Can we please confirm our assumption of how an active consent would be treated following the death of a customer:
- Where a customer dies, their CDR consent expires and no further data sharing should take place.
- Where a customer dies and they have a joint account, the account ownership reverts to the other living account holders.
(a) If the deceased customer was the requester/initiator of the CDR consent, the consent expires and no further data sharing should take place.
(b) if the requester/initiator of the CDR consent is one of the remaining living account holders, the CDR consent continues unaffected.
The rules don't directly specify what happens when a CDR consumer dies. To some extent, the effect of a customer dying will depend on the data holder's practices in relation to the customer's accounts. We are not able to review and comment on all data holders' practices.
However, our assumption is that generally the consumer would no longer qualify as an eligible CDR consumer, which would cause their authorisations to automatically expire (Rule 4.26).