Mandatory Disclosing of Minor's User Data to Minor's Guardian

Question

I was thinking of ideas for software projects to work on, and the one I thought to try brought an interesting legal question to mind. The idea was to create a collection of tools, such as a browser, file storage, email, and other similar services via a web interface. Acting similar to a remote computer. The idea is for the platform to minimise data collected and disclosed, to provide users with desired privacy. As a privacy concerned minor, I already go to extraordinary lengths to ensure my privacy, even in situations where I may not have any legal basis (such as against legal guardians on personal devices).

If I were to run this platform, what legal requirements would I be faced with in regards to disclosing personal information, if the account owner is a minor. To be more specific, what information, if any, am I required to disclose to a parent or guardian of the account holder without the account holder's explicit permission? Legally, would I be required to disclose information such as the content of files stored on the service, the browsing history of the user, or the communications the user had with other users and the contents of the aforementioned communication. Would I be required to possibly even grant access to the minor's account at request of a parent or guardian.

An added complexity to the legal questionability of mandatory releasing of minor's data to parents or guardians, what provisions apply if I (the service provider) am unable to provide access to such data. For example, if the platform (as I intend to) stores the data in encrypted mediums, that is unrecoverable by the platform. In this case, many mandatory release of minor data, if legally required, would be invalid since I would no longer be capable of disclosure.

This is excluding cases such as those that are similar to HIPPA Privacy Rules. For example, releasing data in case of imminent threat to their person or others. This is in regard to the case of a parent or guardian contacting the platform requesting access to the account holders data for unspecified reasons. At this point, would I have to disclose anything? Do I have to keep the account? Would I (the service) legally be able to close the account, if the account holder had retroactively requested account termination in attempt of unauthorised access.

Background

Some background on why I ask. As I said I am a minor, and I've very privacy concerned. I encrypted everything I save with a very long and complex password that only I know, change constantly, and never transcribe to clear-text medium. I talk to people and read about stories, how their parents would violate basic levels of privacy that should be expected, things like reading journals. That's why I ask if there are any legal requirements that I, if I were to deploy a platform such as this, to the guardians. I don't believe they have any right whatsoever to the content stored in a platform like this, since everyone deserves the right to privacy. However, legally, I wanted to know what I would be mandated to do.

Answer 1

What rights the guardians would have to compel disclosure will vary by jurisdiction -- in the US I believe this would be a matter of state law. But in at least some states I think the guardians could legally compel the site to disclose such data, if it were able to.

And it is very clear that law enforcement can compel such disclosure if a warrant has been issued. In some cases law enforcement may be able to compel disclosure even without a warrant, if there is good cause and exigent circumstances.

A third party who is engaged in legal action against the person who saved the information might be able to obtain a subpoena compelling the service to disclose at least some information. That would depend on the nature of the legal action, how documents stored on the service are or might be relevant, and the opinion of the judge of the case.

Of course if the information is encrypted and the service cannot recover it, it cannot be compelled to do so. It is unsettled when a party providing encryption software must comply with a demand to help breach the encryption. But then presumably the user must have the access key, and many users will not be able to retain it without writing it down, or will not choose good keys.

---

I encrypted everything I save with a very long and complex password that only I know, change constantly, and never transcribe to clear-text medium.

This may not actually be the best technique. Note that the strength of the encryption system is at least as important as the complexity of the password. Note that if you ever view the content, you are transcribing to clear-text, at least in memory, and the OS may write a copy to storage if virtual memory is enabled, as it normally is. Note that each time you change a password, the content must be decrypted and then re-encrypted, and there is a risk that the temporary clear-text version which will normally exist during the process may be stored without your knowledge.