BILL ANALYSIS Ó AB 691 Page 1 Date of Hearing: May 5, 2015 ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION Mike Gatto, Chair AB 691 (Calderon) - As Amended April 30, 2015 SUBJECT: The Privacy Expectation Afterlife and Choices Act (PEAC) SUMMARY: Establishes the Privacy Expectation Afterlife and Choices Act ("the Act") to establish rules for when electronic records or content from a deceased person's account with an electronic communication service (e.g., email provider) or remote computing service provider (e.g., social media website) can be disclosed to the executor or administrator of the deceased person's estate for purposes of administering the estate. Specifically, this bill: 1)Authorizes a probate court that has jurisdiction over the estate of a deceased person ("user") to issue a court order to an electronic communication service or remote computing service ("provider") requiring the provider to disclose certain types of information pertaining to the account of the deceased user that is stored with the provider, if the court makes all specified findings of fact required to enable the disclosure of that type of information. 2)With respect to a record of communications or other information pertaining to a deceased user's account, but not AB 691 Page 2 the contents of communications or stored contents, the probate court must find all of the following facts: a) The user is deceased. b) The deceased user was the subscriber to or customer of the provider. c) The account belonging to the deceased user has been identified with specificity, including a unique identifier assigned by the provider. d) There are no other owners or persons or entities who have registered with the provider with respect to the deceased user's account. e) Disclosure is not in violation of another applicable federal or state law. f) The request for disclosure is narrowly tailored to the purpose of administering the estate. g) The executor or administrator demonstrates a good faith belief that the information requested is relevant to resolve issues regarding assets or liabilities of the estate. h) The request seeks information spanning no more than 18 months prior to the date of death, or the requester has made a request for information that specifically requests data older than 18 months prior to the date of death. i) The request is not in conflict with the deceased user's will or other written, electronic, or oral expression of the deceased user's intent regarding access to or disposition of information contained in or regarding the user's account. AB 691 Page 3 3)With respect to the contents of communications or stored contents, the probate court must find all of the following facts: a) The findings required by Item 2(a) through 2(h) above; and b) The will of the decedent, or a choice made by the deceased user within the product or service or otherwise regarding how the user's contents can be treated after a set period of inactivity after the user's death, or other event evidences the decedent's express consent to the disclosure of the requested contents. 4)Clarifies that the court must make all of the above findings of facts based upon a sworn declaration of the personal representative, or based upon other admissible evidence. 5)Requires a provider to disclose to the executor or administrator of the estate the contents of the deceased user's account, to the extent reasonably available, only if the executor or administrator gives the provider all of the following: a) A written request for the contents of the deceased user's account; b) A copy of the death certificate of the deceased user; c) An order of the probate court with jurisdiction over the estate of the deceased that includes all of the findings required for disclosure of contents of communications or stored contents; (see Item (3) above) and, AB 691 Page 4 d) An order that the estate shall first indemnify the provider from any and all liability in complying with the order. 6)Prohibits a provider from being compelled to disclose a record or the contents of communications if any of the following apply: a) The deceased user expressed an intent to disallow disclosure through either deletion of the records or contents during the user's lifetime, or an affirmative indication, through a setting within the product or service, of how the user's records or the content of communications can be treated after a set period of inactivity or other event. b) The provider is aware of any indication of lawful access to the account after the date of the deceased user's death or that the account is not that of the deceased user. c) Disclosure would violate other applicable law, including, but not limited to, electronic communications privacy provisions or copyright law. 7)Provides that a provider served with an order compelling disclosure of subscriber records or contents may make a motion to quash or modify the order within a reasonable time after receiving the order, in which case the court shall do any of the following: a) Modify the order to the extent that the court finds that compliance with the order would cause an undue burden on the provider, or quash the order if the court finds that the order cannot be modified so as to avoid the undue AB 691 Page 5 burden. Further clarifies that a cost that the requester offers to pay shall not be considered when a court is making a determination whether a request constitutes an undue burden. b) Quash the order if any of the applicable required findings of fact (Items 2 and 3, above) are not met. c) Quash the order if the court finds, based upon the preponderance of the evidence submitted by the provider or any other person, that any of the circumstances set forth in Item 6 (above) apply. 8)Allows a provider to require the requester to pay the direct costs of producing a copy of the record or other information pertaining to the account of the deceased, when those records are not already available for production during the ordinary course of business. 9)Provides that disclosure of the contents of the deceased user's account to the executor or administrator of the estate shall be subject to the same license, restrictions, terms of service, and legal obligations, including copyright law, that applied to the deceased user. 10)Provides that nothing in this Act shall be construed to require a requesting party to assume control of a deceased user's account. 11)Protects a provider from liability for good faith compliance with a court order issued pursuant to the Act. 12)Defines a number of key terms, including "authorized user," "contents," "electronic communication," "record," and "undue AB 691 Page 6 burden," among others. EXISTING LAW: 1)Provides for the disposition of a testator's property by will. (Probate Code (PC) Section 6100 et seq.) 2)Provides that any part of the estate of a decedent not effectively disposed of by will passes to the decedent's heirs as prescribed. (PC 6400 et seq.) 3)Provides that title to a decedent's property passes on the decedent's death to the person to whom it is devised in the decedent's last will or, in the absence of such a devise, to the decedent's heirs as prescribed in the laws governing intestate succession. (PC 7000) 4)Provides that the decedent's property, including property devised by a will, is generally subject to probate administration, except as specified. (PC 7001) 5)Pursuant to the federal Electronic Communications Privacy Act, restricts the ability of an electronic communication service or remote computing service to share information with any party but the user. (18 U.S.C. Sections 2510-22) FISCAL EFFECT: None. This bill has been keyed non-fiscal by the Legislative Counsel. AB 691 Page 7 COMMENTS: 1)Purpose of this bill . This bill seeks to ensure that Californians have the right to decide what happens to their digital assets, including email, social media website content, electronic documents, and other records held in electronic form, after they die. This bill is author-sponsored. 2)Author's statement. According to the author, "Prior to the digital age, the memorabilia of our lives was stored in a cardboard box in our parent's attic or under their bed. Today, a significant portion of the information about our lives is kept online on our personal accounts. Whether it's Facebook, Twitter, YouTube or even email, the digital assets we 'own' are today's version of the photo albums, videos, and hand-written journals of yesterday." "Most people expect the contents of these online communications to remain private, even after they pass away; it's likely the recipients of those messages likely expect the same?With no statute currently in place in California protecting the digital assets of the newly deceased, families are left responsible for accessing their loved ones information, often times causing unnecessary financial and emotional burdens' during a time that is already painfully difficult. "This bill strikes a balance between providing a clear path for fiduciaries to access relevant information to handle the deceased person's estate, while respecting the privacy choices of not just the deceased person but those with whom the deceased was communicating." AB 691 Page 8 3)Giving consumers control over their personal privacy - even after death . In the common law legal systems of the United Kingdom and the United States, the law does not protect privacy after death - unless there is a statute to the contrary. According to the Restatement of Torts, "Except for the appropriation of one's name or likeness, an action for invasion of privacy can be maintained only by a living individual whose privacy is invaded." (Restatement (Second) of Torts, Section 6521(1977)) Huw Beverly-Smith, a legal writer on the subject of post-mortem rights, summarizes the reasoning behind the common law rule delicately: "Reputation and injured dignity are generally of no concern to a deceased person." (The Commercial Appropriation of Personality, Huw Beverly-Smith, Cambridge University Press, 2002, p. 124.) However, in today's digital world, society's expectations and values appear to have changed. According to a recent Zogby poll, over 70% of Americans said their private online communications and photos should remain private after they die, unless they gave prior consent for others to access. Only 15% said that estate attorneys should control their private communications and photos, even if they gave no prior consent for sharing. (Zogby Analytics Online Survey of Adults, Zogby Analytics, 2015, p. 45.) Over the last two decades privacy law in California, the United States, and other countries has seen robust development. The trend toward more privacy rights is undoubtedly in part a response to the increased risks of fraud, identity theft and other crimes that are made easier by the Internet and the massive shift away from paper and toward electronic and online management of data. This bill proposes to establish landmark privacy protections in an, as of yet, uncharted territory: post-mortem privacy. AB 691 Page 9 "Post-mortem privacy" is not a recognized legal term of art, but as one legal scholar posits, it may be termed "the right of a person to preserve and control what becomes of his or her reputation, dignity, integrity, secrets or memory after death." (Protecting Post-Mortem Privacy: Reconsidering the Privacy Interests of the Deceased in a Digital World," Lilian Edwards and Edina Harbinja, Cardozo Arts & Entertainment Law Journal, Vol. 32, No. 1, 2013.) This bill attempts to reflect current societal expectations and values about these matters after death by requiring estate executors and Internet, email and social media providers to live by default rules that preserve individual privacy rather than end it upon death. 4)Protection for digital records and even more protection for digital content . Under this bill, executors and online service providers would be required to respect the privacy choices a person makes in their online account controls as well as the explicit instructions a person leaves in their will or in other written, electronic or oral expressions of a person's intent. A provider could not release information until the executor of a deceased person's estate obtains a court order from the probate court, which oversees estate administration after death. AB 691 allows the probate court to issue an order granting access to a digital record and other information about a digital account, but not the contents of communications or stored contents, if the court makes a number of findings, including that an executor's request for access is "narrowly tailored" and demonstrates a "good faith belief" that the scope of the request is relevant to the process of settling the deceased person's estate. Further, the bill specifies that a court can only issue an order for the release of the contents of communications (or stored contents of an online account), if the person's will - or a choice made by the person within the product or service - evidences the person's express consent to the disclosure of the requested contents. The bill also gives providers the AB 691 Page 10 ability to deny a request for disclosure if the deceased person had deleted the requested contents during their lifetime or based on a person's user settings within the product or service regarding what should happen with the account after a set period of inactivity or after death. Generally speaking, this bill establishes an "opt-in" rule for access to digital assets after death, which means the default rule - if a person fails to make a conscious choice - is no post-mortem access to digital assets. 5)A competing proposal: the national model legislation . In 2014, the National Conference of Commissioners on Uniform State Laws (NCCUSL), completed work on a piece of model legislation, called the Fiduciary Access to Digital Assets Act, which essentially vests fiduciaries, such as estate executors and trustees, with the authority to access, manage and distribute digital assets after a person's death. In a nutshell, the NCUSSL model act establishes an "opt-out" rule for access to digital assets after death, which means the default rule - if a person fails to make a conscious choice during their life - is full post-mortem access to digital assets. While the NCCUSL model legislation has been introduced in at least 23 states, as of yet no state has adopted the model act. Because the model act provides an opt-out for access and AB 691 provides an opt-in, this bill could be viewed as significantly more protective of personal privacy rights than the national model legislation developed by NCUSSL. 6)No distinction for digital assets with economic or historical value . Usually a person's email or stored content on a social media website has only sentimental or, cynically speaking, gossip value. However, a celebrity or author's digital assets, such as photos, emails, letters and unpublished novels stored electronically, may represent significant economic AB 691 Page 11 value for a deceased person's estate. This bill does not appear to distinguish between digital assets that have economic value and those that have no economic value, nor does the bill address the fact that certain digital assets may have historical value and should therefore be retained and ultimately shared. The author and the Committee may wish to consider whether and how this bill should address these issues. 7)Arguments in support . The Center for Democracy and Technology (CDT) states that this bill "recognizes that digital content is different from physical records?An individual's digital estate might include bank accounts, photo albums, email accounts, text messages, voicemails, social media profiles, health and fitness data, and/or dating messages. The same person may have different preferences for each of these separate accounts?[this bill] creates a strong incentive for technology companies to develop tools that capture these preferences." 8)Double referral . This bill was double-referred to the Assembly Judiciary Committee where it was heard on April 28, 2015, and passed on a 10-0 vote. REGISTERED SUPPORT / OPPOSITION: Support American Online (AOL) AB 691 Page 12 Center for Democracy and Technology California Hispanic Chambers of Commerce Civil Justice Association of California (CJAC) Facebook Internet Association NetChoice Service Employees International Union (SEIU) TechNet Yahoo Opposition None on file. Analysis Prepared by:Jennie Bretschneider / P. & C.P. / (916) 319-2200 AB 691 Page 13