Does GDPR Apply To Data Relating To A Deceased Person?

In short, the UK GDPR only applies to information that relates to an identifiable living individual. Information relating to a deceased person does not constitute personal data and therefore is not subject to the UK GDPR.

With the above in mind, if you want to obtain data about a deceased person you will not be able to use the usual method of making a Subject Access Request. Instead, any request for data may be made under the Freedom of Information Act 2000 (FOIA).

Making an application to obtain data relating to a deceased person

FOIA

If the data that is being requested under FOIA is not sensitive in nature, the fact that it contains details about a deceased person is irrelevant and the request should be considered in the normal way and the information may be suitable for disclosure (subject to the relevant exemptions present under the FOIA).

In contrast, if the data being requested is sensitive in nature, the fact that it contains information about a deceased individual is wholly relevant and should be an important consideration when deciding whether the data should be disclosed.

Exemptions under the FOIA

In terms of exemptions, there are no specific exemptions under FOIA relating to data about a deceased person. This means that an organisation cannot refuse to disclose the data being requested simply because such data is in relation to a deceased person.

There are, however, some exemptions present under the FOIA that may apply to the data being requested. For example, the exemption present under Section 41, which relates to any information that was originally obtained from the deceased such as health or banking records. The information contained in medical records will generally be confidential, as the duty of confidence continues to apply after death. Therefore, a public authority upon receiving such a request may rely upon the exemption present under Section 41 and may choose not to disclose such data.

Access to Health Records Act 1990

As an alternative, it is important to note that the Access to Health Records Act 1990 (AHRA) gives a right of access to health records of the deceased to either the personal representatives or to the persons who may have a claim arising out of the death of the individual.

It is important to note that the reference to a personal representative is very specific. It can only be a person who has been appointed as a personal representative. This does not extend to any other surviving family members or next of kin.

If you do have a right to access data in accordance with AHRA you must make the application under AHRA rather than FOIA. If you make the application under FOIA your request will be rejected in accordance with Section 21 FOIA on the basis that the data is reasonably accessible by other means.