GDPR and the deceased

The right to the protection of personal data ceases when a person’s life ends. This was established in Art. 2.4 of the Regulation that implements the abrogated Spanish Data Protection Act of 1999: “This regulation shall not apply to data relating to the deceased”.

This being said, and in line with the principle that personal data must reflect the real situation of its owner, the article referred to the fact that relatives of the deceased could contact the holder of his or her data to report the death and cancel his or her personal data.

The current Spanish Law on Data Protection and Digital Rights (LOPDGDD) of 2018 goes even further and includes an entire article, number 3, to refer to the deceased and sets forth

• that relatives of the deceased may contact the holder of the data, the controller or processor to request rectification or erasure of the data.
• The deceased may forbid – obviously while he or she is alive – relatives from accessing his or her data or requesting its rectification or erasure.

The LOPDGDD also introduces what is known as the Digital will, which establishes that the announced rights may be exercised, with the exception already indicated, with regard to the providers of information services. It also adds that representatives may decide whether to maintain or erase the social profiles of the deceased.

What do the major service providers do?

Most service providers have what is known as an inactive account management policy. This establishes that, where account inactivity is detected, it can be considered inactive and can be cancelled.

• Facebookallows for a “legacy contact” to be appointed to manage commemorative accounts and has a form to request the deletion of the account of a deceased person. Instagram has a similar policy, as it is owned by Facebook.
• Google enables users to appoint someone to whom this notification regarding account inactivity is sent so that they can make the corresponding decision.
• Twitter recommends logging on every 6 months because, if not, the account may be considered inactive and may be suspended.

It’s never pleasant to think about these things, but as we leave the trace of our lives on the internet it’s worthwhile thinking about what we want to happen when we’re no longer here. Unlike several years ago, the major providers now have mechanisms in place to solve this problem. They just have to be activated.