Introduction: Right to Information under Data Protection Law and Inheritance Law
Since the General Data Protection Regulation (GDPR) came into force, affected individuals have had a comprehensive right to information from data processing entities according to Art. 15 GDPR. This right allows natural persons to inquire about details regarding the processing of their personal data. In legal practice, the question of how to handle such information rights in the event of the person’s death is gaining increasing relevance, especially in the context of inheritance law. The following provides a comprehensive overview and classification of the relevant legal principles, current developments, and prevailing opinions in jurisprudence and literature.
Legal Basis of the Right to Information under the GDPR
Scope and Content of the Right to Information
Article 15 GDPR grants affected individuals the right to request confirmation from controllers as to whether personal data concerning them is being processed. If processing is taking place, the individual has the right to access the stored data, processing purposes, and a range of other information.
Special Features of the Right to Information
The right is expressly tailored to “affected individuals.” Personal data generally relates to living natural persons; the GDPR does not explicitly regulate the application of the right to information after the death of an individual. This gap raises various questions in inheritance law and data protection law.
Inheritable Transference of the Right to Information
Principle of Succession
German civil law stipulates that, upon a person’s death, their entire estate, including all rights and obligations, passes to the heirs by universal succession (§ 1922 BGB). This raises the fundamental question of whether data protection information rights also become part of the estate and can be asserted by heirs.
Personal Rights Nature and Its Implications
The right to information under Art. 15 GDPR is closely linked to the general right to privacy. In literature and jurisprudence, there is still disagreement as to whether it is an extremely personal right, which is not inheritable, or an inheritable property right. Particularly when the right to information is used to enforce economically valuable interests – such as for the examination of compulsory portion rights or to assert compensation claims – there is a practical need for its inheritability.
Considerations from the GDPR and National Implementation Acts
The GDPR itself states in recital 27 that its regulations generally do not apply to the personal data of deceased individuals. At the same time, member states are free to create further regulations for dealing with data of deceased individuals. The German legislature has taken advantage of this opportunity through § 35 Federal Data Protection Act (BDSG) and created certain protection regulations for the data of deceased individuals – however, it has not implemented an explicit rule on the inheritability of the right to information.
Current Jurisprudence and Opinions
Higher Regional Court Nuremberg, Decision of 29.09.2023
Recent decisions – such as the decision of the Higher Regional Court (OLG) Nuremberg dated 29.09.2023 (ref.: 12 W 1923/23) – underline the complexity of the issue. The underlying case addressed the question of whether heirs can assert a right to information from a company regarding the personal data of the deceased after a person’s death.
The OLG Nuremberg denied a general inheritability of the right to information under Art. 15 GDPR, as this is particularly tailored to the protection of living individuals. However, the court explained that in individual cases, asserting the heirs’ information interest may be permissible under the BDSG in conjunction with specific inheritance interests, such as when data is needed to enforce their own rights (e.g., compulsory portion claims).
Diverging Opinions in Literature and Practice
In literature, there are indeed voices that advocate for a restrictive handling of the purpose of the GDPR. Other voices argue for a case-by-case solution, particularly where the legitimate interest of heirs clearly outweighs or where there are no opposing interests of the deceased or third parties. Specifically, the need for information to manage the estate can, according to this view, establish a transferability/claimability right.
Practical Challenges for Data Processing Entities
Companies and other data processing institutions face the challenge of weighing, in individual cases, under consideration of data protection, civil law, and compliance-based guidelines, whether and to what extent they may or must provide information to heirs. This applies particularly with regard to data protection accountability and potential liability risks towards affected individuals and their legal successors.
Outlook and Design Options
Lack of Clarity in European and National Law
In the absence of explicit legal regulations, a differentiated, fact-based examination standard is currently required, which adequately considers the legitimate interests of the heirs, the privacy of the deceased, and possible rights of third parties. Both data processing entities and heirs are advised to carefully examine each situation and observe current legal developments.
Considerations for Reform and Future Developments
Various approaches are being discussed in the professional debate about how a clearer regulation regarding the transferability of data protection rights after a person’s death can be established. A binding decision by the European Court of Justice on this issue is still pending, so uncertainties persist.
Conclusion
The question of the inheritability of the data protection right to information under the GDPR remains open and is of considerable significance in practice. While the relevant norms have not yet contained an explicit regulation, a trend towards case-by-case analysis under consideration of the interest situation of all parties involved is emerging in jurisprudence and literature.
For companies and private individuals, a careful examination of the respective situation is recommended in cases of uncertainty. In legal questions and uncertainties regarding the inheritability of data protection claims, affected individuals can always confidently turn to MTR Legal Attorneys to assess the current developments and recognize legal risks early.
