Towards Postmortem Data Management Principles for Generative AI

2025-09-08

AI Summary

This study addresses the unresolved legal and ethical challenges concerning data rights and privacy protection for deceased individuals in the generative AI era. Through doctrinal legal analysis, comparative examination of major technology companies’ privacy policies, and cross-validation against regulatory frameworks—including the EU AI Act—we systematically develop, for the first time, a principled governance framework for posthumous personal data. The framework advances three actionable principles: (1) continuity of data rights beyond death; (2) a legally grounded proxy authorization mechanism; and (3) a pre-training screening and dynamic withdrawal protocol for deceased individuals’ data used in AI model training. It bridges critical theoretical and practical gaps at the intersection of AI ethics and data governance—specifically regarding “posthumous data rights”—and provides policymakers with legislative guidance, developers with compliance pathways, and privacy practitioners with auditable implementation tools. Ultimately, it extends robust data rights protections from the living to the deceased.

Technology Category

• Philosophy and Ethics of AI: AI & Law, Justice, Regulation & Governance
• Natural Language Processing: Ethics — Bias, Fairness, Transparency & Privacy
• Humans and AI: AI for Accessibility

Application Category

• User Modeling, Personalization and Recommendation: Accountability, Transparency, and Ethics for personalization
• Responsible Web: Ethical and legal aspects of web-scale data analysis, uses and collection practices
• Security and Privacy: Data transparency and provenance

Abstract

Foundation models, large language models (LLMs), and agentic AI systems rely heavily on vast corpora of user data. The use of such data for training has raised persistent concerns around ownership, copyright, and potential harms. In this work, we explore a related but less examined dimension: the ownership rights of data belonging to deceased individuals. We examine the current landscape of post-mortem data management and privacy rights as defined by the privacy policies of major technology companies and regulations such as the EU AI Act. Based on this analysis, we propose three post-mortem data management principles to guide the protection of deceased individuals data rights. Finally, we discuss directions for future work and offer recommendations for policymakers and privacy practitioners on deploying these principles alongside technological solutions to operationalize and audit them in practice.

Problem

• Examining ownership rights of deceased individuals' data
• Analyzing post-mortem data management and privacy regulations
• Proposing principles to protect deceased individuals' data rights

Innovation

• Proposes postmortem data management principles
• Guides protection of deceased individuals data
• Recommends deploying principles with technological solutions