LONDON – From photos to personal posts and private messages, social media users leave a long digital trail behind them. Who owns that data when they die?
With about 1 in 3 people worldwide estimated to have a social media account, the question has become more pressing for legal experts.
It was brought to the fore last week by the family of a deceased teenage girl in Britain. The parents of Molly Russell, a 14-year-old who committed suicide in 2017, told media they had been unable to access data on her phone, including her Instagram account, which they said might hold clues to why she took her own life.
“It seems to me that the data on Molly’s phone should have become her parents’ property,” her father, Ian, told the BBC. “She died without a will, she was 14, and everything else quite naturally returns to us as her parents — and so should her data.”
Her family reportedly found she had been viewing material linked to anxiety, depression, self-harm and suicide, and her father has said Instagram’s algorithms enabled her to view more harmful content.
The Facebook-owned social media giant said it is against its policies for someone to log into another person’s account, but it would consider legitimate requests for family members to access information, provided there is a court order.
Britain, like most countries, has no laws on digital inheritance, which makes such cases complicated, said Edina Harbinja, a senior lecturer in media and privacy law at Birmingham’s Aston University.
As most social media accounts are used to send private messages, privacy is a key issue, and so are the different legal interpretations of what can be considered transferable property in the digital world, she said. “There is a complete legal mess there,” she said.
Under the EU’s General Data Protection Regulation (GDPR), a landmark privacy law adopted last year, individuals have the right to get a copy of their data held by internet companies, or ask that it be deleted.
But the legislation is no help in inheritance matters, as it applies only to the living, said Rowenna Fielding, an expert on data protection expert at the British consultancy Protecture.
This is partly because, unlike in the United States, the leading legal view in Europe is that personal data is not a type of property and as such cannot be sold or disposed of, legal experts said.
“The only owner of the personal data is the individual,” said Gabriel Voisin, a partner specializing in data protection and privacy at the international law firm Bird & Bird.
Personal data is any information relating to a person’s identity, like their name, address or religion.
“Organizations may receive this information because I provided them with it … but they are not (the) owners of my name. They are instead what we call ‘custodians’ of the information,” Voisin said.
But not everything people share online is personal data.
Other things, like photos or short compositions, are treated as intellectual property and should pass onto heirs following copyright rules, said Harbinja, a leading expert on post-mortem privacy. “The problem is how can they access that,” she said.
In France, people have the right to tell companies what do to with their data after they die. In Canada, the deceased’s executor can access digital assets by default.
In Germany, heirs have the right to access the data of their deceased relatives in full, after a court ruled last year that social media accounts can be inherited in the same way as letters.
In the United States, a law implemented by most states allows for executors to see whom the deceased communicated with and when, but not to read the messages unless authorized by a court or the departed account holder.
Tech companies have also come up with their own rules.
Google allows users to decide what data they want to share — and with whom — after their death.
If no provisions are made, the firm said, it can work with family members to close an account and may provide content in some circumstances, but its primary responsibility is to keep people’s information secure, safe and private.
Facebook and Instagram allow family members to request that an account be deleted or turned into a memorial page, where content remains visible but locked.
Facebook users can also nominate a “legacy contact” to look after their memorial accounts after they pass away. But although such curators can write posts or change profile pictures, they cannot log into the account or read messages.
Even when an account is deleted, Facebook and Instagram continue to store personal data for a period of time.
Such data could be of economic value, as social media companies rely on massive databases to train artificial intelligence and machine learning applications, said Harbinja.
But both Facebook and Instagram said they do not use data of deceased users to target ads more accurately.
Experts say it is just a matter of time before more countries pass legislation on the matter. But in the meantime, in places where rules are absent, what happens in the digital afterlife remains obscure.
“Solicitors are quite confused (in Britain) as to what happens, and they sometimes advise their clients to leave password and user names attached to their will, which is nonsense,” said Harbinja.
Wills are public documents in the country and passwords change, she noted, allowing for massive privacy violations.
Experts’ views on what an ideal system should look like vary.
Some, like David Haynes, a research fellow at London’s City University, fear that growing public resentment over cases of data misuse by social media could result in blanket requirements for all data to be automatically deleted after death.
“That would be a mistake,” said Haynes, as the account holder might have wished otherwise.
Harbinja said that everything purely personal should be deleted, but that heirs should be given the option to access copyrighted material and other assets of value.
Fielding, of Protecture, said that legislation would be difficult to apply, with many people holding different social accounts, sometimes under pseudonyms.
It would be easier to ask social platforms to provide users with an option to name a digital executor by default, she said.
“It won’t solve all the issues, and probably wouldn’t be taken up in large numbers by very young people, but it’s better than nothing,” she added.