Inheriting the Facebook Graveyard

By Michael Goodyear

Last year, I wrote about a German court case that struggled with the question of whether anyone could have access to a deceased individual’s social media accounts. The case centered on a 15-year-old girl who had been killed by a subway train, and her parents wanted to access her Facebook account to see if they could determine from her posts and messages if she committed suicide. In May 2017, the German court of appeals reversed a lower court ruling in favor of the parents, holding that allowing the parents access to their daughter’s account would compromise the constitutional expectation of telecommunications privacy of the third parties with whom she had interacted online. On July 12, 2018, the highest German court, the Federal Court of Justice (BGH), overruled the court of appeals, agreeing with the initial lower court decision and holding that online data can be inherited just like physical writings such as personal diaries or letters.

While there is a strong policy interest in probate, and social media does appear to fit into a broad interpretation of written communications traditionally included in probate, social media accounts include a much greater breadth of information than those traditional sources. While probate law stretches back centuries, social media does not. Today, instead of a simple spoken conversation, which could not be inherited, we engage in lengthy conversations on social media and via texting. In many cases, our social media accounts and private messages are reflections of our personal thoughts. Although diaries also contained sensitive thoughts, they cannot compare to the magnitude of personal information present on Facebook. This is a fundamental change from prior physical document inheritance under probate law.

The German case was also particularly tricky due to the girl’s age. Since she was a minor, her parents had an expanded range of rights which they would not have had upon her reaching legal adulthood. The BGH ruled broadly that digital content can be inherited, but it is unclear if this could be limited to only minors.

Such a limitation could be one way to achieve the court’s goal while still preserving data privacy for third parties. If such a policy were implemented, third parties would know when communicating over Facebook with underage individuals that their communications are not necessarily limited to the recipient’s eyes alone.

Facebook’s own policies do not allow access to a deceased individual’s account, even if the requesters are family members or he or she was a child. The only options are to leave the Facebook account as is, memorialize it, or remove it. The BGH ruling will likely force Facebook to reevaluate its current deceased users policy, which provides the perfect opportunity to adapt its policies to better protect user privacy.

While the BGH’s decision does not directly affect those outside Germany, Facebook’s reaction to the decision, including any policy changes, could apply to the rest of Europe and the United States as well. However, Facebook has previously resisted broadly applying EU privacy protections to its users who do not reside in the EU. It could very well maintain separate positions on accessing deceased users’ accounts as well.

The prevailing standard in the United States is that third-party communications are protected under the Stored Communications Act, 18 U.S.C. §§ 2701-2712. This broad privacy protection is not only important for third parties, but also for online services themselves. Platforms such as Facebook can simply refuse to disclose, except under limited circumstances, and cite the shield of the Stored Communications Act.

A possible alternative, in addition to drawing a distinction for minors, that would still comply with the Stored Communications Act and ameliorate the issue of the Facebook graveyard would be allowing the inclusion of social media accounts in your will. Since over 10,000 Facebook users die every day, there is a pressing question of what to do with this every-increasing digital graveyard of accounts filled with personal information. Delaware adopted a law for fiduciary access to digital assets and digital accounts in 2014. Under this law, an individual can list social media access in their will, despite sites like Facebook not allowing such a transfer. There are already services to hand over social media account access after the user’s death. Furthermore, courts have held that users can consent to the disclosure of their online communications in cases such as In re Facebook, 923 F. Supp. 2d 1204 (N.D. Cal. 2012), and Ajemian v. Yahoo!, Inc., 84 N.E.3d 766 (Mass. 2017).

The seemingly impenetrable wall between Facebook accounts and the outside world has already been penetrated. Facebook divulges account information and private messages to government officials with a warrant. Facebook private data is subject to discovery requests in litigation. Providing for access in a user’s will would be another step in compliance with the law that would allow the user to use his own discretion and also forewarn third parties that their communications might be shared. While the exact privacy rights of children are trickier, following the BGH’s ruling, Facebook should craft a new policy to best meet the interests of the dead, the living, and privacy.

Michael Goodyear is a former ISLAT member and is currently a rising 2L at the University of Michigan Law School, where he is the President of Michigan’s Privacy and Technology Law Association.

Facebook after Death

 By Michael Goodyear

With nearly two billion users, Facebook is firmly entrenched in 21st century life. A person’s Facebook account serves as a digital doppelgänger: their thoughts, interests, pictures, friends, and memories are available in perpetuity. But what happens to the digital profile when its physical owner dies? With physical property, there is often a presumed heir. A Facebook account, even if it doesn’t have monetary value, can have significant emotional value—after all, it is a record of life, a sense of personality and who the deceased individual was. Should a parent, significant other, sibling, or someone else have access to a Facebook account after the owner has passed away?

No, said a Berlin court yesterday.  A 15-year-old girl had been killed by a subway train back in 2012. Her parents wanted to access her Facebook to determine whether she had committed suicide by looking at her posts and reading her chats. The parents had petitioned Facebook to grant them access to the account, but when it was denied the parents went to the German courts.

Back in 2015, a regional court had ruled in favor of the parents, classifying Facebook messages and posts as similar to letters and diaries, which can be inherited. But the court of appeals instead looked to the privacy of those with whom the deceased girl had communicated. Granting her parents access to her account would compromise those other individuals’ constitutional right to privacy. The case could be appealed all the way to Germany’s Federal Court of Justice.

But for now, Facebook’s policies on a deceased person’s account are maintained. There are actually only three options for a deceased person’s Facebook account: 1) leaving it, 2) memorializing it, and 3) removing it. Facebook has a special form for a deceased person’s account, but this is only for memorializing or removing the account, not accessing it. Facebook’s policy is to not allow anyone other than the account user to log in to their account, including the family of the deceased.

But while Facebook does not turn over account access to family members, it does respond to requests from the government, including access to posts and messages if the government supplies a warrant. This means that there is a threshold where even privacy is outweighed by a greater goal.

Back in 2005, the family of a deceased marine, Justin Ellsworth, was granted accessed to his Yahoo email account after an Oakland County probate judge ordered Yahoo to grant them access. Cybersecurity law experts Julie E. Cohen of Georgetown University Law Center and Henry H. Perritt, Jr., of Chicago-Kent College of Law argued that emails were like other types of information or property routinely accessed or transferred after someone’s death and that access should be granted to survivors.

But seven years later in 2012, a California district court quashed a subpoena by a deceased individual’s family members to have access to the contents of her Facebook account. Sahar Daftary had died falling from the 12th floor of an apartment building in Manchester, England. Similar to the German case, her family wanted to know whether it was an unfortunate accident or suicide. The court upheld Facebook’s policy, noting that the Stored Communications Act, 18 U.S.C. §§ 2701-2712, protected the contents of Daftary’s Facebook account. The court did note that Facebook could turn over the contents voluntarily, but that would be unlikely given Facebook’s policy on the accounts of deceased persons.

“I think it’s a good idea for sites not to have a blanket policy to hand this stuff over to survivors.  This information is private and you assume that it’s private, you assume that your Facebook account is private, you assume that your email account is private,” said Rebecca Jeschke of the Electronic Frontier Foundation.

While someone’s public posts on Facebook were intended for others’ eyes, their private messages were not. Even in the case of children, it is unlikely that they would want their parents reading their private messages when they were alive. Why should it be different now that they are deceased? In addition to the deceased individual themselves, the privacy of those with whom they communicated would also be at stake. The German appeals court’s decision supports a broader point: a loved one’s death is tragic, but even it should not trump the constitutional right to privacy.

Michael Goodyear, who has a BA in History and Near Eastern Languages and Civilizations from the University of Chicago, is part of the ISLAT team.