The Italian Data Protection Authority’s newsletter of Nov. 27, 2023, gives notice of the Oct. 26 decision (web doc. no. 9954881), interpretative about the exercise of the right of access by heirs to the data of deceased individuals.
However, the Authorithy’s intervention, which appropriately traces the regulatory and interpretive path on this matter, requires some further clarification.
Legal value of the interpretative decision
In first place, one probably wonders what the legal value of this decision is.
The interpretive power of a law belongs, as a matter of authenticity, first of all to the legislator itself, and then to the court of merits, in deciding the specific case, and to the court of legitimacy with the function also of a principle of law.
Among the powers that the GDPR grants to national supervisory authorities – whose establishment is provided for in the Nice Charter and the TFEU – is not to interpret the GDPR rules, even though the authority performs important supervisory, prescriptive and advisory decisions. The authority’s interpretive intervention, like the positions it takes in guidelines or other measures, for the authority itself constitutes a precedent to be followed; as for the rest, it represents a reference point to which judges called upon to resolve disputes can refer in forming their free conviction for the resolution of the case in the field of law.
In legal practice, normally, judges give due consideration to the Authority’s pronouncements on the subject of personal data protection. Therefore, the authority’s interpretive ruling has important value but is not legally binding.
Data protection of deceased people
The GDPR does not apply to personal data of deceased individuals (Recital 27, GDPR).
Nonetheless, the Italian legislator, availing itself of the option provided by the same Recital, has established that the rights of the deceased data subject may be exercised by the heirs and those who have an interest of their own that is legally relevant (Art. 2-terdecies of the Italian Privacy Code).
Paragraph 1 of Article 2-terdecies reads as follows, “1. The rights referred to in Articles 15 to 22 of the Regulation referring to personal data concerning deceased persons may be exercised by a person who has an interest of his own, or is acting on behalf of the data subject, as his representative, or for family reasons deserving protection.”
Article 2-terdecies is in continuity with the relevant provision of the same substance in the Code in force before the General Regulation came into force (Article 9(3) of the former Code).
