By Ollie Wright, Head of FI Team at Estatesearch
There is much good work happening in Financial Institutions to protect vulnerable people with disabilities and mental incapacity. Many financial firms are proactively implementing policies to ensure consumers are treated fairly and with good outcomes. Some now employ vulnerability champions and are working through steps to improve their vulnerability processes, which many solicitors would argue have historically been poor.
However, whilst the rights of attorneys and deputies dealing with mental capacity cases are clear cut when it comes to GDPR, if you compare this to the rights of executors and professionals who advise personal representatives in probate cases, these are implied by Consumer Duty but are much more ambiguous.
Living individuals are subject to GDPR which means if they suffer from mental incapacity a legal representative, via a Lasting Power of Attorney for example, can utilise their data rights on their behalf. However, the moment someone passes away they become a ‘deceased subject’ and GDPR ceases to be applicable. This means guidance for financial institutions is not standardised across the board when responding to enquiries such as Data Subject Access Requests (DSARs) from legal representatives who are working to identify assets in probate.
The effects of a bereavement are included by the FCA in its list of things which can constitute vulnerability, but what about the deceased person themselves? Why aren’t we talking about rights when someone dies? It sounds strange to write it, but isn’t this when someone and the assets they leave behind are at their most vulnerable?
Currently, the moment someone passes away, their data rights become almost non-existent. The deceased effectively just becomes a line on a spreadsheet at this point. In intestate cases where there is no Will, the deceased has no say in what happens to their estate. As a result, grieving relatives, themselves in a vulnerable position, face a difficult challenge when it comes to liaising with institutions during probate.
As a founder of the Vulnerable Banking Group and an organisation who supports legal representatives working on probate cases, Estatesearch has discussed this subject at length with the regulators and the ICO has been instrumental in helping us to make sense of what’s applicable.
Here, the FCA’s Principles should be highlighted, particularly Principle 6 which states that a firm “must pay due regard to the interests of its customers and treat them fairly” and Principle 12 which is Consumer Duty, which focuses on providing good outcomes to consumers. Just because someone is no longer living, if the bank still holds their assets, they are still a customer; at least until after probate has completed, the beneficiaries receive their inheritance and certainly while a legal representative is in place.
The rights of Personal Representatives in deceased cases are implied by Consumer Duty, and we applaud the FCA for taking steps to clarify how the application of their principles help to protect the deceased. However, we are of the opinion that further improvements need to be made to ensure a cohesive approach across all industry sectors. Therefore, we are keen to collaborate with fellow stakeholders in the probate process, including Financial Institutions, to address ambiguity in the recommendations and to ensure that the deceased themselves are treated fairly.
One solution would be to introduce a grace period post-death where GDPR is clearly applicable to the deceased. This would allow their financial affairs to be brought into order, accounts to be properly closed and the beneficiaries to receive any legacies due to them, with minimal stress and delay.
Interestingly, in Scotland there is a rule that claimants for an estate must come forward within six months of a person’s death. This six month claims period is deemed reasonable time for a creditor of the estate to step forwards. Perhaps a similar time frame would work for an extension of GDPR rights for deceased individuals to enable legal representatives to establish the financial assets within an estate and ensure they are rightfully distributed to beneficiaries? We work closely with the ‘big six’ financial firms and they are proactively leading the way, taking steps to ensure deceased subjects continue to be treated fairly.
In the rest of the financial industry however, we observe a variety of approaches which makes navigating probate more difficult for the bereaved families who seek to move on with their lives once the estate has been administered. It can also mean additional costs against the estate if assets are missed and later identified.
Another important consideration is the need for GDPR compliance in financial institutions’ own processes. Article 5 states that data controllers and processors have an obligation to ensure that the data they keep on file is accurate. However, as institutions merge or acquire one another, it becomes even more challenging to maintain the integrity of data. This ‘Data Pandemic’ will only worsen until addressed head on. One of my colleagues working in our Estatetrace arm, aids financial institutions in tracing ‘gone aways’ and has witnessed records being held for individuals who would have been 120 years old, which demonstrates the challenges with the current approach, and further enhances the argument for data rights to extend to the deceased.
The current situation is simply not good enough by modern standards, and effectively dehumanising a person by stripping them of their data rights the moment they pass away is not the answer. Times have changed and we now have the technology and knowledge to explore a new solution. Therefore, we believe that it is time to bring this issue to the forefront. We would like to open a debate to discuss an extension to data rights and access to information for the period of time it takes to administer the deceased’s estate. Not only will this ease the burden on the legal representatives and the family, but it also makes sense for the financial institutions to which they remain customers.
We would love to hear from you
Contact Ollie on [email protected] to get involved in our mission to transform industry standards and support vulnerable customers more effectively.