Confuzzled
Very Active Member
- Joined
- Oct 1, 2018
- Messages
- 299
Depending on jurisdiction, not necessarily.But death status is health information, therefore protected personal data
For example, the GDPR does not apply to a dead person's personal information, BUT other national legislation may well do so.
GDPR recital 27: “This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons.".
Thomsen Reuters Practical Law: Is a deceased person a data subject for the purpose of GDPR?
In the UK it is "the Access to Health Records Act 1990 (AHRA) that remains the current legislation in relation to the release of a deceased patient’s medical records."
Medical Protection: Disclosures after death
So, as ever, it is complicated, and varies from jurisdiction to jurisdiction. One of the benefits of the GDPR is that it sets a baseline for the protection of personal data across the EEA, so businesses can worry less about differences between national legislation. Minimising administrative bureaucracy is a good thing: just ask anyone who operates in multiple US states about filing taxes. US sales taxes can vary by county.