With order of February 10th 2022, the Court of Rome ordered Apple to deliver to the widow of a user the access credentials of her late husband, stating that the rights related to the personal data of a deceased person can be exercised by subjects with family interests deserving protection.
The case concerned a woman’s request to obtain the necessary assistance in order to recover data associated to the account of her deceased husband.
The woman stated that the man passed away suddenly – leaving two daughters of 3 and 5 years old – and that photos and videos with deep emotional content were archived in his iCloud.
Not knowing the account access credentials, the woman tried to ask Apple for assistance, without success. In fact, the US giant, even if it seemed to be willing to cooperate, clarified that its own contractual conditions did not allow access to deceased user accounts without a judicial order.
At that point, the woman was forced to present an urgent appeal, pursuant to art. 700 c.p.c.
In particular, the urgency was due to the risk of irrevocably losing the data archived in the iCloud of the deceased man, because, after a 6-months period of inactivity, the Apple systems automatically deactivate the account destroying the data associated to it.
Moreover, on the basis of her request, the woman invoked art. 2-terdecies (1) of the Legislative Decree 101/2018, according to which rights “referring to personal data concerning deceased persons can be exercised by those having an interest of their own, or act to protect the interested as their agent, or for family matters deserving protections”.
The Judge accepted the woman’s request, recalling how in the “Recital” no. 27 of the GDPR, it is expressly specified that the Regulation on the personal data protection (2016/679) does not apply to data of deceased persons. Moreover, in the case under exam, the Judge considered that the familiar interest deserving protection is represented precisely by the necessity to recover family images and videos, destined to strengthen the memory of the father and for the benefit of the two daughters at an early age.
For these reasons, Apple was ordered to give all the necessary assistance to the woman in order to recover the data associated to the account of the deceased man, also by handing over the relative access credentials.
Lastly, the Judge specified that the access to data cannot even be considered precluded by the mere acceptance of the general conditions of Apple at the moment of the purchase of the mobile device.
In fact, in order to make his data inaccessible after death, the user would have to expressly prohibit it and communicate the prohibition in written form to the controller. Only this could possibly exclude the applicability of art. 2 terdecies (1). It is the same rule, in comma 3, to provide that such prohibition must be expressly and unequivocally manifested: this because the legislator wanted to guarantee that the interested part could have full conscience of its own choice and, therefore, it provided that the will to prohibit the exercise of digital rights after death could be expressed in a free, informed and specific way.
In conclusion, the Judge affirmed that the mere adhesion to the general conditions predisposed by the service provider is not adequate to satisfy the formal and substantial requirement provided for in the mentioned rule, above all considering the fact that they are negotiation practices that do not enhance the independence of the users’ choices.
Ilaria Feriti