Posthumous Medical Data Donation: The Case for a Legal Framework

Abstract

This article explores the options for establishing a legal framework for posthumous medical data donation (PMDD). This concept has not been discussed in legal scholarship to date at all. The paper is, therefore, a first legal study of PMDD, aiming to address the gap and shed light on the most significant legal issues that could affect this concept. The paper starts by looking at the protection of the deceased's health records and medical data, finding that this protection in law is more extensive than the general protection of the deceased's personal data, or the protection of post-mortem privacy as a concept. The paper then investigates key issues around ownership and succession of personal data, including medical and health-related data, and how these could affect PMDD and its legal framework. The author then goes on to explore some parallels with organ donation to determine whether there are some lessons to be learned from this comparable regulatory framework. The paper concludes with the discussion around the need for a Code for posthumous medical data donation developed by the Digital Ethics Lab at the Oxford Internet Institute, and a more formal regime that would enable and facilitate this practice. Here, the author proposes key law reforms in the area of data protection and governance related to PMDD. These reforms would include amendments to the general data protection ideally, to ensure harmonisation and consistency across the EU, as well as between the general and sector-specific data protection laws and policies. These changes would contribute to legal and regulatory clarity and would help implement this important and valuable practice, which aims to facilitate research and advances in medical treatments and care.

Own Data? Ethical Reflections on Data Ownership

“…The dominant view in legal theory tends to be that data cannot be owned: "Individual ownership of data […] is contrary to well-established legal precedent in the United States, United Kingdom, and many other jurisdictions, which for good reasons do not recognize property interests in mere facts or information" (Contreras et al 2018). European frameworks like the Convention for the Protection of Human Rights are typically understood as presenting data-related rights as an extension or subset of fundamental human rights, which suggests that they are inalienable and unsuitable for propertization, commodification, commercialization (Purtova 2010, 202-204;Harbinja 2017Harbinja , 2019Prainsack 2019a, 18). In the US discourse, some commentators have been amenable to data ownership (Purtova 2009).…”

“…Since Pearce also has arguments against a personal rights reading of the GDPR-e.g. personal rights typically cannot exist independently from their owner, whereas the dead do retain certain rights to data protection (Harbinja 2017(Harbinja , 2019)-neither the proprietary nor the personal rights paradigm sits well with the GDPR, and Pearce thus speaks of a "Conceptual Muddle of Data Protection Rights under EU Law" (ibid. ).…”

Contextual Exceptionalism After Death: An Information Ethics Approach to Post-Mortem Privacy in Health Data Research

“…For instance, Stokes (2015) argues that because digital online remains persist as ethical patients, there exists a moral obligation not to delete social media profiles of deceased persons (unless that person wanted it to be deleted). The European legal framework similarly regards data as inalienable possessions, and EU laws are based on human rights such as dignity, autonomy, and respect for persons (Harbinja, 2019). When someone donates their body to science, researchers have a duty to treat the body with respect and not to damage it more than necessary; despite the consent from the ante-mortem person.…”

“…However, in Europe the General Data Protection Regulation (GDPR) does not directly apply to deceased persons, causing Member States to vary in their enactment of provisions regarding dead data subjects. 1 Post-mortem data use is generally not discussed in study consent forms and few international 2 guidelines address this topic (Harbinja, 2019;Hirschberg et al, 2013;Jurate et al, 2014;Tassé, 2011).…”

“…2 Countries may have sector-specific regulations governing confidentiality of medical data post-mortem, but legislation varies widely within Europe and across the globe. For instance, France and Hungary have established protections for deceased persons' data while the United Kingdom emphasises that personal data only exists in relation to living individuals (Harbinja, 2019). In the United States, the Health Insurance Portability and Accountability Act (HIPAA) protects health information for 50 years after the individual's death.…”