”
Right of access under Art. 15 GDPR as a strictly personal right?
\n\n
The right of access under Article 15 of the General Data Protection Regulation (GDPR) is intended to provide data subjects with transparency about the processing of their personal data. A recurring question is whether this right is strictly tied to the person or whether, after the person’s death, it can be asserted by heirs. The GDPR itself contains no explicit rule on this, so the answer may depend significantly on how the claim is classified and on supplementary provisions.
\n
The GDPR’s regulatory framework regarding deceased persons
\n
No direct application to data of deceased persons
\n\n
The GDPR protects personal data of living natural persons. The Regulation does not provide for direct applicability to data of deceased persons. At the same time, the GDPR does not in principle preclude national provisions on this subject area. In practice, the permissibility of providing information after a death may therefore be determined at the interfaces between data protection law, civil law and, where applicable, sector-specific statutory rules.
\n
Significance of national provisions and value judgments
\n\n
Because the GDPR contains no inheritance rule of its own in this regard, the legal classification of the right of access under national law can become relevant, particularly with regard to the inheritability of rights and claims. The decisive question is whether the claim is understood as an asset-related component of the estate or as a strictly personal right that expires upon death.
\n
Inheritability of the right of access: dispute and classification
\n
Arguments in favor of inheritability
\n\n
In favor of inheritability, it is argued that the right of access cannot serve purely non-material purposes. It can also serve to clarify asset-related issues, for example where it concerns the review of contractual relationships, the determination of claims, or the examination of estate matters. In such constellations, it is discussed whether, in effect, the claim has a function that also affects legal positions continuing after the data subject’s death.
\n
Arguments against inheritability
\n\n
It is countered that Article 15 GDPR primarily serves to protect informational self-determination and is therefore linked to the data subject. By its structure, the claim is designed to give the data subject control over the processing of their own data. From this it is inferred that it may constitute a strictly personal right that does not readily pass to third parties — including heirs.
\n
Case law and ongoing proceedings
\n
Judicial clarification on a case-by-case basis
\n\n
The question of inheritability has been the subject of judicial disputes in case law. Where proceedings are conducted on this, it must be taken into account that decisions are always rendered on a case-by-case basis and may depend in particular on the specific substantiation of the claim, the purpose of the requested information, and the categories of data concerned.
\n
Notes regarding proceedings that have not been concluded
\n\n
If, in relation to individual aspects, legal remedies are still pending or highest-court clarification has not yet been completed, the following applies: the mere fact of pending proceedings does not allow any definitive conclusions to be drawn for other situations. Until a final and binding decision is issued, the legal questions concerned must be treated as still open (principle of the presumption of innocence or lack of res judicata in non-concluded proceedings). The source for the initial presentation of this complex of issues is the article cited in the assignment at: https://www.juraforum.de/news/dsgvo-und-vererbbarkeit-des-datenschutzrechtlichen-auskunftsanspruchs-welche-regelung-besteht_267780.
\n
Practical relevance of the classification
\n\n
What legal consequences arise from inheritability or non-inheritability can be significant in particular when heirs assert information rights, when dealing with estate data, and when communicating with controllers within the meaning of the GDPR. In doing so, a distinction must regularly be made between data-protection-law claims that are linked to the data subject and other civil-law or contractual information rights that may exist independently of the GDPR.
\n
Classification from the perspective of MTR Legal Rechtsanwälte
\n\n
For companies, investors and high-net-worth private individuals, the question of whether and to what extent rights of access can be asserted or must be fulfilled after a death can have considerable legal and organizational implications — especially at the interfaces with IT-supported processes, documentation obligations and compliance structures. As an internationally active full-service commercial law firm, MTR Legal Rechtsanwälte supports clients in the legal classification of data-protection-related issues in the corporate context. Further information on how to get in touch can be found at: Legal advice on data protection.
“
