Last year, I wrote about a German court case that struggled with the question of whether anyone could have access to a deceased individual’s social media accounts. The case centered on a 15-year-old girl who had been killed by a subway train, and her parents wanted to access her Facebook account to see if they could determine from her posts and messages if she committed suicide. In May 2017, the German court of appeals reversed a lower court ruling in favor of the parents, holding that allowing the parents access to their daughter’s account would compromise the constitutional expectation of telecommunications privacy of the third parties with whom she had interacted online. On July 12, 2018, the highest German court, the Federal Court of Justice (BGH), overruled the court of appeals, agreeing with the initial lower court decision and holding that online data can be inherited just like physical writings such as personal diaries or letters.
While there is a strong policy interest in probate, and social media does appear to fit into a broad interpretation of written communications traditionally included in probate, social media accounts include a much greater breadth of information than those traditional sources. While probate law stretches back centuries, social media does not. Today, instead of a simple spoken conversation, which could not be inherited, we engage in lengthy conversations on social media and via texting. In many cases, our social media accounts and private messages are reflections of our personal thoughts. Although diaries also contained sensitive thoughts, they cannot compare to the magnitude of personal information present on Facebook. This is a fundamental change from prior physical document inheritance under probate law.
The German case was also particularly tricky due to the girl’s age. Since she was a minor, her parents had an expanded range of rights which they would not have had upon her reaching legal adulthood. The BGH ruled broadly that digital content can be inherited, but it is unclear if this could be limited to only minors.
Such a limitation could be one way to achieve the court’s goal while still preserving data privacy for third parties. If such a policy were implemented, third parties would know when communicating over Facebook with underage individuals that their communications are not necessarily limited to the recipient’s eyes alone.
Facebook’s own policies do not allow access to a deceased individual’s account, even if the requesters are family members or he or she was a child. The only options are to leave the Facebook account as is, memorialize it, or remove it. The BGH ruling will likely force Facebook to reevaluate its current deceased users policy, which provides the perfect opportunity to adapt its policies to better protect user privacy.
While the BGH’s decision does not directly affect those outside Germany, Facebook’s reaction to the decision, including any policy changes, could apply to the rest of Europe and the United States as well. However, Facebook has previously resisted broadly applying EU privacy protections to its users who do not reside in the EU. It could very well maintain separate positions on accessing deceased users’ accounts as well.
The prevailing standard in the United States is that third-party communications are protected under the Stored Communications Act, 18 U.S.C. §§ 2701-2712. This broad privacy protection is not only important for third parties, but also for online services themselves. Platforms such as Facebook can simply refuse to disclose, except under limited circumstances, and cite the shield of the Stored Communications Act.
A possible alternative, in addition to drawing a distinction for minors, that would still comply with the Stored Communications Act and ameliorate the issue of the Facebook graveyard would be allowing the inclusion of social media accounts in your will. Since over 10,000 Facebook users die every day, there is a pressing question of what to do with this every-increasing digital graveyard of accounts filled with personal information. Delaware adopted a law for fiduciary access to digital assets and digital accounts in 2014. Under this law, an individual can list social media access in their will, despite sites like Facebook not allowing such a transfer. There are already services to hand over social media account access after the user’s death. Furthermore, courts have held that users can consent to the disclosure of their online communications in cases such as In re Facebook, 923 F. Supp. 2d 1204 (N.D. Cal. 2012), and Ajemian v. Yahoo!, Inc., 84 N.E.3d 766 (Mass. 2017).
The seemingly impenetrable wall between Facebook accounts and the outside world has already been penetrated. Facebook divulges account information and private messages to government officials with a warrant. Facebook private data is subject to discovery requests in litigation. Providing for access in a user’s will would be another step in compliance with the law that would allow the user to use his own discretion and also forewarn third parties that their communications might be shared. While the exact privacy rights of children are trickier, following the BGH’s ruling, Facebook should craft a new policy to best meet the interests of the dead, the living, and privacy.
Michael Goodyear is a former ISLAT member and is currently a rising 2L at the University of Michigan Law School, where he is the President of Michigan’s Privacy and Technology Law Association.
Ransomware is gaining traction as one of the most significant cyber threats online. On May 12th, 2017, the ransomware “WannaCry” began infecting PCs all over the world. The impact of Wannacry is staggering, infecting over 150 countries and 300,000 computers. Ransomware is a type of malware that encrypts or locks your computer’s data and files for ransom. The use of Bitcoin is a very popular form of currency with cyber attackers, because the money is anonymized to prevent the extortionists from being tracked by federal and international authorities. Moreover, there is no guarantee that paying the ransom will give the infected user access to their computer. Thus, if you do not create a backup of your data, paying the ransom can lead to a costly or futile outcome and leave potentially sensitive data in the hands of clandestine criminals.
Federal Trade Commission Enforcement. In a November 2016 blog entry, the FTC warned that “a business’ failure to secure its networks from ransomware can cause significant harm to the consumers whose personal data is hacked. And in some cases, a business’ inability to maintain its day-to-day operations during a ransomware attack could deny people critical access to services like health care in the event of an emergency.” The FTC also highlighted that “a company’s failure to update its systems and patch vulnerabilities known to be exploited by ransomware could violate Section 5 of the FTC Act.” When data breach occurs, the FTC may also consider the accuracy of the security promises made to the consumer. Under Section 5 of the FTC Act, the “unfair or deceptive acts or practices” doctrine gives the FTC the authority to pursue legal actions against businesses and organizations that misrepresent security measures used to protect sensitive data.
Breach Notification Requirements. In the U.S., 48 States, the District of Columbia, U.S. Virgin Islands, Guam, and Puerto Rico contain laws that require notification to affected individuals in the event of a breach. Some States also require notification to regulators. Federal laws, such as the Health Insurance Portability and Accountability Act (“HIPPA”), also have specific breach notification requirements. Moreover, U.S. businesses and organizations that operate or sell products internationally may also be subjected to stricter notification laws. For example, on May 25th, 2018, E.U.’s upcoming General Data Protection Regulation (“GDPR”) will require notification to affected individuals “within 72 hours of first having become aware of the breach.” Penalties for businesses or organizations that violate the GDPR can be fined up to a maximum of 4% of annual global turnover or €20 Million (whichever is greater).
Understanding the applicable breach notification laws can save a business or organization from significant legal and monetary complications. The unfortunate reality is that ransomware may be the beginning of much more sophisticated and sinister malware attacks. Therefore, businesses and organizations that maintain personal data should ensure they are complying with data privacy and cyber security laws. With the high profitability and anonymity that ransomware provides for cyber criminals, there will certainly be more attacks in the future.
George Suh is a 3L at Chicago-Kent. He is the co-founder and current Vice President of Chicago-Kent’s Cyber Security and Data Privacy Society.
Alexa, Am I Violating Legal Ethics?
Thomson Reuters announced its release of Workplace Assistant, which allows attorneys to record, inquire about, and use a timer to calculate billing entries via Amazon Echo and Alexa-enabled devices. The new Workplace Assistant interacts with the existing Elite 3E platform used by law firms to manage workflow and to streamline tasks. Thomson Reuters indicates that Workplace Assistant “always works within the firm’s security walls.” Workplace Assistant does, however, interact with the Amazon environment, although Thomson Reuter’s considers the interaction “low touch,” which means very little interaction between Workplace Assistant and the Amazon environment. This minimal interaction, beyond a firm’s security walls, could draw ethical concerns for the attorneys who use the Alexa-enabled aspects of Workplace Assistant.
Alexa- enabled voice assistants, such as Amazon Echo and Amazon Dot, respond to voice requests from users. These devices either stream or record the voice requests to servers which access the requests and form responses. For the Alexa-enabled Amazon products, the wake-up word, “Alexa,” activates these voice assistants, which then respond to voice requests. Therefore, in order to hear the wake-up word, the voice assistant’s microphone must be active even when a user is not actually making a request, i.e., the voice assistant is listening, even when the device is not awake. When an Alexa-enabled product is used with the Workplace Assistant, the device is listening for the wake-up word inside the attorney’s office. The Workplace Assistant manages the voice requests regarding client billing with the client information from the Elite 3E platform, the law firm management software. Even if the Elite 3E platform is ultimately handling any voice requests pertaining to billing, it is not clear who is handling any other voice requests or who has access to the microphone when Alexa is not awake. This scenario requires investigation in order to comply with the American Bar Association’s Model Rules of Professional Conduct.
The American Bar Association’s Model Rule 1.6 pertaining to confidentiality of information in an attorney-client relationship indicates in part (c) that “a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client” (emphasis added.) The committee provides insight as to what defines reasonable efforts in Comment 18 to Model Rule 1.6, which requires attorneys to act competently to preserve confidentiality. In acting competently, attorneys know not to discuss confidential information in public places, with others outside of the legal team, or with those individuals with whom communication is not necessary to adequately represent clients. Because competent representation includes awareness of individuals (physically and electronically) present when discussing confidential information, the Workplace Assistant could pose a problem as to conclusively determining who is listening, or has access to, the microphone and its recordings on the Alexa-enabled device.
Model Rule 1.1 also requires that an attorney provide competent representation to clients and, in its comments, addresses technology used by attorneys. According to Comment 8 of Model Rule 1.1, this competency includes the attorney keeping up-to-date on changing law “including the benefits and risks associated with relevant technology.” Therefore, attorneys cannot blindly use technology without knowing the security measures and the possible ramifications on client representation. The benefit of the Workplace Assistant is the time saved in recording and inquiring about billing. The risk is having an active microphone within an attorney’s office able to record client-privileged information, which may be a risk that attorneys do not want to take.
However, Amazon does have another product, the Amazon Tap, which may lessen the risk associated with voice assistants but still allow attorneys to use the Workplace Assistant program. Although this device also uses Alexa to respond to voice requests, a wake-up word is not required because the user must touch the button on the top of the device to activate the microphone. Therefore, the microphone is not listening for the wake-up words, which alleviates some concerns regarding confidentiality.
Either way, attorneys may still hesitate to use any of these gadgets due to actual reactions from clients, who may step into the office for a meeting and see the microphone in an area where they want to discuss private, confidential information.
Peggy Wojkowski graduated from Chicago-Kent College of Law in May 2017. She will be joining a large IP boutique firm in September 2017 after sitting for the Illinois bar exam in July 2017.