This week, a German federal court ruled that Facebook must give the mother of a dead 15-year-old access to her entire account. They’re not just talking about access to a memorial page, either. The mother gets access to everything, including private messages. In Germany, the judges decided, heirs should be able to inherit a social media account in the same way that they might inherit a box of letters.
That seems like a bad idea, right?
From a privacy perspective, the answer to whether someone should be able to inherit your Facebook messages — or your Gmail inbox — seems like a screaming “NO!” That data is potentially deeply personal and without context, anyone who reads it could easily misinterpret what was happening in the life of the deceased.
The seemingly easy way to avoid confusion here would be for everyone to write a will. In the 21st century, a will should include instructions about what to do with digital files after a person’s death. Many companies simply don’t have processes set up for transferring data from deceased users over to their heirs.
The process of doing so is also a sensitive and time-consuming process. In other words, it would cost companies money.
Then again, there might be money at stake. Online messages and emails often contain financial information that could prove essential in handling the estate of someone who’s died. If a person’s heirs have a right to someone’s assets, they need to know what they are.
And are emails really all that different than a box full of letters? Everyone’s lives are largely dominated by digital correspondence, so it’s becoming increasingly obvious that we need to figure out exactly what happens to our data after we die. How we do that is the real tough question.
As long as computers have existed, the legal world has debated what should happen to a person’s data after they die. The concept of inheriting data has become more essential and more urgent in recent years as the age of social media and cryptocurrency has taken over.
Companies like Facebook, however, have historically been resistant to hand over users’ private data to relatives in cases where the user didn’t explicitly request that in a will.
“These questions — how to weigh the wishes of the relatives and protect the privacy of third parties — are some of the toughest we’ve confronted”, a Facebook spokesperson told Gizmodo in a statement about the recent court ruling in Germany. “We empathise with the family. At the same time, Facebook accounts are used for a personal exchange between individuals which we have a duty to protect”.
The statement goes on to say that Facebook “respectfully disagree[s]” with the ruling. Based on this sentiment, Facebook apparently doesn’t think it should hand over private user data without that user’s explicit consent. If you don’t want your parents to read your Facebook messages after you die unexpectedly, you might agree with this!
The German case is a little more complicated, though. The deceased was a 15-year-old girl who was hit by a train in Berlin back in 2012. The girl’s parents wanted to access her Facebook account so that they might figure out if their daughter had died by suicide or if it was an accident.
Given Germany’s recent history of strong privacy laws, it’s significant that the federal judges ruled that the parents should have access to their deceased daughter’s data. Some say it’s also a sign that German lawmakers need to create better policy around digital inheritance.
After all, the new ruling applies not only to Facebook but to all social networks in the country, which means that any heir has the right to inherit digital correspondence from a deceased person, including minors.
The United States does not yet have such a clear court ruling on digital inheritance. If you die tomorrow and don’t have a will, a court could decide not only who inherits your physical assets but also your data. Whether your heirs can gain access to private accounts depends on certain state laws, however and only a handful of states have passed laws that deal directly with digital inheritance.
That means that your relatives might have to ask tech companies for access to the data — those companies might say no, citing their terms of service or certain laws — or they could try to guess your passwords, which might lead them to break the law.
“It’s important for people to plan ahead, as they would with their physical goods and financial assets”, Nikolas Guggenberger, assistant professor of IT law at the University of Münster, told Gizmodo. “I think people have to start doing that with their digital assets and digital goods, so that those things go to the person they would want them to”.
Dark as it may seem, writing a will that includes instructions for handling your data after death is important. Some tech companies offer other solutions. Google lets users control their data after death with a tool called the Inactive Account Manager. This lets you assign contacts who will be notified after your account has remained inactive for a certain period of time.
You can give permission to share certain types of data, including Google Drive files and Gmail messages, with that person. You can also instruct Google to delete any data that you don’t want shared. All things considered, this seems like a pretty good option for Google users, especially if there’s valuable information like banking or cryptocurrency account information in Gmail or Google Drive.
Things aren’t so easy on Facebook. On Facebook, you can assign a legacy contact, who will gain some control over what happens to your profile when you die. They’ll be able to do certain things, like change your profile picture, respond to friend requests and approve new wall posts.
Your legacy contact can also delete your profile. (You can also tell Facebook to just delete everything when it’s notified of your death and skip the memorial page altogether.) Your legacy contact will not, in many cases, be able to access your messages.
The legal debate over heirs gaining access to private messages, specifically in terms of how the Stored Communications Act comes into play, is also far from over. Last year, the Massachusetts Supreme Judicial Court ruled that personal representatives of the deceased could grant consent to release private data in the absence of a will.
That case involved a young man named John Ajemian who died in a cycling accident and left behind a Yahoo! email account. His siblings requested access to his email account so that they could notify friends of his death and figure out what assets he left behind. Ajemian did not have a will and Yahoo! said that releasing the emails would violate the Stored Communications Act.
The Massachusetts court ultimately said that releasing the emails would not violate the federal law. After Yahoo! appealed, the United States Supreme Court declined to hear the case.
Whether the family will get the emails is now up to Yahoo! and how the company decides to enforce its terms of service. The ultimate outcome of the case bears implications for other tech companies, too. If Yahoo! sets a precedent by releasing the messages, it’s possible that Facebook might have to rethink its own policies.
“If you die tomorrow and you don’t have a will and say nothing, what we now know is that federal law does not prohibit Facebook from giving [your data] to the executor of your estate”, said Vivek Krishnamurthy from Harvard Law School’s Cyberlaw Clinic, which filed an amicus brief in the Yahoo! case. “That said, it’s still highly uncertain about whether your executor will get it”.
That’s because tech companies, for now, can ultimately decide what to do with the data. Without a more specific regulations on digital inheritance, Facebook and others can simply change their terms of service in order to determine what happens to users’ data after they’ve died.
These companies can build tools, like Google’s Inactive Account Manager, that gives users more control. But they might also decide that building tools and transferring all the data of dead people is too much of a hassle.
“In many ways, yes, we probably need legal development here”, Krishnamurthy added. “But there’s a lot tech companies can do to make this easier and better for ordinary people”.
You don’t have to wait around for tech companies to make things easier. The best thing for anyone to do is write up a will and just explain what you want to happen to your data. If you want it all deleted, just say that. Your heirs should honour your wishes. If you want all of your old Facebook messages downloaded and bound into a book, well, that’s a weird thing to do, but your heirs should do it.
The good news for privacy advocates is the fact that tech companies probably won’t give your parents a copy of your private messages if those instructions aren’t in your will. It’s still going to take an expensive and protracted court case to come close to forcing Facebook or Google or whomever into handing over that data.
If you live in Germany, however, things are different now.