After learning that his father was dying of cancer, James Vlahos, a journalist and conversational artificial intelligence designer, designed a program called the Dadbot. Vlahos can now exchange text and audio messages with an avatar of his late father. Short of creating a virtual loved one, proper digital estate planning allows the best chance for someone to be remembered–or forgotten. Digital planning decisions have online and real-world consequences, and it is critical for attorneys to address digital assets professionally and personally.
The Need for Digital Planning
Most of us use phones, laptops or tablets to work, manage financial affairs, participate in social media, watch movies, or look at pictures of family, friends, and pets (not in that order). According to a study by Dashlane (a popular password manager), the average user has 150 online accounts that require a password. Dashlane estimates that the number will double by 2022. McAfee estimates that the average user has $35,000 or more worth of digital assets on his or her devices. Some are priceless to friends or family. Virtual real estate, social media handles, online game items and similar items carry real value. The right to be remembered—or forgotten—cannot be quantified, but is important to us all.
It’s Not That Easy
Many will point to the deceptively simple “digital planning” solution of giving someone a list of passwords. Unfortunately, it is not that easy.
First, by using a website, you have usually agreed to abide by the website’s terms of service. Most terms of service expressly prohibit the sharing of passwords.
Second, the Computer Fraud and Abuse Act, 18 USC 1030, criminalizes intentionally accessing a computer without authorization or exceeding authorized access. A violation of a site’s terms of service by sharing a password may also violate federal law.
Third, the Stored Communications Act, 18 U.S.C. §2701 et seq., penalizes intentional access without authorization to a facility through which an electronic communication service is provided, or intentionally exceeding an authorization to access this facility. Because the law also penalizes unauthorized disclosure of communications, providers do not have much incentive to disclose information. If an exception applies, such as lawful consent to disclosure, the service provider may disclose information, but is not required to do so.
The practical effect is that websites have denied requests for account access to surviving family members and friends. Federal law was not directed at estate administration, and most websites err on the side of limiting disclosure.
Revised Uniform Fiduciary Access to Digital Assets Act
In response, most states have enacted the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA). The act covers digital assets, such as information on a computer or other digital device, content uploaded onto websites, rights in digital property, email accounts, social media accounts, cloud storage, digital photos, apps, blogs, subscription accounts, and access to banks and financial institutions. RUFADAA applies to personal representatives, agents under a power of attorney, conservators, and trustees.
The law establishes a three-tier system to protect the wishes and privacy rights of the decedent (not to ease estate administration).
First, the website (custodian) can use an online tool that gives a user control of fiduciary access in the future. This tool is distinct from the terms of service and allows the user to provide or prevent disclosure of digital assets, including the content of communications. An online tool overrides a contrary direction by the user in a will or other estate planning document.
Second, if a custodian does not offer such a tool, or if the user did not use it, a user can grant or prohibit specific access via estate planning documents. If specific access is not granted, but there are no directions to the contrary, a personal representative can usually obtain a catalog of dates, times, recipients and possibly other information. This may give the personal representative the information needed to locate online assets and accounts.
Third, if the user does not use an online tool or specific direction as to digital assets, then the terms of service apply. If they don’t address the situation, then the act provides default rules.
After a custodian receives a valid request, in its sole discretion it may grant full access, partial access, or an electronic or paper copy of the information sought. The custodian may seek guidance if compliance would cause an undue burden.
So, if a fiduciary is seeking access to digital assets that are not controlled by an online tool, then the custodian is required to comply if given a written request for disclosure, a certified copy of a death certificate, a copy of the court authorization/appointment (letters testamentary), and a copy of the user’s consent to disclosure. Alternatively, the fiduciary can seek a court order directing compliance.
The custodian can require the personal representative to provide additional information or ask for a court order that, among other things, finds that disclosure of the communications does not violate the SCA, the decedent consented to the disclosure, or the disclosure of the information is reasonably necessary for the administration of the estate.
Although this area of the law is still growing, so far custodians are reluctant—absent a court order—to disclose information under general personal representative power provisions. In the absence of specific authorization, the content of digital assets is hard to obtain, although the personal representative may request a catalog of information. This may be enough.
Popular Sites
Here are how several popular companies handle user data.
Facebook. Facebook uses an online tool to either memorialize or delete a user’s account, depending on the user’s direction. A Facebook user can name a legacy contact to control certain aspects of a user account, (writing a pinned post or changing the profile picture) but not others (requesting or removing friends). The legacy contact, if authorized, can also download the deceased user’s data. No time limit on memorialized accounts is apparent from Facebook’s terms of service.
Google. A Google account holder can name a contact who, after a certain time period, will receive an email saying that the account is inactive and allowing access to Google account information including Google Drive, Gmail, YouTube, and more. Alternatively, a user can direct Google to delete the account after a certain period of inactivity.
Apple. Apple does not yet have an online tool, and its terms of service provide for no right of survivorship and state that accounts are not transferable. Generally, when you purchase music and videos through iTunes, you purchase a license to use the items, not the items themselves, unlike purchasing vinyl, a CD or a DVD. However, Apple has some plans that enable families to share accounts, which may provide some continuity of ownership. Also, anecdotally, Apple will sometimes work with families to provide access to a decedent’s account, particularly pursuant to a court order. It is wise periodically to back up your Apple devices to a hard drive. As to iPhones, Apple cannot open a locked phone.
Amazon. Amazon also sells you a license to use music and videos. Downloading and backing up the content increases the chances of being able to keep the content. If the account is canceled, access to everything in the account that has not been downloaded will be deleted. Amazon now has household plans, which is probably the easiest way to ensure continuity of access.
Yahoo. Yahoo will not provide passwords or allow access to accounts when an account holder dies, at least absent a court order, and even then your personal representative may not get all the content needed.
What to Do
In the future, it’s likely that more services will create online tools for the disposition of digital assets. For now, though, here are some practical steps to take:
- Create a list of important online accounts and assets.
- Periodically check your websites for an online tool
- Close inactive accounts.
- Discuss the access issue with your children.
- Backup regularly.
- Update estate planning documents to specifically grant or deny access to digital assets.
- Leave instructions for access to computers and other devices.
The Password Problem
When composer Leonard Bernstein died in 1990, he left a password-protected file containing his memoirs. He did not leave the password, and the file remains locked to this day. There is no elegant answer to the password issue. Some people give a list of passwords to a trusted friend or family member. Some password-protect a computer file listing the passwords. Some put a file on a USB stick. Some separate out the list of accounts and the list of passwords so that one is useless without the other. Some put a list in a safe or safety deposit box.
One possible solution is a password manager like LastPass, KeePass, or Dashlane. When used properly, a password manager will keep track of login credentials and other secure notes.
In the future, sites like Everplan and Joincake, which provide online depositories for documents and digital assets, may gain more recognition and widespread usage.
Shorter Of Breath, One Day Closer to Death
Pink Floyd sang, “And then one day you’ll find ten years have got behind you, no one told you when to run, you missed the starting gun.”
Neither you nor your clients have as much time as you think. The time to update your digital asset plan is now.
About the Author
Michael J. Polk is an attorney at Belser & Belser, P.A., in Columbia, SC. He focuses his practice on probate administration and litigation, estate planning and creditor’s rights matters. Contact him on Twitter @polkzilla.