Privacy Laws: What Happens After We Die?

The right to privacy is not explicitly mentioned in the US Constitution or the Bill of Rights. However, the Supreme Court has interpreted the Constitution as providing a right to privacy, relying on the Fourth, Ninth, and Fourteenth Amendments. Under most privacy regimes, people stop having the right to privacy once they die. For instance, in the United States, the Federal Privacy Act of 1974 does not apply to deceased individuals. However, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule protects a decedent's health information for 50 years following their death. This period of protection balances the privacy interests of surviving relatives and other individuals.

The right to privacy after death

The right to privacy is a human right recognised across the world. According to the Universal Declaration of Human Rights (UDHR), "no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence". However, the question of whether this right to privacy extends beyond an individual's death is a complex and evolving area of law.

The right to privacy is considered a personal right under common law, meaning it typically applies only to the living. As a result, the privacy interests of the deceased are not recognised, and privacy torts that prevent damage to an individual's reputation cannot be extended post-mortem. For example, a family cannot sue for invasion of privacy on behalf of a deceased relative. This is because, as a personal right, it can only be exerted by the person whose rights are being infringed upon.

In most jurisdictions, privacy rights are tied to the right-holder's life, and so once an individual's life ends, their privacy rights also end. However, this approach has been questioned in the digital age, where vast amounts of personal information are stored and shared online, and emerging technologies can be used to recreate the lives of the deceased.

In some jurisdictions, such as the United States, there are no federal laws that specifically extend post-mortem privacy protections. Instead, privacy laws pertaining to the deceased vary at the state level and generally do not extend any clear rights beyond property rights. In contrast, medical confidentiality is upheld through both state and federal law in the US, with the Health Insurance Portability and Accountability Act (HIPAA) protecting individually identifiable health information for 50 years after an individual's death.

While the right to privacy of the deceased is not explicitly recognised in many jurisdictions, the privacy rights of the next of kin or other stakeholders may offer some protection. For example, in South Africa, medical practitioners are required to obtain written consent from the next of kin or executor of a deceased patient's estate before divulging information.

Testamentary Rights and Personality Rights

There are two main legal approaches to recognising post-mortem privacy: testamentary rights and personality rights. In the case of testamentary rights, the deceased individual would deal with their information legacy in their will. For instance, Article 25 of the Rwandan Data Protection Law grants individuals the right to designate an heir to their personal data. On the other hand, personality rights extend the deceased's privacy rights beyond death.

The Federal Privacy Act and Health Insurance Portability and Accountability Act (HIPAA)

The Health Insurance Portability and Accountability Act (HIPAA) was enacted by the 104th United States Congress and signed into law by President Bill Clinton in 1996. The Act establishes federal standards to protect sensitive health information from disclosure without a patient's consent. It also requires the establishment of national standards for electronic healthcare transactions and national identifiers for providers, employers, and health insurance plans.

HIPAA's Privacy Rule standards address the use and disclosure of individuals' protected health information (PHI) by entities subject to the rule, known as "covered entities." These include healthcare providers, health plans, healthcare clearinghouses, and business associates. The Privacy Rule also contains standards for individuals' rights to understand and control how their health information is used, while also promoting high-quality healthcare and protecting the public's health.

Covered entities may disclose PHI to facilitate treatment, payment, or healthcare operations without a patient's written authorization. Any other disclosures of PHI require the covered entity to obtain prior written authorization. When disclosing PHI, covered entities must make a reasonable effort to share only the minimum necessary information.

The HIPAA Privacy Rule protects the individually identifiable health information of a decedent for 50 years following the date of death. During this time, the decedent's personal representative has the ability to exercise rights under the Privacy Rule, such as authorizing certain uses and disclosures of the information. After 50 years, identifiable health information is no longer considered protected health information, and entities may use or disclose the information without regard to the Privacy Rule.

The Federal Privacy Act, also known as the Privacy Act of 1974, is a United States federal law that governs the maintenance, collection, and dissemination of personally identifiable information by federal government agencies. It also grants individuals the right to seek amendments to their records and sets forth various agency record-keeping requirements. The Act applies to information about individuals retrieved by federal agencies and was created to balance the government's need to collect and maintain information with the rights of individuals to be protected against unwarranted invasions of their privacy.

Privacy rights of the deceased's next of kin

Privacy laws vary across jurisdictions, but under most privacy regimes, people stop having the right to privacy once they die. However, the privacy rights of the deceased's next of kin are still recognised and protected.

The next of kin refers to a person's closest living relative(s), including those with a blood relation, such as children, or those with legal standing, such as spouses or adopted children. The next of kin often takes precedence in inheritance cases, especially when a will is not established. They may also have responsibilities such as making medical decisions for the individual if they are incapacitated, and taking responsibility for funeral arrangements and financial affairs after their relative dies.

In the context of health information, the HIPAA Privacy Rule in the United States recognises that a deceased individual's health information may be relevant to a family member's health care. As such, the rule permits a covered entity to disclose protected health information about a decedent to family members or other persons involved in the individual's health care or payment for care prior to death. However, this is only allowed if doing so does not conflict with any prior expressed preference of the deceased individual.

In South Africa, Rule 13 of the HPCSA's ethical rules states that a medical practitioner may only divulge information regarding a deceased patient with the written consent of the next of kin or the executor of the deceased's estate.

While the deceased's next of kin have privacy rights, it is unclear whether these rights extend to the deceased person's genetic material. With the advancements in technology, the information legacies of dead people are increasing exponentially, and it is possible to recreate their lives using AI and holograms. This raises questions about the privacy and confidentiality of the deceased's data and whether it can be used without the consent of the next of kin.

Posthumous privacy rights

Legal Definition of Death

The legal definition of death varies by jurisdiction. For example, in the ZA case of S v Williams, the court adopted the traditional view that death occurs when an individual stops breathing and their heart stops beating. However, under the ZA National Health Act, 'death' is defined as brain death.

The primary reason privacy rights end after death is that the law views privacy as a personality right that arises from an individual's legal personality. Once a person dies, they are no longer considered a legal person, and the rights attached to their legal personality, such as privacy, fall away.

Exceptions and Alternative Approaches

While the deceased themselves do not retain privacy rights, their next of kin or other stakeholders may have confidentiality and privacy rights related to the deceased's information. For example, in ZA, medical practitioners can only divulge information about a deceased patient with the written consent of the next of kin or the executor of the deceased's estate.

There are also calls for a re-examination of privacy rights for the deceased in the digital age, as social media companies store vast amounts of user data, even after death. This data can be used for advertising or even to create algorithms that manifest dead users, potentially revealing sensitive information.

Two potential legal approaches to recognising post-mortem privacy rights include testamentary rights, where the deceased designates an heir to their personal data in their will, and personality rights, where the law extends the deceased's privacy rights beyond death.

Health Information Privacy

In the United States, the HIPAA Privacy Rule protects identifiable health information about a decedent for 50 years following their death. During this time, the personal representative of the decedent can exercise rights under the Privacy Rule, such as authorising certain uses and disclosures of the information. After 50 years, the information is no longer considered protected health information, and can be disclosed without regard to the Privacy Rule.

Privacy of electronic accounts after death

Privacy laws vary across jurisdictions, but under most privacy regimes, privacy rights cease after death. However, the digital age has brought about a new dimension to privacy, with people's data and digital footprints living on long after they are gone. This has led to a growing discussion around post-mortem privacy and the need for legal protection for the deceased's digital information and accounts.

Post-Mortem Privacy

The concept of post-mortem privacy refers to the privacy of an individual after their death. With the exponential growth of digital information, the data of deceased individuals can be used to recreate their lives, conversations, and even their likeness through emerging technologies like AI and holograms. This has sparked a debate about the legal protection of the dead's digital privacy and the need to prolong privacy rights beyond the grave.

The privacy of electronic accounts after death is a complex issue that involves balancing the rights of the deceased with the needs of those managing their estates. Here are some key considerations:

• Access Rights: In most cases, explicit permission from the deceased is required to access their electronic accounts. This can be granted through a will, digital estate plan, or by designating a legacy contact.
• Privacy Expectations: Privacy laws and platform policies play a significant role in determining who can access an account and what content they can recover. For example, the Electronic Communications Privacy Act (ECPA) in the US sets "Privacy On" as the default setting, requiring lawful consent before releasing any content.
• Verification and Documentation: Gaining access to a deceased person's electronic accounts often requires providing documentation such as a death certificate, proof of authority to access the account (e.g., power of attorney, will), and proof of identity.
• Platform-Specific Policies: Each platform has its own rules and regulations regarding access to and management of deceased users' accounts. For example, social media platforms may offer memorialization or deletion options, while financial platforms may have specific procedures for transferring or closing accounts.
• Data Protection and Privacy: Privacy laws, such as The Personal Information Protection and Electronic Documents Act (PIPEDA), protect the privacy of the deceased's data even after death, restricting access to their digital accounts and requiring legal authority to access them.
• Ethical Considerations: Managing a deceased person's digital presence raises ethical questions, including respecting the wishes of the deceased, safeguarding their privacy, and considering the privacy of individuals with whom they interacted online.
• Digital Estate Planning: Including digital assets in estate planning is essential to ensuring that online accounts are managed according to the deceased's wishes. This can involve specifying how each account should be handled and providing necessary access information to trusted individuals.

The privacy of electronic accounts after death is a complex and evolving issue that requires careful consideration of legal, ethical, and practical factors. While privacy rights traditionally cease upon death, the digital age has brought about new challenges and the need for prolonged privacy protections. By including digital assets in estate planning and complying with platform policies and privacy laws, individuals can ensure that their digital privacy is respected even after they are gone.

Frequently asked questions