COMING SOON TO A LEGISLATURE NEAR YOU: COMPREHENSIVE STATE LAW GOVERNING FIDUCIARY ACCESS TO DIGITAL ASSETS

Transcription

1 COMING SOON TO A LEGISLATURE NEAR YOU: COMPREHENSIVE STATE LAW GOVERNING FIDUCIARY ACCESS TO DIGITAL ASSETS Suzanne B. Walsh * I. INTRODUCTION: WHY DRAFT A UNIFORM LAW ON FIDUCIARY ACCESS TO DIGITAL ASSETS? II. CHALLENGES TO FIDUCIARY ACCESS TO DIGITAL ASSETS UNDER CURRENT LAWS A. Federal Privacy Laws B. Copyright, Commercial Privacy, and Data Protection Statutes C. TOSA Provisions that Inhibit Access D. TOSA Provisions that Prohibit Transfer or Inheritance E. As a Result of These Barriers, Fiduciaries Have Been Denied Access F. Self Help Options for Account Holders III. CURRENT FADA DRAFT AND APPROACH IV. CONCLUSION I. INTRODUCTION: WHY DRAFT A UNIFORM LAW ON FIDUCIARY ACCESS TO DIGITAL ASSETS? The vast majority of Americans use the Internet and many have online access to their financial accounts. 1 Domain names * Suzanne B. Walsh is a partner at Cummings & Lockwood LLC in West Hartford, Connecticut. She chairs the Uniform Law Commission s Fiduciary Access to Digital Assets Act drafting committee. Thanks to Naomi Cahn, the Act s Reporter, for so thoughtfully and brilliantly crafting our approach to this subject, and for her many suggestions for this piece. This essay was written for Charleston Law Review s Symposium on Social Media and the Law held in Charleston, South Carolina on January 31,

2 CHARLESTON LAW REVIEW [Volume 8 and other digital assets can have significant monetary value. 2 It s now often more convenient to bank online than to bank in a branch office. 3 To prevent identity theft, fiduciaries must monitor and protect perhaps simply by termination an incapacitated person s or decedent s online accounts. 4 Most agreements governing online accounts ignore death and incapacity altogether, or worse, they provide for automatic account termination if either occurs. 5 Only seven states have enacted legislation specifically granting some fiduciary access to digital assets. 6 This means agents, conservators, trustees, and even personal representatives are often hampered when administering modern estates, trusts, and accounts. The management and transfer of digital and traditional assets accessed by or held in online accounts requires compliance with internet-based service agreements. 7 Since fiduciaries are obligated to collect and preserve the assets of the estates they manage, any impediments to access are potentially damaging. 8 Digital assets can also have significant sentimental value. Grieving family members and friends frequently search for answers, comfort, and support in the social media accounts of their deceased relatives and friends. For example, teenager Eric Rash s parents, Ricky and Diane Rash, were the driving force behind Virginia legislation that grants parents postmortem 1. Maeve Duggan, What Happens to Your Digital Life After Death?, PEW RESEARCH CTR. (Dec. 2, 2013), 2. See McAfee Reveals Average Internet User Has More Than $37,000 in Underprotected Digital Assets, MCAFEE (Sept. 27, 2011), HJ2J. 3. Geoffrey Michael, The Pros and Cons of Internet Banks, INVESTOPEDIA (Apr. 14, 2011), 4. See Gerry W. Beyer & Naomi Cahn, When You Pass On, Don t Leave the Passwords Behind, 26 PROB. & PROP. 40, 40 41(Jan./Feb. 2012). 5. See generally Duggan, supra note Connecticut, Idaho, Indiana, Oklahoma, Rhode Island, and, in 2013, Nevada and Virginia, have granted some fiduciary access to digital assets. See Jim Lamm, August 2013 List of State Laws and Proposals Regarding Fiduciary Access to Digital Property During Incapacity or After Death, DIGITAL PASSING (Aug. 30, 2013), 7. See, e.g., Privacy Policy, GOOGLE, (last modified Dec. 20, 2013) (showing one example of a service agreement and access to information). 8. See UNIF. PROBATE CODE (amended 2010); Kendal Dobra, An Executor s Duty Toward Digital Assets, 59 PRAC. LAW 21, 22 (Oct. 2013). 430

3 2014] Fiduciary Access to Digital Assets access to a minor s Facebook account content. 9 Others find comfort in saving and replaying voic messages. 10 Although state probate laws and systems are not uniform, Internet service providers and digital account custodians operate in each and every state. 11 Given the challenges to fiduciary access under existing federal and state laws, the speedy enactment of a uniform state law that clearly delineates access rules for agents and fiduciaries, and the compliance rules for providers and custodians, is crucial. 12 All of the foregoing concerns led to the creation of the Uniform Law Commission Fiduciary Access to Digital Assets Act drafting committee, which has promulgated draft legislation to address these issues. 13 II. CHALLENGES TO FIDUCIARY ACCESS TO DIGITAL ASSETS UNDER CURRENT LAWS. Because most probate codes and statutes do not mention electronic or digital assets, they do not define them. Likewise, they do not specify the default rules that apply to grant or prevent fiduciary access to electronic communications or data. As such, there is no commonly accepted definition of digital assets. 14 Digital assets, however defined, are accessed by a tangible device, such as a computer, smartphone, tablet, or a server. 15 Digital assets are frequently governed by adhesion contracts known as Terms-of-Service Agreements (TOSAs), which are 9. Tracy Sears, Family, Lawmakers Push for Facebook Changes Following Son s Suicide, WTVR, (last updated Jan. 9, 2013, 6:52 AM). The result of the Rashes work was VA. CODE ANN (Supp. 2013). 10. Beth Teitell, Preserving Voic s Helps Modern Grieving Process, BOSTON GLOBE, (Nov. 20, 2013), See Michael D. Roy, Note, Beyond the Digital Asset Dilemma: Will Online Services Revolutionize Estate Planning?, 24 QUINNIPIAC PROB. L.J. 376, 379 (2011). 12. See Gerry W. Beyer, Estate Planning in the Digital Age 19 (Apr. 21, 2013), available at See infra Part III; see also FIDUCIARY ACCESS TO DIGITAL ASSETS ACT (Discussion Draft 2013), available at [hereinafter FADA]. 14. Id. at Jamie P. Hopkins, Afterlife in the Cloud: Managing a Digital Estate, 5 HASTINGS SCI. & TECH. L.J. 209, 212 (2013). 431

4 CHARLESTON LAW REVIEW [Volume 8 agreements controlling the relationship between the account holder and the custodian. 16 As we know, very few people read TOSAs users have unknowingly agreed to sell their souls to the devil in exchange for opening an account. 17 TOSAs include terms of use and license agreements, as well as privacy policies. 18 Fiduciaries might unknowingly violate laws or contractual agreements when trying to access digital assets. The Federal Computer Fraud and Abuse Act and its state counterparts (CFAAs) criminalize or at least create civil liability for the unauthorized access of computer hardware and devices and their stored data. 19 Because CFAAs are supposed to be directed at fraudulent activity and not authorized acts, they should not reach a fiduciary s use of a computer or device. 20 For CFAA purposes, a fiduciary using a computer or system that they lawfully possess or control is most likely an authorized user. 21 The analogy would be that using or even hacking into the computer is no more illegal than a fiduciary using a locksmith or crowbar to get into the deceased s house. A. Federal Privacy Laws Critics have identified the Stored Communications Act (SCA) 22 as a major impediment to fiduciary access to some electronic communications content. 23 Enacted in 1986 as a part of the Electronic Communications Privacy Act (ECPA), 24 the SCA extends Fourth Amendment protections against unreasonable 16. BLACK S LAW DICTIONARY 208 (9th ed. 2009). 17. George Fox, Selling Your Soul, and Other Fine Print, FOX + MATTSON, P.C. (Dec. 30, 2013), See, e.g., Privacy Policy, supra note See Computer Fraud and Abuse Act, 18 U.S.C. 1030(e)(2) (2012) (defining a protected computer in a manner that includes virtually all computers and smartphones). 20. See 18 U.S.C. 1030(a) (2006). 21. See Telecommunications and Information Technology, NAT L CONF. OF STATE LEGIS., (last updated Jan. 19, 2014) (listing relevant state laws) U.S.C (2012). 23. Jim Lamm, Thoughts on the Stored Communications Act, Federal Preemption and Supremacy, and State Laws on Fiduciary Access to Digital Property, DIGITAL PASSING (Nov. 4, 2013), U.S.C (2012). 432

5 2014] Fiduciary Access to Digital Assets search and seizure to data sent as well as stored remotely on computer networks. 25 The privacy protections of the SCA work by prohibiting specified providers of public communications services from disclosing the contents of users communications to a government or nongovernment entity (different rules apply to each), except under limited circumstances that are akin to the situation in which a warrant would be required under the Fourth Amendment. 26 Although it is not clear which social media account contents such as photos, videos, or posts are protected by the SCA, it appears, for example, that Facebook and other social media sites are covered when it comes to limited access or materials that are not publicly available. 27 If a provider isn t subject to the SCA, it may disclose content to a third party without penalty. 28 While law enforcement officials can force or compel the provider who is otherwise covered and subject to the SCA to divulge the contents of an account, there is no mechanism for nongovernment requesters to compel providers to disclose content. 29 Providers subject to the SCA can voluntarily disclose electronic communications content to a third party only if an exception to the nondisclosure rule applies. 30 The relevant exception permits service providers to disclose communications with the lawful consent of the originator or an addressee or intended recipient of such communication[s], or the subscriber For this reason, underlying state law or court order should expressly provide that the fiduciary requesting the SCA 25. See generally Orin S. Kerr, A User s Guide to the Stored Communications Act, and a Legislator s Guide to Amending It, 72 GEO. WASH. L. REV (2004). 26. Id. at Naomi Cahn, Probate Law Meets the Digital Age: Harmonizing Federal Law with State Wealth Transfer Law on Digital Assets, 67 VAND. L. REV. (forthcoming Spring 2014); see also Rudolph J. Burshnic, Note, Applying the Stored Communications Act to the Civil Discovery of Social Networking Sites, 69 WASH. & LEE L. REV. 1259, (2012). 28. See Troutman Sanders LLP, The Stored Communications Act and Document Subpoenas to Cloud Computing Providers, INFO. INTERSECTION (Apr. 11, 2013), U.S.C (2012) U.S.C. 2702(b) (2012). 31. Id. at (b)(3). 433

6 CHARLESTON LAW REVIEW [Volume 8 protected material has the user s lawful consent. 32 In one example, Facebook, while moving to quash a subpoena, essentially asked one court for information contained in a deceased user s account in order to alternatively hold that the fiduciary had lawful consent and to order Facebook to disclose the requested content. 33 Instead of accepting that invitation, the Court granted Facebook s motion and quashed the subpoena. 34 Providers are always allowed to divulge non-content information such as the user s name, address, connection records, IP address, and account information, because the SCA prohibits only the disclosure of the content of communications. 35 B. Copyright, Commercial Privacy, and Data Protection Statutes The above-referenced laws might impede a fiduciary from downloading or distributing another person s digital files as they may violate copyright law, the limited common law of privacy, trade secret law, and any federal or state personal data protection statutes. 36 Generally, copyrights can be transferred 32. FADA will absolve fiduciaries of any technical TOSA breaches that might occur when the fiduciary accesses the account. This issue is absolved by codifying the concept of the fiduciary stepping into the shoes of the account holder. FADA, supra note 13, 8(b). 33. Motion to Quash Subpoena in a Civil Case, at 3, In re Facebook, Inc., 923 F. Supp. 2d 1204 (N.D. Cal. Aug. 6, 2012) (No. 5:12-MC LHK (PSG)). 34. In re Facebook, Inc., 923 F. Supp. 2d 1204, 1206 (N.D. Cal. 2012) (providing Sahar Daftary as the name of the decedent). 35. SCA violations can give rise to civil damages. 18 U.S.C (2012). A federal jury in Massachusetts awarded $450,000 in damages in a recent private civil action. The defendant had been given the plaintiff s account password so she could access it for business purposes. A business dispute followed and the defendant used the unchanged password to access the account for reasons connected to the business dispute but well beyond the initial authorization. The plaintiff alleged that the later, unauthorized access to his account violated the SCA. Despite very thin testimony to support the damage claim, the jury awarded the plaintiff $450,000 for the unauthorized intrusion. Jury Verdict Form, Cheng v. Romo, No. 11-cv DJC, 2012 WL , at *1 7 (D. Mass. Nov. 28, 2012). 36. For example, Massachusetts has a data security statute that requires encryption of personal information owned or licensed [held by permission] by any person. See 201 MASS. CODE REGS (2010) (requiring businesses to encrypt sensitive personal information on Massachusetts residents that is stored on portable devices such as PDAs and laptops or on storage devices such as memory sticks and DVDs). According to the National Conference of State Legislatures, forty-six states have enacted a data breach or privacy law of some 434

7 2014] Fiduciary Access to Digital Assets posthumously under federal law, and they clearly belong to the holder and are not subject to a TOSA with another party. 37 Of the federal privacy laws, only the Gramm-Leach-Bliley Act allows information to be divulged to fiduciaries. 38 C. TOSA Provisions that Inhibit Access Provider terms of service provisions are the biggest impediment to fiduciary access because they rarely mention fiduciaries. 39 Facebook will allow a personal representative or family member to obtain content with a court order via special request, 40 but once the account is memorialized, Facebook won t allow anyone except the user who presumably would then have to prove that the user hasn t actually died as reported to log into it. 41 It will allow verified family members to request that the account be removed from Facebook. 42 Apple s itunes terms of use grant the account holder a license to download and use (listen to) digital music files, but expressly prohibit their sale or transfer. 43 This may or may not allow the user to bequeath the content or actual music files the terms of use do not mention what occurs at the death of the account holder. 44 kind. See Telecommunications and Information Technology, supra note See Cahn, supra note 27 at 6 n.25 ( The ownership of a copyright... may be bequeathed by will or pass as personal property by the applicable laws of intestate succession. ) (quoting 17 U.S.C. 203(d)(1)); see generally Deven R. Desai, The Life and Death of Copyright, 2011 WIS. L. REV. 219 (2011); Andrea Farkas, Comment, I ll Be Back: The Complications Heirs Face When Terminating a Deceased Author s Online Copyright Licenses, 5 EST. PLAN. & COMMUNITY PROP. L.J. 411 (2013). 38. See 15 U.S.C. 6802(e)(3)(E) (2012). 39. FADA, supra note 13, How Do I Submit a Special Request for a Deceased Person s Account on the Site?, FACEBOOK, (last visited Mar. 6, 2014). 41. How Do I Report a Deceased Person or an Account that Needs to be Memorialized?, FACEBOOK, (last visited Feb. 21, 2014). 42. Special Request for Deceased Person s Account, FACEBOOK, facebook.com/help/contact/ (last visited Mar. 6, 2014). 43. See Terms and Conditions, APPLE, (last visited Mar. 6, 2014). 44. Id. (indicating that Apple grants customers an end user license to download and play songs, but not to transfer them to third parties). 435

8 CHARLESTON LAW REVIEW [Volume 8 Instagram and Vine, two popular video and photo sharing services, both have TOSAs and privacy policies indicating that while users own their posted videos and photos, they grant the service the rights to use their content but not to sell it to advertisers. 45 This suggests that users may bequeath their content. The Instagram TOSA states that its policy is to remove the user s account when notified of the user s death; however, it says nothing about granting postmortem access to the content. 46 Likewise, Twitter s policy now contemplates only deactivation of an account and provides no mechanism for obtaining a copy or archive of the user s account files or content. 47 Previous versions of Twitter s policy gave family members the option of either removing the account or saving a backup of public tweets. 48 Yahoo! s TOSA prohibits postmortem transfer or access altogether. 49 D. TOSA Provisions that Prohibit Transfer or Inheritance Some digital assets may not be transferable on death. Frequently, account holders are granted very limited contract rights or licenses in assets such as music, movies, and travel reward and mileage programs. 50 Unsurprisingly, those rights do not generally include rights to transfer assets to beneficiaries at 45. Terms of Service, VINE, (effective Jan. 3, 2013); Terms of Use, INSTAGRAM, (effective Jan. 19, 2013); Privacy Policy, INSTAGRAM, (effective Jan. 19, 2013). 46. Terms of Use, INSTAGRAM, (effective Jan. 19, 2013). 47. Terms of Service, TWITTER, (effective June 25, 2012). 48. See Jeremy Toeman, Why Twitter s New Deceased User s Policy Isn t Good Enough, LEGACY LOCKER (Aug. 9, 2010), Yahoo Terms of Service, YAHOO!, utos/terms/ (last visited Mar. 6, 2014) ( No Right of Survivorship and Non- Transferability. You agree that your Yahoo account is non-transferable and any rights to your Yahoo ID or contents within your account terminate upon your death. Upon receipt of a copy of a death certificate, your account may be terminated and all contents therein permanently deleted. ). 50. See, e.g., APPLE, supra note 43 (indicating that Apple grants customers an end user license to download and play songs but not to transfer them to third parties). 436

9 2014] Fiduciary Access to Digital Assets death. 51 A beneficiary may or may not be able to invalidate a TOSA that renders a digital asset, such as a music or video file, non-descendible. 52 It is not clear whether a TOSA governing an online account can provide for an enforceable, testamentary beneficiary designation that will be considered a valid will substitute. In general, contractual, post-mortem beneficiary designations of non-digital property are enforceable, and valid, even if not properly executed and attested in accordance with the statute of wills, if the jurisdiction, by statute or case law, has validated the nonprobate transfer. 53 Custodians, and statutes validating such designations, normally require that the beneficiary designations be written and signed, but not all require witnesses. 54 Such laws may need clarification so that they clearly apply to online contractual beneficiary designations and to digital assets. The former may not be an issue in light of the widespread enactment of the Uniform Electronic Transactions Act (UETA), 55 but the omission of digital assets from the nonprobate transfer enabling laws is clearly problematic. 56 Furthermore, since the probate system generally backstops these nonprobate transfers for example, by naming the account holder s probate estate as the default contingent beneficiary probate laws will ultimately have to be updated to address digital assets David Horton, Indescendibility, 102 CALIF. L. REV. (forthcoming 2014), available at See id. 53. See John H. Langbein, The Nonprobate Revolution and the Future of the Law of Succession, 97 HARVARD L. REV. 1108, 1132 (1984), available at see, e.g., UNIF. PROBATE CODE (1969) (amended 2010) (eliminating the formal requirements of state wills acts, rendering them inapplicable in many states to most beneficiary designations and nonprobate transfers of nondigital assets). 54. Langbein, supra note 53, at UNIF. ELEC. TRANSACTIONS ACT (1999) see also Electronic Transactions Act Summary, UNIF. L. COMM N, available at See generally Roy, supra note 11, at (exploring several theories in which the purported beneficiary of a digital asset could attempt to validate an online beneficiary designation as a will substitute). 57. See Langbein, supra note 53, at 1120 (discussing the relationship between probate and nonprobate systems). 437

10 CHARLESTON LAW REVIEW [Volume 8 E. As a Result of These Barriers, Fiduciaries Have Been Denied Access As a result of these barriers, many social media and electronic communications providers have balked at fiduciary (and family members ) requests for access to digital assets. In 2005, a Michigan probate judge ordered Yahoo! to give the contents of an account to the father of Justin Ellsworth, a twenty-year-old who was killed by a roadside bomb in Fallujah. 58 Soon afterward, Connecticut enacted the first fiduciary access law that authorized executors to access accounts. 59 Virginia dairy farmer Ricky Rash and his wife Diane, upset with Facebook s refusal to grant them access to their deceased teenaged son s Facebook posts, successfully lobbied for a law 60 granting parents access to a deceased minor child s social media account content. 61 In another instance, Sahar Daftary, an internationally famous model, fell to her death from the window of her boyfriend s London apartment in As part of the coroner s inquest to determine whether her death was a suicide or a suspicious death, her executors subpoenaed Facebook and asked it to provide the information contained in her user profile and account. 63 Although Facebook objected to the subpoena, in its memo supporting its motion to quash the civil subpoena, Facebook asked the court to alternatively hold that the fiduciary had lawful consent and to order Facebook to disclose the requested content. 64 The court granted Facebook s motion and quashed the subpoena. 65 In 2013, Yahoo! refused to accept a co-administrator s authority to access his deceased brother s Yahoo! s, even 58. Stefanie Olsen, Yahoo Releases of Deceased Marine, CNET NEWS (Apr. 21, 2005, 12:39 PM), CONN. GEN. STAT. 45a-334a (2010). 60. VA. CODE ANN to -110 (2013). 61. Sears, supra note Sahar Daftary Inquest: Model s Ultimatum to Husband, BBC NEWS (July 25, 2012, 1:07 PM), See Cahn, supra note 27, at Motion to Quash Subpoena in a Civil Case, supra note 33, at In re Facebook, Inc., 923 F. Supp. 2d 1204, 1206 (N.D. Cal. 2012). 438

11 2014] Fiduciary Access to Digital Assets though the surviving brother had opened and originally shared access to the account but had since forgotten the password. 66 Yahoo! attempted to dismiss the Massachusetts declaratory action based on the California forum designation provision in its TOSA and claimed that the s were not property of the Massachusetts estate. 67 The appeals court refused to enforce the adhesive TOSA provisions and remanded the case to the probate court to determine whether the s were an asset of the estate and whether the SCA barred Yahoo! from disclosing them. 68 The court s opinion discusses and differentiates between clickwrap agreements, that require the user to click an I agree box, and browsewrap agreements, in which the terms are simply posted and the user need not confirm having read them. 69 The Court concluded that without evidence that the account holder agreed to the TOSA, it was not enforceable against anyone, especially the estate s co-administrators who were not parties to it. 70 The Court did not rule on the application of the SCA. 71 F. Self Help Options for Account Holders In April 2013, Google introduced an option called Inactive Account Manager to allow users to determine within preset options what will happen to their Google accounts after a predetermined period of inactivity. 72 Users can set the time period of inactivity that triggers a Google response and Google will also alert the user by text and one month before deleting the account. 73 Users may have Google notify up to ten beneficiaries that the account will be closed before Google deletes it. 74 After the recipients receive that notice, those designated beneficiaries can download the user s Google content such as 66. Ajemian v. Yahoo!, Inc., 987 N.E.2d 604, 608 (Mass. App. Ct. 2013). 67. Id. at Id. at Id. at Id. 71. Id. at Charles Arthur, Google Launches Tool to Help Users Plan for Digital Afterlife, GUARDIAN (Apr. 12, 2013, 11:47 AM), Jill Duffy, Get Organized: Should You Use Google s Inactive Account Manager?, PCMAG (Aug. 19, 2013), Id. 439

12 CHARLESTON LAW REVIEW [Volume 8 Gmail, photos, YouTube videos, or blogs. 75 Alternatively, the user can simply instruct Google to delete all account content. 76 Although this feature will not assist with postmortem access if it is not used by the deceased account holder, or if the designated beneficiary is unavailable, incapable, or dead, it is a step forward. Unlike Google, Facebook has not updated its policies on postmortem access. 77 Other companies offer services, which, like Google s, can help clients plan for their digital passing. There are many services that offer master, secure storage for passwords. 78 Others are more like digital estate planning (DEP) services, which purportedly allow clients to grant others access to their digital accounts after they die or become incapacitated. 79 There is even a commercial service designed to assist fiduciaries in marshaling digital assets. 80 The legality, or at least the utility, of these services is unclear because fiduciary access may violate a TOSA. 81 III. CURRENT FADA DRAFT AND APPROACH In January 2012, the Uniform Law Commission (ULC) authorized a Fiduciary Access to Digital Assets (FADA) drafting committee to write legislation that will vest fiduciaries with the authority to manage and distribute digital assets, copy or delete 75. Id. 76. About Inactive Account Manager, GOOGLE, accounts/answer/ ?hl=en (last visited Mar. 6, 2014). 77. See Memorialization Request, FACEBOOK, contact/ (last visited Mar. 6, 2014). 78. See Digital Death and Afterlife Online Services List, THE DIGITAL BEYOND, (last visited Mar. 3, 2014). 79. See Is the Legacy Locker for PasswordBox Service the Same as a Will or Estate? Or an Electronic Will?, PASSWORD BOX, (last updated Nov. 19, 2013, 10:56 AM) [hereinafter Legacy Locker] ( Legacy Locker for PasswordBox is not a legal service. PasswordBox only provides the tools to securely allow for the transfer of your online assets to a person you choose. It should not and cannot replace the counsel of a legal professional. ). 80. See WEBCEASE DIGITAL ASSET DISCOVERY, (last visited Mar. 6, 2014). 81. See Legacy Locker, supra note 79; see also supra Part II.E (discussing fiduciary access and its relation to TOSAs). 440

13 2014] Fiduciary Access to Digital Assets digital assets, and access digital assets. 82 The charge does not necessarily mean that the final uniform act will provide for exactly that authority; rather, it was intended to give the drafting committee sufficient authority to draft an effective statute. 83 It is important to note that the Act will govern access, not distribution and ownership. This is a key distinction. 84 Therefore, FADA will not vest fiduciaries with greater rights to licensed content than the account holder enjoys, nor will it specify how digital assets are to be distributed. 85 The members of the FADA drafting committee include Uniform Law Commissioners; American Bar Association (ABA) Advisors from several different sections; numerous observers from interested groups such as the American College of Trust and Estate Counsel, the National Academy of Elder Law Attorneys, and the American Banker s Association; as well as individuals from companies that receive fiduciary requests for access. 86 Most of the drafting committee s meetings have been attended by fifteen or more observers, and many have participated in pre-meeting discussions of the draft. The Uniform Law Conference of Canada has also participated. 87 FADA has already been read once, line by line, at the ULC s July 2013 annual meeting, and will be read for a final time at this year s 2014 annual meeting in Seattle. If approved by a vote of the states, FADA will be finalized and officially ready for promulgation in the fall of First and foremost, FADA governs and facilitates fiduciary access to digital assets but does not vary the underlying laws of management, descent, and distribution that otherwise apply to 82. UNIF. L. COMM N, (last visited Mar. 6, 2014) (containing information and drafts regarding FADA). 83. The Fiduciary Access to Digital Assets Committee plants to move the ULC s executive committee to officially designate the Act as uniform in advance of the 2014 annual meeting. Until that time, the acronym is FADA and not UFADA. 84. See FADA, supra note Id UNIF. L. COMM N, supra note See John Gregory, Fiduciaries Access to Digital Assets, SLAW (Jan. 9, 2014), Id. 441

14 CHARLESTON LAW REVIEW [Volume 8 all assets and property. 89 FADA is currently divided into eight substantive sections. 90 Sections2 through 3 contain the scope provision and the definitions. 91 Sections4 through 7 establish the rights of personal representatives, conservators, agents acting pursuant to a power of attorney, and trustees (in that order). 92 Section8 contains the rules governing the extent and limitations of the fiduciary s authority. 93 Section9 requires compliance with requests properly made under the Act, and Section 10 grants providers immunity for complying with such requests in exchange. 94 Sections 1 and 11 through 14 address miscellaneous issues, including the effective date of the Act and similar issues. 95 The Act addresses only the rights of the four types of fiduciaries. 96 Unlike any existing state law, FADA covers personal representatives, conservators, agents acting under powers of attorney, and trustees. 97 By defining the fiduciary as an authorized user, the Act gives the fiduciary the authority to access electronic communications under the SCA, as well as under the CFAA. 98 It also specifies that a fiduciary acting under the Act s authority has the lawful consent of the originator/subscriber. 99 That state law confirmation should allow the provider to voluntarily disclose the files, even if the SCA is not amended to add a corresponding confirmation. 100 Ideally, the SCA will be amended to authorize disclosure of electronic communications content to agents and fiduciaries that are recognized under state law. 101 FADA will then supply the 89. See FADA, supra note See generally id. (describing the sections of the Act briefly in Prefatory Note for the Drafting Committee ). 91. Id. 2, Id Id Id. 9(c), Id. 1, See generally id. (addressing the four different types of fiduciaries in Prefatory Note for the Drafting Committee ). 97. Id. 98. Id. 8 cmt.; see generally 18 U.S.C. 1030, 2701 (2006). 99. FADA, supra note 13, 8(a)(ii) See 18 U.S.C. 2702(b)(1) (3) (2006) Id. 442

15 2014] Fiduciary Access to Digital Assets requisite state law authority, and disclosure would be unquestionably permitted. 102 Until the SCA is amended in that manner, providers will undoubtedly first want a definitive federal court ruling that a fiduciary s lawful consent satisfies the SCA exception and constitutes account holder consent. 103 FADA provides clear rules for determining when a fiduciary does or does not have lawful consent in addition to proscribing default rules that will govern the fiduciary s authority over digital accounts and assets. 104 Those default rules are crucial, as not all documents governing fiduciary conduct contain digital asset guidance due to either their age or a scrivener omission. 105 FADA is premised on the principle that fiduciaries step into the shoes of a decedent, settlor, or incapable as agents do for their principals. 106 The idea is for FADA to remove any impediment to that authority over electronic communications content and other digital assets, placing them on the same footing as all other assets. 107 FADA defines an account holder as an individual not acting in a fiduciary capacity that has entered into a TOSA. 108 This maintains the distinction between a fiduciary s authority over an account and the account holder s authority. 109 While the account holder can use the account, the fiduciary can only access it in furtherance of fiduciary duties. 110 For example, the fiduciary would be able to access a decedent s Facebook or Twitter accounts in order to terminate the accounts or possibly to copy files, but would be unable to impersonate the decedent and continue to use the account in that manner. By analogy, consider a decedent s country club membership, which an executor or conservator might have to bring current, terminate, or transfer, but which would not entitle the fiduciary to play eighteen holes of 102. See generally FADA, supra note See U.S.C. 2702(b)(3) (2006) FADA, supra note 13, Id. at 8 cmt See generally id See FADA, supra note Id. 2(1) Id.; see Cahn, supra note See FADA, supra note 13,

16 CHARLESTON LAW REVIEW [Volume 8 golf and use the clubhouse. This limitation on fiduciary access is repeated in several sections of the current draft. 111 A custodian is defined as a person that stores, or has control of, digital assets property or electronic communications of an account holder. 112 This definition does not include an employer because an employer typically does not have a TOSA with an employee, and an account holder, by the Act s definition, has entered into a TOSA. 113 This distinction is crucial because systems supplied by employers or educational institutions might contain private information that is subject to safeguard under other law, in addition to the federal communications privacy law that applies to public providers. 114 Further, any digital assets created through employment generally belong to the employer. 115 Digital assets are broadly defined as electronic records to which a person is entitled to have access. 116 This definition includes the contents of an electronic communication and the record of the name of each person with whom an account holder communicated, time and date of the communication, and the electronic address of the person. 117 Digital assets include any information that is stored on the Internet or on a digital device, such as music, photos, social media profiles, bitcoins, 118 s, electronic documents, and the underlying accounts through which other assets are accessed. 119 Because this definition includes the phrase, to which a person is entitled to have access, digital assets do not include any material that the account holder has not obtained legally, 111. Id. 2, 3, Id. 2(6) Id. 2 cmts. for the committee U.S.C (2006) FADA, supra note 13, 2 cmts. for the committee Cahn, supra note 27, at 5; Matthew J. Tokson, The Content/Envelope Distinction in Internet Law, 50 WM. & MARY L. REV. 2105, (2009) (discussing the information transmitted through various forms of electronic communication) See generally Cahn, supra note 27, at Bitcoins are a virtual currency. See generally BITCOIN, HG7H-7G35 (last visited Mar. 6, 2014) Cahn, supra note 27, at 5; Hopkins, supra note

17 2014] Fiduciary Access to Digital Assets such as pirated media. 120 Electronic communication is simply defined as a transfer of an electronic record. 121 Therefore, it also includes both the content of the communication and the noncontent, 122 such as logs or metadata. 123 Access is not defined because the nature of the fiduciary s authority over the account will depend on the type of digital asset. 124 A fiduciary cannot impermissibly manage any asset under the fiduciary s control, including digital assets, rendering lengthy provisions delineating the scope of the fiduciary s authority over digital assets unnecessary. 125 Instead, the Act s scope provision in Section 3 expressly limits its application to a grant of authority to a fiduciary who is acting lawfully in accordance with fiduciary obligations and duties. 126 FADA Section 4 governs authority of personal representatives, such as executors and administrators. 127 Its default rule is that the personal representative is authorized to administer all of the decedent s digital assets, [u]nless prohibited by the will of the decedent, a court, or other state or federal law. 128 Access to the electronic communications content sent or received by the decedent is also granted under those circumstances, but is subject to the additional condition that disclosure be permitted by federal law. 129 Thus, FADA respects and effectuates a decedent s intent to keep his or her electronic communications private also known as dead hand control but properly recognizes and encourages 120. FADA, supra note 13, 8 cmt Id. 2(10) The SCA defines non-content as a record or other information pertaining to a customer or subscriber. 18 U.S.C. 2702(c) (2012) FADA, supra note 13, 2(10) See, e.g., UNIF. PROBATE CODE (amended 2010) See generally FADA, supra note Id. 3 cmt. (stating that the scope provision distinguishes the authority of fiduciaries, who exercise authority... from any other efforts to access the digital assets and electronic communications ) Id Id. 4 cmts. for the committee ( Section (a)(1) establishes the default rule that the personal representative is authorized to administer all of the decedent s digital assets other than material covered by the Electronic Communications Privacy Act (ECPA). It is modeled on the formulation of the personal representative s default power set out in UPC Sec ) Id.; see Cahn, supra note 27; see Tokson, supra note

18 CHARLESTON LAW REVIEW [Volume 8 fiduciary access to what is almost always information necessary to estate administration. 130 The Act does not permit the account holder s fiduciary to override the TOSA in order to make a digital asset or collection of digital assets descendible, although it does give the fiduciary essentially the same rights as the account holder. 131 Importantly, the Act grants fiduciaries the authority to compel disclosure of the contents of electronic communications, although the SCA merely permits the ISP to disclose and does not contain such a compliance provision. 132 Therefore, while the account holder would not need to compel disclosure, the fiduciary has to be able to do so in order to ensure fiduciary access. This is not an impermissible incursion into the federal law. 133 FADA Section 5 governs the authority of guardians or conservators and permits a court to allow and authorize access to digital assets, but only after the opportunity for a hearing. 134 In addition, a court is required to consider the protected person s intent, best interest, and personal values. Also, as in Section 4, the court may only grant access to ECPA-protected communications content when the provider is permitted to disclose it under federal law. 135 FADA Section 6 governs the authority of agents acting under powers of attorney, and is quite simple. 136 Unless prohibited by the principal, an agent has access to the principal s digital assets and the records of the principal s electronic communications. 137 However, the principal must expressly grant access to the contents of his or her electronic communications in the power of 130. FADA, supra note 13, See Id. 8 cmt.; see Horton, supra note 51, at See Cahn, supra note 27, at Id. at 22 ( [W]hen it comes to a state law mandating an action that is permissive under federal law, the two can be harmonized. The state has no power to compel an ISP to take an action that is contrary to federal law, but, where federal law permits the action, there is room for state law so that the two laws can be interpreted together. That is, ISPs can comply with state law without violating federal law. ) FADA, supra note 13, Id. 5(1) Id Id. 446

19 2014] Fiduciary Access to Digital Assets attorney; access to contents will not be assumed. 138 This tracks the ECPA approach, which requires the account holder s lawful consent before the custodian can disclose content. 139 FADA Section 7, which governs trustees, presumes access to digital assets and electronic communications with respect to most digital assets held in trust. 140 A trustee may have title to digital assets and electronic communications both through an account created and used by the principal and an account created by the trustee for trustee business. 141 The underlying trust documents and default trust law will supply the allocation of responsibilities between and among trustees. 142 FADA Section 8 clarifies that the fiduciary has the same authority as the account holder. 143 Note that when the account holder has died, the fiduciary has access as of the hour before the account holder s death. 144 In exercising its responsibilities, the fiduciary is subject to the duties and obligations established pursuant to state fiduciary law and is liable for breach of those duties. In a crucial provision, FADA Section 8(b) renders a boilerplate provision in a terms-of-service agreement limiting a fiduciary s access right under FADA as void as against public policy. 145 The idea behind this provision is to prevent the use of an equivalent to the sell your soul to the devil unread TOSA provision to bar fiduciary access. 146 The account holder could permissibly select a digital death by affirmatively choosing to bar access, but this would have to be established by an affirmative choice, and not a click through provision. 147 This recently added 138. See id Compare id. 6 (providing that power of attorney over digital assets allows for access and management of an account holder s electronic communications), with 18 U.S.C. 2702(c) (2012) (providing an exception from culpability when an electronic communication account is accessed with the authorization of an account holder) FADA, supra note 13, Id. 7 cmts. for committee Id Id Id. 8 cmt Id. 8(b) See id See Ajemian v. Yahoo!, Inc., 987 N.E.2d 604, 612 (Mass. App. Ct. 2013) (refusing to enforce a choice of law TOSA when the service provider failed to 447

20 CHARLESTON LAW REVIEW [Volume 8 FADA provision has been criticized by some industry observers as reversing the SCA s presumption of nondisclosure. 148 However, the drafting committee wants to ensure that a TOSA provision barring fiduciary access is deliberate and not inadvertently included. 149 Similarly, Section 8 provides that a fiduciary s access to a digital asset or electronic communication is not a transfer of property, notwithstanding a contrary provision in a TOSA. 150 This provision is intended to circumvent TOSA provisions that flatly bar all third party access by characterizing such access as an impermissible transfer. Thus, Section 8 codifies the characterization of the fiduciary s authority as akin to that of the account holder. 151 FADA s compliance provisions are in Section They provide that if the fiduciary is entitled to access under FADA and the fiduciary has complied with the Section 9 substantiation of authority provision, the custodian must comply with the fiduciary s written request for access, ownership, or a copy of the digital asset. 153 In exchange, Section 10 immunizes the custodian from liability for complying with a fiduciary request for access under the Act. 154 Some content providers are concerned that this immunity provision could operate to launder illegally obtained or pirated content. 155 That is, their concern is that a fiduciary and a custodian could conspire to obtain and sell illegal content, abetted by FADA. 156 Needless to say, the drafting committee is committed to avoiding that result. 157 demonstrate that the terms were reasonably communicated and accepted) Letter from Steve Del Bianco, Exec. Dir., NetChoice, to author (July 8, 2013), available at FADA, supra note 13, 8(b) (specifying that a fiduciary s rights are only limited by enforceable TOSAs) Id. 8(c) Id. 8 cmt Id See id. 9(a) Id Cahn, supra note 27, at Id Id. at 20 n.74 ( One concern at drafting committee meetings has been fiduciary s efforts to access and then possibly transfer, illegally obtained property, such as pirated material. ). 448