Planning for Digital Assets
New York Banker’s Association
Trusts and Investment Conference
October 2, 2015
Presented by:
Jill Choate Beier, Esq.
Partner
McGlashan Law Firm
www.mcglawyer.com
370 Lexington Avenue, 24th Floor New York, NY 10017 [email protected]
Assistant Professor Marymount Manhattan College
221 E. 71st Street New York, NY 10021
2
I. Introduction
A. How much exposure do we have to digital assets?
1. Number of people using social media – 1.61 billion1 2. Facebook users – 1.39 billion2
3. Flickr users – 92 million3 4. Gmail users – 500 million4 5. LinkedIn users – 347 million5 6. Twitter users – 288 million6 7. Yahoo! Mail users – 273 million7 8. YouTube users – 1 billion8
B. Recent anecdotes involving digital assets
1. The issue first gained attention in 2005 when the media reported about the family of a soldier who was killed by a bomb while stationed in Fallujah. The family wanted copies of email correspondence from his Yahoo! Email account.9
a. According to the soldier’s family, Corporal Ellsworth was keeping a journal to ensure this his generation and the generations that follow had words from someone who was in Iraq.
b. When the family approached Yahoo! regarding access to the emails, the company denied the request on the basis of privacy. The Ellsworth family brought suit in Michigan Probate Court.
1 Craig Smith, 20 Social Media Statistics You Probably Didn’t Know, December 21, 2014, DIGITAL MARKETING
RAMBLINGS, available at http://expandedramblings.com/index.php/category/social-media/social-mediameasurement/ (website last checked Apr. 28, 2015).
2 Craig Smith, How Many People Use 800+ of the Top Social Media, Apps and Tools? Apr. 8, 2015, DIGITAL
MARKETING RAMBLINGS, available at http://expandedramblings.com/index.php/resource-how-many-peopleuse-the-top-social-media/ (website last checked Apr. 28, 2015).
3 Id. 4 Id. 5 Id. 6 Id. 7 Id. 8 Id.
3
c. The court appointed the father as personal representative of the estate and obtained a court order directing Yahoo! to turn over the emails. (N.B. Yahoo! was made a party to the proceeding.) 10 d. Yahoo! ultimately provided a C.D. with photographs and emails—
but only the emails the deceased received because he set up the account not to save sent messages.
2. A blogger died suddenly of a heart attack during the night and his Flickr account, full of photos, was closed and unavailable to the family after his death.11
a. Mac Tonnies was unmarried and had no children. He had launched a blog in 2003 that had garnered a small but devoted following. His parents had no idea of Mac’s digital presence and did not know how to access it.
b. After the news of Mac’s death was posted by an anonymous user on his blog, there was an outpouring of messages in the form of tributes, grief and commentary.
3. The family of a 15-year old who committed suicide wanted access to their son’s Facebook account as they searched for answers. Facebook
refused.12
4. Facebook was granted a motion to quash a subpoena ordering it to release content of the deceased’s Facebook account to her family to assist in determining whether her death was a suicide.13
5. In 2009, Kathleen Yockey’s daughter, Michaela, graduated from Florida State and was ready to start graduate school. But those dreams were cut short when Michaela was killed in a car accident.14
a. The Yockeys chose to memorialize her Facebook page, thinking it would freeze it. Instead, everything disappeared.
10 In re Ellsworth, No. 2005-296. 651-DE (Mich. Prob. Ct. 2005).
11 See Maria Perrone, What Happens When We Die: Estate Planning of Digital Assets, COMMON LAW CONSPECTUS,
p. 197, Vol. 21 (2012).
12 Tracy Sears, Family, lawmakers push for Facebook changes following son's suicide, available at http://wtvr.com,
January 8, 2013.
13 In re Facebook, Inc., 2012 U.S. Dist. LEXIS 134977 (N.D. Cal. Sept. 20, 2012).
14 Julie Gargotta, Proposed Bill would protect digital assets after you die, Bay News 9, Mar. 4, 2015, available at
http://www.baynews9.com/content/news/baynews9/news/article.html/content/news/articles/cfn/2015/3/4/bill_would _protect_d.html?cid=rss.
4
b. “It was like somebody had taken a stack of personal letters and memories and just threw them away,” said Yockey.
c. While Yockey has gotten much of the data back over time, it was devastating. “I want to keep not only those words that she said, but even things she didn’t say to me. You don’t, you can’t get those kind of memories back if they take them,” said Yockey. d. Florida Senator Dorothy Hukill has introduced a bill that would
allow an individual to designate an individual to access digital assets.
6. A grieving Oregon mother battled Facebook for full access to her deceased son's account.15
a. "Everybody's going to face this kind of a situation at some point in their lives," says Karen Williams, whose 22-year-old son died in a 2005 motorcycle accident.
b. The Oregon Legislature responded and took up the cause recently with a proposal that would have made it easier for loved ones to access the "digital assets" of the deceased, only to be turned back by pressure from the tech industry, which argued that both a 1986 U.S. federal law and voluntary terms of service agreements prohibit companies from sharing a person's information — even if such a request were included in a last will and testament.
7. When Bill and Kristi Anderson lost their son Jake in December 2013 from hypothermia, they were surprised to discover that without a search
warrant, the law does not permit them access to Jake’s final text messages, phone calls or pictures. “Was he abducted? Did he get lost? We don’t know,” Kristi Anderson testified before lawmakers Tuesday morning, “but we think his cell phone could possibly contain some of those answers.” Jake’s parents want answers surrounding his death.16
a. Fortunately, Representative Debra Hilstrom wants to help
them. “Imagine if your bank chose to treat your assets in the same way and said, ‘oh, no, you died, so no one can get access to your assets. We’d all be outraged.”17
15 Mother fights for access to her deceased son’s Facebook account, The Associated Press, Mar. 1, 2013, available
at http://www.cbc.ca/news/technology/mother-fights-for-access-to-her-deceased-son-s-facebook-account-1.1327683.
16 Tom Hauser, Family Fights to Access Late Son’s Digital Data, ABC Eyewitness News, Jan. 21, 2015, available at
http://www.webcease.com/news/blog/105-family-fights-to-access-late-son-s-digital-data.
5
b. Hilstrom authored a bill that would allow account holders or a personal representative of the deceased get access to digital assets, as long as the deceased does not prohibit access in their will. The Minnesota Legislature will hold additional hearings to vote on the bill.
8. Recently a New York attorney had to deal with Google concerning a decedent’s Gmail account. According to the attorney, Google is requiring an order from the court before it will grant the surviving spouse access to the decedent’s gmail account. The attorney reported that she received different answers from Google at different times, and believes that Google is still trying to determine how to handle these issues. First, they told her she only needed a death certificate, then they came back with the proposed order. It is not clear whether Kings County will accept the request or sign the order.
9. Access to digital assets may also be necessary during life. One such incident occurred in Maryland when an individual who ran a building supply business suffered a stroke.18
a. The individual kept all of his records -- what he ordered, who was owed products and what bills needed to be paid -- in a Yahoo! account.
b. The family attempted to get access to the account so the business could continue operating. Yahoo! denied the family access. Meanwhile, products were being delivered daily and could not be distributed to customers and the business went into a rapid decline. c. The individual eventually regained consciousness, but was unable
to understand and answer the “secret” questions.
d. Yahoo! continues to refuse to divulge the individual’s password and, as a result, he completely lost his business.
10. Not all individuals may want their digital assets revealed to family members upon death. Many accounts have passwords for a reason.19
18 Katy Steinmetz, States Seek A Way to Pass on Digital Accounts After You Die, TIME Swampland, July 27, 2013,
available at http://swampland.time.com/2013/07/27/states-seek-a-way-to-pass-on-digital-accounts-after-you-die/.
19 See e.g., Geoffrey A. Fowler, Life and Death Online: Who Controls a Digital Legacy?, WALL ST.J. Jan. 5, 2012,
available at http://online.wsj.com/news/articles/ (describing a teenager who had a secret second blog in which she wrote many “dark” passages).
6
II. Current Legal Landscape A. Federal Privacy Laws
1. Computer Fraud and Abuse Act (CFAA)
a. Prohibits unauthorized access to computers and protects against anyone who “intentionally accesses a computer without
authorization or exceeds authorized access.”20
b. The statute does not define what it means to “exceed authorized access.”
2. Electronic Computer Privacy Act and the Stored Communications Act (“SCA”)
a. Makes it a crime for anyone to “intentionally access without
authorization a facility through which an electronic communication service is provided”21 as well as to “intentionally exceed an
authorization to access that facility.”22
b. Technically, this prohibited behavior would include violating a Terms of Service agreement and subject the violator to criminal sanctions.
c. Prohibits an electronic communications service from knowingly divulging the contents of a communication that is stored by or maintained on that service unless disclosure is made “to an
addressee or intended recipient of such communication or an agent of such addressee or intended recipient” or “with the lawful
consent of the originator or an addressee or intended recipient of such communication, . . . .”23
d. Federal law distinguishes between the permissible disclosure of the catalogue (logs and records) that electronic communication
services providers may release with or without consent under the SCA and the electronic content for which consent is required before the service provider may disclose it to a third party.24
e. Non-content material or the catalogue information can be disclosed either with the lawful consent of the account holder or to any
20 18 U.S.C. § 1030(a).
21 18 U.S.C. § 2701(a). 22 Id.
23 18 U.S.C. § 2702(b)(1) and (3). 24 18 U.S.C. § 2702 et. seq.
7
person (other than a governmental entity) even without lawful consent.25
f. Content-based material can be divided into two types of
communications: those received by the account holder and those sent by the account holder.
1) When the account holder is the “addressee or intended recipient,” material can be disclosed to that individual or an agent for that person26 and it can also be disclosed to third parties with the “lawful consent” of the addressee or intended recipient.27
2) Material for which the account holder is the “originator” can be disclosed to third parties only with the account holder’s “lawful consent.”28
B. State Laws
1. All 50 states have enacted statutes criminalizing unauthorized access to computer systems.29
2. New York Penal Code Article 156 et. seq.
§ 156.05. Unauthorized use of a computer
A person is guilty of unauthorized use of a computer when he or she knowingly uses, causes to be used, or accesses a computer, computer service, or computer network without authorization.
Unauthorized use of a computer is a class A misdemeanor.
25 See 18 U.S.C. § 2702(c)(6) (which sets forth an exception to the general rule for disclosure of customer records by
providing that a service provider “may divulge a record or other information pertaining to a subscriber to or
customer of such service (not including the contents of communications…) to any person other than a governmental entity”).
26 18 U.S.C. § 2702 (b)(1). 27 18 U.S.C. § 2702(b)(3). 28 18 U.S.C. § 2702(b)(3).
29 See Jim Lamm, “Planning Ahead for Access to a Decedent’s Online Accounts” available at
http://www.digitalpassing.com/2012/02/09/planning-ahead-access-contents-decedent-online-accounts/, February 9, 2012 in which Lamm reports that all fifty states have enacted criminal laws penalizing unauthorized access to computer systems; see e.g. CAL.PENAL CODE § 502 (2010); FLA.STAT.ANN. § 815.06 (2013); 720 ILL.COMP. STAT. 5/17-51 (2012); NYCLSPENAL § 156.05 (2012); TEX.PENAL CODE § 33.01 et seq. (2009).
8
§ 156.10. Computer trespass
A person is guilty of computer trespass when he or she knowingly uses, causes to be used, or accesses a computer, computer service, or computer network without authorization and:
1. he or she does so with an intent to commit or attempt to commit or further the commission of any felony; or
2. he or she thereby knowingly gains access to computer material.
Computer trespass is a class E felony.
§ 156.20. Computer tampering in the fourth degree
A person is guilty of computer tampering in the fourth degree when he or she uses, causes to be used, or accesses a computer, computer service, or computer network without authorization and he or she intentionally alters in any manner or destroys computer data or a computer program of another person.
Computer tampering in the fourth degree is a class A misdemeanor
C. Service provider Terms of Service agreements (“TOS”)
1. Most people in most states will be subject to the terms of the TOS if the service provider has a policy regarding the transfer or disposal of account access and content.30
2. Shutterfly's TOS states that the individual agrees not to disclose his or her username or password to any third party and acknowledges that the individual's access to the account is non-transferable.31
3. The TOS for LinkedIn, Google and Twitter each contain similar language regarding disclosure of the secured access information and
transferability.32
4. Gmail has a policy for potentially releasing emails to the personal
30 Service providers routinely amend the TOS agreements with no notice to the account holder, so it is wise to
periodically check the service provider’s website for any changes to the TOS.
31 See http://www.shutterfly.com/help/terms.jsp.
32 See http://www.linkedin.com/static?key=user_agreement&trk=hb_ft_userag;
9
representative of a deceased account holder.33 The policy makes it clear, however, that a court order will be required and there is no guarantee the email content will be released. .34
5. Yahoo! explicitly states in its TOS that the account cannot be transferred and any rights to content within the user's email account terminate upon death and all content may be permanently deleted.35
6. Facebook allows someone to report a user as deceased and the deceased user's Facebook page may then be converted into a memorial to the deceased user.
a. Up until recently, only confirmed friends will continue to have access to the deceased user's profile and may continue to post messages in memoriam on the deceased user's wall.36
b. In March 2014, Facebook announced a new policy that the account of a deceased user will be visible “as-is.”37
D. Case law application of privacy laws
1. In re Facebook, Inc. 38 - 23-year old fell 12 floors from estranged
husband’s flat in London. The authorities ruled her death a suicide, but the family did not believe it. The family wanted access to her Facebook posts because they believed it would provide evidence of her state of mind. a. The District Court in California quashed the subpoena ordering
Facebook to produce the content and stated that to hold otherwise would run afoul of the specific privacy interests the SCA seeks to protect.
b. The court rejected the notion that the family members were agents who could provide consent to access the Facebook account and further stated that even if they could provide consent, the language in SCA does not require Facebook to produce the contents, only permits them to do so. Facebook has yet to produce the contents of the account. 33http://support.google.com/mail/answer/14300?hl=en&ref_topic=1669055. 34 Id. 35http://help.yahoo.com/kb/index?page=product&y=PROD_ACCT&locale=en_US. 36 See http://www.facebook.com/help/?ref=pf#!/help/103897939701143/?q=death&sid=0G0Ow9oru3HcT7v4v 37 Evan Carroll, Facebook Changes Policy on Privacy Settings for Memorialized Accounts, The Digital Beyond,
March 15, 2014, available at http://www.thedigitalbeyond.com.
10
2. In re Ellsworth39 - Yahoo! rejected the request of the family of a soldier killed by a bomb while stationed in Fallujah based on privacy grounds. The family wanted copies of email correspondence from his Yahoo! email account and access to a journal that the soldier said he was keeping. 3. Ajemian v. Yahoo! Inc.40 – co-administrators of their brother’s estate
brought a declaratory judgment action seeking a declaration that the electronic mail messages that the brother sent and received using Yahoo! mail are property of his estate.
a. Robert (co-administrator) opened an email account for his brother, John (decedent) as co-users but the account was to be primarily used by John. Robert continued to access the email account from time to time. At the time of John’s death, Robert had not accessed the account for a long period and had forgotten the password. b. After appointment by the Massachusetts Probate Court, the
co-administrators tried to obtain access to the email account to help identify and locate assets and administer John’s estate. Yahoo! initially agreed to turn over the information provided the family produced proper documentation but then later refused to provide access to the contents citing the SCA which Yahoo! interpreted to “preclude disclosing John’s emails even to the administrators of his estate.”41
c. Further negotiations resulted in a partial resolution in which the co-administrators would obtain a court order requiring production of only the catalogue information but not the contents. The court order was obtained and Yahoo! turned over the catalogue information.
d. The co-administrators continued to seek access to the content of the emails and Yahoo! repeatedly denied such access. The co-administrators filed this action and the probate court judge dismissed the action after Yahoo! argued that the forum selection clause in the TOS requires the action to be brought in California. The co-administrators appealed.42
4. In 2005 after twenty-two-year-old Loren Williams was killed in a
motorcycle accident, his mother, Karen, hoped to learn more about her son after his death. She found her son’s password and then emailed Facebook
39 No. 2005-296. 651-DE (Mich. Prob. Ct. 2005). Yahoo! ultimately provided a C.D. with photographs and emails—
but only the emails the deceased received because he set up the account not to save sent messages.
40 987 N.E.2d 604 (Mass. App. Ct. 2013). 41 Ajemian, 987 N.E.2d 604, 609. 42 Id.
11
requesting that administrators maintain the account in order for her to review his posts and comments by his friends. Within two hours of Karen’s request, Facebook administrators had changed her son‘s
passwords, essentially locking her out of his account. Karen subsequently filed a lawsuit against Facebook, and, after a two-year legal battle,
Facebook granted her ten months of access to Loren‘s account. After this ten-month period, Loren’s Facebook profile was removed.43
III. Accessing Digital Assets
A. State laws – only 9 states have enacted laws relating to access to digital assets 1. Connecticut enacted the first statute in this country in 200544 to respond to
situations similar to that of the Ellsworth family whose son was killed by a bomb in Fallujah and was unable to obtain the contents of his email
account from Yahoo!.
2. Rhode Island enacted a statute in 2007 similar to the Connecticut statute which also only deals with fiduciary access to a deceased person's email account. The statute require a court order that includes the
indemnification of the service provider. 45
3. Indiana enacted a statute that attempts to deal with additional types of digital assets.46 The Indiana statute provides that a custodian47 "shall provide to the personal representative of the estate of a deceased person, who was domiciled in Indiana at the time of the person’s death, access to or copies of any documents or information of the deceased person stored electronically by the custodian . . . ."48
4. Oklahoma’s statute provides:
The executor or administrator of an estate shall have the power, where otherwise authorized, to take control of, conduct, continue, or terminate any accounts of a deceased person on any social networking website, any microblogging or short message service website or any e-mail service
43Karen Williams’ Facebook Saga Raises Question of Whether Users’ Profiles Are Part of ‘Digital Estates’, HUFF POST TECH
(Mar. 15, 2012, 5:57 PM), http://commcns.org/1022lHS.
44 See CONN.GEN.STAT. § 45a-334a (2013). 45 See R.I.GEN.LAWS § 33-27-3 (2012).
46 See BURNS IND.CODE ANN. § 29-1-13-1.1 (2012).
47 BURNS IND.CODE ANN. § 29-1-13-1.1(a) (2012) defines custodian as "any person who electronically stores the
documents or information of another person."
12
websites.49
5. Idaho's statute uses virtually identical language, but the language is applicable for both personal representatives50 and conservators of person with a disability.51
6. Nevada statute only allows the personal representative of the decedent to “direct the termination of any account of the decedent…”52 which includes social networking accounts, email accounts, short message services, web log services and microblog services. The statute specifically excludes accounts association with financial institutions.53
7. The Virginia statute was crafted to specifically address the inability of the Rash family, whose 15-year old committed suicide, to gain access to their son's Facebook account.54
a. The statute, however, only addresses the access of digital accounts that were controlled by a minor.55
b. The personal representative of a minor is allowed to assume the minor’s position with respect to each service provider agreement executed by the minor for each of the minor’s online accounts.56 c. The statute specifically excludes accounts association with
financial institutions.57
d. Virginia recently passed the Privacy Expectation Afterlife and Choices Act (discussed below) although it has not been signed into law.
8. Delaware’s law became effective January 1, 2015.58
a. To date, this is the broadest state law dealing with digital assets to be enacted.
b. The law is loosely modeled after the UFADAA (discussed below)
49 OKL.ST. § 58-269 (2012).
50 See IDAHO CODE § 15-3-715(28) (2012). 51 See IDAHO CODE § 15-5-424(z) (2012). 52 NEV.REV.STAT. § 143.188(1) (2013). 53 NEV.REV.STAT. § 143.188(2) (2013). 54 See Note 2 supra.
55 See VA.CODE ANN. §§ 64.2-109 and 110 (2013). 56 VA.CODE ANN. §§ 64.2-110.A (2013).
57 VA.CODE ANN. §§ 64.2-109 (2013). 58 See 12 DEL.C. §§ 5001 through 5007.
13
and addresses access to digital assets by a personal representative, guardian, trustee and agent acting under a power of attorney.59 c. The statute is a default statute that allows fiduciary access to
digital assets unless otherwise prohibited in the governing instrument.
d. Yahoo! Response to Delaware law – in a recent article, Yahoo! criticized Delaware’s new legislation. Yahoo! stated that the main issue with Delaware’s law is the presumption that the deceased would want his or her digital assets to be accessed by the fiduciary. Facebook agreed with Yahoo!’s response.60
9. Louisiana recently passed a law dealing with digital assets.61
a. “. . . succession representative shall have the power and authority to take control of, handle, conduct, continue, distribute, or
terminate any digital account of the decedent.”
b. Succession representative is considered an authorized user.
10. Several states have recently introduced digital asset legislation but to date no proposed bills have been signed into law.62
B. A Uniform Law
1. In October 2014, the Uniform Law Commission finalized and issue the Uniform Fiduciary Access to Digital Assets Act63 – very broad and contemplates access to digital assets and accounts by executor, guardian, attorney-in-fact and trustee.
2. The definitions of content and catalogue are adapted from SCA. The definitions are designed to cover log-type information and the content subject to coverage of the SCA.
“Catalogue of electronic communications” means information that identifies each person with which an account holder has had an electronic communication, the time and date of the communication, and the electronic address of the person.
59 See id.
60 Zach Miners, Yahoo slams new ‘digital will’ law, says users have privacy when they die, PCWORLD, September
15, 2014, available at http://www.pcworld.com/article/2683472/yahoo-slams-new-digital-will-law-says-users-have-privacy-when-they-die.html.
61 LA.CODE CIV.PROC.ANN. ART. 3191 (2015).
62 California, Colorado, Florida, Minnesota, New Hampshire and New Jersey have introduced digital asset
legislation.
14
“Content of electronic communications” means information concerning the substance, or meaning of the communication which: (A) had been sent or received by the account holder; (B) is in electronic storage by a custodian providing an electronic-communication service to the public or is carried or maintained by a custodian providing a remote-computing service to the public; and (C) is not readily accessible to the public.
“Digital asset” means a record that is electronic. The term does not include an underlying asset or liability unless the asset or liability is itself a record that is electronic
3. UFADAA clarifies the difference between a fiduciary’s authority over digital assets other than the content of an electronic communication and authority over SCA-protected content of an electronic communication. 4. UFADAA provides a default rule to provide access to executors and
trustees. For guardians/custodians, the power must be specifically authorized in the governing instrument.
5. The October 2014 version of UFADAA was approved by the ULC and in 2015, over 20 states introduced it as proposed legislation.
6. The American Bar Association formally approved UFADAA for enactment by the states.64
7. The National Academy of Elder Law Attorneys has formally endorsed UFADAA.65
8. Not a single state has successfully enacted the October 2014 UFADAA and in many states the legislation was handily defeated.
C. Potential issues with statutory access to digital assets 1. Federal Preemption
a. The enactment of state laws in the area of digital assets raises the issue of preemption. Federal law may impliedly preempt state law where there is a conflict between state law and federal law. b. This type of preemption can occur either
64 ABA Approves Three Uniform Acts at its Recent Midyear Meeting, Feb. 13, 2015, available at
http://www.uniformlaws.org/NewsDetail.aspx?title=ABA%20Approves%20Three%20Uniform%20Acts%20at%20i ts%20Recent%20Midyear%20Meeting.
65 See letter from NAELA to Uniform Law Commissioner Suzy Walsh, available at
15
1) when it is impossible for someone to comply with state and federal laws simultaneously, or
2) when the purposes and objectives of federal law would be thwarted by state law.66
c. Consequently, a challenge to any state law providing access to digital assets on the ground that such law conflicts with federal privacy laws may be eminent.
2. Permissive nature of the SCA
a. The SCA does not require the service provider to disclose the electronic catalogue or content even if the proper authorization is obtained.67
b. At least one court has pointed out the SCA’s permissive language and held that even if the family members were deemed agents of the deceased, the service provider does not have to comply with the request for disclosure.68
3. Choice of law and forum selection clause in TOS
a. Shutterfly, Twitter, LinkedIn, Yahoo!, Facebook and Google are each governed by the laws of the State of California and subject to jurisdiction in California.
b. Hotmail is governed by the State of Washington and subject to jurisdiction in Washington.
c. Even where the deceased resides in a state with a statute governing the disposition of and access to the deceased's digital assets, the TOS may override the state law where the deceased resides. d. The forum selection clause will likely determine in what court any
action may be brought, which effectively may act as a barrier for family members of the deceased user.
66 U.S. Const. Art. VI, cl. 2.
67 See 18 U.S.C. § 2702(c)(6) (which sets forth an exception to the general rule for disclosure of customer records by
providing that a service provider “MAY divulge a record or other information pertaining to a subscriber to or customer of such service . . .” (emphasis added).
68 See In re Facebook, Inc., U.S. Dist. LEXIS 134977 (N.D. Cal. Sept. 20, 2012) where the court stated that “under
the plain language of Section 2702, while consent may permit production by a provider, it may not require such a production”.
16
e. Click wrap versus Browse wrap
1) Whether the TOS is enforceable as a contract of adhesion is still unsettled.
2) The courts have drawn a distinction in the manner in which an individual agrees to the terms of the TOS and
determined enforceability of the provisions of the TOS in accordance with that distinction.
3) A “click wrap” agreement is one in which an individual agrees to the TOS of the service provider by affirmatively clicking on the “I
Agree” button prior to clicking on the button to create the account 4) A “browse wrap” agreement is one in which the sign up
page simply includes a statement that the user agrees to the terms of the agreement by creating an account and using the service.
5) The Ajemian69 case discussed above involved browse wrap and click wrap agreements.
a) At issue was whether forum selection clause in a TOS agreed to by decedent is enforceable against executors of estate.
b) The court stated that Yahoo! had the burden of demonstrating that the forum selection clause in the TOS was “reasonably communicated and accepted.” c) The court further stated that a forum selection
clause has almost always been enforced in a “click-wrap” agreement, but that such a clause in a “browse-wrap” agreement has not.
d) The court distinguished between a TOS in which the terms were displayed on the screen for the user to see and a TOS in which the user had to follow a link to view the terms.
e) In the latter case, the court stated that the reasonable communication of the terms would depend upon the location of the link, the conspicuousness of the link
17
and the user’s ability to manifest acceptance of the terms.
4. Technology Industry response to UFADAA
a. The technology industry and privacy advocates have lobbied state legislatures tirelessly to block any enactment of the October 2014 UFADAA. Two alternative approaches to access to digital assets have been developed.
b. Model Fiduciary Access to Digital Assets70
1) Requires a court order prior to the access of digital assets by the executor.
2) Allows access to the content of the account holder’s account.
3) Requires the estate to indemnify the service provider who discloses the contents of the account holder’s digital assets. c. Privacy Expectations Afterlife and Choices Act71
1) Requires a court order prior to access of digital assets by the executor.
2) Does not allow disclosure of the contents of the account holder’s account only disclosure of the record and other information about the account holder’s account and requires the court to determine whether such disclosure violates federal law.
3) Limits the disclosure of the account holder’s record to a period of one year prior to the account holder’s death. 4) Allows the provider to quash the order if it can establish
that the request poses an undue burden on the provider. 5) Provides immunity to the provider for compliance with the
court order.
70 Drafted by the American Legislative Exchange Council available at
http://www.alec.org/model-legislation/model-fiduciary-access-to-digital-assets-act/.
18
d. In the wake of industry and privacy advocate pressure, the Uniform Law Commission revised UFADAA and reissued the revised version in July 2015.72 See Exhibit A comparison chart of original UFADAA, PEAC and revised UFADAA.
1) No longer provides the fiduciary with default access to the electronic content. The account holder must specifically provide access in the governing instrument.
2) Any online designation made by testator supersedes any contrary instruction in the will.
3) Service provider has the right to request a court order that states disclosure of the electronic content by the service provider does not violate federal law and that the disclosure is required by the fiduciary to carry out his or her duties as fiduciary.
IV. Planning for Digital Assets
A. Step One – Identify what the client owns
1. Digital Estate Resource is a website that provides information to attorneys about digital assets. The website contains a definition of the physical devices that store digital data and has introduced a separate definition for digital accounts.73
2. The definition of digital assets has evolved over the last 2 to 3 years and now no longer includes physical devices which are really tangible personal property and can be transferred at death along with all other tangible personal property.
3. Digital assets, therefore, can be found in many different forms and include items such as music, videos, medical records, tax documents, financial records, photographs stored on websites such as Shutterfly or Flickr, or generic file storage sites in the Cloud such as Dropbox.
72 Available at http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20Assets/
UFADAA_Clean_Revised_2015AM.pdf.
73 Evan Carroll, Digital Assets: A Clearer Definition, DIGITAL ESTATE RES. (Jan. 30, 2012) available at
http://www.digitalestateresource.com/2012/01/digital-assets-a-clearer-definition/ (defining physical devices to include desktop computers, laptops, tablets, storage devices, mobile telephones, and smartphones and defining digital accounts to include email accounts, software licenses, social network accounts, file sharing accounts, financial management accounts, etc.).
19
4. Digital accounts include social media websites, such as Facebook, Twitter, LinkedIn, Pinterest, Tumblr or Instagram74 and other secured access sites such as email accounts with Yahoo!, Gmail or Hotmail75, on-line banking accounts, PayPal accounts, eBay accounts and Amazon accounts, just to name a few.
5. The definition has evolved so that the electronic account is separate from the electronic content in that account. This distinction is particularly important when considering the implication of Federal privacy laws. 6. Digital Assets with sentimental value
a. Social media accounts such as Facebook, MySpace, Twitter and Instagram
b. Websites that warehouse personal photographs, such as Shutterfly and Flickr
c. Electronic email accounts such as Gmail, Hotmail, Yahoo! Mail 7. Digital Assets with monetary value
a. Facebook contains a feature entitled “Facebook Credits” whereby individuals acquire credits by using the site or purchasing the credits with a credit card, debit account or PayPal account.76 These accounts may have stored credits upon the death of the owner that are valuable.
b. A client may have created a blog that is popular or becomes popular and generates advertising dollars.
c. The content on the blogs, which are likely “original works of authorship fixed in a tangible medium of expression”,77 may also invoke copyright law.
d. Click-through fees - Investment News recently published an article that focused on a retired commercial pilot who developed a loyal following to the tune of 1 million followers on his Pinterest
74 Sample websites taken from "Top 15 Most Popular Social Networking Sites," updated October 2014, available at
http://www.ebizmba.com (website last checked October 12, 2014).
75 It should be noted that these email account providers are free services. Many people pay a fee for their email
service to companies such as Time Warner Cable, Optimum Online and AT&T. For these types of services, the email accounts will remain active as long as the fee is paid.
76 Chelsea Ray, ‘Til Death Do Us Part: A Proposal for Handling Digital Assets After Death,” 47REAL PROP.,TRUST AND ESTATE L.J. Winter 2013 at p. 593.
20
account which features photographs of various types of flowers and blossoms from his garden.78
e. Domain names
1) A client may own the rights to a domain name that is valuable or will be valuable in the future.
2) Recent sales of domain names79: a) MI.com sold for $3.6 million. b) Whisky.com sold for $3.1 million. c) Teamwork.com sold for $675 thousand.
3) How do you know if your client’s domain name is valuable? a) Just because a client has a registered domain name, does
not mean he or she owns it. The client could simply have the right to use the domain name for a period of years (typically 10 years). Check with a domain name registry such as GoDaddy.com to find out more.
b) Other factors80:
i. “.com” is still the preferred extension and is more valuable.
ii. Shorter is better.
iii. Hyphens are less valuable. iv. Misspellings cut the value.
v. Fewer words are better. vi.
78 Darla Mercado, The Latest Wrinkle in Estate Planning: Digital Assets, Investment News, July 20, 2014, available
at http://www.investmentnews.com/article/20140720/REG/307209998/the-latest-wrinkle-in-estate-planning-digital-assets. (the pilot has accumulated about 1.6 million followers on Pinterest and receives as much as $10,000 a month for driving traffic to other sites through his posts).
79 See DN Journal available at http://www.dnjournal.com/ytd-sales-charts.htm.
80 See Determining the Value of Domain Names available at
21
f. Participation in frequent flyer and frequent stay programs allows the individual to redeem miles or points in exchange for free flights and/or hotel rooms.
1) Many of these programs allow the program participant to redeem points and assign another person’s name to appear on the airline ticket, effectively transferring the earned miles or points.81
2) Be wary that not all airlines treat the transfer of frequent flier miles on death equally. Some airlines will allow transfer if you call them directly and you may have to pay a fee. Other airlines will not allow for a transfer upon death.
g. Virtual property exists within virtual worlds, such as gaming sites in which the user creates virtual identities and personas. 82 1) Virtual items may have real monetary value and virtual items
have sold for prices ranging from $16,000 (a virtual sword) to $6 million (for a planet for the Entropia Universe).83
2) Second Life allows used to buy, sell and trade with other residents using “Linden Dollars.”
3) Users can create avatars and other digital persona. The existence of these digital assets has impacted other areas of law, including criminal law.84
4) This virtual property involves property rights, but it is still somewhat up for debate to what extent property rights apply.
81 See e.g., American Airlines AAdvantange Program Terms and Conditions available at
http://www.aa.com/i18n/AAdvantage/programInformation/termsConditions.jsp.
82 See Bobby Glushko, Tales of the (Virtual) City: Governing Property Disputes in Virtual Worlds, 22 BERKELEY
TECH.L.J. 507, 511. (2011).
83 See www.bornrich.com (April 23, 2011).
84 Olivia Y. Truong, Virtual Inheritance: Assigning More Virtual Property Rights, 2009 SYRACUSE SCI.&TECH.L.
REP.57, 59 (Fall 2009) (in August 2008, a U.S. woman was charged with plotting the real-life abduction of a boyfriend she met on a virtual game world; another online episode prompted police to arrest a teenager for swindling virtual currency worth $ 360,000 in an interactive role playing game by manipulating another player's portfolio using a stolen ID and password).
22
h. Bitcoins85
1) Currency created in 2009. Holders of bitcoins can use them to pay for transactions with no intermediary and little or no fees involved.
2) The value of Bitcoins fluctuates wildly and in the last six months have been valued anywhere from $250 to $600 each. 3) Bitcoins can be stored in a digital wallet but it is not necessary.
An individual can hold the cryptographical password that validates ownership in a text file or some other location and use it when he or she wants to use the bitcoins.
4) If the bitcoins are held in a digital wallet, they are more susceptible to hacking and/or accidental deletion. If the bitcoins are stolen or lost, there is no recourse.
5) Some online retailers are accepting bitcoins for purchases such as WordPress and Overstock.com.
i. Digital Music and Books
1) iTunes provides access to music, books, movies and apps. The Service Provider Agreement varies depending upon which product has been accessed and downloaded.86
a) The user must first establish an Apple account to access the iTunes Store. The Apple account Terms and
Conditions make it clear that access to the Apple software is a license that may not be transferred. It also indicates that if the account holder provides express permission then another person may access the account holder’s account.87 b) The iTunes agreement seems to imply that music files are
purchased and movies, books and apps are licensed. However, downloaded music files may be used on multiple devices as defined in the agreement which does not coincide with outright ownership of music.88
85 Russell Goldman, What are Bitcoins? Virtual Currency Explained (Like You’re an Idiot), abcnews.com, Nov. 18,
2013, available at http://abcnews.go.com/Technology/bitcoins-virtual-currency-explained-idiot/story?id=20926230.
86 See http://www.apple.com/legal/internet-services/terms/site.html.
87 See http://www.apple.com/legal/internet-services/itunes/us/terms.html#SALE. 88 See id.
23
c) These restrictions on copying music may be consistent with current copyright laws, such as the “first sale” doctrine.89
2) Amazon books for the Kindle
a) Amazon’s agreement is clear that the user’s account is only a license to use Amazon’s services and requires the user to maintain the confidentiality of his or her password.90 b) The Kindle Store Terms of Use agreement is clear that the
Kindle Content downloaded is licensed and not sold to the user.91
3) Simply having access to the tangible personal property on which the content is stored, e.g., the Nook, iPad, iPhone, iPod, etc. and having the password may eliminate some of the licensing restrictions, but it is likely that this circumvents the law.
4) Having a digital back up of the music and book files on a flash drive or a backup device may allow access to the music and book files so long as the file types are compatible with the device being used to access them.
B. Step Two – Consider the various objectives for digital asset planning 1. Ease the burden on the surviving family members and the
executor/administrator of dealing with digital assets
a. Without a complete and accurate list of accounts and the information necessary to access them, the survivors have a daunting amount of work ahead of them
b. Particularly when a death is unexpected, the survivors want
immediate access to any memories, e.g., emails, photographs, blog posts, etc.
2. Prevent identity theft
a. Over the course of a year, the IRS paid out $12.1 million in refunds to over 5,000 dead people. The Social Security Death Index which
89 See 17 U.S.C. § 109(a) (2012) which grants the owner of a copy to dispose of that copy; see also CleanFlicks of Colo. LLC v. Soderbergh, 433 F.Supp.2d 1236, 1242 (D. Colo. 2006) (“[The first sale] doctrine protects the
purchaser in any use of the authorized copy acquired but does not permit the making of additional copies.”).
90 See http://www.amazon.com/gp/help/customer/display.html/.
24
lists all deaths reported to the SSA is publicly available on the Internet.92
b. Facebook will create a memorial page to a deceased Facebook account holder so would-be identity thieves have ample access to the deceased’s personal information.
c. Thieves find critical pieces of information from obituaries. d. Accounts that are not regularly monitored for spam, phishing and
other cyber-attacks make the identity of the owner of that account vulnerable to attack.
e. It can take six months for financial institutions, credit-reporting bureaus and the Social Security Administration to receive, share or register death records. That gives hackers and identity thieves plenty of time to open bank accounts, credit card accounts, get jobs and a host of other things before anyone will detect them.93 3. Prevent unwanted secrets from being discovered or revealed: Post-mortem
privacy
a. It is not universal that a decedent will want his or her family members to have access to every electronic email account or blog or other type of digital asset.
b. Generally, the law provides that any action for defamation, invasion of privacy or breach of confidence dies with the person. So, any access to unwanted secrets may not be protected if they end up in the wrong hands.94
c. Clients who have celebrity status or are a public figure may be particularly concerned with the exploitation of his or her image, name and other digital information after death.
d. Some states have begun to recognize a post-mortem right of publicity. Therefore, an estate plan is needed to administer such rights.
92 Janet Novak, IRS Pays Refunds to 5,000 Dead People in Post-Mortem Identity Theft Scam, FORBES.COM, May 6,
2011, available at http://www.forbes.com/sites/janetnovack/2011/05/06/irs-pays-refunds-to-5000-dead-people-inpost-mortem-identity-theft-scam/.
93 Sid Kirchheimer, Protecting the Dead from Identity Theft, AARPBULLETIN, March 6, 2013, available at
http://www.aarp.org/money/scams-fraud/info-03-2013/protecting-the-dead-from-identity-theft.html.
94 Lilian Edwards and Edina Harbinja, Protecting Post-Mortem Privacy: Reconsidering the Privacy Interests of the Deceased in a Digital World, 32 CARDOZO ARTS &ENT.LJ 83, 102 (2013).
25
1) Florida recognizes the right of publicity for 40 years after death.95
2) Illinois recognizes the right of publicity for 50 years after death.96
3) California recognizes the right of publicity for 70 years after death.97
4) Indiana recognizes the right of publicity for 100 years after death.98
5) Nevada, Illinois and Washington recognize the right of publicity for non-celebrities but the term of protection is limited to 10 years in most cases.99
e. Some states have begun to reject the concept that libel claims die with the victim.100
1) U.S. Supreme Court recognized that a person’s interest in protecting his reputation does not end upon death.101 2) Rhode Island is the only state that provides a cause of
action for defamation of the deceased and only in limited circumstances.102
4. Preserve the deceased’s life story
a. The soldier in Fallujah intended to keep a journal of his experiences in Iraq.
b. Photographs, emails, Tweets and other types of message are the electronic equivalent of photo albums and boxes full of letters.
95 John E. Ottaviani and Allison A. Reuter, Maybe You Can Take it With You: Post-Mortem Rights of Publicity in the United States, WORLD TRADEMARK REV., 118-19 (Oct./Nov. 2012).
96 Id. 97 Id. 98 Id.
99 See NEV.REV.STAT.ANN. § 597.790 (2011); 765 ILL COMP.STAT.ANN. § 1075/10 (1999); WASH.REV.CODE
ANN. §§ 63.60.020, 63.06.040 (2103).
100 See generally Raymond Iryami, Give the Dead Their Day in Court: Implying a Private Cause of Action for Defamation of the Dead from Criminal Libel Statutes, 9 FORDHAM INTELL.PROP.MEDIA &ENT.L.J. 1083, 1088 n.33 (1999).
101 See Swidler & Berlin v. United States, 524 U.S. 399 (1988).
102 See R.I.GEN.LAWS § 10-7.1-1 (1974) (the ability to bring a cause of action is limited to a slanderous or libelous
statement made within 3 months of the decedent’s death that would have entitled the deceased to maintain an action in slander or libel if he or she had not died).
26
c. Digital assets can have an indefinite lifespan so it is crucial to protect the deceased’s digital legacy.
5. Prevent losses to the estate103
a. Many clients are the owners of small- to medium-sized businesses. There are many reasons for these clients to protect their digital assets in addition to protecting the business and the tangible assets they plan to pass to their heirs.
b. A business’s value is not just linked to physical assets, but can also incorporate digital assets, such as mailing addresses, online stores, photographs, bank accounts, payroll systems, timekeeping systems, computer software, business plans, videos, etc.104
c. Power of attorney documents are generally not respected by a financial institution with respect to online bank accounts. This could result in financial losses to the business and damage to creditor relationship because of the inability to pay debts. d. If a business loses digital information, it can be expensive to
retrieve it. The loss can also lead to a loss of goodwill with customers.
e. Electronic documents with trade secrets can be lost as well as other inside information.
C. Step Three – Digital Asset Inventory
1. Discussing with the client the most appropriate method for maintaining an up-to-date inventory of accounts, passwords and login information is critical.
2. Ask the client to prepare a comprehensive inventory.
a. A sample checklist, “Digital Audit,” is set forth at Exhibit B. It is designed to provide a list of passwords and account information for a comprehensive list of digital assets. The template is
downloadable from:
http://www.digitalpassing.com/digitalaudit.pdf
103 Steve Parrish, Beyond Identity Theft: Why You Need To Protect Your Digital Assets, FORBES.COM, February 10,
2014, available at http://www.forbes.com/sites/steveparrish/.
27
b. The inventory should also ask clients to list the answers to security questions used when clients forget passwords.
3. In addition to a written inventory the client should consider creating an electronic list (in a Word or Excel document) which can be accessed with one master password. The physical list should be kept in a secure location such as a safe deposit box.
4. Password services
a. Online tools that are designed to protect and manage passwords. Free and commercial software is available for this purpose and can be kept on the client’s smartphone, computer or on a web-based service. Some services offer encryption software.105
b. Encrypted services: 1) LastPass106 2) 1Password107 3) Dashlane108 4) KeePass109 5) Roboform110
c. Web-based unencrypted services: 1) PasswordBox111
2) SecureSafe Pro112 3) E-Z Safe113
d. Family members and/or executor must have access to master password for the encrypted service to access the list of password data.
105 The author does not endorse or sponsor any of the products listed. 106 See https://lastpass.com/how-it-works/. 107 See https://agilebits.com/onepassword. 108 See https://www.dashlane.com/. 109 See http://www.keepass.info/. 110 See http://www.roboform.com/. 111 See https://www.passwordbox.com/. 112 See http://www.securesafepro.com/.. 113 See http://www.e-z-safe.com/.
28
5. Hybrid methods
a. Keep an encrypted electronic list of your passwords, online accounts, and digital property plus keeping a separate written instruction sheet describing how to find and access your encrypted electronic list, including the master password. Keep the separate written instruction sheet in a secure location, like a safe deposit box or a home safe.
b. Use a Web-based service to both keep your encrypted electronic list and provide a mechanism for designated fiduciaries or family members to access the unencrypted list.
D. Step Four - Secure digital assets
1. Clients should regularly backup any electronically stored data. Especially data that is stored by a service provider.
2. Fiduciaries should only deal with service providers for the purpose of closing or memorializing accounts, while accessing locally stored data and backups for collecting, managing, and distributing digital property. 3. Avoiding the need to access information that is stored remotely by service
providers, fiduciaries also avoid the potential problems of federal and state data privacy laws and computer crime laws related to accessing remotely stored information.114
E. Step Five – Include special provisions in the will (see Exhibit C for sample language).
1. Appoint a digital executor where possible
a. Federal government suggests creating a social media will that appoints an online executor; many jurisdictions may not recognize a separate executor to administer digital assets115
b. Executor may need to determine whether some material should be deleted and not distributed to preserve decedent’s privacy; i.e., medical records, adult recreational material.
114 James D. Lamm, Christina L. Kunz, Damien A. Riehl & Peter John Rademacher, The Digital Death Conundrum: How Federal and State Laws Prevent Fiduciaries from Managing Digital Property,U.MIAMI L.REV, Vol 68:385, 416 (February 2014).
29
c. Executor chosen should have skills necessary to deal with digital assets or at a minimum will should provide that executor may engage technology specialist.
2. Executor’s powers and duties clause should grant executor authority to: a. create an inventory;
b. change passwords;
c. back up data on external media;
d. consolidate, distribute or destroy content; e. value the assets for tax purposes;
f. delete secret accounts; and g. clean up devices.
3. Provide for the distribution of tangible digital property and digital assets a. Include provisions for abandoning or eliminating digital assets that
are worthless.
b. Include provisions to ensure that metadata is deleted along with specific digital assets that the client wants deleted upon death. 4. Include a definition of digital assets that is consistent with federal privacy
laws.
5. Include language that expressly authorizes service providers to disclose private information to the Executor. The authorization should clearly state the client’s intention to satisfy the CFAA, SCA and any state privacy laws. This will provide the service provider with evidence of the client’s “lawful consent” and “authorized access.”
6. Do not include detailed lists of accounts and passwords. F. Planning during life (see Exhibit C for sample language)
1. Currently, only Delaware, Nevada and Idaho have legislation concerning the administration of digital assets during life but only in the context of a court-appointed guardian. No state has enacted legislation for the
30
2. NY Power of Attorney form does not provide the agent access to digital assets. Language may be added to the Modifications section to expressly provide this authority.
3. Must expressly authorize the attorney-in-fact to access the account. 4. Transfer digital assets to a trust
a. Digital Access Protection trust (“DAP trust”) – increasingly becoming a popular tool for digital asset planning.
b. Trustee and all successor trustees should be expressly authorized to have access to the content of the beneficiary’s account.
c. Before setting up a DAP, consider whether the service provider will allow a trust to be the account holder and whether the account can be transferred to a trust.
d. Similar language should be included in the trust instrument regarding definitions, powers of the trustee, etc.
G. Utilize succession planning tools provided by service provider
1. Google became the first service provider to implement a solution
regarding access to a user’s account upon his or her death or incapacity.116 a. The company introduced a feature called the “Inactive Account
Manager,” which can be accessed through the user’s profile page. b. The Inactive Account Manager will become “activated” after the
user’s account is inactive for a period of three, six, nine or twelve months, as determined by the user.117
c. The user can also determine what will happen to his or her data in advance of the account becoming inactive. For instance, the user may elect that the data be deleted or some or all of it may be sent to a specified individual.118
116 A user’s Google account provides access to all of Google’s products including Gmail, YouTube and Picasa. 54 See https://www.google.com/settings/account/inactive?hl=en; see also
http://support.twitter.com/articles/15362inactive-account-policy#. Twitter also has a very simple inactive account policy for user who do not access their account for 6 months in which they will terminate and delete the account information.
117 See Id.; the term “inactive” is not defined, but one can assume that if the account is not access, it will be deemed
inactive.
31
d. Google will notify the user by text or email as the period of inactivity approaches.119
e. Google’s Account Manager is not part of the TOS.
f. In August 2015, Google added a new page in the Support section where the death certificate, letters testamentary, etc. may be uploaded to facilitate review of a request to access the account.120 2. In early 2015, Facebook began to allow account holders to appoint a
“legacy contact.”121
a. A legacy contact is someone the account holder can choose to manage his or her account after death. The legacy contact will be able to pin a post on the account holder’s Timeline, respond to new friend requests and update the account holder’s profile picture. The legacy contact will not have the ability to post message as the account holder or see the account holder’s messages.
b. The account holder can also request to have his or her account deleted permanently after the account holder’s death.
c. The account holder can designate a legacy contact by going to Settings, then clicking on Security.
H. Digital Estate Planning Services
1. Online digital estate planning can be a helpful way to manage digital assets. The fiduciary will only have to gain access to one online account to obtain all of the decedent’s digital asset information and wishes.122 2. The service allows users to identify and input all user names and
passwords and identify the individuals who will have access to the digital estate when the user dies.
3. Some services provide the ability to direct the elimination and deletion of an account and its contents.
4. Example Digital Estate Planning Services:
119 See Id.
120 See https://support.google.com/accounts/contact/deceased?hl=en.
121 See https://www.facebook.com/settings?tab=security§ion=memorialization&view (website last checked Apr.
28, 2015.
122 Jamie P. Hopkins, Afterlife in the Cloud: Managing a Digital Estate, 5 HASTINGS SCI.&TECH.L.J. 209 (Summer
32
a. SecureSafe 123 b. Asset Lock124
c. Planned Departure125
5. Criticisms of Digital Estate Planning Services
a. The area is still relatively new and the longevity of the company offering the service is a concern.
b. These services create a large repository of information which makes them a target for online hackers and thieves. They may also be susceptible to virus software.
c. Clients are often concerned about privacy when submitting all access information to a third party account. This may also violate the TOS for many types of accounts which could lead to the service provider closing the account and deleting content.
VII. What To Do When a Client Has Not Planned in Advance
A. Consider contacting the service providers to request a copy of the catalogue and/or the contents of the decedent’s or incapacitated person’s valuable or significant accounts.
1. Could avoid the potential problems of attempting to directly access the account itself, which could constitute “unauthorized access” within the scope of the CFAA or state criminal laws.
2. This request could also trigger the provisions of the TOS and the service provider may have the authority to delete the account and its contents. B. Determine whether there are any pending civil or criminal investigations
involving the decedent.126
1. Fiduciaries should not access or tamper with any digital property, so as to maintain complete and accurate copies of all data.
123 See http://www.securesafe.com/en/. 124 See http://www.assetlock.com/.
125 See https://www.planneddeparture.com/.
33
2. If accessing digital property is necessary, fiduciaries should consult with an attorney and a computer forensics expert to prevent altering or
inadvertently deleting any digital property.
C. Consider creating copies of all digital property before any other attempts to access the storage device or data, to the extent possible.
D. If you lack information regarding what accounts a decedent or incapacitated person had, the content within those accounts, and the necessary access information, hire a computer forensics experts to attempt to discover this information.127
1. Access the deceased’s computer without authority could be considered hacking which violates federal and state privacy laws.
E. Steps to protect digital assets128
1. Get multiple copies of the death certificate because most authorities will need one for their records.
2. Request the deceased’s credit reports from each of the three credit bureaus. 3. Request that the credit bureaus suppress the deceased’s credit file.
4. Send a copy of the death certificate to all of the deceased’s creditors. 5. Request a benefits statement for review from the Social Security
Administration
6. Cancel the deceased’s identification cards including: driver’s license,
AAA membership, and health insurance.
7. Securely store all documents that contain the Social Security Number of the deceased.
8. Avoid giving too many details about the deceased in public death announcements
127 See id.
128 Gerry W. Beyer, Identity Theft After Death, Wills Trusts and Estates Prof Blog, April 19, 2010, available at
