Jusletter IT

The digital environment is an environment based on information technology and information processing.² The individual’s rights have increasingly shifted into computer networks. These rights are also increasingly used in the digital environment. This represents a major legal change in relation to the time before the cyber revolution.

The digital environment affects not only the living human beings but it also affects the status and the rights of deceased persons. This is problematic because the deceased persons aren’t always seen as a subject of fundamental and human rights, that is, the subject of the protection afforded by these rights.³ The inviolability of human dignity, guaranteed by international human rights documents and the Finnish Constitution, extends its effect, however, also to the deceased⁴. As the inviolability of human dignity is realized through the fundamental rights, a dead person can also be considered benefiting from the protection of fundamental and human rights.⁵

The concept of digital inheritance is used to denote all the digital material belonging to the deceased’s inheritance.⁶ In Finland, the question of digital inheritance has had little notice in jurisprudence.⁷ Because no specific legislation concerning digital inheritance can be found, many legally problematic situations have arisen in practice.

The handling of a deceased person’s digital inheritance and the processing of information belonging to this inheritance, for example, has proven to be very problematic, as the ruling T14/44626 of the Helsinki District Court in 2014 demonstrates. In the ruling, the Court ordered the defendant, a telecommunications company, to assign the estate executor access to the e-mail account, and other similar electronic property belonging to the deceased’s digital inheritance, which the defendant was able to give access to. The defendant was ordered to assign all passwords and other information required for the use of the above activities. Apart from these, the Court ordered the defendant to give unlimited access to the deceased’s digital inheritance, so that the deceased’s heirs receive it by the same manner as to be recovered in his lifetime.

According to the Court, the right of inheritance is a universal succession under which all the property belonging to the deceased’s inheritance is transferred to the heirs. Because the deceased’s correspondence is also a subject of inheritance, it is transferred to the heirs under universal succession. The property is transferred directly to the heirs on the account of death, without a court order. However the main argument of the Court was that a deceased person’s fundamental rights protection does not have the same scope as the protection of fundamental rights of the living. For these reasons the court came to the conclusion that the defendant is obliged to disclose all the digital property belonging to the deceased’s inheritance.

At the request of the parties, the Court declared the ruling to be kept secret for ten years. The lawyer handling the case by the Court’s order has, however, granted me a permission in the spring of 2015 to use the case for research. Accordingly, I have been able to familiarize myself with the ruling, and comment on it.

In this article I will examine the aforementioned ruling, as it is problematic in mind of the existing Finnish legislation and especially of the fundamental and human rights. The ruling deals with the following questions: does data protection and confidentiality of communications apply to the deceased, and can the confidential material of the deceased, such as emails, be inherited. For this reason, I will look at the ruling from three different perspectives: the personal data protection, the confidentiality of communications and the law of inheritance.

Data protection is said to be one of the most significant parts of privacy in the digital environment.⁸ According to Saarenpää, data protection can be defined as the protection of individuals by means of data protection legislation. Today, we can talk about data protection as a part of fundamental and human rights.⁹ In Finland, data protection has been taken into account in Section 10 of the Finnish Constitution (11 June 1999/731), which requires that data protection is to be stipulated in more detail by an act. This requirement is realized through The Personal Data Act (22 April 1999/523), the general act concerning the processing of personal data in Finland, through which the Data Protection Directive (95/46/EY) was implemented. According to the Personal Data Act personal information is defined as any information on a private individual and any information on his/her personal characteristics or personal circumstances, where these are identifiable as concerning him/her or the members of his/her family or household (Personal Data Act, Section 3). The definition covers every kind of information related to a natural person, regardless of the manner or the platform in which the data is processed.¹⁰

Neither the Personal Data Act’s scope of application nor the definition of personal data don’t clearly state if they are applied to the personal data of a deceased.¹¹ In the application praxis developed during the Personal Data Act’s predecessor, Act on Personal Registers (471/1987), the starting point was, however, that the Act is to be applied also to the processing of a deceased’s personal information.¹² This starting point was not changed when the Personal Data Act was enacted, meaning that the personal information of a deceased is (still) protected in the Finnish legislation.¹³ The need for protection has, however, been seen to decrease the more time has elapsed since the person’s death.¹⁴ According to the ruling of the Data Protection Board, the Personal Data act is no longer applied to i.e. personal data concerning people executed during the Second World War.¹⁵

The Personal Data Act sets out the general prerequisites for processing of personal data, under which the processing of personal information is allowed, unless otherwise provided by a specific legislation. Because the Personal Data Act applies also to the deceased, the processing of the deceased’s information must be in compliance with the Act’s provisions. Therefore, the only ground for the processing of a deceased’s personal data practically is the deceased’s unambiguous consent given (i.e. in a will or when registering to a service) in his / her lifetime, unless otherwise provided by law (Personal Data Act, Section 8). Consent must clearly spell out what information the data controller may process, for what purpose and how the information will be processed. The consent-based processing of personal data is considered actualizing the principle of informational self-determination and transparency of record-keeping.¹⁶ The processing of a deceased’s personal data without the unambiguous consent given by the deceased in his / her lifetime is against the provisions laid down in the Personal Data Act, unless otherwise provided by law.

The confidentiality of communications is a fundamental and human right.¹⁷ Therefore, also the Finnish Constitution guarantees everyone the right to confidential communications in its section 10. The specific national provisions concerning electronic communications are included in the Information Society Code (7 November 2014/917), which came into force at the beginning of 2015.

The object of protection is the content of the confidential message, which is protected from third parties (that is, others than the sender or the receiver of the message). The protection of the confidentiality of communications applies to both parties: the sender and the receiver of the message.¹⁸ Thus, for example, the opening of a confidential message by a third party infringes this right.

The Constitution’s provision concerning the confidentiality of communications is intended neutral, even though it mentions specifically only a letter and a phone call as a means of communication. If the message is intended confidential, it is protected by the Constitution regardless of the means of communication or what device was used for transmission.¹⁹ With this in mind, i.e. e-mail messages are undeniably in the scope of the constitutional protection of confidential communications.²⁰

Electronic communication means information that is distributed electronically (Information Society Code, Section 3). The definition of electronic communication covers i.e. e-mails. According to the Information Society Code, Parties to communication are entitled to process their own electronic messages and the traffic data associated with these messages unless otherwise provided by law. Others are entitled to process these electronic messages only with the consent of the party to the communication or if so provided by law (Information Society Code, Section 136).

No specific provision concerning the processing or confidentiality of electronic messages belonging to the deceased’s digital inheritance can be found in the Information Society Code. The act gives specifically a telecommunication company neither the right to disclose the electronic messages nor information related to the messages to the heirs.

In the absence of specific provisions, the interpretation of the existing legislation must be in favor of the fundamental and human rights. The right to confidential communications is a human rights principle guaranteed in the Finnish Constitution, which is also relevant after an individual’s death.²¹ Regardless of the interpretation, it is undeniable that an individual’s death doesn’t terminate the living party’s right to confidential communications in any circumstances. Thus, the unauthorized examining and opening of confidential communications is, almost without an exception, a violation of the rights of the living party of the communications. In this way, a deceased person can be deemed to obtain at least an indirect protection through the living party’s right to confidential communications.

The Inheritance Code of 1965 is a vital piece of inheritance law in Finland. However the Act doesn’t have any exact provisions on, whether the heirs become parties of the deceased’s communication instead of the deceased under universal succession.²² In inheritance law, the term universal succession is used to denote the transfer of the deceased’s assets and debts, that is, the inheritance, to the heirs.²³ Thus, the Inheritance Code does not give an answer, whether or not the confidential material, such as e-mails, can be a subject of inheritance.

In inheritance law, the transferability of rights can be examined by dividing the rights into five different categories: personality rights, rights of the family, the rights of inheritance, immaterial rights and property rights. When the rights belonging to the inheritance concern the individual’s personality, they are called personality rights. Life, honor, personal integrity and privacy have usually been seen to belong to the personality rights.²⁴ These rights can clearly be applied also to the deceased.²⁵

When considering the transferability of rights, the starting point in inheritance law is that particularly personal rights cannot be inherited.²⁶ This is because the rights concerning the deceased’s personality during his life are deemed to end in death. For example, the deceased’s patient information cannot be a subject of inheritance.²⁷

The inheritability of the confidential messages included in the deceased’s digital inheritance can be contested because it would (often) violate the deceased’s right to privacy. Transferring this material to the heirs would jeopardize the deceased’s, and possibly other people’s privacy, because it usually contains private information that has been kept secret on purpose.²⁸ It is, thus, a question of protecting the personality rights of the deceased. In the case of digital inheritance, the subjects of protection are especially the deceased’s rights of privacy, such as personal data protection and the confidentiality of communications. These are uninheritable because they protect information related to the deceased, and therefore are particularly personal by nature. With this in mind, the confidential material, containing information related to the deceased, is also an uninheritable part of the deceased’s digital inheritance.

The Finnish legal culture emphasizes the importance of fundamental and human rights. The fundamental and human rights have been a central topic in Finland since the constitutional reform in 1995. These rights permeate the whole jurisprudence, extending to every field of law.²⁹ However the Finnish discussion on the rights and status of the deceased has fallen behind time. The ruling of the Helsinki District Court, discussed in this article, clearly points out the problems we have with the discussion on the rights and status of the deceased. In a constitutional state, based on human rights, the rights of the deceased must also be protected. The question is not only figurative, but also about the change in the status of the individual, the society and the state. The temporal dimension of the inviolability of human dignity, which is an important part of our legal wellbeing, has changed.³⁰ Therefore the deceased should always be seen basically as a subject of fundamental and human rights.

In this article the ruling of the Helsinki District Court was examined first from the perspective of data protection. This perspective was important, because the Court permitted access to the digital material belonging to the deceased, which also includes information relating to the deceased. The disclosure of this information is processing of personal data. This brings out the question on the deceased’s right to data protection. Although the Personal Data Act falls silent on the question, in the application praxis of the Act it has traditionally been seen that the Act is applied also to the processing of personal data of the deceased. In Finland, the deceased’s personal data are protected and the Personal Data Act is to be applied mutatis mutandis when processing the personal data of the deceased.

In the ruling, the telecommunications company did not have a permission of the deceased, given in his lifetime, for the disclosure of his personal data. The company did not, therefore, have the right to disclose the information to the estate executor. Thus, the ruling differs from the acknowledged application praxis of the Personal Data Act.

The second perspective, from which the ruling was examined, was the confidentiality of communications. The right to confidential communications has been guaranteed not only as a fundamental right in the Finnish Constitution, but also as a human right in various human rights documents. In its ruling, the Court viewed that the right to confidential communications ends in a person’s death. Thus, the Court saw no reason, why the electronic messages in the digital inheritance could not be transferred to the estate executor. The Information Society Code, stipulates inter alia the confidentiality of communications. It doesn’t, however, have any explicit provisions on the confidentiality of communications of the deceased. Because the explicit legislation concerning this question is lacking, the question should be examined through the existing fundamental and human rights principles guaranteed in a constitutional state, and these principles undoubtedly concern also the deceased. Thus, the electronic communications of the deceased is protected by the confidentiality of communications. The ruling of the Helsinki District Court, therefore, violates not only the right to confidential communications of the living party, but also the right to confidential communications of the deceased.

The third and final question examined in this article was, whether or not the confidential digital material in the digital inheritance, such as e-mails, can be inherited. Despite the fact that no explicit provisions on the inheritability of confidential material in the digital inheritance exist in the Finnish legislation, the Court was in the opinion that this material can be inherited.³¹ Although the legislation says nothing on the issue, a traditional starting point in inheritance law is that particularly personal rights, i.e. the right to privacy, cannot be inherited. The confidential material in the digital inheritance contains, almost without exceptions, information belonging to the private sphere of the deceased. By protecting this information the personality of the deceased is protected. Thus, the question is about personality rights of the deceased, and these rights cannot be inherited. Therefore, it can be argued that, unlike the District Court has evaluated the matter, the confidential material in the digital inheritance, i.e. e-mails, cannot be inherited.³²

With this in mind, the ruling of the Helsinki District Court is very problematic, if not even unlawful, from the fundamental and human rights perspective. As Saarenpää so aptly puts it: «From a conservative point of view some lawyers are however only asking about a special rule concerning digital inheritance. If and when they do not find any special rules, all digital information belongs to the heirs.»³³

Aarnio, Aulis /Kangas, Urpo, Suomen jäämistöoikeus I: Perintöoikeus. Fifth reneved edition, Talentum Media Oy, Helsinki 2009.

Article 29 data protection working party: Opinion 4/2007 on the concept of personal data (20 June 2007). 01248/07/FI. WP 136. Available at: http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_fi.pdf.

HE 309/1993 vp Hallituksen esitys Eduskunnalle perustuslakien perusoikeussäännösten muuttamisesta (Government bill).

HE 96/1998 vp Hallituksen esitys Eduskunnalle henkilötietolaiksi ja eräiksi siihen liittyviksi laeiksi (Government bill).

HE 221/2013 vp Hallituksen esitys Eduskunnalle tietoyhteiskuntakaareksi sekä laeiksi maankäyttö- ja rakennuslain 161 §:n ja rikoslain 38 luvun 8 b §:n muuttamisesta (Government bill).

Hidén, Mikael, Perusoikeuksien yleisiä kysymyksiä. In: Nieminen, Oyj, Kustannus (ed.), Perusoikeudet Suomessa, Helsinki 1999, pp. 1–27.

Hirvonen, Ari, Oikeuden ja lainkäytön teoria. Helsingin yliopiston oikeustieteellisen tiedekunnan julkaisuja. Forum iuris, Helsinki 2012.

Jyränki, Antero/Husa, Jaakko, Valtiosääntöoikeus, CC Lakimiesliiton Kustannus, Helsinki 2012.

Kangas, Urpo, Digitaalinen jäämistövarallisuus, Talentum Media Oy, Helsinki 2012.

Karapuu, Heikki, Perusoikeuksien käsite ja luokittelu, In: Hallberg, Pekka (ed.), Perusoikeudet, Second revised edition, WSOYpro Oy, Helsinki 2011, p. 67.

Office of the Data Protection Ombudsman: Annual report of the year 2008. Available at: http://www.tietosuoja.fi/material/attachments/tietosuojavaltuutettu/tietosuojavaltuutetuntoimisto/tehtavat/vuosikertomus/5CKn5f90x/2008.pdf.

PeVL 71/2002 vp Hallituksen esitys hautaustoimilaiksi (Opinion of the Constitutional Committee).

PeVL 18/2014 vp Hallituksen esitys eduskunnalle tietoyhteiskuntakaareksi sekä laeiksi maankäyttö- ja rakennuslain 161 §:n ja rikoslain 38 luvun 8 b §:n muuttamisesta (Opinion of the Constitutional Committee).

Saarenpää, Ahti, Testamentti viimeisenä tahtona jäämistöoikeuden järjestelmässä. Johdatus testamenttiin omalaatuisena oikeustoimena, 2006. Available at: http://www.ulapland.fi/loader.aspx?id=732db75c-1061-4118-97ee-2e13fdcb6338.

Saarenpää, Ahti, Data protection in the network society – the exceptional becomes the natural, El derecho de la sociedad en red, Zaragoza 2013, pp. 85–127.

Saarenpää, Ahti, Henkilö- ja persoonallisuusoikeus. In: Niemi, Marja-Leena (ed.), Oikeus tänään / osa II, Third revised edition, Lapin yliopiston oikeustieteellisiä julkaisuja, Sarja C 63, Rovaniemi 2015, pp. 203–430.

Saarenpää, Ahti, Oikeusinformatiikka. In: Niemi, Marja-Leena (ed.), Oikeus tänään / osa I, Third revised edition, Lapin yliopiston oikeustieteellisiä julkaisuja. Sarja C 63, Rovaniemi 2015, pp. 17–205.

Scheinin, Martin, Ihmisarvon loukkaamattomuus valtiosääntöperiaatteena. In: Aerschot, Paul–Ilveskivi, Paula–Piispanen, Kirsti (ed.), Juhlakirja Kaarlo Tuori 50 vuotta, Helsinki 1998, pp. 57–69.

Szulewski, Pawel, Transferability of digital assets in case of death, In: Schweighofer, Erich/Kummer, Franz/Hötzendorfer, Walter (eds.), Co-operation. Proceedings of the 18th International Legal Informatics Symposium IRIS 2015, Wien 2015, pp. 595–602.

Tuori, Kaarlo, Lausunto (10 September 2008) perustuslakivaliokunnalle hallituksen esityksestä eduskunnalle laiksi Jokelan koulukeskuksessa sattuneiden kuolemaan johtaneiden tapahtumien tutkinnasta (HE 51/2008).

Viljanen, Veli-Pekka, Yksityiselämän suoja (PL 10 §). In: Hallberg, Pekka (ed.), Perusoikeudet, Second revised edition, WSOYpro Oy, Helsinki 2011, pp. 389–411.