DATA OF THE DEAD: A PROPOSAL FOR PROTECTING POSTHUMOUS DATA PRIVACY.

• Author: Ashley, Kate C.

TABLE OF CONTENTS INTRODUCTION 650 I. THE RIGHTS WE OWE THE DEAD 653 A. Posthumous Property Interests 654 B. Posthumous Dignitary Interests 656 C. Posthumous Privacy Rights 658 II. THE RIGHT TO DATA PRIVACY 662 A. The First Data Privacy Framework: GDPR 664 B. The American Solution: California Consumer Privacy Act 666 III. THE DATA PRWACY RIGHTS OF THE DEAD 669 A. A Dignitary Approach 672 B. A HIPAA- and FOIA-Influenced Approach 673 C. A Property- and Publicity-Rights-Influenced Approach 676 D. The Proposed Approach 680 CONCLUSION 682 INTRODUCTION

On January 1, 2020, a sweeping set of new consumer protections took effect in California. (1) The California Consumer Privacy Act (CCPA) breaks new ground in empowering consumers with the tools necessary to protect their data privacy. (2) Modeled partially after the European Union's General Data Protection Regulation (GDPR), (3) CCPA has been criticized for not going far enough, (4) while affected industries (including search engine and social media companies) have generally regarded the bill's enactment as the end times. (5) CCPA enjoys strong support among Californians, with 88 percent in favor of the legislation. (6) However, one group of affected consumers has been altogether reticent on the matter--the dead.

Though the deceased are unable to register opinions of any variety following their demise, it is foundational to many aspects of the law that the dead's wishes and rights be observed. Consider, for example, the area of trusts and estates, in which individuals may express their wishes for the settlement of their property in the event of their death, or the numerous dignitary statutes that criminalize desecration of human remains. (7) This Note argues that data privacy rights should be included in the privacy, property, and dignitary interests that the law extends posthumously.

First, a brief overview of what is meant by data privacy rights will help clarify the following analysis. Data privacy laws (both domestically and abroad) "govern[] the collection, use, processing, preservation, and divulgence of personal information." (8) In statutes, personal information often means "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information." (9) The private sector has defined personal information as including

(1) name, address, email address, phone number, (2) race, nationality, ethnicity, origin, color, religious or political beliefs or associations, (3) age, sex, sexual orientation, marital status, family status, (4) identifying number, code, symbol, (5) finger prints, blood type, inherited characteristics, (6) health care history including information on physical/mental disability, (7) educational, financial, criminal, employment history, (8) others' opinion about the individual, and (9) personal views except those about other individuals. (10) However, data privacy is not limited to just the information covered in statutes like the Driver's Privacy Protection Act (11) and the Video Privacy Protection Act. (12) As enumerated in CCPA, personal information includes the myriad data that businesses collect on individuals: "where a consumer lives and how many children a consumer has, how fast a consumer drives, a consumer's personality, sleep habits, biometric and health information, financial information, precise geolocation information, and social networks." (13) This kind of deeply personal information fuels artificial intelligence recommendations for prospective dates and new varieties of dog food, reminders of upcoming birthdays and anniversaries, and predictions on optimal fertility windows. (14) The amount and scope of information businesses collect about individuals rivals (and likely exceeds) what even our closest friends, family, and romantic partners know about us. (15)

Identifying the right to privacy as an "'inalienable' right[] of all people," (16) California leads the way in protecting the kinds of information that many among us would consider deeply personal. This is the kind of information that some would prefer was never revealed--even after death. (17) Generally, American culture has understood this desire and has created legal protections to honor this posthumous wish when it has been expressed. For example, many public figures place their private papers under seal for a certain number of years following their death (18) or require the destruction of their personal papers. (19)

Before American society transformed into an increasingly digital culture, honoring a decedent's intent with respect to personal papers and information was fairly straightforward and typically entailed taking possession of the physical papers, mail, and documents found at the decedent's residence and office, following the decedent's wishes. (20) Today, most of one's "papers" live electronically in cloud storage, email accounts, and various social media profiles. (21) The law remains unsettled on how to regard an individual's digital effects, as courts determine whether these digital assets are more like property or are something else altogether. (22) However, a vast trove of personal data currently exists beyond the control of any individual: the personal information created about an individual but not created by that individual. This is the very information CCPA was designed to protect, (23) but the law's scope contains a significant gap. While CCPA empowers individuals to control this personal data in their lifetime, (24) CCPA stops short of empowering the personal representatives of decedents to exercise control over personal data according to the decedent's wishes.

This Note will focus on the posthumous disposition of the personal information businesses collect, use, and sell about individuals and argue that data privacy rights should extend posthumously to fulfill the promise of data privacy legislation like CCPA. In Part I, this Note will examine the dead's legal and customary rights, from property rights to cultural observances, to identify the contours of posthumous rights. Part II will shift the analysis to the evolution of data privacy rights in American jurisprudence by tracing the development of CCPA. Part III will weave together the contours of posthumous rights with the development of data privacy rights to argue that data privacy rights must extend posthumously.

1. THE RIGHTS WE OWE THE DEAD

   The legal maxim that "the dead have no rights," though pithy, has never been strictly true. (25) The field of trusts and estates exists to ensure a decedent's wishes for the distribution of an estate are honored. (26) The Uniform Anatomical Gift Act requires that the living respect the wishes of the dead vis-a-vis organ donation. (27) Criminal statutes prevent the desecration of dead bodies and burial sites. (28) Many of the legal rules that protect posthumous interests stem primarily from "cultural norms, including dignity and respect for decedents' wishes." (29) A brief examination of three theories of posthumous interests will lay the foundation for a consideration of posthumous data privacy: property interests, dignitary interests, and privacy interests.

   1. Posthumous Property Interests

      Within reasonable limits, American common law allows individuals to direct the distribution of real property and to condition its uses following an individual's death. (30) So long as testamentary wishes are lawful, a decedent's decisions will generally be honored. (31)

      A decedent's beneficiaries may take legal action to enforce the decedent's wishes (even, in some cases, by taking legal action against each other). (32) Suits regarding real property are common enough, while an emerging area of law considers the ownership of digital assets, such as social media profiles and the contents of email accounts. (33) Though analyzing the legal theories of ownership of digital assets remains beyond the scope of this Note, the underlying theory that digital data constitutes property will figure into the discussion to follow.

      In addition to the real property a decedent leaves behind, the law also treats the decedent's remains as property. (34) The property interests in one's remains are limited to the specification of funerary arrangements (within reason), though as Dahlia Lithwick points out, "[A] will's burial specifications are not probated until long after the funeral." (35) While respect for burial specifications, as a practical matter, veers away from property interests and into the cultural norms and dignitary interests discussed by Professor Smolensky, the treatment of a decedent's likeness is firmly rooted in notions of property. (36)

      Though there is no libel of the dead, some jurisdictions empower a decedent's beneficiaries to file libel suits on a theory that a third party has violated the decedent's publicity rights. (37) This theory centers on the notion of "descendible publicity rights" as a form of perpetual right to identity, which becomes a form of property. (38) This theory is grounded more in protecting the living's ability "to create marketable identities and with protecting the financial interests of the decedent's heirs" rather than protecting the decedent's dignitary interests. (39) This claim would be actionable when a libel claim would fail because the injury suffered is concrete: a loss of economic value. (40) Generally, though, the law does not allow for posthumous defamation under the belief that the dead no longer have a reputation and cannot suffer offense. (41)

      Though not legally actionable, the cultural taboo against speaking ill of the dead plays a central role in traditions of posthumous dignitary interests. The next Section discusses how concerns for the dignity of the dead have shaped these interests in both cultural norms and state statutes.

   2. Posthumous Dignitary Interests

      ...