States Seek to Fill Privacy Law Gaps in Wake of Social Media

When a loved one dies, laws cover how their houses, cars, and other property are passed on to relatives. But the rules are murkier – and currently far more restrictive – when it comes to pictures on Facebook, emails to friends or relatives and even financial records stored in online cloud accounts.

Google, Facebook and other companies have said a federal privacy law approved decades before digital storage became common prevents them from releasing electronic memories or records unless the account owner grants permission – even if the person is dead. Without an estate plan, families must try to crack their loved one’s passwords or take the costly step of litigating the matter to access photos and emails – and some have, with little success.

The laws governing how to divide belongings after someone dies have not caught up with the technological advances that have permeated the ways people communicate, but states have begun trying to bridge that gap. This year, Illinois was one of 19 states that passed similar laws to clarify what internet companies can release after someone dies and when information should remain inaccessible.

“I post quite a bit on Facebook. I post a lot of photos. If something were to happen to me, maybe my wife would like to have access to those photos,” said Rep. Emanuel Chris Welch, a state legislator from suburban Chicago who sponsored Illinois’ measure on the topic.

With the new laws, unless a person expresses otherwise, companies will release basic information from a user, such as the person’s email contact list, to help find friends or gather an inventory of a person’s assets. But to get the actual contents of the emails – even the subject lines – or photos and documents stored in a cloud service, people must proactively specify who they want to have their digital belongings.

The federal Electronic Communications Privacy Act, passed in 1986, doesn’t anticipate the release of online information when executing wills. Because probate law is typically left to the states, the laws legislatures are passing could effectively set new rules.

The Chicago-based Uniform Law Commission wrote the legislation states are passing with the support of internet companies, but that wasn’t always the case. Initially, the commission wanted administrators of a person’s estate to have access to everything from users’ accounts in cases where someone did not leave instructions about what to do with their digital assets.

Only one state, Delaware, managed to pass that version of the commission’s proposal, but 27 legislatures tried and failed in 2014.

Carl Szabo, senior policy counsel at NetChoice, an industry group that represents the interests of such companies as Facebook, Google and PayPal, said the revised legislation “balances the needs of the bereaved with the privacy interests of the account holders and the people with whom they corresponded.”

West Virginia, Utah, and Iowa are among the dozen other states that have drafted bills seeking to join the 19 that enacted laws.

Facebook allows users to choose a “legacy contact” to access their account, and Gmail has an “account trustee” option. In instances where people use those options, the companies’ agreements with them will supersede the state laws.

Even with the new laws, planning is necessary at a time when many still don’t think about the contents of their internet accounts as property.

“This is one of those many examples where the law really gets its power by giving people the knowledge that it exists,” said Washington state Sen. Jamie Pedersen, the sponsor of the law passed there this year.

The promise of privacy companies offer users has led to heartache and frustration for the families of account holders who have had to go to court for the right to access their relative’s emails and photos.

In 2005, Yahoo turned over more than 10,000 pages of emails in a CD to the family of Lance Cpl. Justin Ellsworth, a marine from Michigan whose family went to court for the material. But others have not been successful.

The family of John Ajemain in Massachusetts has been unable to get his emails from Yahoo after his death in 2006. And in 2012, Facebook quashed a subpoena from the family of Sahar Daftary, a model who fell to her death from an apartment building in Manchester, England, in 2008.

In Virginia, after Ricky Rash’s 15-year-old son, Eric, killed himself in 2011, Facebook provided a CD with the contents of his account but not his password. Rash still struggles with the notion that for decades people have stumbled upon mementos while cleaning out a late parents’ home, but in the digital age those keepsakes can be out of reach.

“What is the difference of the shoebox full of letters and pictures under the bed or in the attic?” Ricky Rash asked. “You go in as a child taking care of your parents’ estate, you may find something in those memoirs that surprises you.”

(This story has been corrected to show that the Washington state senator’s last name is Pedersen, not Pederson.)