Introduction
Data has become essential for both humanitarian and military activities during armed conflict.Footnote 1 Most importantly for the purposes of this article, digital methods of data processing, including the use of artificial intelligence, are increasingly being used to identify deceased persons,Footnote 2 promising to significantly increase the chances of successful identification.Footnote 3 However, as much as it can be a force for good, data can also be an enabler or facilitator of humiliation, coercion, intimidation, discrimination and violence.Footnote 4 Privacy scholars have discussed how data can create reputational, emotional, physical, economic and other types of harm during peacetime,Footnote 5 and recent years have shown that such harms are at least as pertinent in situations of armed conflict or military occupation.Footnote 6 Many humanitarian actors are keenly aware of these risks and have developed detailed guidance and policies on data protection,Footnote 7 including with respect to the identification of the dead.Footnote 8
However, it is far less clear which duties arise for States. On the face of it, data protection law might seem like a natural starting point in this respect. Indeed, data processed to identify the dead will frequently qualify as personal data – i.e., “information relating to an identified or identifiable natural person”.Footnote 9 In a peacetime setting, such data might be covered by data protection lawFootnote 10 if such legislation exists,Footnote 11 but data protection law will frequently not apply to national security-related conductFootnote 12 or to deceased individuals.Footnote 13 More generally, the applicability of domestic law to foreign armed forces in international armed conflict (IAC) and in cases where martial law has been declared is not entirely certain. While data protection law can certainly be highly relevant in some armed conflicts, its applicability and protective value would need to be confirmed on a case-by-case basis.
Consequently, there is merit in turning to the rules of international humanitarian law (IHL) that explicitly regulate the treatment of those who have died in the context of an armed conflict. At the time of the drafting of the most relevant treaties of IHL, digital technologies were not yet invented or were not used as widely as they are nowadays. It is therefore unsurprising that these treaties do not explicitly and comprehensively address certain pertinent issues of data protection. Against this background, the following will provide an initial analysis of how IHL regulates data related to the identification of deceased persons and the harms that might arise from its processing.
For the purposes of this article, data is understood as being related to the identification of deceased persons when it is processed – i.e., collected, shared, retained, disclosed or used – as part of efforts to identify a person who has died in relation to an IAC or a non-international armed conflict (NIAC). This includes both missing person data and unidentified person data.Footnote 14 Equally, it covers data relating to the loved ones of a missing person, which is often generated as a by-product in the process of gathering information on a missing person, or is required to inform the loved ones of the fate and whereabouts of their relative.Footnote 15 Note that this reflects the intimate connection between the protection of the dead and the rights of the living. Although one important motivation of the rules relating to deceased persons is the protection of their dignity, IHL explicitly states that obligations to facilitate the identification of deceased persons are “prompted mainly by the right of families to know the fate of their relatives”.Footnote 16 Consequently, the protection of the dead cannot be analyzed in separation from the living whom they leave behind.
It is worth pointing out that efforts to identify the dead and efforts to protect data are not inherently opposed forces. The success of identification will often depend on the availability and quality of data. Where data is not properly protected, it might be deleted or modified (deliberately or accidentally), hence decreasing its availability and quality. Moreover, the loved ones of missing persons might refuse to cooperate due to fears that sharing their personal data could expose them to risks. By sowing such seeds of distrust, insufficient data protection standards can turn into a significant obstacle to achieving humanitarian objectives.Footnote 17 Therefore, data protection is generally conducive to the objective of clarifying the fate of missing persons and identifying the dead.Footnote 18
Overall, the article shows that certain rules of IHL can provide protection from various data-based harms, either by outlawing said harms (e.g., dignitary harm arising from the public exposure of deceased persons) or by building protection mechanisms into the default processes relied on in the process of identifying the dead and informing their families about their fate. Moreover, certain more general obligations can be interpreted as giving rise to a duty to prevent data-based harm. However, it should be noted that there is a lack of specific protections in the texts of the relevant treaties, especially in NIAC. It is suggested that the interaction between IHL and international human rights law (IHRL), as well as domestic data protection law with respect to data relating to the dead, should therefore be analyzed further to assess how the latter two bodies of law could complement IHL.
The bright side of data: A brief note on how data can facilitate the identification of deceased persons
As noted by the International Committee of the Red Cross (ICRC), “[i]dentification is achieved through the process of comparison of information”.Footnote 19 Thus, the identification of the dead is an inherently data-reliant endeavour. To identify a deceased person, two sets of data are needed. On one end, data is collected from an unidentified deceased person (e.g., fingerprints, DNA, dental records, location of body, personal property).Footnote 20 On the other end stands data on missing persons (e.g., physical background information, such as sex, age, height, ethnicity or distinct features; and information about a person’s social background, such as professional, academic or political affiliation).Footnote 21 In the age of social media, data regarding a missing person’s last communications and activities can significantly facilitate the process of establishing hypotheses about that person’s whereabouts.Footnote 22
The quality and quantity of the available information is a crucial determinant of how likely identification will be, especially in light of the difficulty of ascertaining which information will turn out to be truly relevant at the outset of the identification process.Footnote 23 It should be remembered why successful identification is so essential: without it, families will be stuck in a painful limbo between hope and grief – sometimes for years or even decades – which can be likened to a “secret prison”.Footnote 24 Consequently, there is an understandable incentive to increase the chances of identification as much as possible. This might sometimes translate into collecting as much potentially relevant information as possible. From this perspective, the fact that more and more data is being generated nowadays (e.g., social media, data collected by States or humanitarian actors) can be a source of hope for families who are looking for their lost loved ones.
The dark side of data: How data related to the identification of deceased persons can enable or reinforce harm, and how it is regulated by IHL
As the above has shown, information is central in identifying deceased persons. Yet, as much as data can facilitate the identification of the dead, it can also enable or reinforce harm. The three following fictional scenarios, inspired by real-life events, illustrate this risk. Information-related risks and the harm caused when they materialize are not necessarily new, but as information is increasingly stored and processed in a digital format, they are often magnified due to the increased ease with which the data can be analyzed and shared. Each of the following three scenarios will be followed by an analysis of how the rules of IHL could serve to prevent the relevant data-based harms.
Scenario 1: Respecting the dead in times of social media
In scenario 1, State A is engaged in an IAC with State B and is occupying part of B’s territory. As a result of a violent clash between the occupying forces and local insurgents, two civilians die. Soldier S, belonging to State A, takes pictures of the deceased civilians to facilitate later identification. After uploading said pictures to an unidentified persons database, S also posts them on her public social media accounts, adding a derogatory caption. The picture shows the faces and naked bodies of the two civilians. Soldier S’s post goes viral and is viewed by millions of people all around the world.
IHL obligations regarding the respect of the dead
In recent armed conflicts, images of deceased persons have been published online.Footnote 25 The above scenario highlights how this can create and magnify dignitary harms caused to deceased persons. It should first be noted that the conduct of soldier S clearly goes beyond the processing which would have been necessary to fulfil the purpose for which the information was initially collected. This is not explicitly and specifically prohibited by IHL,Footnote 26 but several rules of IHL do protect the dignity of the dead.
In IAC, Article 34(1) of Additional Protocol I (AP I) obliges States Parties to respect the remains of the deceased. According to the ICRC Commentary on AP I, this includes preventing them “from being exposed to public curiosity”.Footnote 27 Given that social media content can reach millions of users all over the world, sharing images of the deceased online without anonymizing them first would most certainly qualify as such an act of exposing them to public curiosity. Moreover, Article 16(2) of Geneva Convention IV (GC IV) obliges belligerent parties to protect deceased civilians against ill-treatment.Footnote 28 The ICRC Commentary on Geneva Convention II (GC II) states that the concept of ill-treatment should be “interpreted broadly” and that it certainly includes outrages upon personal dignity and humiliating or degrading treatment.Footnote 29 Simply sharing an image of a deceased person, in the absence of any intent or even risk of causing mental suffering or a feeling of humiliation, would not amount to ill-treatment, but due to its humiliating and degrading nature, this author believes that the specific conduct of S would most likely qualify as an outrage upon personal dignity.Footnote 30 However, what if the deceased persons in the pictures had not been naked? What if S had not added a derogatory caption? While the concept of ill-treatment remains highly relevant, the uncertainty regarding its precise meaning decreases its immediate utility with respect to conduct falling between the extremes of clearly outrageous behaviour and generally desirable efforts to document atrocities.Footnote 31
Given that the photographs in scenario 1 show deceased civilians in occupied territories, Article 27 of GC IV might regulate the conduct of S more specifically: sharing images of identifiable deceased persons could constitute a failure to protect them against public curiosity, as required by Article 27.Footnote 32 However, a crucial question arises: does Article 27 apply to deceased persons?
It has been argued that IHL makes a distinction between protected persons and the dead: had the drafters intended for Article 27 of GC IV to protect deceased persons, they would have explicitly mentioned them.Footnote 33 Yet, it is submitted here that this terminological distinction is not as clear-cut as suggested. For instance, Article 139 of GC IV speaks of “protected persons mentioned in Article 136, in particular those who have … died”. If a person were to lose their status as a protected person immediately upon death, this formulation would be somewhat contradictory. There are good reasons to believe that this is not just a linguistic lapse, but an expression of the notion that IHL obliges States to protect the dignity of persons beyond their death.Footnote 34 Note that if S had taken pictures of dead prisoners of war (PoWs), Article 13(3) of Geneva Convention III (GC III) would be pertinent, and Article 13(3) was considered to be equally applicable to deceased PoWs by the authors of the ICRC Commentary on GC III.Footnote 35 There is no reason why this should be any different in the case of civilians. Moreover, it should be noted that the Elements of Crimes of the Rome Statute of the International Criminal Court explicitly state that “persons” should be interpreted to include deceased persons in the context of the war crime of outrages upon dignity.Footnote 36 As Article 27 of GC IV is equally concerned with the protection of dignity, this author considers it acceptable to consider the general rule of Article 27 as providing protection against being exposed to public curiosity, during life as in death.
By virtue of Article 1 common to the Geneva Conventions (common Article 1) and Article 1 of AP I, belligerent parties are under an obligation to ensure respect for the Geneva Conventions and Additional Protocols by their armed forces as well as by their population as a whole.Footnote 37 One might therefore argue that they have a duty to work towards the deletion of such images, which might require regulating online platforms. Since Article 1 of AP I is addressed to all “State Parties”, and common Article 1 to all “Contracting Parties”, this obligation would arise not just for those engaged in an armed conflict.Footnote 38 As States are increasingly regulating online platforms, ensuring respect for the Geneva Conventions and their Additional Protocols with regard to protecting the dignity of the dead should therefore be on the list of regulatory concerns.
However, a careful balance must be struck between protecting the dignity of those seen in the images and other interests. Documenting atrocities can be crucial for criminal investigations and transitional justice purposes,Footnote 39 and images of deceased persons on social media could help authorities to clarify the fate of missing persons through open-source investigations,Footnote 40 which would be conducive to the right of families to know the fate and whereabouts of their relatives.Footnote 41 Therefore, any regulatory action based on the Geneva Conventions or their Additional Protocols should be the result of a careful legislative process of weighing and balancing the potentially conflicting interests of preserving information conducive to identifying the dead and ensuring the documentation of atrocities, on the one hand, and ensuring the dignity of the dead, on the other. Such a balance might, for instance, take the form of prescribing anonymization measures rather than deletion and defining compelling reasons of public interest that would justify the publication of images in which deceased persons are identifiable.Footnote 42 Moreover, content which might facilitate the clarification of the fate of missing persons could be shared with the relevant agencies before being deleted from public platforms.
The previous analysis has focused on IAC. In NIAC, Article 8 of Additional Protocol II (AP II) obliges States Parties to take all possible measures to prevent the dead from being despoiled and to ensure a decent burial.Footnote 43 The sentence structure of Article 8 suggests that the explicit protection against ill-treatment which it provides is limited to the wounded, sick and shipwrecked. Moreover, AP II does not provide protection against public curiosity comparable to that of GC IV. Consequently, the treaty-based protection of deceased persons against different forms of adverse treatment is not as far-reaching in NIAC as in IAC.Footnote 44 However, it is essential to consider customary law in this respect. State practice shows that several states apply military manuals in NIAC which require their armed forces to respect the deadFootnote 45 and protect them from maltreatment.Footnote 46 A case-by-case-analysis would be required to ascertain if and under which circumstances these notions would cover the posting of images showing deceased persons. This author would hope that States Parties interpret the pertinent parts of their military manuals in a way that is in line with the International Criminal Tribunal for the former Yugoslavia (ICTY) Appeals Chamber’s understanding that “[w]hat is inhumane, and consequently proscribed, in international wars, cannot but be inhumane and inadmissible in civil strife”.Footnote 47
Scenario 2: Collecting and sharing data
In scenario 2, State C is involved in an armed conflict with neighbouring state D, which is known for its radical laws on non-heterosexual relationships and has publicly executed members of the LGBTQ+ community. Upon a request from D, C shares information on deceased persons on its territory, including on combatant T who is a national of D and died in combat. Apart from a photo of his military identity disc (or “dog tag”), C transmits a photo of an intimate letter from T’s boyfriend, U, found in T’s pocket and showing U’s current address. A few days later, agents from the “Ministry of Morality” of D appear at U’s home and publicly shame him for his presumed romantic relationship with the late T.Footnote 48
IHL obligations on collecting data on unidentified persons
The first question one might ask is whether State C was allowed to record information on T, and especially on the letter he was carrying. Since identification would probably have been possible simply based on his identity disc, was C allowed to also collect the letter from T’s boyfriend?
In IAC, Article 16(1) of Geneva Convention I (GC I) and Article 19(1) of GC II oblige belligerent parties to “record as soon as possible, in respect of each … dead person falling into their hands, any particulars which may assist in his identification”.Footnote 49 A crucial question, however, is which information should be collected by States Parties. While certain particulars should always be collected,Footnote 50 the formulation “any particulars which may assist in his identification”Footnote 51 seems to confer on States Parties significant discretion as to the additional information that they can collect. In fact, the ICRC Commentary on GC I even states that “[t]he guiding principle in this area is that as much information as possible that may assist in the identification of the wounded, sick or dead person is to be recorded”.Footnote 52
Had T been a civilian who died in detention, then Article 130 of GC IV would have been pertinent. Interestingly, the wording is more precise in this case, narrowing the information to be recorded and shared down to what is “necessary for the identification of the deceased internees”.Footnote 53 Yet another formulation is used in Article 33(2) of AP I, dealing with deceased persons who “would not receive more favourable consideration under the Conventions and [AP I]”. With respect to persons who have died in detention, belligerent parties shall record “at least” the information set out in Article 138 of GC IV. However, the ICRC Commentary states that “other useful information may be added”.Footnote 54 For persons within the scope of Article 33(2) of AP I who have died in other circumstances, there is no further specification as to which information should be recorded. Regarding the other side of the information equation, information on missing persons, Article 33(1) of AP I speaks of “all relevant information”, which is similarly broad. In IAC as in NIAC, customary IHL compels “each party to the conflict [to] record all available information”.Footnote 55 This formulation seems even broader.
In sum, the wording of provisions detailing which information on deceased persons should be collected differs across different provisions. While the Geneva Conventions contain some guidelines as to which information should definitely be collected,Footnote 56 most IHL provisions seem to accord belligerent parties relatively broad discretion when deciding which (additional) information on deceased persons they might want to collect.Footnote 57
The main point of this section is not to argue that the open-ended nature of provisions on the duty to collect information from deceased persons is in itself problematic. A certain degree of flexibility with respect to which information can be gathered from unidentified persons might be necessary, as it is often not entirely clear what kind of information will be most useful in identifying a deceased personFootnote 58 and this “may vary considerably in each individual case”.Footnote 59 Yet, the fact that a great amount of potentially very sensitive personal data related to unidentified persons and their loved ones could be collected by States Parties makes safeguards regarding the sharing and retention of such data all the more important.
IHL obligations on sharing unidentified and missing person data
Inevitably, matching information on missing persons with information on deceased persons so as to identify them requires an exchange of information. As the above scenario suggests, such data transmissions can potentially cause harm. How can IHL provide protection against such harms?
In IAC, National Information Bureaux (NIBs) play a crucial role in organizing and transmitting information.Footnote 60 The role of the NIB is to receive information on PoWs (including those who have died in captivity)Footnote 61 and deceased combatants,Footnote 62 as well as on protected persons in the hands of a belligerent party (including those who have died while being interned),Footnote 63 and to forward such information. Importantly, for all the previously referenced categories of persons, transmission to the adverse party would be intermediated by the Protecting Power or the Central Tracing Agency (CTA, formerly the Central Prisoners of War Agency).Footnote 64 As the CTA is part of the ICRC, data related to deceased persons transmitted through the CTA will be subject to the ICRC’s stringent data protection rules, mandating among other things a data protection impact assessment ahead of any further distribution.Footnote 65
While not directly relevant to the scenario at hand, it should be noted that GC IV itself contains certain specific safeguarding duties: where the NIB has reasons to believe that the transmission of information might have a detrimental impact on the person concerned or their relatives,Footnote 66 it needs to notify the CTA thereof.Footnote 67 However, such concerns are not a valid reason to withhold the information in question from the CTA.Footnote 68 The CTA itself is obliged to consider the potential detrimental impact of sharing data and to suspend or adapt the transmission accordingly.Footnote 69 This should be highlighted as an example of the timelessness of the Geneva Conventions – even long before the emergence of data-based technologies, as well as the risks and harms associated with them, the drafters integrated a provision that, at least in spirit, somewhat resembles the data protection impact assessments known by modern data protection law.
Interestingly, Article 33(3) of AP I explicitly mentions the possibility of directly transmitting data concerning persons reported missing and requests related thereto to the enemy belligerent party.Footnote 70 While the Geneva Conventions do not prohibit such direct transmissions, they do establish the above-described intermediated transmission process, together with its safeguarding mechanisms, as the default approach.
However, even when information on civiliansFootnote 71 protected by GC IV is directly transmitted by the NIB, Article 137(2) of GC IV will still need to be heeded. Strictly speaking, Article 137(2) constitutes an exception to the obligation to transmit potentially harmful information, not an obligation to refrain from doing so. Yet, it would seem in line with the object and purpose of the provision to interpret it as a de facto prohibition against transmitting harmful information. This exception is a clear expression of the drafters’ intention to mitigate harm to those concerned by the transmitted information. It would be contrary to the object and purpose of the provision to consider that it is within the discretion of each State to decide whether it would nonetheless like to transmit such information directly. However, it should be noted that the State would be always obligated to transmit the information to the CTA.Footnote 72
Apart from the treaty-based rules applicable in IAC, customary law applicable in both IAC and NIAC obliges belligerent parties to “provide [the] family members [of missing persons] with any information … on their fate”.Footnote 73 The precise modalities of how to transmit such information are not further specified in the identified customary rule.Footnote 74 In NIAC, where no specific treaty-based rules on the transmission of information related to dead and missing persons exist, this relative paucity of IHL-based provisions could make domestic data protection law and IHRL potentially essential complementary sources, as will be discussed below.Footnote 75
Applying this to the case of T, the following can be said. The default approach foreseen by the Geneva Conventions would have been to transmit information through the CTA. As the CTA has stringent data protection protocols, the harm to U most likely would have been identified in the risk assessment and mitigated.Footnote 76 If T had been a civilian, C’s NIB further would have been obliged to alert the CTA to the potential harm that the transmission of information on T could entail. It was argued that the pertinent provision can further be interpreted to outlaw a direct transmission to the adverse party D if such information might cause harm; however, as stated above, data must always be transmitted to the CTA.
Scenario 3: Retaining data
In scenario 3, State E is engaged in a NIAC with non-State armed group F. When activist V goes missing, the authorities invite V’s family to provide information on where V was last seen. The family informs the authorities that V was documenting alleged war crimes committed by group F. E records this information in its database on missing persons, which can be accessed without a password from all its military bases. V is identified a few weeks later and her family is informed of her passing. Weeks later, armed forces belonging to F establish control over a military base close to the village in which V’s family lives. They later appear at the house of V’s family, torture and severely injure her brother. They refer to the data provided by V’s family and to V’s past activities, for which her family is now being “punished”.
IHL obligations on deleting data related to the dead
As mentioned previously, customary IHL establishes an obligation to search forFootnote 77 and identify the deadFootnote 78 as well as to record all available information on missing people and to provide families with any information on their fate and whereabouts, in both IAC and NIAC. This naturally requires not only the collection, analysis and transmission of data but usually also its retention,Footnote 79 thus raising an important question: is there any point at which information relating to the dead must be deleted?
Certainly, the relevant provisions can only be properly complied with if the information in question is retained for as long as necessary to account for the missing, identify the dead and inform their families as required by the norms discussed above. However, there will be a point where information in the hands of a belligerent party might no longer serve any purpose related to the right of families to know the fate and whereabouts of their missing loved ones – e.g., once all information has been transmitted to the CTA, which has thus been enabled to take all the necessary steps. In such a situation, the deletion of data on the dead held by a belligerent party can constitute an important measure to avoid future data-based harm (such as the events described in scenario 3).
IHL itself does not explicitly oblige States Parties to delete the information they hold once it is no longer needed. The updated ICRC Commentary on GC III states that “[o]nce an enquiry has been concluded, all personal information collected with a view to settling the case should be treated in accordance with applicable standards on data protection …, including, where necessary, deleting or destroying the data”.Footnote 80 The Model Law on the Missing states that “[p]ersonal data that has served the purpose for which it was collected should be deleted or destroyed”.Footnote 81 In the case of V, having such legislation in place could have prevented significant harm. However, problems might arise where States have no or only very weak data protection standards to this effect, or do not consider their domestic data protection law applicable.
IHL obligations on protecting data related to the dead
In the case of V, harm might have been prevented by having more robust safeguards aimed at protecting the data on the dead and missing that State E held. Beyond the scenario presented above, keeping data safe is crucial.Footnote 82
Again, IHL does not contain an explicit duty to take specific measures to ensure that data is not accessed, interfered with or deleted by malign third parties. The updated ICRC Commentaries on GC I and GC II suggest that the duty to keep data safe is inherent in the requirement to record said information in the first place.Footnote 83 This author has great sympathy for the idea of reading data protection considerations into a specific aspect of existing obligations, but others (including States) might consider that such an interpretation veers too far away from the text of the relevant provisions.
In V’s case, a similar obligation would need to be read into the customary obligations related to the dead and missing which are applicable in NIAC. If present or future State practice were to show that States apply data protection standards when deciding how to treat data related to the dead after their families have been informed about their relatives’ fate, such an interpretation would seem convincing.Footnote 84
It should be noted that F’s conduct clearly constitutes a violation of IHL.Footnote 85 If there is a foreseeable risk that third-party access to data related to the dead and missing would lead to such a violation, States Parties could have a duty to do everything reasonably in their power to protect such information as part of their general obligation to ensure respect for IHL.Footnote 86 A case-by-case assessment would be required to identify when the risk of a violation would be foreseeable and which preventative measures would have been reasonably available.Footnote 87 Generally, where data is at risk, emphasizing the responsibility of States Parties to keep data safe could be an additional incentive to comply with their obligation to forward information as quickly as possible.Footnote 88 When a State has grounds to believe that it is not in a position to ensure the safety of the personal data that it retains, it can avoid liability for data-enabled violations by third parties by arranging a transfer of the data it holds to the CTA and destroying its own records once all data has been transmitted. The CTA has the expertise and capacity to store data safely and to conduct data impact assessments.
In sum, IHL does not explicitly specify when or under which circumstances data related to the dead would need to be deleted or how it must be protected. Nonetheless, if the failure to delete data or keep data safe would foreseeably entail a violation of IHL, the general obligation to ensure respect for IHL might serve as a basis for obliging States Parties to take the necessary protective measures. A duty to keep data safe and to potentially delete it has further been read into existing treaty provisions applicable in IAC; a similar approach could be adopted with respect to the customary rules governing the collection and transmission of information on dead and missing persons in NIAC, but such an approach would only be truly convincing if sufficient evidence of State practice supporting it could be adduced.
How IHL could be complemented by other bodies of law: Some preliminary suggestions
As the previous section has shown, some of the rules on the identification of the dead and the right of their families to know about their fate provide explicit protection against certain data-based harms. Others can be interpreted as implicitly establishing certain data protection obligations. However, to provide effective protection in practice, such interpretations would need to be accepted and put into practice by States. Moreover, due to the paucity of treaty-based rules dealing with the identification of the dead in common Article 3 and AP II, reading data protection duties into existing IHL rules appears more difficult in the context of a NIAC. To strengthen the claim that IHL should indeed be interpreted in the suggested manner and to complement its protection, a look beyond IHL might be useful.Footnote 89
International human rights law
Most human rights treaties do not explicitly regulate data.Footnote 90 However, the processing of personal data has regularly been considered to fall within the protective scope of the right to private life.Footnote 91 The European Court of Human Rights (ECtHR) and the United Nations Human Rights Committee have interpreted said right as establishing five requirements: legality, necessity, proportionality, adequate safeguards and access to remedy.Footnote 92 While the precise content of these principles has been analyzed elsewhere,Footnote 93 it suffices to say here that the case law on the human right to private life contains certain specific obligations regarding, inter alia, the limitation of processing what is necessary for the purpose for which it was collected,Footnote 94 ensuring safe storage and transmission,Footnote 95 and a limited retention period for personal data.Footnote 96
However, several notes of caution are in order. First, it is not entirely clear to what extent human rights would protect deceased persons.Footnote 97 In fact, IHL might provide more direct and complete protection of the dignity of the dead; IHRL would most likely be more useful regarding the protection of information which might cause dignitary, physical, discriminatory or other privacy-based harms to their living relatives. Second, IHRL might not always be applicable. Its precise extraterritorial applicability in situations of IAC remains disputed, and in NIAC, its personal scope might exclude non-State armed groups. Moreover, States can derogate from specific rights, including the right to private life, in times of public emergency.Footnote 98 Lastly, although it is by now widely accepted that IHRL does not cease to apply in situations of armed conflict,Footnote 99 there is still a great deal of uncertainty as to how exactly IHL and IHRL interact when concurrently applicable. Many seem to agree that IHL and IHRL are, in principle, complementary.Footnote 100 This will frequently allow for the avoidance of norm conflicts by interpreting both bodies of law in a coordinated manner.Footnote 101
Without trying to deny these caveats, IHRL could provide useful additional legal “firepower” to “data protection-friendly” interpretations of existing IHL obligations. Although further analysis would be required, such interpretations could be considered as necessary to give effect to the right to private life by harmonizing IHL and IHRL obligations where both are concurrently applicable.
Data protection law
As noted above, some IHL provisions have been interpreted as giving rise to certain data protection obligations. Especially in IAC, international standards would come with the great advantage of ensuring equal protection on all sides, regardless of any differences between the belligerents’ data protection laws. Nonetheless, in the absence of comprehensive and well-established international standards, data protection law “proper” could complement the above-identified international protections, providing a stringent, specific and comprehensive legal framework for data processing.
There are three potential caveats to consider here. First, not every country has data protection laws, and for some of those that do, those laws might provide only very limited protection.Footnote 102 Second, data protection law can be limited in its applicability to conflict-related activitiesFootnote 103 or where martial law has been declared. Third, not every domestic or regional data protection legislation protects the personal data of the dead.Footnote 104 Therefore, certain data-based harms to the dignity of the dead might escape the reach of domestic data protection law.
Generally, it would be problematic if data protection law stood in the way of identifying the dead and informing their families of their fate. In fact, domestic data protection law cannot justify a failure to comply with the obligations arising from the pertinent IHL treaties.Footnote 105 In many cases, such a failure could be prevented by putting in place procedures and structures to ensure the protection of personal data related to the dead and missing.Footnote 106 Depending on the details of the data protection regime in question, however, further adaptations might be necessary to account for the particular humanitarian needs created by armed conflict. For instance, a rigid focus on consent might need to give way to a greater emphasis on the vital interests of the data subject or their relatives and the public interest.Footnote 107 Moreover, certain data subject rights (e.g., the right to access or the right to data portability) might need to be limited to account for the realities of armed conflict. A case-by-case analysis would be required to understand how the data protection laws applicable in a specific jurisdiction might need to be adapted.Footnote 108
Conclusion
The processing of data is an integral part of efforts to identify persons who have died in relation to an armed conflict, but data can equally enable or facilitate harm, especially in times of hostilities. Consequently, when harnessing the benefits of the increasing amount of available data, the protection of that data must not be forgotten.
This article has discussed how IHL regulates data related to the identification of deceased persons by analyzing three hypothetical scenarios. The first scenario showed that certain IHL rules can offer protection against the dignitary harm caused to deceased persons (and emotional harm to their families) which can arise when images of their remains are published and disseminated online.
The second scenario revealed that IHL sets a minimum limit, but not a maximum limit, as to which information should be collected from the dead. However, this can be seen as a reflection of the inevitable uncertainty as to which information will be useful in identifying a deceased person. Regarding the transmission of information related to the dead, even before the rise of data and the harms associated with it, the drafters of the Geneva Conventions were concerned with the potential detrimental effects that sharing information on dead and missing people could have.
The third scenario discussed a situation where a failure to keep data safe and to delete it enabled physical harm. IHL does not explicitly contain a duty to delete data related to deceased or missing persons once it is no longer needed, but such a duty could potentially be derived from the general obligation to ensure respect for IHL where a failure to delete would foreseeably lead to violations of IHL. Moreover, duties to keep data safe could be read into existing provisions governing IACs.
In sum, IHL outlaws certain data-enabled harms and can be interpreted to oblige States to take certain measures to reduce the risk of other data-based harms. Yet, advancing interpretations ensuring the protection of personal data related to the identification of the dead is easier in IAC than in NIAC. Moreover, even regarding IAC, there is a risk that progressive interpretations which read certain data protection duties into IHL will not be taken up by all States. Generally, IHL-based data protection duties regarding data related to the dead remain somewhat scattered and incomplete. Against this background, it was suggested that the right to private life could strengthen the claim that States are required to protect the data they control. Furthermore, although some adaptations to provide a certain degree of flexibility might be needed, domestic or regional data protection law could complement IHL. However, both approaches come with their own complications and would need to be analyzed further.
As a final remark, it should be said that the protection of data related to the dead should not be seen as a merely theoretical concern. In certain situations, it might be the main determinant of whether those who have lost someone due to armed conflict can grieve as peacefully as possible, or whether they have to fear that the price they pay for identifying their loved ones is losing their own safety and privacy.
Open access
