What happens to our digital assets when we die is a question that has still not been finally answered. Here we provide information about developments and how you may be able to take action on social or digital media after a loved one dies.
Everyone has some form of interaction with the internet. Our digital footprint is our own personal biography. Most of us store our photos either on social media or in “the cloud”. We use our social media accounts to keep track of big events and milestones. So, what happens to our accounts when we die?
Photos used to be kept in physical photo albums but now they’re kept online. Now, instead of looking through a photo album, our loved ones need a username and password to access this material. But what happens when they don’t have this information?
At present, there is no universal rule in the UK regarding what happens to your digital assets. Each social media/cloud provider has varying rules on what happens to your account after your death. For example, Facebook allows you to set up a legacy contact who can choose whether to memorialise your account or a family member can request its deletion. Twitter offers the option to have the account deleted. Google has a function called “Inactive Account Manager” which lets you appoint a trusted person to access your account after your death. Apple, however, has a no survivorship rule when it comes to iCloud. There is no clear or consistent way of dealing with data after death. If a person has made no specific provisions, it is unlikely that you will be granted access without some form of court order, even if you have a probate certificate (as our client, Rachel Thompson, recently discussed in the Times, read her story here.)
The General Data Protection Regulation (EU) 2016/679 (“GDPR”) makes provisions for Member States to decide what they think should happen to their citizen’s personal data after they die. Recital 27 of the GDPR states that “This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons.” The GDPR acknowledges that in today’s age there may be a need to deal with the position regarding the processing of data of deceased persons; the UK, has not yet created such a provision.
Legal Considerations
The Data Protection Act 2018 does not provide a provision for deceased individuals. S3(2) of the Act defines personal data as ‘any information relating to an identified or identifiable living individual’. A social media or cloud-based site will therefore not have to hand over the data they hold in response to a GDPR request for information on behalf of the estate of an individual. Have legislators missed a trick when they did not legislate for what happens to our data after death?
Across Europe, there have been cases where Member States have been starting to map out the future of intestacy laws in relation to data kept online.
In July last year, the German Federal Court of Justice held that a Facebook account can pass to a user’s heir after death. This case concerned the death of a young girl whose parents subsequently wanted access to her Facebook account. The German court held that this was a contractual issue; the contract of use between the Claimants’ daughter and Facebook was transferred to the heirs of her estate due to German Testacy rules. The contract of use was therefore passed onto the Parents and they were permitted access to the Facebook Account. The judge drew an analogy to diaries and private letters in their reasoning.
The question of other user’s privacy was raised also; when handing over the account details, Facebook is not only handing over the personal data of the deceased, but also the personal data of those who communicated with the deceased. This type of social media account is therefore different to inheriting a “cloud” account for example, where there are just photos or files. Here, you would be receiving the personal data of another too. The German Court considered this issue and still acted to allow the transfer of the account. The transfer was held to be GDPR compliant as the breach of personal data rights concerning other social media users was justified by Articles 6(1)(b) (“necessary for the performance of a contract”) and (6)(1)(f) (“legitimate interests”) of the Regulation. The contract that the deceased user and the other users had entered into was sufficient enough to justify the breach of personal data rights. In addition, the court noted that there was no legitimate expectation that the messages would not be passed on or shown to anyone else.
The UK has different testacy rules, but due to the increasing influence of social media, a similar case will inevitably reach the courts soon.
The UK courts are slowly beginning to recognise the need for the law to cover issues that arise after death in relation to data. In Sabados v Facebook Ireland [2018] EWHC 2369, the Claimant sought to have a Norwich Pharmacal order put in place to find out who had requested deletion of the deceased’s account. The family had not requested this and with the deletion, lost many photos and memories posted by the deceased. This claim was successful and has led to further thinking surrounding what happens to your social media after death. The story of the parents of Molly Russell, who are currently campaigning to gain access to her Instagram account has also hit the headlines recently. It is only a matter of time before the UK has to confront these issues head-on.
We have recently acted for a client whose husband tragically and suddenly passed away, which meant that she inherited the entirety of his estate apart from, it would seem, access to his iCloud. Apple refused to grant access to the iCloud even with a Grant of Probate. The tech giant would only allow access if she obtained a court order (see her story here).
There is no specific court order relating to the conveyance of data assets after death. In fact, the judge noted this in court. Nevertheless, we were successful in the application and Apple were ordered to confer the information to our client.
The UK needs to deal with this issue. As more and more of us use cloud-based accounts and social media, this is going to be an increasingly more common action. There should be a universal process in order for heirs of estates to access the data held in these accounts. These cases are analogous to a memoir being found in a storage unit; in the case of a storage unit, a grant of probate or death certificate is usually sufficient to allow the release of the contents. There does need to be a clear guideline (i) how to obtain such an order and (ii) how to leave your data assets behind when you die.
A solution may be found in France. The French Data Protection Act allows you to assign your data rights to others in your Will. In fact, this has been the law in France since 2016, with the implementation of the Digital Republic Act. You can give instructions in relation to the use and disclosure of personal data after death. Is this the way forward?
In the absence of such a framework, what can you do? It is important to start looking at “digital Wills”. Something we have already been asked by clients to advise on and manage. Preparing in this way can avoid having to obtain court orders, particularly where sensible practical measures have been put in place. It can also be difficult to navigate each social media or cloud account’s specific policy on accounts after death, but as this information is so important, it is a necessity. However, as some social media and cloud accounts, Apple, for example, have a rule against survivorship in their terms and conditions, it may be necessary to apply for a court order and, of course, we can assist with this. Will the differing policies change which companies you will use in the future?
Navigating the policies for each online account can be as confusing. These are the current policies for the most popular Apps and what you can do.
Apple Account
Apple only allows the transfer of an Apple Account after a grant of probate and a court order. There is no method to arrange for this before you pass away. The only sensible solution is to make practical arrangements in advance.
If you wish to gain access to a deceased loved one’s iCloud we can assist.
Users can choose a friend or a family member to become a “legacy contact”. This allows this “contact” to take control over some aspects of the account. They can either choose to have the account deleted or memorialise the account. This means that the contact cannot read the deceased person’s messages, but they are able to change their profile photo and archive old posts and photos. They won’t be able to post as you, but they will be able to post tribute posts and manage tribute posts that others have made. This option can be found under “General Account Settings”. Alternatively, you can choose to request an automatic account deletion after you’ve passed away. A family member can also have the Facebook account removed by presenting a death certificate or grant of probate.
Realistically, if you wish to obtain full access to a loved one’s account after death, a court order is likely to be necessary.
Instagram currently does not allow the transfer of accounts. However, an account, like Facebook (which owns Instagram) can be memorialised or deleted on request by the next of kin of the user.
As with Facebook, obtaining full access to the account is likely to require a court order.
Twitter currently allows you to request the deletion of a loved one’s account but will not allow you to access it.
As with Facebook and Instagram, obtaining full access to the account is likely to require a court order.
Google Account
Google has a function that is called “Inactive Account Manager”. A user nominates a friend or relative to be contacted when you die. Google will contact this friend when your account has been inactive for 3 months. Your friend or relative will then receive an email themselves, allowing them to download the data you have selected to be sent to them. You can choose which data to share, for example, you could choose to share the data on your Google Drive but not your Email. You can choose up to 10 people to receive data for different Google services. They essentially allow you to create a digital Will in relation to their services.
This post originally appeared on Himsworth Scott Insights and is reproduced with permission and thanks.
You mention how you can possibly assist with accessing a deceased family member’s iCloud. How would we go about doing this?
If you really want to be helpful you’ll provide templates for the court orders this article says you need. I’m trying to get my brother’s iPhone unlocked from his Apple ID and it’s absurd I’ll have to hire a lawyer for it.
Am in the same boat Larry – did you make any progress?
My son passed away November 10th 2022. I have his I cloud information but he never saved anything there. He had me wright down his passcode for his I phone but I could not find it. However i found the passcode in his drawer I think anyway. But family has tried to access it and now the phone is locked. So I cannot put this number in. My question is: Is there anyway to get the lock off so I can put this number in?