I think you've got it back-to-front. Personal identifying information does not belong to any company that gathers or purchases it unless they have specific per

I think you've got it back-to-front. Personal identifying information does not belong to any company that gathers or purchases it unless they have specific permission (i.e. not some dark pattern "click here to disable the non-collection of your data") from the person and it is reasonable for them to have that data for their stated purpose. (Somewhat paraphrased from GDPR). The company and or government department need to have a strong reason to be manipulating the family's data and the family should have the right to see the data that is being held on them and also correct or delete it if it is incorrect.