Digital Estate Planning: What happens to data when someone passes away?

Data protection is a widespread concern because many people worry about exactly what data is being collected about them and how securely it is processed or stored. But what happens to data when there is no one left to whom it can be attributed? And what steps must be taken to manage the data of a deceased person? We take a closer look at the topic of "post-mortem data protection."

What happens to the data?

In general, the topic of data protection after death is often overlooked, as data is neither a physical asset nor a monetary one, and companies rarely have an interest in collected data once a person has passed away. In a sense, the data loses its value. Nevertheless, it is advisable to include data management in your estate planning. Accounts on social networks, online memberships, or customer accounts with e-commerce providers should be taken offline to ensure that no one can hack these accounts and use them for their own purposes after your death.

Protecting data: simple and secure

Data should be protected even after death. To ensure this, we are happy to advise you as your external data protection officer. Book an initial consultation now – free of charge and with no obligation.

2018 Federal Court of Justice ruling

In 2018, the Federal Court of Justice (BGH) issued the following ruling: "A contract for a user account on a social network is inheritable." Accordingly, user accounts on social networks are part of the estate and are therefore passed on to the heirs. The heirs are thus transferred the contractual rights and obligations of the social media account. Consequently, providers are obligated to grant heirs access to them.

Managing your digital estate

In the age of cryptocurrencies and the metaverse, the data left behind is no longer just personal information. The umbrella term "data" also includes virtual assets, for which you need the corresponding access rights. Providers or platforms are not obligated to release virtual assets, even if they are mentioned in a will. Only with the appropriate access credentials can heirs claim the corresponding assets. This is referred to as the "private key." If this is lost, the virtual assets are lost as well.
It is also possible to list access credentials in a traditional will. However, this method is considered rather insecure. Much like writing down a password on a piece of paper, there is a risk that unauthorized third parties could gain access to this information. In practice, it is often difficult to track who these people are and who is actually accessing digital accounts. Furthermore, access credentials should be changed regularly. This means the will would also need to be updated accordingly. If the will is deposited with a notary, this becomes a recurring expense. Additionally, there is a high risk that updating the access credentials in the will is simply forgotten.

Does the GDPR apply to deceased persons?

In principle, the GDPR stipulates that it does not apply to deceased persons. This means that all regulations compliant with the GDPR cannot be applied to a natural person after their death. It is noted that individual member states may enact regulations that specify exactly how the data of the deceased can and may be handled. However, the German legislature has not yet made use of this option. Accordingly, there are currently no specific regulations in Germany applicable to the personal data of the deceased.

Since data now has an incredibly high value, it is advisable to specify in your estate planning who is granted access and who may be able to delete existing data sets. A will should definitely be used for virtual assets. Customer data or data collected during surveys generally loses its value after a person's death. Nevertheless, you should be aware of where you leave data and who might have access to it or an interest in continuing to use it after you are gone.