Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
In the case of a deceased relative, is there any law violation in any of these circumstances in relation to an online account (let's say google, facebook, twitter, msn, etc)?
Countries interested: USA, Mexico, Japan, UK
Does the intention matters until those points?
In the United Kingdom:
A person has no authority to access an online account of a deceased relative, unless this has been agreed with the operator of the website (etc). If a Power of Attorney over the deceased's financial affairs existed, this ceases upon death.
Using a person's login credentials without permission from the owner of the website would be a breach of the Computer Misuse Act 1990, as amended by Part 5 of the Police and Justice Act 2006, and Part 2 of the Serious Crime Act 2015.
Actus Reus
The offence is made out once a defendant has caused a computer, which would include his own computer, to perform a function with intent to secure access.
The access to the program or data which the accused intends to secure must be 'unauthorised' access.
Mens rea
There are two elements:
There must be knowledge that the intended access was unauthorised; and
There must have been an intention to secure access to any program or data held in a computer.
There has to be knowledge on the part of the offender that the access is unauthorised; mere recklessness is not sufficient. This covers not only hackers but also employees who deliberately exceed their authority and access parts of a system officially denied to them.
Crown Prosecution Service legal guidance
Additional note for accessing online banking and similar accounts:
A person who accessed a bank computer with the intention of transferring the deceased's funds to themself (such funds being the property of the estate, not the person) thus committing theft, would potentially be committing the further offence under Section 2 of the CMA of Unauthorised access with intent to commit or facilitate commission of further offences
If the person has a legitimate claim on the funds in the bank account, i.e. they are an executor or administrator of the estate, there is an established procedure to claim the funds from the bank. This does not include being given access to the deceased's accounts or statements, as these remain confidential. The bank will provide a closing balance at the date of death, together with a list of regular payments in/out of the account (those being parties the executor/administrator should advise of the death) together with a statement for any transactions after death ie during the period of executry of the estate.
There has to be knowledge on the part of the offender that the access is unauthorized : Who is the offended part here? If the access is done to provide information to the local police, for example, and all the family agrees, what is the worst case scenario? I doubt a US based company will sue someone in UK for doing so. I know it may depends on the country/state, but in general, has anyone been in legal trouble for doing so? Do you know of any case study?
In the US, it depends first on what the state law is, and second what platform policy is. There is a law, the Revised Fiduciary Access to Digital Assets Act, enacted in most states. Here is a summary of what that law does, and here is the version enacted by Washington. The Washington law makes an important distinction between the person's communications and their other digital assets. Both are stated in terms of the "custodian" (platform) disclosing information. In the case of a communication, you must have authority (e.g. be the personal representative) and prove that the person authorized access to the communications (or a court order, which would be granted only if reasonably necessary for administration of the estate). In the case of other digital assets (which would include lists of communications but not their contents), access is granted unless forbidden by the person: or, if required by the custodian. In other words, if you don't say one way or the other, only the content of communications are sealed, save for court order. But the platform itself can require proof that access is necessary to administer the estate.
Individual platforms may have provided something in their TOS regarding accessing a deceased's account, a number of which are summarized here p. 8 ff., but this was 6 years ago (before RUFADAA was circulated). None of these platforms addressed the matter of continuing to use an account with earlier permission, once the account holder dies. Instead, they simply say "we won't provide you with access to the account". The TOS probably allows the platform operators to block access in case of "suspicious activity". The Computer Fraud and Abuse Act does not say that permission to access an account is revoked upon death of an account holder, so if the person authorized you to access the account and did not revoke that authorization, you are authorized (eternally, or until the law or TOS changes). But each state has some such law, so there might be some "revocation on death" clause, somewhere. It may be contrary to a particular platform's TOS for a person other than the account owner to ever log in to the account.
