Processing data of a deceased individual
Pursuant to Art. 2 (1) of the PDPL
The processing of a deceased person’s data is also in the scope of the PDPL if such pro-cessing would lead to them or a member of their family being identified specifically.
This provision of the PDPL does not mean that the use of the data of a deceased person is always subject to the same requirements as the personal data of a living individual. Instead, it means that if the data of a deceased individual may cause harm to an identified living family member (for example, reputational harm), then such data of a deceased individual must be protected in the same way as the personal data of a living individual.
What is considered harm to an identified living individual and what exact PDPL requirements should apply to the deceased person’s data must be considered in each particular case.
Example | Personal data | Data of the deceased
A company offers a service to research an individual’s family history. In undertaking this research, the company identified that the deceased father of the individual suffered from a dangerous infectious disease. The individual who has ordered the research considers that this information may cause harm to his reputation. The individual notifies the research company about this fact and explains to them the reasons for this opinion.
In such case, the data of the deceased father will need to be protected by the research company in the same way as if it was personal data of the living individual.