it appropriate to delve deeper into this matter and has included in the LOPDGDD that, while excluding their processing from the scope of application of the law, persons related to the deceased may request access to the data, its rectification and/or deletion.

Rights of family members and/or designees

Article 3 of the LOPDGDD regulates a series of cases or situations in which the relatives of the deceased may carry out certain actions aimed at protecting the data of the deceased, specifically those indicated below:

• Persons related to the deceased may, for family or de facto reasons, as well as their heirs, may contact the data controller or the processor in order to request access to the deceased’s personal data and, where appropriate, their rectification or erasure. 

• In the event of the death of minors, such requests may also be made or exercised by their legal representatives or, within the framework of its powers, by the Public Prosecutor’s Office, which may act ex officio or at the request of any interested natural or legal person. 

• In cases of death of persons with disabilities, these rights may also be exercised by those who have been designated to exercise support functions, in the event that such powers are understood to be included in the support measures provided by the designated person.

Likewise, in the event that the deceased had designated a specific person, outside the family circle, or an institution to carry out this type of post-mortem procedures, these may also request, in accordance with the instructions received, access to the data, its rectification or deletion. For this purpose, and by decree, the requirements and conditions for accrediting the validity and currency of these mandates and instructions and, where appropriate, the registration of the same will be established. 

Furthermore, unless the deceased person had left express instructions in this regard, with regard to social media, public profiles and/or services of a similar nature, the entitled persons may decide on the maintenance or elimination of the referred profiles. 

However, and as an exception to the above, the relatives and/or persons related to the deceased may not access the data of the deceased, nor request its rectification or deletion, when the deceased had expressly prohibited it or it is so established by law. Such prohibition shall not affect the inherent right of the heirs of the deceased to access the data of the deceased’s estate.

Time periods for the preservation of deceased person’s data

The fundamental principle governing the conservation of personal data is to keep them for the time strictly necessary to fulfill the purpose for which they were collected. 

In the case of the data of the deceased person, and given that the purpose is understood to have been extinguished, they may be kept duly blocked for the period legally established by the applicable regulations, after which their deletion will be carried out, in the event that such erasure has not been requested by a family member or person authorized to do so beforehand.