Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

This bill would enact the Revised Uniform Fiduciary Access to Digital Assets Act, which would authorize a decedents personal representative or trustee to access and manage digital assets and electronic communications, as specified. The bill would authorize a person to use an online tool to give directions to the custodian of his or her digital assets regarding the disclosure of those assets. The bill would specify that, if a person has not used an online tool to give that direction, he or she may give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record. The bill would require a custodian of the digital assets to comply with a fiduciarys request for disclosure of digital assets or to terminate an account, except under certain circumstances, including when the decedent has prohibited this disclosure using the online tool. The bill would make custodians immune from liability for an act or omission done in good faith in compliance with these provisions.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

This bill would enact the Revised Uniform Fiduciary Access to Digital Assets Act, which would authorize a decedents personal representative or trustee to access and manage digital assets and electronic communications, as specified. The bill would authorize a person to use an online tool to give directions to the custodian of his or her digital assets regarding the disclosure of those assets. The bill would specify that, if a person has not used an online tool to give that direction, he or she may give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record. The bill would require a custodian of the digital assets to comply with a fiduciarys request for disclosure of digital assets or to terminate an account, except under certain circumstances, including when the decedent has prohibited this disclosure using the online tool. The bill would make custodians immune from liability for an act or omission done in good faith in compliance with these provisions.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

This bill would enact the Revised Uniform Fiduciary Access to Digital Assets Act, which would authorize a decedents personal representative or trustee to access and manage digital assets and electronic communications, as specified. The bill would authorize a person to use an online tool to give directions to the custodian of his or her digital assets regarding the disclosure of those assets. The bill would specify that, if a person has not used an online tool to give that direction, he or she may give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record. The bill would require a custodian of the digital assets to comply with a fiduciarys request for disclosure of digital assets or to terminate an account, except under certain circumstances, including when the decedent has prohibited this disclosure using the online tool. The bill would make custodians immune from liability for an act or omission done in good faith in compliance with these provisions.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

This bill would enact the Revised Uniform Fiduciary Access to Digital Assets Act, which would authorize a decedents personal representative or trustee to access and manage digital assets and electronic communications, as specified. The bill would authorize a person to use an online tool to give directions to the custodian of his or her digital assets regarding the disclosure of those assets. The bill would specify that, if a person has not used an online tool to give that direction, he or she may give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record. The bill would require a custodian of the digital assets to comply with a fiduciarys request for disclosure of digital assets or to terminate an account, except under certain circumstances, including when the decedent has prohibited this disclosure using the online tool. The bill would make custodians immune from liability for an act or omission done in good faith in compliance with these provisions.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

This bill would establish the Privacy Expectation Afterlife and Choices Act, which would authorize a probate court to order an electronic communication service or remote computing service provider, as defined, to disclose to the executor or administrator of the estate or the trustee of the trust a record or other information pertaining to the account of the deceased user that is in electronic storage with the provider. The bill would require the probate court to make specified findings in order to require this disclosure, including that the executor or administrator executor, administrator, or trustee demonstrates a good faith belief that the information requested is relevant to resolve issues regarding assets or liabilities of the estate. The bill would additionally require the court to find that the decedent expressed consent to the disclosure of the contents of communications or stored contents, as specified, in order to require the disclosure of those documents. The bill would permit a provider to disclose a decedents account information if the executor, administrator, or trustee gives the provider documents and information, as specified. The bill would additionally permit a provider to disclose contents of communications or stored contents if an executor, administrator, or trustee gives the provider documents and information, as specified, including a will or trust showing the decedents express consent for disclosure of the contents. The bill would allow a provider to require the requester to pay the direct costs of producing a copy of the record or other information pertaining to the account of the deceased, when those records are not already available for production during the ordinary course of business. The bill would exempt the provider from disclosure if the deceased user expressed an intent to disallow disclosure by either deleting the records or contents during the users lifetime, or affirmatively indicating, through a setting within the product or service, of how the users records or the content of communications can be treated after a set period of inactivity or other event. The bill would also exempt the provider from civil liability for compliance in good faith with a court order issued pursuant to disclosing records or contents as required or permitted under this act.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

This bill would establish the Privacy Expectation Afterlife and Choices Act, which would authorize a probate court to order an electronic communication service or remote computing service provider, as defined, to disclose to the executor or administrator of the estate a record or other information pertaining to the account of the deceased user that is in electronic storage with the provider. The bill would require the probate court to make specified findings in order to require this disclosure, including that the executor or administrator demonstrates a good faith belief that the information requested is relevant to resolve issues regarding assets or liabilities of the estate. The bill would additionally require the court to find that the decedent expressed consent to the disclosure of the contents of communications or stored contents, as specified, in order to require the disclosure of those documents. The bill would allow a provider to require the requester to pay the direct costs of producing a copy of the record or other information pertaining to the account of the deceased, when those records are not already available for production during the ordinary course of business. The bill would exempt the provider from disclosure if the deceased user expressed an intent to disallow disclosure by either deleting the records or contents during the users lifetime, or affirmatively indicating, through a setting within the product or service, of how the users records or the content of communications can be treated after a set period of inactivity or other event. The bill would also exempt the provider from civil liability for compliance in good faith with a court order issued pursuant to this act.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

This bill would establish the Privacy Expectation Afterlife and Choices Act, which would authorize a probate court to order an electronic communication service or remote computing service provider, as defined, to disclose to the executor or administrator of the estate a record or other information pertaining to the account of the deceased user. user that is in electronic storage with the provider. The bill would require the probate court to make specified findings in order to require this disclosure, including that the executor or administrator demonstrates a good faith belief that the information requested is relevant to resolve issues regarding assets or liabilities of the estate. The bill would additionally require the court to find that the decedent expressed consent to the disclosure of the contents of communications or stored contents, as specified, in order to require the disclosure of those documents. The bill would exempt the provider from disclosure if the deceased user expressed an intent to disallow disclosure by either deleting the records or contents during the users lifetime, or affirmatively indicating, through a setting within the product or service, of how the users records or the content of communications can be treated after a set period of inactivity or other event. The bill would also exempt the provider from civil liability for compliance in good faith with a court order issued pursuant to this act.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

This bill would establish the Privacy Expectation Afterlife and Choices Act, which would require authorize a probate court to order an electronic communication service or remote computing service provider, as defined, to disclose to the executor or administrator of the estate a record or other information pertaining to the account of the deceased user, but not the contents of communications or stored contents. user. The bill would require the probate court to make specified findings in order to require this disclosure, including that the executor or administrator demonstrates a good faith belief that account records are the information requested is relevant to resolve issues regarding fiscal assets of the estate. The bill would additionally require the court to find that the decedent expressed consent to the disclosure of the contents of communications or stored contents, as specified, in order to require the disclosure of those documents. The bill would exempt the provider from disclosure if the deceased user expressed a different intent through an intent to disallow disclosure by either deletion of deleting the records or contents during the users lifetime, or affirmatively indicating, through a setting within the product or service, how the users records or the content of communications can be treated after a set period of inactivity or other event and event. The bill would also exempt the provider from civil liability for compliance in good faith with a court order issued pursuant to this act.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

This bill would establish the Privacy Expectation Afterlife and Choices Act, which would require a probate court to order an electronic communication service or remote computing service provider, as defined, to disclose to the executor or administrator of the estate a record or other information pertaining to the deceased user, but not the contents of communications or stored contents. The bill would require the probate court to make specified findings in order to require this disclosure, including that the executor or administrator demonstrates a good faith belief that account records are relevant to resolve issues regarding fiscal assets of the estate. The bill would exempt the provider from disclosure if the deceased user expressed a different intent through either deletion of the records or contents during the users lifetime, or affirmatively indicating, through a setting within the product or service, how the users records or the content of communications can be treated after a set period of inactivity or other event and would exempt the provider from civil liability for compliance in good faith with a court order issued pursuant to this act.

Existing law provides for the disposition of a testators property by will. Existing law also provides for the disposition of that portion of a decedents estate not disposed of by will. Existing law provides that the decedents property, including property devised by a will, is generally subject to probate administration, except as specified.

This bill would establish the Privacy Expectation Afterlife and Choices Act, which would require a probate court to order an electronic communication service or remote computing service provider, as defined, to disclose to the executor or administrator of the estate a record or other information pertaining to the deceased user, but not the contents of communications or stored contents. The bill would require the probate court to make specified findings in order to require this disclosure, including that the executor or administrator demonstrates a good faith belief that account records are relevant to resolve issues regarding fiscal assets of the estate. The bill would exempt the provider from disclosure if the deceased user expressed a different intent through either deletion of the records or contents during the users lifetime, or affirmatively indicating, through a setting within the product or service, how the users records or the content of communications can be treated after a set period of inactivity or other event and would exempt the provider from civil liability for compliance in good faith with a court order issued pursuant to this act.

CONCURRENCE IN SENATE AMENDMENTS

CSA2 Bill Id:AB 691

Author:(Calderon)

As Amended Ver:June 14, 2016

Majority vote

(vote not relevant)

(Jud.)

Original Committee Reference: JUD.

SUMMARY: Establishes the Revised Uniform Fiduciary Access to Digital Access Act (RUFADAA) to specify rules for the disclosure of electronic information from a custodian of a person's digital assets (custodian) to the personal representative of the estate of a deceased user (representative) or trustee of the deceased user's trust (trustee) for the purpose of administering the estate or trust.

The Senate amendments delete the Assembly version of this bill, and instead:

1. Establish the RUFADAA and authorizes a decedent's personal representative or trustee (fiduciary) to access and manage digital assets and electronic communications, as specified.
2. Authorize a person to use an online tool to give directions to the custodian of his/her digital assets regarding the disclosure of those assets.
3. Specify that, if a person has not used an online tool to give that direction, he or she may give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record.
4. Require a custodian, as specified, of the digital assets to comply with a fiduciary's request for disclosure of digital assets to terminate an account, except under certain circumstances, including when the decedent has prohibited this disclosure using the online tool.
5. Specify that a user's direction through the online tool or testamentary document would override a contrary provision in a terms-of-service agreement.
6. Provide that a fiduciary's or designated recipient's access to digital assets may be modified or eliminated by a user, by federal law, or by a terms-of-service agreement when the user has not provided any direction as specified by this bill.
7. Authorize the custodian, in its sole discretion, to do any of the following when disclosing the digital assets of a user:
   1. Grant the fiduciary or designated recipient full access to the user's account;
   2. Grant the fiduciary or designated recipient partial access to the user's account sufficient to perform the tasks with which the fiduciary or designated recipient is charged; and
   3. Provide the fiduciary or designated recipient with a copy in a record of any digital asset that, on the date the custodian received the request for disclosure, the user could have accessed if the user were alive and had full capacity and access to the account.
8. Authorize a custodian to assess a reasonable administrative charge for the cost of disclosing digital assets and would not require a custodian to disclose a digital asset deleted by a user.
9. Provide that if a user directs or a fiduciary or designated recipient requests a custodian to disclose some, but not all, of the user's digital assets, the custodian need not disclose the assets if segregation of the assets would impose an undue burden on the custodian.
10. Authorize the custodian, fiduciary, or designated recipient to petition the court for an order, as specified, if the custodian believes the direction or request imposes an undue burden.
11. With respect to the content of electronic communications of the user:
    1. Provide that, if a deceased user consented to or a court directs disclosure of the content of electronic communications of the user, the custodian must disclose to the personal representative of the estate of the user the content of an electronic communication sent or received by the user if the personal representative gives to the custodian specified forms of documentation, including, among other things: i) a written request for disclosure; ii) a certified copy of the user's death certificate; iii) a certified copy of the letter of appointment of the representative; and iv) a copy of the user's will, trust, or other record evidencing the user's consent to disclosure, unless the user provided direction using an online tool.
    2. Provide that, unless otherwise ordered by the court, directed by the user, or provided in a trust, the custodian must disclose to a trustee that is not an original user of an account the content of an electronic communication sent or received by an original or successor user and carried, maintained, processed, received, or stored by the custodian in the account of the trust if the trustee gives to the custodian specified forms of documentation.
12. With respect to the catalogue of electronic communication sent or received by the user, and digital assets, other than the content of electronic communications, of the user:
    1. Provide that, unless the user prohibited disclosure of digital assets or the court directs otherwise, the custodian must disclose to the personal representative of the estate of a deceased user a catalogue of electronic communications sent or received by the user and digital assets, other than the content of electronic communications, of the user, if the personal representative gives to the custodian specified documentation, including, among other things: i) a written request for disclosure; ii) a certified copy of the user's death certificate; and iii) a certified copy of the letter of appointment of the representative.
    2. Provide that, unless otherwise ordered by the court, directed by the user, or provided in a trust, a custodian must disclose, to a trustee that is not an original user of an account, the catalogue of electronic communications sent or received by an original or successor user and stored, carried, or maintained by the custodian in an account of the trust and any digital assets, other than the content of electronic communications, in which the trust has a right or interest if the settlor of the trust is deceased and the trustee gives to the custodian specified documentation.
13. Provide that the legal duties imposed on a fiduciary charged with managing tangible property apply to the management of digital assets, including all of the following: a) the duty of care; b) the duty of loyalty; and c) the duty of confidentiality.
14. Provide that a fiduciary with authority over the property of a decedent or settlor has the right of access to any digital asset in which the decedent or settlor had a right or interest, as specified.
15. Require a custodian, not later than 60 days after receipt of the information required, as specified, to comply with a request from a fiduciary or designated recipient to disclose digital assets or terminate an account. Further provides that if the custodian fails to comply with a request, the fiduciary or designated recipient may apply to the court for an order directing compliance.
16. Make disclosure of the contents of the deceased user's or settlor's account to a fiduciary of the deceased user or settlor subject to the same license, restrictions, terms of service, and legal obligations, including copyright law, that applied to the deceased user or settlor.

FISCAL EFFECT: None

COMMENTS: In July 2014, the National Conference of Commissioners on Uniform State Laws (NCCUSL) approved the Uniform Fiduciary Access to Digital Assets Act (UFADAA), which was recommended for enactment in all states "to vest fiduciaries with the authority to access, control, or copy digital assets and accounts[,] ... remove barriers to a fiduciary's access to electronic records[,] and to leave unaffected other law, such as fiduciary, probate, trust, banking, investment, securities, and agency law." UFADAA was recently revised to clarify the application of federal privacy laws and give legal effect to an account holder's instructions for the disposition of digital assets. According to NCCUSL, the 2014 UFADAA provided fiduciaries with default access to all digital information, but the Revised UFADAA protects the contents of electronic communications from disclosure without the user's consent, and fiduciaries can still access other digital assets unless prohibited by the user.

Prior versions of this bill would have enacted the Privacy Expectation Afterlife and Choices Act, which is an alternative approach to disclosure of a decedent's electronic information. As amended in the Senate, this bill adopts a modified version of the RUFADAA and attempts to provide a clear legal framework to help probate courts resolve questions about how to balance competing privacy and estate administration concerns when a decedent's estate representative, for the purpose of settling the estate, seeks information, records, digital assets, or electronic communications, from, typically, the email or social media account of the deceased user.

NCCUSL states that the RUFADAA was recently approved and represents a consensus reached among stakeholders, including technology firms, privacy advocates, bankers, and the trust and estate bar. NCCUSL asserts that the "consensus was the result of a concerted effort by all parties over the last few months to agree on a reasonable regulatory framework that will balance the privacy interests of internet users with the need for fiduciaries to perform their tasks and ensure the orderly transfer of a decedent's assets to heirs. It gives legal effect to an internet user's wishes when they are known, and provides reasonable default rules that apply if the user has not expressed a contrary intent. The act represents the best opportunity to enact uniform legislation for an industry that operates in every state." To date, 10 states (Colorado, Florida, Idaho, Indiana, Michigan, Oregon, Tennessee, Washington, Wisconsin, and Wyoming) have enacted RUFADAA, and at least 18 other states have introduced RUFADAA legislation this year.

Scope of the bill. Unlike the broader approach of the RUFADAA model act adopted by the NCCUSL, the scope of this bill does not include powers of attorney, trusts, and conservatorships where the principal, trustor, and conservatee, respectively, are still alive. Instead, this bill has a more limited scope that applies only to situations where a person has died, and electronic information is being requested from the custodian by a decedent's personal representative, administrator, executor, or trustee for the purpose of ascertaining the decedent's assets and liabilities.

Disclosure of electronic communications. This bill provides protections for a deceased user's private electronic communications by establishing the circumstances under which the custodian of the electronic communications could disclose those communications. This bill establishes a three-tier priority system for determining the user's intent for disclosure of his or her electronic communications.

First in priority, this bill authorizes disclosure pursuant to the user's designation through an online tool. This tool provides the most current reflection of the user's intent for disclosure to another person. Second, the user can provide directions in an estate plan for the disposition of the user's digital assets. The custodian would then be able to rely on the testamentary document containing these disclosure instructions, which would then have legal effect pursuant to this bill. Finally, if the user did not provide any direction regarding disclosure of digital assets, the terms-of-service governing the account would apply. If the terms-of-service do not address fiduciary access to digital assets, the default rules provided in this bill would apply. Opponents assert that, contrary to what the bill provides, an online tool should take precedence over a user's testamentary will only if the online tool is used later in time after the will is executed.

Documentation needed for disclosure once authorization established. Authorization of disclosure is not alone sufficient to compel disclosure under this bill; additional documentation must be provided to the custodian by the representative of the decedent's estate. With respect to the content of electronic communications sent or received by the user, the bill provides that if a deceased user consented to or a court directs disclosure of such content, the custodian make such disclosure to the personal representative of the estate of the user if the personal representative gives to the custodian all of the following: 1) a written request for disclosure in physical or electronic form; 2) a certified copy of the death certificate of the user; 3) a certified copy of the letter of appointment of the representative, a small-estate affidavit, or court order; and 4) a copy of the user's will, trust, power of attorney, or other record evidencing the user's consent to disclosure of the content of electronic communications, unless the user provided direction using an online tool (in which case the online tool evidences the user's content, making this documentation unnecessary).

With respect to the catalogue of electronic communications sent or received by the user and digital assets other than the content of electronic communications, the bill requires the custodian to make such disclosure to the personal representative unless the user prohibited disclosure of digital assets or the court directs otherwise. More specifically, if the user did not prohibit such disclosure and there is no contrary direction from the court, then under this bill the custodian shall make the disclosure if the personal representative has given the custodian all of the following: 1) a written request for disclosure in physical or electronic form; 2) a certified copy of the death certificate of the user; and 3) a certified copy of the letter of appointment of the representative, a small-estate affidavit, or court order. The bill specifies similar documentation relevant to trusts to be provided to the custodian by a trustee seeking disclosure of either the catalogue or content of electronic communications.

For both the content and catalogue of electronic communications, the bill also requires the personal representative to provide any of the following additional documentation, if requested by the custodian: 1) a number, user name, username, address, or other unique subscriber or account identifier assigned by the custodian to identify the user's account; 2) evidence linking the account to the user; 3) an affidavit stating that disclosure of the user's digital assets is reasonably necessary for estate administration; and 4) an order of the court making certain findings, as specified. Opponents of the bill assert that some of these items of information — particularly the unique subscriber information or other evidence linking the account to the decedent for which records are being requested — should be required to be provided in all cases rather than provided only if requested by the custodian. They also recommend that the bill should require the fiduciary to show that the information contained in the account is necessary for the administration of the estate, and not just in cases where the custodian has requested production of a court order making such a finding.

Terms-of-service agreements. As discussed above, if the user did not provide any direction regarding disclosure of digital assets through an online tool or testamentary document (e.g. a will), then under the third-tier of the rule, the terms-of-service agreement governing the account would apply. This bill does not change or impair a right of a custodian or a user under a terms-of-service agreement to access and use digital assets of a user, and does not give a fiduciary or designated recipient any new or expanded rights other than those held by the user for whom, or for whose estate or trust, the fiduciary or designated recipient acts or represents. This bill provides that a fiduciary's or designated recipient's access to digital assets may be modified or eliminated by a user, by federal law, or by a terms-of-service agreement when the user has not provided any direction, as specified. Opponents, contend that the bill will ultimately allow custodians to freely control the release and retention of digital assets under the terms of service, because most users will not have a will or make use of an online tool.

Author's intent to narrow grant of immunity from liability provided to custodians for compliance with this bill. As currently in print, this bill simply provides that "a custodian and its officers, employees, and agents are immune from liability for an act or omission done in good faith in compliance with this part [i.e. the entirety of RUFADAA]." Probate Code Section 881(f), as proposed by this bill, would grant custodians broad immunity from liability as long as they act in good faith in complying with the Act—with no exception even for conduct amounting to gross negligence or willful or wanton misconduct. Opponents of the bill contend that the broad grant of immunity in this bill gives custodians no incentive to act responsibly, and increases the probability that cases of privacy invasion will occur since there will be little consequence for careless behavior, or even gross negligence.

While the NCCUSL's intent may have been to protect the custodian from liability for disclosure of a digital asset as long as the custodian was acting in good-faith compliance, the Judiciary Committee has a long history of ensuring that legislation it approves does not provide blanket immunity from liability for acts rising to the level of gross negligence or willful or wanton misconduct, even when done "in good faith." (See, e.g. AB 83 (Feuer), Chapter 77, Statutes of 2009, amending the California "Good Samaritan" statute to grant qualified immunity to any person who renders medical or non-medical aid in an emergency, so long as that person acts in good faith and not for compensation, but specifically exempting gross negligence and willful or wanton misconduct.)

In order to ensure that this Act, should it become law, does not immunize disclosure of information that amounts to gross negligence or willful or wanton misconduct, the author has agreed to take steps to revise the immunity provisions proposed by this bill in Probate Code Section 881(f). Because this bill cannot be amended in this House to address this concern, the author instead proposes that another bill, SB 873 (Beall) of the current legislative session, be amended to accomplish this purpose. Specifically, it is the author's intent that SB 873 (of which he is a principal co-author) shall be enacted subsequent, and as a companion, to this bill so that if this bill, is chaptered, then SB 873 shall also be chaptered to replace the version of Section 881 of the Probate Code in this bill. In other words, it is the author's intent that SB 873 enacts the ultimate language of Section 881, namely, to exempt gross negligence and willful or wanton misconduct from any immunity from liability for custodians provided by this Act.

Analysis Prepared by: Anthony Lew / JUD. / (916) 319-2334 FN: 0004832

Date of Hearing: August 23, 2016

ASSEMBLY COMMITTEE ON JUDICIARY

Mark Stone, Chair

ABPCA Bill Id:AB 691

Author:(Calderon) – As Amended Ver:June 14, 2016

FOR CONCURRENCE

SUBJECT: REVISED UNIFORM FIDUCIARY ACCESS TO DIGITAL ASSETS ACT

KEY ISSUE: SHOULD CALIFORNIA enact THE REVISED UNIFORM FIDUCIARY ACCESS TO DIGITAL ASSETS ACT (RUFADAA), DEVELOPED BY THE UNIFORM LAW COMMISSION FOR ADOPTION IN all FIFTY STATES, IN ORDER TO PROVIDE GUIDANCE to custodians of digital assets and representatives of decedents' estates regarding THE DISCLOSURE OF a decedent’s ELECTRONIC COMMUNICATIONS AND digital assets?

SYNOPSIS

Current state law addresses the disposition of a person's property and assets through a will or through intestate succession, but is still inadequate to address many questions concerning the right to access electronic assets or communications that may be necessary to settle the estate of a deceased user. For example, who gets access to our social media and email accounts after we die? And what happens when the content of a decedent's electronic communications, stored on a provider's server, is needed by the decedent's representative to properly settle the decedent’s estate? Service providers report being constrained by federal electronic communications privacy laws that restrict to whom, other than the account holder, they may disclose the contents or records of communications. The response of state courts, according to proponents of the bill, is often a confusing mix of contract law, property law, and privacy law.

Prior versions of this bill would have enacted the California-specific Privacy Expectation Afterlife and Choices (PEAC) Act, but was ultimately held in the Senate at the end of 2015. As amended in the Senate earlier this year, however, this bill instead seeks to enact a modified version of the Revised Uniform Fiduciary Access to Digital Access Act (RUFADAA), originally developed by the Uniform Law Commission for passage in all fifty states. Consequently, the Judicial Council, the Trust and Estates Section of the State Bar (TEXCOM), and the California Judges Association have removed their opposition and are now neutral on this bill.

This bill, backed by the Internet Association and a host of online companies, seeks to provide a framework for custodians and fiduciaries to work out access issues on their own and limits court involvement to an option of last resort, rather than requiring early court involvement in most cases to authorize the release of digital assets. First, the bill authorizes a decedent’s personal representative or trustee (fiduciary) to access and manage digital assets and electronic communications, as specified. This bill authorizes a person to use an online tool to give directions to the custodian of his or her digital assets for the disclosure of those assets, and also permits a person to give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record if he or she has not used an online tool to do so. The bill establishes a three-tiered system for determining the user's intent for disclosure of his or her electronic communications, with first priority given to the user's designation through an online tool, followed in second priority by any directions specified by the user in an estate plan for the disposition of his or her digital assets. Finally, if the user did not provide any direction regarding disclosure of digital assets, the terms-of-service governing the account apply. Once authorization of disclosure by the decedent is determined, additional documentation, as specified, must be given to the custodian by the representative or trustee of the decedent's estate before disclosure is compelled. The bill also seeks to establish that a fiduciary owes a duty of confidentiality to the decedent, in addition to the duties of care and loyalty.

As currently in print, this bill would broadly immunize custodians from liability for any act or omission done in good faith in compliance with these provisions. In order to address the Committee's concern that this Act, should it become law, would immunize the disclosure of information in a manner that amounts to gross negligence or willful or wanton misconduct, the author has agreed to take steps to revise the immunity provisions at issue, as provided in subdivision (f) of Probate Code Section 881 in this bill. Because this bill can no longer be amended in this House, the author instead proposes that another bill, Senate Bill 873, serve as companion legislation to this bill and be appropriately amended to address the Committee's concerns about immunity from liability. Amendments to SB 873, which is to be heard by this Committee in the same hearing as this bill, reflect the author's agreement and intent to replace the version of Section 881 in this bill with the version of Section 881 provided in that legislation in the event that it is chaptered into law by the Governor.

The bill continues to be opposed by the ACLU and other privacy advocates, who believe it still allows disclosure of digital assets and electronic communications without sufficient safeguards, and allows custodians to dictate terms of disclosure and override contrary directions expressed by users, among other things.

SUMMARY: Establishes the Revised Uniform Fiduciary Access to Digital Access Act (RUFADAA) to specify rules for the disclosure of electronic communications from a custodian of a person's digital assets (custodian) to the personal representative of the estate of a deceased user (representative) or trustee of the deceased user's trust (trustee) for the purpose of administering the estate or trust. Specifically, this bill:

1. Authorizes a decedent's personal representative or trustee (fiduciary) to access and manage digital assets and electronic communications, as specified.
2. Authorizes a person to use an online tool to give directions to the custodian of his/her digital assets regarding the disclosure of those assets.
3. Specifies that, if a person has not used an online tool to give that direction, he or she may give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record.
4. Requires a custodian, as specified, of the digital assets to comply with a fiduciary's request for disclosure of digital assets to terminate an account, except under certain circumstances, including when the decedent has prohibited this disclosure using the online tool.
5. Specifies that a user's direction through the online tool or testamentary document would override a contrary provision in a terms-of-service agreement.
6. Provides that a fiduciary's or designated recipient's access to digital assets may be modified or eliminated by a user, by federal law, or by a terms-of-service agreement when the user has not provided any direction as specified by this bill.
7. Authorizes the custodian, in its sole discretion, to do any of the following when disclosing the digital assets of a user:
   1. Grant the fiduciary or designated recipient full access to the user's account;
   2. Grant the fiduciary or designated recipient partial access to the user's account sufficient to perform the tasks with which the fiduciary or designated recipient is charged; and
   3. Provide the fiduciary or designated recipient with a copy in a record of any digital asset that, on the date the custodian received the request for disclosure, the user could have accessed if the user were alive and had full capacity and access to the account.
8. Authorizes a custodian to assess a reasonable administrative charge for the cost of disclosing digital assets and would not require a custodian to disclose a digital asset deleted by a user.
9. Provides that if a user directs or a fiduciary or designated recipient requests a custodian to disclose some, but not all, of the user's digital assets, the custodian need not disclose the assets if segregation of the assets would impose an undue burden on the custodian.
10. Authorizes the custodian, fiduciary, or designated recipient to petition the court for an order, as specified, if the custodian believes the direction or request imposes an undue burden.
11. With respect to the content of electronic communications of the user:
    1. Provides that, if a deceased user consented to or a court directs disclosure of the content of electronic communications of the user, the custodian must disclose to the personal representative of the estate of the user the content of an electronic communication sent or received by the user if the personal representative gives to the custodian specified forms of documentation, including, among other things: i) a written request for disclosure; ii) a certified copy of the user's death certificate; iii) a certified copy of the letter of appointment of the representative; and iv) a copy of the user's will, trust, or other record evidencing the user's consent to disclosure, unless the user provided direction using an online tool.
    2. Provides that, unless otherwise ordered by the court, directed by the user, or provided in a trust, the custodian must disclose to a trustee that is not an original user of an account the content of an electronic communication sent or received by an original or successor user and carried, maintained, processed, received, or stored by the custodian in the account of the trust if the trustee gives to the custodian specified forms of documentation.
12. With respect to the catalogue of electronic communication sent or received by the user, and digital assets, other than the content of electronic communications, of the user:
    1. Provides that, unless the user prohibited disclosure of digital assets or the court directs otherwise, the custodian must disclose to the personal representative of the estate of a deceased user a catalogue of electronic communications sent or received by the user and digital assets, other than the content of electronic communications, of the user, if the personal representative gives to the custodian specified documentation, including, among other things: i) a written request for disclosure; ii) a certified copy of the user's death certificate; and iii) a certified copy of the letter of appointment of the representative.
    2. Provides that, unless otherwise ordered by the court, directed by the user, or provided in a trust, a custodian must disclose, to a trustee that is not an original user of an account, the catalogue of electronic communications sent or received by an original or successor user and stored, carried, or maintained by the custodian in an account of the trust and any digital assets, other than the content of electronic communications, in which the trust has a right or interest if the settlor of the trust is deceased and the trustee gives to the custodian specified documentation.
13. Provides that the legal duties imposed on a fiduciary charged with managing tangible property apply to the management of digital assets, including all of the following: a) the duty of care; b) the duty of loyalty; and c) the duty of confidentiality.
14. Provides that a fiduciary with authority over the property of a decedent or settlor has the right of access to any digital asset in which the decedent or settlor had a right or interest, as specified.
15. Requires a custodian, not later than 60 days after receipt of the information required, as specified, to comply with a request from a fiduciary or designated recipient to disclose digital assets or terminate an account. Further provides that if the custodian fails to comply with a request, the fiduciary or designated recipient may apply to the court for an order directing compliance.
16. Makes disclosure of the contents of the deceased user's or settlor's account to a fiduciary of the deceased user or settlor subject to the same license, restrictions, terms of service, and legal obligations, including copyright law, that applied to the deceased user or settlor.

EXISTING LAW:

1. Provides for the disposition of a testator’s property by will. (Part 1 of Division 6 of the Probate Code, commencing with Section 6100.)
2. Provides that any part of the estate of a decedent not effectively disposed of by will passes to the decedent’s heirs as prescribed. (Part 2 of Division 6 of the Probate Code, commencing with Section 6400.)
3. Provides that title to a decedent’s property passes on the decedent’s death to the person to whom it is devised in the decedent’s last will or, in the absence of such a devise, to the decedent’s heirs as prescribed in the laws governing intestate succession. (Probate Code Section 7000.)
4. Provides that the decedent’s property, including property devised by a will, is generally subject to probate administration, except as specified. (Probate Section 7001.)
5. Pursuant to the federal Electronic Communications Privacy Act, restricts the ability of an electronic communication service or remote computing service to share information with any party but the user. (18 U.S.C. §§ 2510-22.)

FISCAL EFFECT: As currently in print this bill is keyed non-fiscal.

COMMENTS: There can be no doubt that the number of people who use electronic communication and social media has increased astronomically in recent years, and continues to increase as new services and platforms are developed and introduced. In 2014, it was estimated that there were over 900 million Facebook users, over 550 million users of Twitter, and hundreds of millions more who use services like Google or Yahoo to send email, pay their bills electronically, or store important documents or pictures. For many users, social media and electronic communications have expanded into almost every area of daily life, often in ways not previously considered. As a result, lawmakers are increasingly faced with novel policy questions that arise from ways in which social media and the Internet impact our daily lives.

In focusing on the impact of social media and the Internet on our daily lives, perhaps not enough attention has been paid to this increasingly important question: What should happen to all of our email and social media accounts after we die? Current law addresses the disposition of a person's property and assets through a will or through intestate succession, but is still inadequate to address many questions with respect to rights to electronic assets or communications that may be necessary to administrate the estate of a deceased user. For example, under what circumstances should the administrator of an estate be able to access the contents of the decedent’s electronic communications? Should the administrator of an estate be able to access the entire history of a decedent’s online stored content, potentially even contents not needed to settle the estate? Should a person’s privacy settings that restrict the audience that may view a person’s content during life be honored after death? This bill, introduced at the request of the Internet Association and TechNet, seeks to provide a clear legal framework to help courts resolve some of these questions. According to the author:

With no statute currently in place in California protecting the online information of the newly deceased, families are left responsible for accessing their loved ones information, often times causing unnecessary financial and emotional burdens during a time that is already painfully difficult. AB 691 addresses this issue by striking a balance between providing a clear path for fiduciaries to access relevant information to handle the deceased person’s estate, while respecting the privacy choices of not just the deceased person but those with whom the deceased was communicating.

Background on RUFADAA, the uniform legislation sought to be enacted by this bill. In July 2014, the National Conference of Commissioners on Uniform State Laws (NCCUSL, or "Uniform Law Commission") approved the Uniform Fiduciary Access to Digital Assets Act (UFADAA), which was recommended for enactment in all states "to vest fiduciaries with the authority to access, control, or copy digital assets and accounts[,] ... remove barriers to a fiduciary's access to electronic records[,] and to leave unaffected other law, such as fiduciary, probate, trust, banking, investment, securities, and agency law." UFADAA was recently revised to clarify the application of federal privacy laws and give legal effect to an account holder's instructions for the disposition of digital assets. According to NCCUSL, the 2014 UFADAA provided fiduciaries with default access to all digital information, but the Revised Act (RUFADAA) protects the contents of electronic communications from disclosure without the user's consent, and fiduciaries can still access other digital assets unless prohibited by the user.

NCCUSL states that RUFADAA was recently approved at the statewide level and represents a consensus reached among stakeholders, including technology firms, privacy advocates, bankers, and the trust and estate bar. NCCUSL asserts that the "consensus was the result of a concerted effort by all parties over the last few months to agree on a reasonable regulatory framework that will balance the privacy interests of internet users with the need for fiduciaries to perform their tasks and ensure the orderly transfer of a decedent's assets to heirs. It gives legal effect to an internet user's wishes when they are known, and provides reasonable default rules that apply if the user has not expressed a contrary intent. The act represents the best opportunity to enact uniform legislation for an industry that operates in every state." RUFADAA has been formally endorsed by the Association of American Retired Persons (AARP), the Center for Democracy and Technology, Facebook, Google, and the National Academy of Elder Law Attorneys. (NCCUSL, Legislative Fact Sheet – Revised Uniform Fiduciary Access to Digital Assets Act (2015).) To date, 10 states (Colorado, Florida, Idaho, Indiana, Michigan, Oregon, Tennessee, Washington, Wisconsin, and Wyoming) have enacted RUFADAA, and at least 18 other states have introduced RUFADAA legislation this year.

According to NCCUSL:

The purpose of the [RUFADAA] is twofold. First, it gives fiduciaries the legal authority to manage digital assets and electronic communications in the same way they manage tangible assets and financial accounts, to the extent possible. Second, it gives custodians of digital assets and electronic communications legal authority to deal with the fiduciaries of their users, while respecting the user's reasonable expectation of privacy for personal communications. The general goal of the act is to facilitate fiduciary access and custodian disclosure while respecting the privacy and intent of the user. It adheres to the traditional approach of trusts and estates law, which respects the intent of an account holder and promotes the fiduciary's ability to administer the account holder's property in accord with legally-binding fiduciary duties. The act removes barriers to a fiduciary's access to electronic records and property and leaves unaffected other law, such as fiduciary, probate, trust, banking, investment securities, agency, and privacy law.

Legislative history. Prior versions of this bill would have enacted the Privacy Expectation Afterlife and Choices (PEAC) Act, the California-specific approach to disclosure of a decedent's electronic information that was held in the Senate when the 2015 year session ended. The PEAC Act was opposed by the Judicial Council and the Trust and Estates Section of the State Bar (TEXCOM), among others, for a variety of reasons, chief among them because it would have initially required court involvement in most cases in order to authorize release of digital assets to a fiduciary. As amended in the Senate earlier this year, however, this bill instead would enact a modified version of RUFADAA, which provides a framework for custodians and fiduciaries to work out access issues on their own and limits court involvement to an option of last resort. Consequently, the Judicial Council, TEXCOM, and the CA Judges Association have removed their opposition to this bill and adopted a neutral position.

On the other hand, the Senate amendments to enact RUFADAA instead of the PEAC Act have caused a number of consumer and privacy advocates, including the ACLU and Consumer Watchdog, to oppose the bill. These groups ("opponents") were neutral on the approach taken by the PEAC Act, but are opposed to RUFADAA because they believe it allows disclosure of digital assets and electronic communications without sufficient safeguards, allows custodians to dictate terms of disclosure and override contrary directions expressed by users, and grants custodians overly broad immunity from liability.

Scope of the bill. Unlike the broader approach of the RUFADAA model act adopted by the NCCUSL, the scope of this bill does not include powers of attorney, trusts, and conservatorships where the principal, trustor, and conservatee, respectively, are still alive. Instead, this bill has a more limited scope that applies only to situations where a person has died, and electronic information is being requested from the custodian by a decedent’s personal representative, administrator, executor, or trustee for the purpose of ascertaining the decedent’s assets and liabilities.

Stronger privacy interest in contents of communications vs. catalogue of communications. Under this bill, the "contents of electronic communication" is defined to mean information concerning the substance or meaning of the communication sent or received by the user that is not readily accessible to the public and is carried or maintained by the custodian providing the electronic communication service, as specified. This is distinguished from the "catalogue of electronic communications," which is defined as information that identifies each person with which a user has had an electronic communication, the time and date of the communication, and the electronic address of the person. To remain consistent with federal law, under this bill the term "electronic communication" is defined by reference to the Electronic Communications Privacy Act of 1986 (ECPA). Like ECPA, this bill recognizes the stronger privacy interest that users have in the content of their communications through email and on social media. This interest is reflected in the requirements in the bill for disclosure of contents compared to disclosure of the catalogue of electronic communications.

Three –tiered system for user authorization to disclose electronic communications, including content. This bill provides protections for a deceased user's private electronic communications by establishing the circumstances under which the custodian of the electronic communications could disclose those communications. The bill establishes a three-tier priority system for determining the user's intent for disclosure of his or her electronic communications.

First in priority, this bill authorizes disclosure pursuant to the user's designation through an online tool. According to proponents, the online tool provides the most current reflection of the user's intent for disclosure to another person. Second, the user can provide directions in an estate plan for the disposition of the user's digital assets. The custodian would then be able to rely on the testamentary document containing these disclosure instructions, which would then have legal effect pursuant to this bill. Finally, if the user did not provide any direction regarding disclosure of digital assets, the terms-of-service governing the account would apply. If the terms-of-service do not address fiduciary access to digital assets, the default rules provided in this bill shall apply.

Opponents assert that, contrary to what the bill provides, an online tool should take precedence over a user's testamentary will only if the online tool is used later in time after the will is executed. They state:

For those who do have a will or use an online tool, however, the bill defeats the reasonable expectations of most users because the bill stipulates that when a tech company provides an online tool (to designate a recipient and instruct the custodian which digital assets to release), those user settings are determinative of the user’s wishes even if they predate a will or other testamentary document. This priority scheme is contrary to the normal rule and most user’s common understanding that a will is determinative of a decedent’s intentions if it comes after other instructions. Online tools should not be allowed to contradict a later testamentary document.

Documentation needed for disclosure once authorization established. Authorization of disclosure is not alone sufficient to compel disclosure under this bill; additional documentation must be provided to the custodian by the representative of the decedent's estate. With respect to the content of electronic communications sent or received by the user, the bill provides that if a deceased user consented to or a court directs disclosure of such content, the custodian make such disclosure to the personal representative of the estate of the user if the personal representative gives to the custodian all of the following: (1) a written request for disclosure in physical or electronic form; (2) a certified copy of the death certificate of the user; (3) a certified copy of the letter of appointment of the representative, a small-estate affidavit, or court order; and (4) a copy of the user’s will, trust, power of attorney, or other record evidencing the user’s consent to disclosure of the content of electronic communications, unless the user provided direction using an online tool (in which case the online tool evidences the user's content, making this documentation unnecessary).

With respect to the catalogue of electronic communications sent or received by the user and digital assets other than the content of electronic communications, the bill requires the custodian to make such disclosure to the personal representative unless the user prohibited disclosure of digital assets or the court directs otherwise. More specifically, if the user did not prohibit such disclosure and there is no contrary direction from the court, then under this bill the custodian shall make the disclosure if the personal representative has given the custodian all of the following: (1) a written request for disclosure in physical or electronic form; (2) a certified copy of the death certificate of the user; and (3) a certified copy of the letter of appointment of the representative, a small-estate affidavit, or court order. The bill specifies similar documentation relevant to trusts to be provided to the custodian by a trustee seeking disclosure of either the catalogue or content of electronic communications.

For both the content and catalogue of electronic communications, the bill also requires the personal representative to provide any of the following additional documentation, if requested by the custodian: (1) a number, user name, username, address, or other unique subscriber or account identifier assigned by the custodian to identify the user’s account; (2) evidence linking the account to the user; (3) an affidavit stating that disclosure of the user’s digital assets is reasonably necessary for estate administration; and (4) an order of the court making certain findings, as specified. Opponents of the bill assert that some of these items of information--particularly the unique subscriber information or other evidence linking the account to the decedent for which records are being requested--should be required to be provided in all cases rather than provided only if requested by the custodian. They also recommend that the bill should require the fiduciary to show that the information contained in the account is necessary for the administration of the estate, and not just in cases where the custodian has requested production of a court order making such a finding.

Terms-of-service agreements. As discussed above, if the user did not provide any direction regarding disclosure of digital assets through an online tool or testamentary document (e.g. a will), then under the third-tier of the rule, the terms-of-service agreement governing the account would apply. It should be noted that this bill does not change or impair a right of a custodian or a user under a terms-of-service agreement to access and use digital assets of a user, and does not give a fiduciary or designated recipient any new or expanded rights other than those held by the user for whom, or for whose estate or trust, the fiduciary or designated recipient acts or represents. This bill provides that a fiduciary's or designated recipient's access to digital assets may be modified or eliminated by a user, by federal law, or by a terms-of-service agreement when the user has not provided any direction, as specified.

Opponents contend that, in practice, the bill will ultimately allow custodians to freely control the release and retention of digital assets under the terms of service, because most users will not have a will or make use of an online tool. They state:

(The bill) gives the terms of service written by a custodian the controlling priority whenever there is no will and no use of an online tool. Most Americans do not have a will, and few will have the knowledge, determination and foresight to use an online tool, in the same way that most users do not adjust the available settings on various electronic devices, applications, and Internet web sites. The bill provides no limitations or guidelines for the terms of service – custodians are free to write any rules they wish. Nor are custodians under any obligation to make online tools readily detectable, clear or easy to use.

Fiduciary's duty of confidentiality. A decedent’s fiduciary has a duty to the decedent to execute the terms of the decedent’s testamentary documents. The fiduciary is also subject to multiple statutory duties, including care and loyalty, to the beneficiaries of the decedent’s estate or trust, and is also required to keep the beneficiaries reasonably informed and fully disclose all material information necessary to protect the beneficiaries’ interests.

As stated by the author, most people expect the contents of their electronic communications to remain private after they pass away, and the recipients and senders of those messages likely expect the same. Accordingly, this bill would also establish that fiduciaries owe a duty of confidentiality in addition to the duties of care and loyalty. To the extent the decedent limits access to his or her electronic information so that the information is only disclosable to or accessible by the fiduciary, either through the online tool or pursuant to testamentary documents, this bill inherently incorporates the expectation that the fiduciary will maintain the decedent’s confidentiality upon receiving the electronic information.

Author's intent to narrow grant of immunity from liability provided to custodians for compliance with this bill. As currently in print, this bill simply provides that "a custodian and its officers, employees, and agents are immune from liability for an act or omission done in good faith in compliance with this part [i.e. the entirety of RUFADAA]." Subdivision (f) of Probate Code Section 881, as proposed by this bill, would grant custodians broad immunity from liability as long as they act in good faith in complying with the Act—with no exception even for conduct amounting to gross negligence or willful or wanton misconduct.

Opponents of the bill contend that the broad grant of immunity in this bill gives custodians no incentive to act responsibly, and increases the probability that cases of privacy invasion will occur since there will be little consequence for careless behavior, or even gross negligence. They state:

Is it possible that [custodians] will make mistakes – both by releasing too much information without authorization, or releasing it to the wrong person? We think the history of digital records shows that it is likely there will be mistakes. While mistakes cannot be prevented they should be deterred. Unfortunately, this bill does very little or nothing to give technology companies an incentive to behave responsibly. It gives custodians sole and complete discretion to release all digital assets, and it gives them complete immunity when they do it wrongly. . . The only liability they would apparently not be absolved for is for direct violation of a court order, which is arguably beyond the province of the Legislature in any event. The combination of total discretion and no responsibility for unlawful conduct will give custodians very little reason to behave with reasonable prudence.

According to the Uniform Law Commission, the drafters of RUFADAA, the release of digital assets or electronic communications, if not done carefully, could result in harm or an invasion of privacy. The ULC's official comments to RUFADAA even state: "Access to a digital asset might invade the privacy or harm the reputation of the decedent, protected person, principal, or settlor; it might harm the family or business of the decedent, protected person, principal, or settlor; and it might harm other persons." (Uniform Law Commission, Revised Uniform Fiduciary Access to Digital Assets Act (2015), p. 30.)

While the ULC's intent may have been to protect the custodian from liability for disclosure of a digital asset as long as the custodian was acting in good-faith compliance, this Committee has a long history of ensuring that legislation it approves does not provide blanket immunity from liability for acts rising to the level of gross negligence or willful or wanton misconduct, even when done "in good faith." (See, e.g. AB 83 (Feuer), Ch. 77, Stats. 2009, amending the California "Good Samaritan" statute to grant qualified immunity to any person who renders medical or non-medical aid in an emergency, so long as that person acts in good faith and not for compensation, but specifically exempting gross negligence and willful or wanton misconduct.)

In order to ensure that this Act, should it become law, does not immunize disclosure of information that amounts to gross negligence or willful or wanton misconduct, the author has agreed to take steps to revise the immunity provisions proposed by this bill in subdivision (f) of Probate Code Section 881. Because this bill cannot be amended in this House to address this concern, the author instead proposes that another bill, Senate Bill 873 (which is to be heard in this Committee on the same date as this bill), be amended to accomplish this purpose. Specifically, it is the author's intent that SB 873 shall be enacted subsequent, and as a companion, to this bill so that in the event that this bill, AB 691, is chaptered, the version of Section 881 of the Probate Code reflected in SB 873 shall replace the version of that same section provided by this bill.

The SB 873 amendments to Probate Code Section 881(f) appear below for illustrative purposes:

Probate Code Section 881.

[. . .]

(f) (1) A custodian and its officers, employees, and agents are immune from liability for an act or omission done in good faith and in compliance with this part.

(2) The protections specified in paragraph (1) shall not apply in a case of gross negligence or willful or wanton misconduct of the custodian or its officers, employees, and agents.

ARGUMENTS IN SUPPORT: The bill is supported by a coalition of technology and business industry groups, including Google, Yahoo, and Facebook, who state:

The technology industry supports AB 691 because it carefully balances the rights of the decedent and other third parties with the obligations and requirements of handling an estate. It also stays within the privacy framework set by the federal Electronic Communications Privacy Act that restricts the ability of an electronic communication service or remote computing service to share information with anyone but the user.

During the last Senate Judiciary hearing, the author and proponents were instructed to negotiate in good faith, reach a satisfactory solution, and return the bill for consideration. That has been accomplished. All of the opposition to AB 691 present at the September 10, 2015 Senate Judiciary Committee hearing has been removed. All those parties are either neutral or in support.

ARGUMENTS IN OPPOSITION: The bill continues to be opposed by the ACLU, the Electronic Frontier Foundation, and various consumer groups. According to these opponents:

The bill continues to have serious privacy implications that have not been adequately considered or addressed. The bill would allow digital assets and the content of electronic communications to be disclosed to trustees and personal representatives without appropriate safeguards. The bill also lacks adequate definitions of key terms, permits custodians to dictate terms and override contrary directions expressed by users, and could be construed to require companies to give trustees and personal representatives access to electronic communications and content, even if the information is encrypted or password-protected, including by court orders requiring tech companies to hack their own products as some electronic device companies have been asked to do in criminal cases. Moreover, because the bill grants companies sole discretion to give up as much or as little information as they wish, while also granting them immunity for violations, there appears to be no recourse for individuals whose privacy has been invaded.

REGISTERED SUPPORT / OPPOSITION:

Support

TechNet (sponsor)

AOL

California Bankers Association

California Chamber of Commerce

CompTIA

Facebook

Google

Internet Association

Match.com

State Privacy and Security Coalition, Inc.

Yahoo!

Opposition

American Civil Liberties Union of California

Consumer Federation of California

Consumer Watchdog

Electronic Frontier Foundation

Privacy Rights Clearinghouse

Analysis Prepared by: Anthony Lew / JUD. / (916) 319-2334

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 691

Author:(Calderon)

As Amended Ver:June 14, 2016

Majority vote

(vote not relevant)

Original Committee Reference: JUD.

SUMMARY: Establishes the Revised Uniform Fiduciary Access to Digital Access Act (RUFADAA) to specify rules for the disclosure of electronic information from a custodian of a person's digital assets (custodian) to the personal representative of the estate of a deceased user (representative) or trustee of the deceased user's trust (trustee) for the purpose of administering the estate or trust.

The Senate amendments delete the Assembly version of this bill, and instead:

1. Establish the RUFADAA and authorizes a decedent's personal representative or trustee (fiduciary) to access and manage digital assets and electronic communications, as specified.
2. Authorize a person to use an online tool to give directions to the custodian of his/her digital assets regarding the disclosure of those assets.
3. Specify that, if a person has not used an online tool to give that direction, he or she may give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record.
4. Require a custodian, as specified, of the digital assets to comply with a fiduciary's request for disclosure of digital assets to terminate an account, except under certain circumstances, including when the decedent has prohibited this disclosure using the online tool.
5. Specify that a user's direction through the online tool or testamentary document would override a contrary provision in a terms-of-service agreement.
6. Provide that a fiduciary's or designated recipient's access to digital assets may be modified or eliminated by a user, by federal law, or by a terms-of-service agreement when the user has not provided any direction as specified by this bill.
7. Authorize the custodian, in its sole discretion, to do any of the following when disclosing the digital assets of a user:
   1. Grant the fiduciary or designated recipient full access to the user's account;
   2. Grant the fiduciary or designated recipient partial access to the user's account sufficient to perform the tasks with which the fiduciary or designated recipient is charged; and
   3. Provide the fiduciary or designated recipient with a copy in a record of any digital asset that, on the date the custodian received the request for disclosure, the user could have accessed if the user were alive and had full capacity and access to the account.
8. Authorize a custodian to assess a reasonable administrative charge for the cost of disclosing digital assets and would not require a custodian to disclose a digital asset deleted by a user.
9. Provide that if a user directs or a fiduciary or designated recipient requests a custodian to disclose some, but not all, of the user's digital assets, the custodian need not disclose the assets if segregation of the assets would impose an undue burden on the custodian.
10. Authorize the custodian, fiduciary, or designated recipient to petition the court for an order, as specified, if the custodian believes the direction or request imposes an undue burden.
11. With respect to the content of electronic communications of the user:
    1. Provide that, if a deceased user consented to or a court directs disclosure of the content of electronic communications of the user, the custodian must disclose to the personal representative of the estate of the user the content of an electronic communication sent or received by the user if the personal representative gives to the custodian specified forms of documentation, including, among other things: i) a written request for disclosure; ii) a certified copy of the user's death certificate; iii) a certified copy of the letter of appointment of the representative; and iv) a copy of the user's will, trust, or other record evidencing the user's consent to disclosure, unless the user provided direction using an online tool.
    2. Provide that, unless otherwise ordered by the court, directed by the user, or provided in a trust, the custodian must disclose to a trustee that is not an original user of an account the content of an electronic communication sent or received by an original or successor user and carried, maintained, processed, received, or stored by the custodian in the account of the trust if the trustee gives to the custodian specified forms of documentation.
12. With respect to the catalogue of electronic communication sent or received by the user, and digital assets, other than the content of electronic communications, of the user:
    1. Provide that, unless the user prohibited disclosure of digital assets or the court directs otherwise, the custodian must disclose to the personal representative of the estate of a deceased user a catalogue of electronic communications sent or received by the user and digital assets, other than the content of electronic communications, of the user, if the personal representative gives to the custodian specified documentation, including, among other things: i) a written request for disclosure; ii) a certified copy of the user's death certificate; and iii) a certified copy of the letter of appointment of the representative.
    2. Provide that, unless otherwise ordered by the court, directed by the user, or provided in a trust, a custodian must disclose, to a trustee that is not an original user of an account, the catalogue of electronic communications sent or received by an original or successor user and stored, carried, or maintained by the custodian in an account of the trust and any digital assets, other than the content of electronic communications, in which the trust has a right or interest if the settlor of the trust is deceased and the trustee gives to the custodian specified documentation.
13. Provide that the legal duties imposed on a fiduciary charged with managing tangible property apply to the management of digital assets, including all of the following: a) the duty of care; b) the duty of loyalty; and c) the duty of confidentiality.
14. Provide that a fiduciary with authority over the property of a decedent or settlor has the right of access to any digital asset in which the decedent or settlor had a right or interest, as specified.
15. Require a custodian, not later than 60 days after receipt of the information required, as specified, to comply with a request from a fiduciary or designated recipient to disclose digital assets or terminate an account. Further provides that if the custodian fails to comply with a request, the fiduciary or designated recipient may apply to the court for an order directing compliance.
16. Make disclosure of the contents of the deceased user's or settlor's account to a fiduciary of the deceased user or settlor subject to the same license, restrictions, terms of service, and legal obligations, including copyright law, that applied to the deceased user or settlor.

FISCAL EFFECT: None

COMMENTS: In July 2014, the National Conference of Commissioners on Uniform State Laws (NCCUSL) approved the Uniform Fiduciary Access to Digital Assets Act (UFADAA), which was recommended for enactment in all states "to vest fiduciaries with the authority to access, control, or copy digital assets and accounts[,] ... remove barriers to a fiduciary's access to electronic records[,] and to leave unaffected other law, such as fiduciary, probate, trust, banking, investment, securities, and agency law." UFADAA was recently revised to clarify the application of federal privacy laws and give legal effect to an account holder's instructions for the disposition of digital assets. According to NCCUSL, the 2014 UFADAA provided fiduciaries with default access to all digital information, but the Revised UFADAA protects the contents of electronic communications from disclosure without the user's consent, and fiduciaries can still access other digital assets unless prohibited by the user.

Prior versions of this bill would have enacted the Privacy Expectation Afterlife and Choices Act, which is an alternative approach to disclosure of a decedent's electronic information. As amended in the Senate, this bill adopts a modified version of the RUFADAA and attempts to provide a clear legal framework to help probate courts resolve questions about how to balance competing privacy and estate administration concerns when a decedent's estate representative, for the purpose of settling the estate, seeks information, records, digital assets, or electronic communications, from, typically, the email or social media account of the deceased user.

This bill establishes procedures for a decedent's personal representative or trustee to obtain digital assets and electronic information from the custodian of those assets and information. According to the author, this bill "seeks to strike a balance between providing a clear path for fiduciaries to access relevant information to handle the deceased person's estate, while respecting the privacy choices of not just the deceased person but those with whom the deceased was communicating."

NCCUSL states that the RUFADAA was recently approved and represents a consensus reached among stakeholders, including technology firms, privacy advocates, bankers, and the trust and estate bar. NCCUSL asserts that the "consensus was the result of a concerted effort by all parties over the last few months to agree on a reasonable regulatory framework that will balance the privacy interests of internet users with the need for fiduciaries to perform their tasks and ensure the orderly transfer of a decedent's assets to heirs. It gives legal effect to an internet user's wishes when they are known, and provides reasonable default rules that apply if the user has not expressed a contrary intent. The act represents the best opportunity to enact uniform legislation for an industry that operates in every state." RUFADAA has been formally endorsed by the Association of American Retired Persons (AARP), the Center for Democracy and Technology, Facebook, Google, and the National Academy of Elder Law Attorneys. (NCCUSL, Legislative Fact Sheet – Revised Uniform Fiduciary Access to Digital Assets Act (2015).) To date, 10 states (Colorado, Florida, Idaho, Indiana, Michigan, Oregon, Tennessee, Washington, Wisconsin, and Wyoming) have enacted RUFADAA, and at least 18 other states have introduced RUFADAA legislation this year.

According to NCCUSL: "The purpose of the [RUFADAA] is twofold. First, it gives fiduciaries the legal authority to manage digital assets and electronic communications in the same way they manage tangible assets and financial accounts, to the extent possible. Second, it gives custodians of digital assets and electronic communications legal authority to deal with the fiduciaries of their users, while respecting the user's reasonable expectation of privacy for personal communications. The general goal of the act is to facilitate fiduciary access and custodian disclosure while respecting the privacy and intent of the user. It adheres to the traditional approach of trusts and estates law, which respects the intent of an account holder and promotes the fiduciary's ability to administer the account holder's property in accord with legally-binding fiduciary duties. The act removes barriers to a fiduciary's access to electronic records and property and leaves unaffected other law, such as fiduciary, probate, trust, banking, investment securities, agency, and privacy law."

Disclosure of electronic communications. This bill provides protections for a deceased user's private electronic communications by establishing the circumstances under which the custodian of the electronic communications could disclose those communications. This bill establishes a three-tier priority system for determining the user's intent for disclosure of his or her electronic communications.

First in priority, this bill authorizes disclosure pursuant to the user's designation through an online tool. This tool provides the most current reflection of the user's intent for disclosure to another person. Second, the user can provide directions in an estate plan for the disposition of the user's digital assets. The custodian would then be able to rely on the testamentary document containing these disclosure instructions, which would then have legal effect pursuant to this bill. Finally, if the user did not provide any direction regarding disclosure of digital assets, the terms-of-service governing the account would apply. If the terms-of-service do not address fiduciary access to digital assets, the default rules provided in this bill would apply.

This bill does not change or impair a right of a custodian or a user under a terms-of-service agreement to access and use digital assets of a user, and does not give a fiduciary or designated recipient any new or expanded rights other than those held by the user for whom, or for whose estate or trust, the fiduciary or designated recipient acts or represents. This bill provides that a fiduciary's or designated recipient's access to digital assets may be modified or eliminated by a user, by federal law, or by a terms-of-service agreement when the user has not provided any direction, as specified.

Analysis Prepared by: Anthony Lew / JUD. / (916) 319-2334 0003668

 THIRD READING  

Bill No: AB 691

Author:

:

Vote:

SENATE JUDICIARY COMMITTEE: 6-0, 7/14/15

AYES: Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

NO VOTE RECORDED: Jackson

SENATE JUDICIARY COMMITTEE: 7-0, 9/10/15 (pursuant to Senate Rule 29.10)

AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

SENATE JUDICIARY COMMITTEE: 6-0, 5/3/16 (pursuant to Senate Rule 29.10)

AYES: Jackson, Moorlach, Anderson, Leno, Monning, Wieckowski

NO VOTE RECORDED: Hertzberg

ASSEMBLY FLOOR: 79-0, 5/11/15 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill establishes a modified version of the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) and establishes procedures for a decedent’s personal representative or trustee to obtain digital assets and electronic information from the custodian of those assets and information.

Senate Floor Amendments of 6/14/16 provide that a user’s direction (regarding disclosure of his or her digital assets, including the content of electronic communications) through an on-line tool overrides a contrary provision in a terms-of-service agreement; provide that a user’s direction (regarding disclosure of his or her digital assets, including the content of electronic communications) in a will, trust, power of attorney, or other record overrides a contrary provision in a terms-of-service agreement; provide that nothing in this Act requires a custodian to share passwords or decrypt protected devices; remove a provision that would have required that in applying and construing this Act, consideration would have been given to the need to promote uniformity of the law with respect to its subject matter among states that enact similar acts; and make nonsubstantive conforming changes.

ANALYSIS:

Existing law:

1. Authorizes a decedent’s personal representative or the public administrator to take possession or control of all of the decedent’s property to be administered in the decedent’s estate, and requires the personal representative to take all steps reasonably necessary for the management, protection, and preservation of, the estate in his/her possession.
2. Provides that the personal representative has the management and control of the estate and prescribes fiduciary duties to the personal representative.
3. Requires the personal representative to file with the court clerk an inventory of property to be administered in the decedent’s estate together with an appraisal.
4. Requires the account to include both a financial statement and a report of administration, as specified, and requires the statement of liabilities in the report of administration to include information as to whether notice to creditors was given, as specified, creditor claims were filed, as specified, creditor claims were not paid, satisfied, or adequately provided for, and whether any real or personal property is security for a claim, whether by mortgage, deed of trust, lien, or other encumbrance.
5. Requires the personal representative to either petition for an order for final distribution of the estate or make a report of status of administration within one year after the date of issuance of letters in an estate for which a federal estate tax return is not required, and within 18 months after the date of issuance of letters in an estate for which a federal estate tax return is required.
6. Provides that if a report of status of administration is made, the report must show the condition of the estate, the reasons why the estate cannot be distributed and closed, and an estimate of the time needed to close administration of the estate, and authorizes the court to require the personal representative to appear before the court to show the condition of the estate and the reasons why the estate cannot be distributed and closed.
7. Establishes, under the Electronic Discovery Act, procedures, evidentiary privileges, and judicial review for the request and production of electronically stored information, as defined.
8. Limits, under the Electronic Communications Privacy Act (ECPA), the disclosure by an electronic communication service or remote computing service of electronic communication of a user, and provides definitions for “electronic communication,” “user,” electronic communications system,” and “electronic communication service.”
9. Prohibits a person or entity providing an electronic communication service to the public from knowingly divulging to any person or entity the contents of a communication while in electronic storage by that service, and prohibits a person or entity providing remote computing service to the public from knowingly divulging to any person or entity the contents of any communication which is carried or maintained on that service:

• On behalf of, and received by means of electronic transmission from (or created by means of computer processing of communications received by means of electronic transmission from), a subscriber or customer of such service; and
• Solely for the purpose of providing storage or computer processing services to such subscriber or customer, if the provider is not authorized to access the contents of any such communications for purposes of providing any services other than storage or computer processing.

1. Authorizes disclosure of the content of electronic communications with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service.
2. Authorizes disclosure of a record or other information pertaining to a subscriber or customer of an electronic communication service or remote computing service (not including the contents of communications), including to any person other than a governmental entity.

This bill:

1. Establishes the RUFADAA and authorizes a decedent’s personal representative or trustee (fiduciary) to access and manage digital assets and electronic communications, as specified.
2. Authorizes a person to use an online tool to give directions to the custodian of his/her digital assets regarding the disclosure of those assets.
3. Specifies that, if a person has not used an online tool to give that direction, he or she may give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record.
4. Requires a custodian, as specified, of the digital assets to comply with a fiduciary’s request for disclosure of digital assets to terminate an account, except under certain circumstances, including when the decedent has prohibited this disclosure using the online tool.
5. Specifies that a user’s direction through the online tool or testamentary document would override a contrary provision in a terms-of-service agreement.
6. Provides that a fiduciary’s or designated recipient’s access to digital assets may be modified or eliminated by a user, by federal law, or by a terms-of-service agreement unless the terms of service agreement is contrary to the user’s direction in an online tool or the user’s direction in a testamentary device;.
7. Authorizes the custodian, in its sole discretion, only if consistent with the user’s designation in the online tool or in the user’s testamentary document, to do any of the following when disclosing the digital assets of a user:

• Grant the fiduciary or designated recipient full access to the user’s account;
• Grant the fiduciary or designated recipient partial access to the user’s account sufficient to perform the tasks with which the fiduciary or designated recipient is charged; and
• Provide the fiduciary or designated recipient with a copy in a record of any digital asset that, on the date the custodian received the request for disclosure, the user could have accessed if the user were alive and had full capacity and access to the account.

1. Authorizes a custodian to assess a reasonable administrative charge for the cost of disclosing digital assets and would not require a custodian to disclose a digital asset deleted by a user.
2. Provides that if a user directs or a fiduciary or designated recipient requests a custodian to disclose some, but not all, of the user’s digital assets, the custodian need not disclose the assets if segregation of the assets would impose an undue burden on the custodian.
3. Authorizes the custodian, fiduciary, or designated recipient to petition the court for an order, as specified, if the custodian believes the direction or request imposes an undue burden.
4. Provides that the legal duties imposed on a fiduciary charged with managing tangible property apply to the management of digital assets, including all of the following: (a) the duty of care; (b) the duty of loyalty; and (c) the duty of confidentiality.
5. Provides that a fiduciary with authority over the property of a decedent or settlor has the right of access to any digital asset in which the decedent or settlor had a right or interest, as specified.
6. Makes disclosure of the contents of the deceased user’s or settlor’s account to a fiduciary of the deceased user or settlor subject to the same license, restrictions, terms of service, and legal obligations, including copyright law, that applied to the deceased user or settlor.

Background

In order to address privacy concerns with the use of computers and other digital and electronic communications, Congress passed the Electronic Communications Privacy Act of 1986 (ECPA) (18 U.S.C. Sec. 2510-22) to update the Federal Wiretap Act of 1968. The ECPA has been revised over the years by several pieces of legislation, “to keep pace with the evolution of new communications technologies and methods, including easing restrictions on law enforcement access to stored communications in some cases. . . . The ECPA, as amended, protects wire, oral, and electronic communications while those communications are being made, are in transit, and when they are stored on computers. The [ECPA] applies to email, telephone conversations, and data stored electronically.” (Id.) The ECPA reflects a general approach of providing greater privacy protection for materials in which there are greater privacy interests. (Id.)

Notably, the ECPA is primarily targeted at limiting government access to private user information. However, this federal law applies to communications sent or received by users and restricts all access to the records and contents of those communications, including access by an executor, administrator, or trustee of a deceased user. California state law provides specified discovery procedures for parties in civil actions, which include estate and trust proceedings, to obtain documents that are stored electronically.

However, internet service and electronic storage providers are subject to both federal and state electronic communications privacy laws, which may conflict when a person, other than the user sending or storing electronic communications or the recipient of an electronic communication, attempts to obtain the records or contents of the electronic records and communications. This is problematic when the executor, administrator, or trustee (fiduciary) of a deceased user or recipient is tasked with marshaling the decedent’s assets and liabilities in order to administer the decedent’s trust or estate. Since many individuals are now receiving invoices and billing in electronic form as a way to go “paperless,” performing many financial transactions online, as well as primarily corresponding through electronic means, obtaining the decedent’s electronic communications may be the only way for the fiduciary to determine the assets and liabilities of the decedent. By 2014, seven states had enacted laws to grant some degree of access of a decedent’s electronic communications to fiduciaries.

In July 2014, the National Conference of Commissioners on Uniform State Laws (NCCUSL) approved the Uniform Fiduciary Access to Digital Assets Act (UFADAA), which was recommended for enactment in all states “to vest fiduciaries with the authority to access, control, or copy digital assets and accounts[,] . . . remove barriers to a fiduciary’s access to electronic records[,] and to leave unaffected other law, such as fiduciary, probate, trust, banking, investment, securities, and agency law.” (NCCUSL, Uniform Fiduciary Access to Digital Assets Act (Apr. 2, 2015) <http://www.uniformlaws. org/shared/docs/Fiduciary%20Access%20to%20Digital%20Assets/2014_UFADAA_Final.pdf [as of Apr. 14, 2016] p. 1.)

UFADAA was recently revised to clarify the application of federal privacy laws and give legal effect to an account holder’s instructions for the disposition of digital assets. According to NCCUSL, the 2014 UFADAA provided fiduciaries with default access to all digital information, but the revised act (RUFADAA) protects the contents of electronic communications from disclosure without the user’s consent, and fiduciaries can still access other digital assets unless prohibited by the user.

This bill adopts a modified version of RUFADAA and establish procedures for a decedent’s personal representative or trustee to obtain digital assets and electronic information from the custodian of those assets and information.

A coalition of privacy stakeholders contend that serious privacy implications have not been adequately considered or addressed. The opposition urges the author to amend this bill to: (1) require fiduciaries to specify the account for which they are requesting records and provide an affidavit to the custodian that the disclosure of the user’s digital assets is reasonably necessary for estate administration; (2) clarify accessibility to the decedent’s account or digital assets; and (3) clarify several definitions. Additionally, the opposition notes that this bill “contains loopholes that allow the courts and tech companies to disclose the contents of the decedent’s digital assets even if doing so goes against the written wishes of the decedent.” Opposition also highlights that the wishes expressed by the decedent in a will would be trumped by the decedent’s choice in an online tool, even where the decedent made a different choice clear in his/her will at a later date.

Comments

The author writes:

Prior to the digital age, the memorabilia of our lives was stored in a cardboard box in our parent’s attic or under their bed. Today, a significant portion of the information about our lives is kept online on our personal accounts. Whether it’s Facebook, Twitter, YouTube or even email, the information stored online are today’s version of the photo albums, videos, and hand-written journals of yesterday.

Most people expect the contents of these online communications to remain private, even after they pass away; it’s likely the recipients of those messages likely expect the same. According to a recent Zogby poll, over 70 [percent] of Americans say their private online communications and photos should remain private after they die, unless they gave prior consent for others to access. Only 15 [percent] say that estate attorneys should control their private communications and photos, even if they gave no prior consent for sharing.

With no statute currently in place in California protecting the online information of the newly deceased, families are left responsible for accessing their loved ones information, often times causing unnecessary financial and emotional burdens’ during a time that is already painfully difficult.

AB 691 addresses this issue by striking a balance between providing a clear path for fiduciaries to access relevant information to handle the deceased person’s estate, while respecting the privacy choices of not just the deceased person but those with whom the deceased was communicating.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT: (Verified 6/14/16)

AOL

California Bankers Association

California Chamber of Commerce

CompTIA

Facebook

Google

Internet Association

State Privacy and Security Coalition, Inc.

TechNet

Yahoo

OPPOSITION: (Verified 6/14/16)

American Civil Liberties Union of California

Consumer Federation of California

Consumer Watchdog

Electronic Frontier Foundation

Privacy Rights Clearinghouse

ASSEMBLY FLOOR: 79-0, 5/11/15

AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood

NO VOTE RECORDED: Atkins

Prepared by:

6/15/16 17:24:39

**** END ****

 THIRD READING  

Bill No: AB 691

Author:

:

Vote:

SENATE JUDICIARY COMMITTEE: 6-0, 7/14/15

AYES: Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

NO VOTE RECORDED: Jackson

SENATE JUDICIARY COMMITTEE: 7-0, 9/10/15 (pursuant to Senate Rule 29.10)

AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

SENATE JUDICIARY COMMITTEE: 6-0, 5/3/16 (pursuant to Senate Rule 29.10)

AYES: Jackson, Moorlach, Anderson, Leno, Monning, Wieckowski

NO VOTE RECORDED: Hertzberg

ASSEMBLY FLOOR: 79-0, 5/11/15 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill establishes a modified version of the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) and establishes procedures for a decedent’s personal representative or trustee to obtain digital assets and electronic information from the custodian of those assets and information.

ANALYSIS:

Existing law:

1. Authorizes a decedent’s personal representative or the public administrator to take possession or control of all of the decedent’s property to be administered in the decedent’s estate, and requires the personal representative to take all steps reasonably necessary for the management, protection, and preservation of, the estate in his/her possession.
2. Provides that the personal representative has the management and control of the estate and prescribes fiduciary duties to the personal representative.
3. Requires the personal representative to file with the court clerk an inventory of property to be administered in the decedent’s estate together with an appraisal.
4. Requires the account to include both a financial statement and a report of administration, as specified, and requires the statement of liabilities in the report of administration to include information as to whether notice to creditors was given, as specified, creditor claims were filed, as specified, creditor claims were not paid, satisfied, or adequately provided for, and whether any real or personal property is security for a claim, whether by mortgage, deed of trust, lien, or other encumbrance.
5. Requires the personal representative to either petition for an order for final distribution of the estate or make a report of status of administration within one year after the date of issuance of letters in an estate for which a federal estate tax return is not required, and within 18 months after the date of issuance of letters in an estate for which a federal estate tax return is required.
6. Provides that if a report of status of administration is made, the report must show the condition of the estate, the reasons why the estate cannot be distributed and closed, and an estimate of the time needed to close administration of the estate, and authorizes the court to require the personal representative to appear before the court to show the condition of the estate and the reasons why the estate cannot be distributed and closed.
7. Establishes, under the Electronic Discovery Act, procedures, evidentiary privileges, and judicial review for the request and production of electronically stored information, as defined.
8. Limits, under the Electronic Communications Privacy Act (ECPA), the disclosure by an electronic communication service or remote computing service of electronic communication of a user, and provides definitions for “electronic communication,” “user,” electronic communications system,” and “electronic communication service.”
9. Prohibits a person or entity providing an electronic communication service to the public from knowingly divulging to any person or entity the contents of a communication while in electronic storage by that service, and prohibits a person or entity providing remote computing service to the public from knowingly divulging to any person or entity the contents of any communication which is carried or maintained on that service:

• On behalf of, and received by means of electronic transmission from (or created by means of computer processing of communications received by means of electronic transmission from), a subscriber or customer of such service; and
• Solely for the purpose of providing storage or computer processing services to such subscriber or customer, if the provider is not authorized to access the contents of any such communications for purposes of providing any services other than storage or computer processing.

1. Authorizes disclosure of the content of electronic communications with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service.
2. Authorizes disclosure of a record or other information pertaining to a subscriber or customer of an electronic communication service or remote computing service (not including the contents of communications), including to any person other than a governmental entity.

This bill:

1. Establishes the RUFADAA and authorizes a decedent’s personal representative or trustee (fiduciary) to access and manage digital assets and electronic communications, as specified.
2. Authorizes a person to use an online tool to give directions to the custodian of his/her digital assets regarding the disclosure of those assets.
3. Specifies that, if a person has not used an online tool to give that direction, he or she may give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record.
4. Requires a custodian, as specified, of the digital assets to comply with a fiduciary’s request for disclosure of digital assets to terminate an account, except under certain circumstances, including when the decedent has prohibited this disclosure using the online tool.
5. Specifies that a user’s direction through the online tool or testamentary document would override a contrary provision in a terms-of-service agreement that does not require the user to act affirmatively and distinctly from the user’s assent to the terms-of-service agreement.
6. Provides that a fiduciary’s or designated recipient’s access to digital assets may be modified or eliminated by a user, by federal law, or by a terms-of-service agreement when the user has not provided any direction, as specified.
7. Authorizes the custodian, in its sole discretion, to do any of the following when disclosing the digital assets of a user:

• Grant the fiduciary or designated recipient full access to the user’s account;
• Grant the fiduciary or designated recipient partial access to the user’s account sufficient to perform the tasks with which the fiduciary or designated recipient is charged; and
• Provide the fiduciary or designated recipient with a copy in a record of any digital asset that, on the date the custodian received the request for disclosure, the user could have accessed if the user were alive and had full capacity and access to the account.

1. Authorizes a custodian to assess a reasonable administrative charge for the cost of disclosing digital assets and would not require a custodian to disclose a digital asset deleted by a user.
2. Provides that if a user directs or a fiduciary or designated recipient requests a custodian to disclose some, but not all, of the user’s digital assets, the custodian need not disclose the assets if segregation of the assets would impose an undue burden on the custodian.
3. Authorizes the custodian, fiduciary, or designated recipient to petition the court for an order, as specified, if the custodian believes the direction or request imposes an undue burden.
4. Provides that the legal duties imposed on a fiduciary charged with managing tangible property apply to the management of digital assets, including all of the following: (a) the duty of care; (b) the duty of loyalty; and (c) the duty of confidentiality.
5. Provides that a fiduciary with authority over the property of a decedent or settlor has the right of access to any digital asset in which the decedent or settlor had a right or interest and that is not held by a custodian or subject to a terms-of-service agreement.
6. Requires, in applying and construing the RUFADAA, which is based upon a uniform act, consideration to be given to the need to promote uniformity of the law with respect to its subject matter among states that enact similar acts.
7. Makes disclosure of the contents of the deceased user’s or settlor’s account to a fiduciary of the deceased user or settlor subject to the same license, restrictions, terms of service, and legal obligations, including copyright law, that applied to the deceased user or settlor.

Background

In order to address privacy concerns with the use of computers and other digital and electronic communications, Congress passed the Electronic Communications Privacy Act of 1986 (ECPA) (18 U.S.C. Sec. 2510-22) to update the Federal Wiretap Act of 1968. The ECPA has been revised over the years by several pieces of legislation, “to keep pace with the evolution of new communications technologies and methods, including easing restrictions on law enforcement access to stored communications in some cases. . . . The ECPA, as amended, protects wire, oral, and electronic communications while those communications are being made, are in transit, and when they are stored on computers. The [ECPA] applies to email, telephone conversations, and data stored electronically.” (Id.) The ECPA reflects a general approach of providing greater privacy protection for materials in which there are greater privacy interests. (Id.)

Notably, the ECPA is primarily targeted at limiting government access to private user information. However, this federal law applies to communications sent or received by users and restricts all access to the records and contents of those communications, including access by an executor, administrator, or trustee of a deceased user. California state law provides specified discovery procedures for parties in civil actions, which include estate and trust proceedings, to obtain documents that are stored electronically.

However, internet service and electronic storage providers are subject to both federal and state electronic communications privacy laws, which may conflict when a person, other than the user sending or storing electronic communications or the recipient of an electronic communication, attempts to obtain the records or contents of the electronic records and communications. This is problematic when the executor, administrator, or trustee (fiduciary) of a deceased user or recipient is tasked with marshaling the decedent’s assets and liabilities in order to administer the decedent’s trust or estate. Since many individuals are now receiving invoices and billing in electronic form as a way to go “paperless,” performing many financial transactions online, as well as primarily corresponding through electronic means, obtaining the decedent’s electronic communications may be the only way for the fiduciary to determine the assets and liabilities of the decedent. By 2014, seven states had enacted laws to grant some degree of access of a decedent’s electronic communications to fiduciaries.

In July 2014, the National Conference of Commissioners on Uniform State Laws (NCCUSL) approved the Uniform Fiduciary Access to Digital Assets Act (UFADAA), which was recommended for enactment in all states “to vest fiduciaries with the authority to access, control, or copy digital assets and accounts[,] . . . remove barriers to a fiduciary’s access to electronic records[,] and to leave unaffected other law, such as fiduciary, probate, trust, banking, investment, securities, and agency law.” (NCCUSL, Uniform Fiduciary Access to Digital Assets Act (Apr. 2, 2015) <http://www.uniformlaws. org/shared/docs/Fiduciary%20Access%20to%20Digital%20Assets/2014_UFADAA_Final.pdf [as of Apr. 14, 2016] p. 1.)

UFADAA was recently revised to clarify the application of federal privacy laws and give legal effect to an account holder’s instructions for the disposition of digital assets. According to NCCUSL, the 2014 UFADAA provided fiduciaries with default access to all digital information, but the revised act (RUFADAA) protects the contents of electronic communications from disclosure without the user’s consent, and fiduciaries can still access other digital assets unless prohibited by the user.

Recent amendments to this bill adopt a modified version of RUFADAA and establish procedures for a decedent’s personal representative or trustee to obtain digital assets and electronic information from the custodian of those assets and information.

A coalition of privacy stakeholders contend that serious privacy implications have not been adequately considered or addressed. The opposition urges the author to amend this bill to: (1) require fiduciaries to specify the account for which they are requesting records and provide an affidavit to the custodian that the disclosure of the user’s digital assets is reasonably necessary for estate administration; (2) clarify accessibility to the decedent’s account or digital assets; (3) clarify several definitions, including custodian, which is currently overbroad and could apply to public libraries that provide computers for public use; and (4) clarify that this bill does not require a custodian to access a password protected or encrypted account where the custodian does not already have such access. Additionally, the opposition notes that the bill “contains loopholes that allow the courts and tech companies to disclose the contents of the decedent’s digital assets even if doing so goes against the written wishes of the decedent.” Opposition also highlights that the wishes expressed by the decedent in a will would be trumped by the decedent’s choice in an online tool, even where the decedent made a different choice clear in his/her will at a later date.

In the Senate Committee on Judiciary hearing on May 3, 2016, the author committed to continue to work out concerns expressed by committee members and stakeholders and further amend this bill.

Comments

The author writes:

Prior to the digital age, the memorabilia of our lives was stored in a cardboard box in our parent’s attic or under their bed. Today, a significant portion of the information about our lives is kept online on our personal accounts. Whether it’s Facebook, Twitter, YouTube or even email, the information stored online are today’s version of the photo albums, videos, and hand-written journals of yesterday.

Most people expect the contents of these online communications to remain private, even after they pass away; it’s likely the recipients of those messages likely expect the same. According to a recent Zogby poll, over 70 [percent] of Americans say their private online communications and photos should remain private after they die, unless they gave prior consent for others to access. Only 15 [percent] say that estate attorneys should control their private communications and photos, even if they gave no prior consent for sharing.

With no statute currently in place in California protecting the online information of the newly deceased, families are left responsible for accessing their loved ones information, often times causing unnecessary financial and emotional burdens’ during a time that is already painfully difficult.

AB 691 addresses this issue by striking a balance between providing a clear path for fiduciaries to access relevant information to handle the deceased person’s estate, while respecting the privacy choices of not just the deceased person but those with whom the deceased was communicating.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT: (Verified 5/5/16)

AOL

California Bankers Association

California Chamber of Commerce

CompTIA

Facebook

Google

Internet Association

State Privacy and Security Coalition, Inc.

TechNet

Yahoo

OPPOSITION: (Verified 5/5/16)

American Civil Liberties Union of California

Consumer Federation of California

Consumer Watchdog

Electronic Frontier Foundation

Privacy Rights Clearinghouse

ASSEMBLY FLOOR: 79-0, 5/11/15

AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood

NO VOTE RECORDED: Atkins

Prepared by: Margie Estrada / JUD. / (916) 651-4113

5/6/16 14:26:24

**** END ****

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2015-2016 Regular Session

Bill No: AB 691 (Author:Calderon)

Version: April 20, 2016

Hearing Date: May 3, 2016

Fiscal: No

Urgency: No

Consultant: TMW

PURSUANT TO SENATE RULE 29.10

SUBJECT

Revised Uniform Fiduciary Access to Digital Assets Act

DESCRIPTION

This bill would establish the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) and authorize a decedent’s personal representative or trustee (fiduciary) to access and manage digital assets and electronic communications, as specified. This bill would authorize a person to use an online tool to give directions to the custodian of his or her digital assets regarding the disclosure of those assets. This bill would specify that, if a person has not used an online tool to give that direction, he or she may give direction regarding the disclosure of digital assets in a will, trust, power of attorney, or other record.

This bill would require a custodian, as specified, of the digital assets to comply with a fiduciary’s request for disclosure of digital assets or to terminate an account, except under certain circumstances, including when the decedent has prohibited this disclosure using the online tool. This bill would make custodians immune from liability for an act or omission done in good faith in compliance with these provisions.

BACKGROUND

In order to address privacy concerns with the use of computers and other digital and electronic communications, Congress passed the Electronic Communications Privacy Act of 1986 (ECPA) (18 U.S.C. Sec. 2510-22) to update the Federal Wiretap Act of 1968. (The Electronic Communications Privacy Act of 1986 (ECPA), Bureau of Justice Assistance, Office of Justice Programs, U.S. Dept. of Justice (July 30, 2013) <https://it.ojp.gov/ PrivacyLiberty/authorities/statutes/1285> [as of Apr. 14, 2016].) The ECPA has been revised over the years by several pieces of legislation, including the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA Patriot Act), “to keep pace with the evolution of new communications technologies and methods, including easing restrictions on law enforcement access to stored communications in some cases. . . . The ECPA, as amended, protects wire, oral, and electronic communications while those communications are being made, are in transit, and when they are stored on computers. The [ECPA] applies to email, telephone conversations, and data stored electronically.” (Id.) The ECPA reflects a general approach of providing greater privacy protection for materials in which there are greater privacy interests. (Id.)

Notably, the ECPA is primarily targeted at limiting government access to private user information. However, this federal law applies to communications sent or received by users and restricts all access to the records and contents of those communications, including access by an executor, administrator, or trustee of a deceased user. California state law provides specified discovery procedures for parties in civil actions, which include estate and trust proceedings, to obtain documents that are stored electronically. Those procedures were enacted under AB 5 (Evans, Chapter 5, Statutes of 2009), which established the Electronic Discovery Act.

However, internet service and electronic storage providers are subject to both federal and state electronic communications privacy laws, which may conflict when a person, other than the user sending or storing electronic communications or the recipient of an electronic communication, attempts to obtain the records or contents of the electronic records and communications. This is problematic when the executor, administrator, or trustee (fiduciary) of a deceased user or recipient is tasked with marshalling the decedent’s assets and liabilities in order to administer the decedent’s trust or estate. Since many individuals are now receiving invoices and billing in electronic form as a way to go “paperless,” performing many financial transactions online, as well as primarily corresponding through electronic means, obtaining the decedent’s electronic communications may be the only way for the fiduciary to determine the assets and liabilities of the decedent. By 2014, seven states had enacted laws to grant some degree of access of a decedent’s electronic communications to fiduciaries.

In California, SB 849 (Anderson, 2014) would have authorized a decedent’s personal representative to request, and would have authorized an electronic communication service or remote computer service to provide, access to the electronic mail account of a decedent or to copies of the content of the account, subject to any applicable service agreement. SB 849 was held in this Committee after testimony was taken.

In July 2014, the National Conference of Commissioners on Uniform State Laws (NCCUSL) approved the Uniform Fiduciary Access to Digital Assets Act (UFADAA), which was recommended for enactment in all states “to vest fiduciaries with the authority to access, control, or copy digital assets and accounts[,] . . . remove barriers to a fiduciary’s access to electronic records[,] and to leave unaffected other law, such as fiduciary, probate, trust, banking, investment, securities, and agency law.” (NCCUSL, Uniform Fiduciary Access to Digital Assets Act (Apr. 2, 2015) <http://www.uniformlaws. org/shared/docs/Fiduciary%20Access%20to%20Digital%20Assets/2014_UFADAA_Final.pdf > [as of Apr. 14, 2016] p. 1.)

UFADAA was recently revised to clarify the application of federal privacy laws and give legal effect to an account holder’s instructions for the disposition of digital assets. According to NCCUSL, the 2014 UFADAA provided fiduciaries with default access to all digital information, but the revised act (RUFADAA) protects the contents of electronic communications from disclosure without the user’s consent, and fiduciaries can still access other digital assets unless prohibited by the user.

Prior versions of this bill would have enacted the Privacy Expectation Afterlife and Choices Act, which is an alternative approach to disclosure of a decedent’s electronic information. Recent amendments to the bill would adopt a modified version of RUFADAA and establish procedures for a decedent’s personal representative or trustee to obtain digital assets and electronic information from the custodian of those assets and information.

CHANGES TO EXISTING LAW

Existing law authorizes a decedent’s personal representative or the public administrator to take possession or control of all of the decedent’s property to be administered in the decedent’s estate, and requires the personal representative to take all steps reasonably necessary for the management, protection, and preservation of the estate in his or her possession. (Prob. Code Secs. 7601(a), 7602, 9650(a)(1), (b).)

Existing law defines “fiduciary” to mean the decedent’s personal representative or the trustee of the decedent’s trust. (Prob. Code Sec. 16323.) Existing law defines “personal representative” to mean the executor, administrator, administrator with the will annexed, special administrator, successor personal representative, public administrator, as specified, or a person who performs substantially the same function under the law of another jurisdiction governing the person’s status. (Prob. Code Sec. 58(a).)

Existing law provides that the personal representative has the management and control of the estate and prescribes fiduciary duties to the personal representative, including using ordinary care and diligence in managing and controlling the decedent’s estate. (Prob. Code Sec. 9600.)

Existing law requires the personal representative to file with the court clerk an inventory of property to be administered in the decedent’s estate together with an appraisal, which must be filed within four months after letters are first issued to a general personal representative; however, the court may allow such further time for filing an inventory and appraisal as is reasonable under the circumstances of the particular case. (Prob. Code Sec. 8800.)

Existing law, if the personal representative refuses or negligently fails to file an inventory and appraisal within the time allowed, upon petition of an interested person, authorizes the court to: (1) compel the personal representative to file an inventory and appraisal; (2) remove the personal representative from office; and (3) impose on the personal representative personal liability, which may include attorney’s fees, for injury to the estate or to an interested person that directly results from the refusal or failure. (Prob. Code Sec. 8804.)

Existing law requires the account to include both a financial statement and a report of administration, as specified, and requires the statement of liabilities in the report of administration to include information as to whether notice to creditors was given, as specified, creditor claims were filed, as specified, creditor claims were not paid, satisfied, or adequately provided for, and whether any real or personal property is security for a claim, whether by mortgage, deed of trust, lien, or other encumbrance. (Prob. Code Sec. 10900.)

Existing law provides that if a report of status of administration is made, the report must show the condition of the estate, the reasons why the estate cannot be distributed and closed, and an estimate of the time needed to close administration of the estate. (Prob. Code Sec. 12201(a).) The court is authorized to require the personal representative to appear before the court to show the condition of the estate and the reasons why the estate cannot be distributed and closed. (Prob. Code Sec. 12202(a).)

Existing law authorizes a trustee or beneficiary of a trust to petition the court concerning the internal affairs of the trust or to determine the existence of the trust; proceedings concerning the internal affairs of the trust include proceedings to determine questions of construction of a trust instrument, the existence or nonexistence of any immunity, power, privilege, duty, or right, determining the validity of a trust provision, ascertaining beneficiaries and determining to whom property shall pass or be delivered upon final or partial termination of the trust, to the extent the determination is not made by the trust instrument, and settling the accounts and passing upon the acts of the trustee, including the exercise of discretionary powers. (Prob. Code Sec. 17200.)

Existing law, the Electronic Discovery Act (EDA), establishes procedures, evidentiary privileges, and judicial review for the request and production of electronically stored information, as defined. (Code Civ. Proc. Secs. 1985.8, 2031.285.)

Existing law authorizes claims of evidentiary privilege on the grounds that the matter sought to be disclosed is a communication made in confidence in the course of the lawyer-client, lawyer referral service-client, physician-patient, psychotherapist-patient, clergy-penitent, husband-wife, sexual assault counselor-victim, domestic violence counselor-victim, or human trafficking caseworker-victim relationship, the communication is presumed to have been made in confidence and the opponent of the claim of privilege has the burden of proof to establish that the communication was not confidential. (Evid. Code Sec. 917(a).) Further, a communication between persons in one of these types of relationships does not lose its privileged character for the sole reason that it is communicated by electronic means or because persons involved in the delivery, facilitation, or storage of electronic communication may have access to the content of the communication. (Evid. Code Sec. 917(b).)

Existing law makes document production provisions under the Civil Discovery Act, which includes the EDA, applicable to civil actions and trial courts in which the civil action is pending, and defines “electronic” to mean relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities, and “electronically stored information” to mean information that is stored in an electronic medium. (Code Civ. Proc. Sec. 2016.020.)

Existing federal law, under the Electronic Communications Privacy Act (ECPA), limits the disclosure by an electronic communication service or remote computing service of electronic communication of a user and provides definitions for “electronic communication,” “user,” electronic communications system,” and “electronic communication service.” (18 U.S.C. Sec. 2510 et seq.)

Existing federal law, the Stored Communications Act (SCA), defines “remote computing service” to mean the provision to the public of computer storage or processing services by means of an electronic communications system. (18 U.S.C. Sec. 2711(2).)

Existing federal law prohibits a person or entity providing an electronic communication service to the public from knowingly divulging to any person or entity the contents of a communication while in electronic storage by that service, and prohibits a person or entity providing remote computing service to the public from knowingly divulging to any person or entity the contents of any communication which is carried or maintained on that service:

• on behalf of, and received by means of electronic transmission from (or created by means of computer processing of communications received by means of electronic transmission from), a subscriber or customer of such service; and
• solely for the purpose of providing storage or computer processing services to such subscriber or customer, if the provider is not authorized to access the contents of any such communications for purposes of providing any services other than storage or computer processing. (18 U.S.C. Sec. 2702(a)(1)-(2).)

Existing federal law also prohibits a provider of remote computing service or electronic communication service to the public from knowingly divulging a record or other information pertaining to a subscriber or customer of such service (not including the contents of communications) to any governmental entity. (18 U.S.C. Sec. 2702(a)(3).)

Existing federal law authorizes disclosure of the content of electronic communications to an addressee or intended recipient of such communication or an agent of such addressee or intended recipient, as otherwise authorized under ECPA or the SCA; or with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service. (18 U.S.C. Sec. 2702(b).)

Existing law authorizes disclosure of a record or other information pertaining to a subscriber or customer of an electronic communication service or remote computing service (not including the contents of communications) as otherwise authorized, with the lawful consent of the customer or subscriber; or to any person other than a governmental entity. (18 U.S.C. Sec. 2702(c).)

This bill would establish the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), and provide the following definitions:

• “account” means an arrangement under a terms-of-service agreement in which the custodian carries, maintains, processes, receives, or stores a digital asset of the user or provides goods or services to the user;
• “carries” means engages in the transmission of electronic communications;
• “catalogue of electronic communications” means information that identifies each person with which a user has had an electronic communication, the time and date of the communication, and the electronic address of the person;
• “content of an electronic communication” means information concerning the substance or meaning of the communication, which meets all of the following requirements:
• has been sent or received by a user;
• is in electronic storage by a custodian providing an electronic communication service to the public or is carried or maintained by a custodian providing a remote-computing service to the public; and
• is not readily accessible to the public;
• “court” means the superior court presiding over the probate proceedings which have been initiated to administer the estate of the deceased user, or, if none, the superior court sitting in the exercise of jurisdiction in the county of the user’s domicile, and the court, as defined, would have exclusive jurisdiction over proceedings brought under this bill;
• “custodian” means a person that carries, maintains, processes, receives, or stores a digital asset of a user;
• “designated recipient” means a person chosen by a user using an online tool to administer digital assets of the user;
• “digital asset” means an electronic record in which an individual has a right or interest, but does not include an underlying asset or liability, unless the asset or liability is itself an electronic record;
• “electronic” means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities;
• “electronic communication” has the same meaning as the definition in Section 2510(12) of Title 18 of the United States Code;
• “electronic communication service” means a custodian that provides to a user the ability to send or receive an electronic communication;
• “fiduciary” means an original, additional, or successor personal representative or trustee;
• “information” means data, text, images, videos, sounds, codes, computer programs, software, databases, or other items with like characteristics;
• “online tool” means an electronic service provided by a custodian that allows the user, in an agreement distinct from the terms-of-service agreement between the custodian and user, to provide directions for disclosure or nondisclosure of digital assets to a third person;
• “person” means an individual, estate, business or nonprofit entity, public corporation, government or governmental subdivision, agency, or instrumentality, or other legal entity;
• “personal representative” means an executor, administrator, special administrator, or person that performs substantially the same function under any other law;
• “power of attorney” means a record that grants an agent authority to act in the place of the principal;
• “record” means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in a perceivable form;
• “remote-computing service” means a custodian that provides to a user computer processing services or the storage of digital assets by means of an electronic communications system, as defined in Section 2510(4) of Title 18 of the United States Code;
• “terms-of-service agreement” means an agreement that controls the relationship between a user and a custodian;
• “trustee” means a fiduciary with legal title to property under an agreement or declaration that creates a beneficial interest in another, and this term includes a successor trustee;
• “user” means a person that has an account with a custodian; and
• “will” includes a codicil, a testamentary instrument that only appoints an executor, or an instrument that revokes or revises a testamentary instrument.

This bill would apply to: (1) a fiduciary acting under a will executed before, on, or after January 1, 2017; (2) a personal representative acting for a decedent who died before, on, or after January 1, 2017; (3) a trustee acting under a trust created before, on, or after January 1, 2017; and (4) a custodian of digital assets for a user if the user resides in this state or resided in this state at the time of the user’s death.

This bill would not apply to a digital asset of an employer used by an employee in the ordinary course of the employer’s business.

This bill would authorize a user to use an online tool to direct the custodian to disclose to a designated recipient or not disclose some or all of the user’s digital assets, including the content of electronic communications.

This bill would provide that, if the online tool allows the user to modify or delete a direction at all times, a direction regarding disclosure using an online tool would override a contrary direction by the user in a will, trust, power of attorney, or other record.

This bill would provide that if a user has not used an online tool to give direction or if a custodian has not provided an online tool, a user may allow or prohibit in a will, trust, power of attorney, or other record the disclosure to a fiduciary of some or all of the user’s digital assets, including the contents of electronic communications sent or received by the user.

This bill would specify that a user’s direction through the online tool or testamentary document would override a contrary provision in a terms-of-service agreement that does not require the user to act affirmatively and distinctly from the user’s assent to the terms-of-service agreement.

This bill would not change or impair a right of a custodian or a user under a terms-of-service agreement to access and use digital assets of a user, and does not give a fiduciary or designated recipient any new or expanded rights other than those held by the user for whom, or for whose estate or trust, the fiduciary or designated recipient acts or represents.

This bill would provide that a fiduciary’s or designated recipient’s access to digital assets may be modified or eliminated by a user, by federal law, or by a terms-of-service agreement when the user has not provided any direction, as specified.

This bill, when disclosing the digital assets of a user, would authorize the custodian, in its sole discretion, to do any of the following:

• grant the fiduciary or designated recipient full access to the user’s account;
• grant the fiduciary or designated recipient partial access to the user’s account sufficient to perform the tasks with which the fiduciary or designated recipient is charged; and
• provide the fiduciary or designated recipient with a copy in a record of any digital asset that, on the date the custodian received the request for disclosure, the user could have accessed if the user were alive and had full capacity and access to the account.

This bill would authorize a custodian to assess a reasonable administrative charge for the cost of disclosing digital assets and would not require a custodian to disclose a digital asset deleted by a user.

This bill would provide that if a user directs or a fiduciary or designated recipient requests a custodian to disclose some, but not all, of the user’s digital assets, the custodian need not disclose the assets if segregation of the assets would impose an undue burden on the custodian.

This bill, if the custodian believes the direction or request imposes an undue burden, would authorize the custodian, fiduciary, or designated recipient to petition the court for an order to do any of the following: (1) disclose a subset limited by date of the user’s digital assets; (2) disclose all of the user’s digital assets to the fiduciary or designated recipient; (3) disclose none of the user’s digital assets; and (4) disclose all of the user’s digital assets to the court for review in camera.

This bill, if a deceased user consented to or a court directs disclosure of the content of electronic communications of the user, would require the custodian to disclose to the personal representative of the estate of the user the content of an electronic communication sent or received by the user if the personal representative gives to the custodian all of the following documentation:

• a written request for disclosure in physical or electronic form;
• a certified copy of the death certificate of the user;
• a certified copy of the letter of appointment of the representative, a small-estate affidavit, as specified, or court order;
• unless the user provided direction using an online tool, a copy of the user’s will, trust, power of attorney, or other record evidencing the user’s consent to disclosure of the content of electronic communications; and
• if requested by the custodian, any of the following:
• a number, user name, address, or other unique subscriber or account identifier assigned by the custodian to identify the user’s account;
• evidence linking the account to the user; and
• an order of the court finding any of the following: (1) that the user had a specific, identifiable account with the custodian; (2) that disclosure of the content of the user’s electronic communications would not violate Chapter 121 (commencing with Section 2701) of Part 1 of Title 18 of, and Section 222 of Title 47 of, the United State Code, or other applicable law; (3) unless the user provided direction using an online tool, that the user consented to disclosure of the content of electronic communications; and (4) that disclosure of the content of electronic communications of a user is reasonably necessary for estate administration.

This bill, unless the user prohibited disclosure of digital assets or the court directs otherwise, would require a custodian to disclose to the personal representative of the estate of a deceased user a catalogue of electronic communications sent or received by the user and digital assets, other than the content of electronic communications, of the user, if the personal representative gives to the custodian specified documentation.

This bill, unless otherwise ordered by the court, directed by the user, or provided in a trust, would require a custodian to disclose to a trustee that is not an original user of an account the content of an electronic communication sent or received by an original or successor user and carried, maintained, processed, received, or stored by the custodian in the account of the trust if the trustee gives to the custodian specified documentation.

This bill, unless otherwise ordered by the court, directed by the user, or provided in a trust, would require a custodian to disclose, to a trustee that is not an original user of an account, the catalogue of electronic communications sent or received by an original or successor user and stored, carried, or maintained by the custodian in an account of the trust and any digital assets, other than the content of electronic communications, in which the trust has a right or interest if the settlor of the trust is deceased and the trustee gives to the custodian specified documentation.

This bill would provide that the legal duties imposed on a fiduciary charged with managing tangible property apply to the management of digital assets, including all of the following: (1) the duty of care; (2) the duty of loyalty; and (3) the duty of confidentiality.

This bill would make all of the following applicable to a fiduciary’s or designated recipient’s authority with respect to a digital asset of a user:

• except as otherwise specified, a fiduciary’s or designated recipient’s authority is subject to the applicable terms-of-service agreement;
• a fiduciary’s or designated recipient’s authority is subject to other applicable law, including copyright law;
• in the case of a fiduciary, a fiduciary’s authority is limited by the scope of the fiduciary’s duties; and
• a fiduciary’s or designated recipient’s authority may not be used to impersonate the user.

This bill would provide that a fiduciary with authority over the property of a decedent or settlor has the right of access to any digital asset in which the decedent or settlor had a right or interest and that is not held by a custodian or subject to a terms-of-service agreement.

This bill would specify that a fiduciary acting within the scope of the fiduciary’s duties is an authorized user of the property of the decedent or settlor for the purpose of applicable computer-fraud and unauthorized-computer-access laws.

This bill would provide that a fiduciary with authority over the tangible, personal property of a decedent or settlor has the right to access the property and any digital asset stored in it and is an authorized user for purposes of any applicable computer-fraud and unauthorized-computer-access laws.

This bill would authorize a custodian to disclose information in an account to a fiduciary of the decedent or settlor when the information is required to terminate an account used to access digital assets licensed to the user.

This bill would authorize a fiduciary of a decedent or settlor to request a custodian to terminate the user’s account, but the request for termination must be in writing, in either physical or electronic form, and accompanied by specified documentation.

This bill, not later than 60 days after receipt of the information required, as specified, would require a custodian to comply with a request from a fiduciary or designated recipient to disclose digital assets or terminate an account; if the custodian fails to comply with a request, the fiduciary or designated recipient would be authorized to apply to the court for an order directing compliance.

This bill would require the court order directing complaint to contain a finding that compliance is not in violation of Section 2702 of Title 18 of the United States Code.

This bill would authorize a custodian to notify a user that a request for disclosure of digital assets or to terminate an account was made.

This bill would authorize a custodian to deny a request from a fiduciary or designated recipient for disclosure of digital assets or to terminate an account if the custodian is aware of any lawful access to the account following the date of death of the user.

This bill would not limit a custodian’s ability to obtain or to require a fiduciary or designated recipient requesting disclosure or account termination to obtain a court order that makes all of the following findings:

• the account belongs to the decedent, principal, or trustee;
• there is sufficient consent from the decedent, principal, or settlor to support the requested disclosure; and
• any specific factual finding required by any other applicable law in effect at that time, including, but not limited to, a finding that disclosure is not in violation of Section 2702 of Title 18 of the United States Code.

This bill would make a custodian and its officers, employees, and agents immune from liability for an act or omission done in good faith and compliance with the RUFADAA.

This bill would require, in applying and construing the RUFADAA, which is based upon a uniform act, consideration to be given to the need to promote uniformity of the law with respect to its subject matter among states that enact similar acts.

This bill would specify that it modifies, limits, or supersedes the federal Electronic Signatures in Global and National Commerce Act (E-SIGN) (15 U.S.C. Sec. 7001 et seq.), but does not modify, limit, or supersede Section 101(c) of that act (15 U.S.C. Sec. 7001(c)) or authorize electronic delivery of any of the notices described in Section 103(b) of that act (15 U.S.C. Sec. 7003(b)).

This bill would make disclosure of the contents of the deceased user’s or settlor’s account to a fiduciary of the deceased user or settlor subject to the same license, restrictions, terms of service, and legal obligations, including copyright law, that applied to the deceased user or settlor.

This bill would specify that if any provision or application of the RUFADAA to any person or circumstance is held invalid, the invalidity does not affect other provisions or applications of the RUFADAA that can be given effect without the invalid provision or application, and, to this end, the provisions of the RUFADAA are severable.

COMMENT

1. Stated need for the bill

The author writes:

Prior to the digital age, the memorabilia of our lives was stored in a cardboard box in our parent’s attic or under their bed. Today, a significant portion of the information about our lives is kept online on our personal accounts. Whether it’s Facebook, Twitter, YouTube or even email, the information stored online are today’s version of the photo albums, videos, and hand-written journals of yesterday.

Most people expect the contents of these online communications to remain private, even after they pass away; it’s likely the recipients of those messages likely expect the same. According to a recent Zogby poll, over 70 [percent] of Americans say their private online communications and photos should remain private after they die, unless they gave prior consent for others to access. Only 15 [percent] say that estate attorneys should control their private communications and photos, even if they gave no prior consent for sharing.

With no statute currently in place in California protecting the online information of the newly deceased, families are left responsible for accessing their loved ones information, often times causing unnecessary financial and emotional burdens’ during a time that is already painfully difficult.

AB 691 addresses this issue by striking a balance between providing a clear path for fiduciaries to access relevant information to handle the deceased person’s estate, while respecting the privacy choices of not just the deceased person but those with whom the deceased was communicating.

2. Digital assets

With the explosion of the various uses of the Internet, including electronic communication through email, social media Internet Web sites, blogs, and electronic media purchases through such Internet Web sites as iTunes and Amazon.com, questions regarding ownership and access to those “digital assets” upon death or incapacity are becoming more common. According to the National Conference of Commissions on Uniform State Laws (NCCUSL), these digital assets, which range from online gaming items to photos, to digital music, to clients, have real value: American consumers valued their digital assets, on average, at almost $55,000. (NCCUSL, Draft of Fiduciary Access to Digital Assets Act (Apr. 10, 2014), p. 1, citing Green, Passing Down Digital Assets, Wall Street Journal (Aug. 31, 2012) <http://www.uniformlaws. org/shared/docs/Fiduciary%20Access%20to%20Digital%20Assets/2014am_ufadaa_draft.pdf > [as of Apr. 16, 2016].) The ability of a personal representative to gain access or control over those digital assets is unclear and is subject to both federal privacy and computer “hacking” laws as well as state probate law.

As the author points out, recent polls show that individuals want their private online communications and photographs to remain private after they die, unless they have provided consent for someone else to access this content. Online content posted or transmitted by Internet users raises a host of legal issues, including user ownership of digital assets and privacy protection for Internet users. When someone dies, three particular issues rise to the surface – access to the deceased user’s (decedent) electronic communications and digital assets, control of the decedent’s electronic communications, online financial accounts and digital assets, and disclosure by the providers of electronic communication and remote computing services (custodian) of the decedent’s online content.

Complicating these issues are the terms of service agreements that most Internet service providers and Internet Web sites require their users to agree to in order to use these services and sites. For example, Yahoo’s terms of service provide that the user’s account is non-transferable and any rights to user’s Yahoo ID or contents within the account terminate upon the user’s death. (Yahoo, Terms of Service, General Information, No Right of Survivorship and Non-Transferability <https://policies. yahoo.com/us/en/yahoo/terms/utos/index.htm> [as of July 4, 2015].) On the other hand, Microsoft provides a “Next of Kin” process that allows the content, including all emails and attachments thereto, in the user’s Outlook account to be released to the user’s next of kin following an authentication process, after which the account contents are released by way of a data DVD shipped to the next of kin. (Microsoft, Next of Kin Process for Outlook.com <http://windows. microsoft.com/en-us/outlook/next-of-kin> [as of Apr. 16, 2016].)

SB 849 (Anderson, 2014) attempted to address these issues regarding the digital assets of decedents and would have provided a personal representative access to a decedent’s electronic mail account, as well as access to copies of the content of the account, subject to the applicable terms of service agreement. When SB 849 was reviewed by this Committee, the complex issues of digital assets were considered, including what is a digital asset, and how can the decedent’s fiduciary marshal all of the decedent’s assets when the types of digital assets continues to expand and there is no comprehensive definition as to what may be considered a digital asset (i.e., original emails, bitcoin, credits purchased on Facebook, blog content, digital music, etc.).

This bill would resolve those issues by defining a digital asset to mean an electronic record in which an individual has a right or interest, but would not include an underlying asset or liability, unless the asset or liability is itself an electronic record. Further, the scope of this bill is limited and only applies to electronic information being requested from the custodians of the digital assets by a decedent’s personal representative, administrator, executor, or trustee (fiduciary) for the purpose of ascertaining the decedent’s assets and liabilities.

3. Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA)

This bill would enact the RUFADAA and provide procedures through which a decedent’s fiduciary could obtain access to, or a catalogue or content of, the decedent’s digital assets from the custodian of those digital assets. According to NCCUSL:

The purpose of the [RUFADAA] is twofold. First, it gives fiduciaries the legal authority to manage digital assets and electronic communications in the same way they manage tangible assets and financial accounts, to the extent possible. Second, it gives custodians of digital assets and electronic communications legal authority to deal with the fiduciaries of their users, while respecting the user’s reasonable expectation of privacy for personal communications. The general goal of the act is to facilitate fiduciary access and custodian disclosure while respecting the privacy and intent of the user. It adheres to the traditional approach of trusts and estates law, which respects the intent of an account holder and promotes the fiduciary’s ability to administer the account holder’s property in accord with legally-binding fiduciary duties. The act removes barriers to a fiduciary’s access to electronic records and property and leaves unaffected other law, such as fiduciary, probate, trust, banking, investment securities, agency, and privacy law. (NCCUSL, Revised Uniform Fiduciary Access to Digital Assets Act (2015) (Mar. 8, 2015) <http://www.uniformlaws.org/ shared/docs/Fiduciary%20Access%20to%20Digital%20Assets/2015_RUFADAA_Final%20Act_2016mar8.pdf> [as of Apr. 16, 2016] p. 1.)

Although the RUFADAA, approved for use in all 50 states, would apply to personal representatives of decedents’ estates, conservators for protected persons and individuals, agents acting pursuant to a power of attorney, and trustees, this bill would adopt a modified version of RUFADAA and would not provide for conservator access to a conservatee’s digital assets.

NCCUSL states that the RUFADAA was recently approved and represents a consensus reached among stakeholders, including technology firms, privacy advocates, bankers, and the trust and estate bar. NCCUSL asserts that the “consensus was the result of a concerted effort by all parties over the last few months to agree on a reasonable regulatory framework that will balance the privacy interests of internet users with the need for fiduciaries to perform their tasks and ensure the orderly transfer of a decedent’s assets to heirs. It gives legal effect to an internet user’s wishes when they are known, and provides reasonable default rules that apply if the user has not expressed a contrary intent. The act represents the best opportunity to enact uniform legislation for an industry that operates in every state.” RUFADAA has been formally endorsed by the Association of American Retired Persons (AARP), the Center for Democracy and Technology, Facebook, Google, and the National Academy of Elder Law Attorneys. (NCCUSL, Legislative Fact Sheet – Revised Uniform Fiduciary Access to Digital Assets Act (2015) <http://www.uniformlaws.org/LegislativeFactSheet.aspx?title=Fiduciary Access to Digital Assets Act, Revised (2015)> [as of Apr. 16, 2016].)

To date, 10 states (Colorado, Florida, Idaho, Indiana, Michigan, Oregon, Tennessee, Washington, Wisconsin, and Wyoming) have enacted RUFADAA, and at least 18 other states have introduced RUFADAA legislation this year. (NCCUSL, Fiduciary Access to Digital Assets Act, Revised (2015) <http://www.uniformlaws.org/Act.aspx?title= Fiduciary%20Access%20to%20Digital%20Assets%20Act,%20Revised%20(2015)> [as of Apr. 16, 2016].)

4. Terms of service agreements

This bill would not change or impair a right of a custodian or a user under a terms-of-service agreement to access and use digital assets of a user, and does not give a fiduciary or designated recipient any new or expanded rights other than those held by the user for whom, or for whose estate or trust, the fiduciary or designated recipient acts or represents. This bill would provide that a fiduciary’s or designated recipient’s access to digital assets may be modified or eliminated by a user, by federal law, or by a terms-of-service agreement when the user has not provided any direction, as specified.

As discussed under Comment 2, provider terms of service agreements establish varying degrees of release of account content. Some providers state that upon the user’s death, the account contents are non-transferrable, while others provide some degree of content disclosure to family of the deceased user. These terms of service agreements may also include choice of law and forum clauses that limit the user’s ability to file an action against the electronic information provider. For example, Yahoo specifies that any and all claims, causes of action or disputes (regardless of theory) arising out of or relating to the terms of service, or the relationship between the user and Yahoo, shall be brought exclusively in the courts located in the county of Santa Clara, California or the U.S. District Court for the Northern District of California. (Yahoo, Terms of Service, General Information, Choice of Law and Forum <https://policies.yahoo.com/us/en/yahoo/ terms/utos/index.htm> [as of Apr. 16, 2016].)

Although the terms of service agreement may provide a choice of law or forum clause, this bill specifically permits, pursuant to the definition of “court” provided in this bill, the decedent’s fiduciary to file an action to compel disclosure of digital assets in the superior court presiding over the probate proceedings initiated to administer the decedent’s estate or, if none, the superior court in the county of the decedent’s domicile.

5. Privacy protections

This bill would provide protections for a deceased user’s private electronic communications by establishing the circumstances under which the custodian of the electronic communications could disclose those communications. This bill would establish a three-tier priority system for determining the user’s intent for disclosure of his or her electronic communications.

First in priority, the bill would authorize disclosure pursuant to the user’s designation through an online tool. This tool would provide the most current reflection of the user’s intent for disclosure to another person. Second, the user can provide directions in an estate plan for the disposition of the user’s digital assets. The custodian would then be able to rely on the testamentary document containing these disclosure instructions, which would then have legal effect pursuant to this bill.

If the user did not provide any direction regarding disclosure of digital assets, the terms-of-service governing the account would apply. If the terms-of-service do not address fiduciary access to digital assets, the default rules provided in the bill would apply. (NCCUSL, Revised Uniform Fiduciary Access to Digital Assets Act (2015) (Mar. 8, 2015) <http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20 Digital%20Assets/2015_RUFADAA_Final%20Act_2016mar8.pdf> [as of Apr. 16, 2016] p. 11.)

6. Fiduciary duties

A decedent’s fiduciary has a duty to the decedent to execute the terms of the decedent’s testamentary documents. The fiduciary is also subject to multiple statutory duties, including care and loyalty, to the beneficiaries of the decedent’s estate or trust. A decedent’s fiduciary is also required to keep the beneficiaries reasonably informed and fully disclose all material information necessary to protect the beneficiaries’ interests. In addition to the duties of care and loyalty, this bill would also establish the fiduciary’s duty of confidentiality.

As stated by the author, most people expect the contents of their electronic communications to remain private after they pass away, and the recipients and senders of those messages likely expect the same. To the extent the decedent limits access to his or her electronic information so that the information is only disclosable to or accessible by the fiduciary, either through the online tool or pursuant to testamentary documents, this bill inherently incorporates the decedent’s expectation that the fiduciary will maintain the decedent’s confidentiality upon receiving the electronic information.

Arguably, the duty of confidentiality provision goes to the heart of the privacy concerns this bill seeks to address. Since the fiduciary would only be able to receive the content of or access to the electronic communications pursuant to the decedent’s online designation, authorization in a testamentary document, or by court order for the purpose of administering the decedent’s trust or estate, this provision effectively resolves much of the concern regarding disclosure of the decedent’s confidential electronic communications. However, the duty of confidentiality may conflict with the fiduciary’s duty to disclose material information to the beneficiaries. In the event the beneficiaries seek information obtained by the fiduciary from the custodian that the fiduciary believes is confidential and not pertinent to the administration of the estate or the trust, the fiduciary could petition the court for instructions on whether the fiduciary has to disclose the information to the beneficiaries.

7. Custodian immunity from liability

This bill would make a custodian and its officers, employees, and agents immune from liability for an act or omission done in good faith and compliance with the RUFADAA. According to comments pertaining to this provision provided in RUFADAA:

This section establishes that custodians are protected from liability when they act in accordance with the procedures of this act and in good faith. The types of actions covered include disclosure as well as transfer of copies. The critical issue in conferring immunity is the source of the liability. Direct liability is not subject to immunity; indirect liability is subject to immunity.

Direct liability could only arise from noncompliance with a judicial order issued under sections 7 to 15. Upon determination of a right of access under those sections, a court may issue an order to grant access under section 16. Section 16(b) requires that an order directing compliance contain a finding that compliance is not in violation of 18 U.S.C. Section 2702. Noncompliance with that order would give rise to liability for contempt. There is no immunity from this liability.

Indirect liability could arise from granting a right of access under this act. Access to a digital asset might invade the privacy or [] harm the reputation of the decedent, protected person, principal, or settlor, it might harm the family or business of the decedent, protected person, principal, or settlor, and it might harm other persons. The grantor of access to the digital asset is immune from liability arising out of any of these circumstances if the grantor acted in good faith to comply with this act. If there is a judicial order under section 16, compliance with the order establishes good faith. Absent a judicial order under section 16, good faith must be established by the grantor’s assessment of the requirements of this act.

Further, Section 16 (e) allows the custodian to verify that the account belongs to the person represented by the fiduciary. (NCCUSL, Revised Uniform Fiduciary Access to Digital Assets Act (2015) (Mar. 8, 2015) <http://www.uniformlaws.org/shared/ docs/Fiduciary%20Access%20to%20Digital%20Assets/2015_RUFADAA_Final%20Act_2016mar8.pdf> [as of Apr. 16, 2016] p. 30.)

Accordingly, the intent of the custodian immunity provided in this bill is to protect the custodian from liability for disclosure of a digital asset as long as the custodian was acting in good-faith compliance with a judicial order requiring disclosure of the digital assets. On the other hand, these comments make clear that the custodian would not be immune from direct liability due to noncompliance with a judicial order.

8. Electronic signatures

This bill establishes procedures relevant to electronic records. The Electronic Signatures in Global and National Commerce Act (E-SIGN) (15 U.S.C. Sec. 7001 et seq.) establishes legal parity between electronic records and signatures and their paper and ink counterparts. (R. A. Wittie, J. K. Winn, Electronic Records and Signatures Under the Federal E-SIGN Legislation and the UETA <http://www.law.washington.edu/Directory/docs/ Winn/Electronic%20Records%20and%20Signatures.htm> [as of Apr. 16, 2016].) To the extent a state law effectively deviates from E-SIGN’s requirements for electronic transactions, E-SIGN provides a two-prong approach for an exemption to preemption of the state law. The second prong, relevant to this bill, requires all of the following:

• the alternative procedures or requirements are consistent with E-SIGN;
• as compared to E-SIGN, those procedures or requirements do not require or give greater legal status or effect to implementation or application of a specific technology or technical specification for the functions of creating, storing, generating, receiving, communicating, or authenticating electronic records or electronic signatures; and
• the state law specifically refers to E-SIGN. (15 U.S.C. Sec. 7002(a)(2).)

After the enactment of E-SIGN, NCCUSL took steps to protect its uniform laws from E-SIGN preemption claims. To meet the second prong of E-SIGN’s preemption test and provide a defense against such claims, NCCUSL created a standard provision (known as “the Standard Section”) for its uniform acts that provide for electronic records, agreements, or signatures. The Standard Section has already been included in a number of uniform acts enacted by California, and is also included in this bill. (Study L-750, Staff Memorandum 2013-14, Uniform Adult Guardianship and Protective Proceedings Jurisdiction Act: E-SIGN (Mar. 28, 2013) Cal. Law Revision Comm. <http://www.clrc.ca.gov/pub/2013/MM13-14.pdf> [as of Apr. 16, 2016] pp. 7-9.)

9. Opposition’s concerns

A coalition of privacy stakeholders are opposed to this bill and argue that the prior version of the bill, which would have adopted a different approach to the same problem by establishing the Privacy Expectation Afterlife and Choices Act (PEAC), was superior to the current version of the bill. The opposition states that, despite repeated requests and inquiries since last September, they were not included in any subsequent discussions of the bill. As a result, the opposition contends that serious privacy implications have not been adequately considered or addressed. The opposition urges the author to amend the bill to: (1) require fiduciaries to specify the account for which they are requesting records and provide an affidavit to the custodian that the disclosure of the user’s digital assets is reasonably necessary for estate administration; (2) clarify accessibility to the decedent’s account or digital assets; (3) clarify several definitions, including custodian, which is currently overbroad and could apply to public libraries that provide computers for public use; and (4) clarify that the bill does not require a custodian to access a password protected or encrypted account where the custodian does not already have such access.

Support: AOL; California Bankers Association; California Chamber of Commerce; CompTIA; Google; Internet Association; State Privacy and Security Coalition, Inc.; Yahoo

Opposition: American Civil Liberties Union of California; Consumer Federation of California; Consumer Watchdog; Electronic Frontier Foundation; Privacy Rights Clearinghouse

HISTORY

Source: Facebook; TechNet

Related Pending Legislation: None Known

Prior Legislation:

SB 849 (Anderson, 2014) See Background.

AB 5 (Evans, Chapter 5, Statutes of 2009) See Background.

Prior Vote:

Senate Judiciary Committee (Ayes 7, Noes 0)

Senate Judiciary Committee (Ayes 6, Noes 0)

Assembly Floor (Ayes 79, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 0)

Assembly Judiciary Committee (Ayes 10, Noes 0)

**************

 THIRD READING  

Bill No: AB 691

Author: Calderon (D), et al.

Amended: 9/4/15 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 6-0, 7/14/15

AYES: Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

NO VOTE RECORDED: Jackson

SENATE JUDICIARY COMMITTEE: 7-0, 9/10/15 (pursuant to Senate Rule 29.10)

AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

ASSEMBLY FLOOR: 79-0, 5/11/15 - See last page for vote

SUBJECT: The Privacy Expectation Afterlife and Choices Act

SOURCE: Facebook

TechNet

DIGEST: This bill establishes the Privacy Expectation Afterlife and Choices Act and provides procedures for the disclosure of electronic communication records, information, or contents, as specified, of a deceased user of an electronic communication service or remote computing service (provider).

Senate Floor Amendments of 9/4/15 restructure the bill and modify the disclosure processes.

ANALYSIS:

Existing law:

1. Authorizes a decedent’s personal representative or the public administrator to take possession or control of all of the decedent’s property to be administered in the decedent’s estate, and requires the personal representative to take all steps reasonably necessary for the management, protection, and preservation of, the estate in his or her possession.

2. Provides that the personal representative has the management and control of the estate and prescribes fiduciary duties to the personal representative, including using ordinary care and diligence in managing and controlling the decedent’s estate.

3. Requires the personal representative to file with the court clerk an inventory of property to be administered in the decedent’s estate together with an appraisal, which must be filed within four months after letters are first issued to a general personal representative. However, the court may allow such further time for filing an inventory and appraisal as is reasonable under the circumstances of the particular case.

4. Requires the account to include both a financial statement and a report of administration, as specified, and requires the statement of liabilities in the report of administration to include information as to whether notice to creditors was given, as specified, creditor claims were filed, as specified, creditor claims were not paid, satisfied, or adequately provided for, and whether any real or personal property is security for a claim, whether by mortgage, deed of trust, lien, or other encumbrance.

5. Requires the personal representative to either petition for an order for final distribution of the estate or make a report of status of administration within one year after the date of issuance of letters in an estate for which a federal estate tax return is not required, and within 18 months after the date of issuance of letters in an estate for which a federal estate tax return is required.

6. Provides that if a report of status of administration is made, the report must show the condition of the estate, the reasons why the estate cannot be distributed and closed, and an estimate of the time needed to close administration of the estate, and authorizes the court to require the personal representative to appear before the court to show the condition of the estate and the reasons why the estate cannot be distributed and closed.

7. Establishes, under the Electronic Discovery Act (EDA), procedures, evidentiary privileges, and judicial review for the request and production of electronically stored information, as defined.

8. Limits, under the Electronic Communications Privacy Act (ECPA), the disclosure by an electronic communication service or remote computing service of electronic communication of a user, and provides definitions for “electronic communication,” “user,” electronic communications system,” and “electronic communication service.”

9. Prohibits a person or entity providing an electronic communication service to the public from knowingly divulging to any person or entity the contents of a communication while in electronic storage by that service, and prohibits a person or entity providing remote computing service to the public from knowingly divulging to any person or entity the contents of any communication which is carried or maintained on that service:

• On behalf of, and received by means of electronic transmission from (or created by means of computer processing of communications received by means of electronic transmission from), a subscriber or customer of such service; and

• Solely for the purpose of providing storage or computer processing services to such subscriber or customer, if the provider is not authorized to access the contents of any such communications for purposes of providing any services other than storage or computer processing.

10. Authorizes disclosure of the content of electronic communications with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service.

11. Authorizes disclosure of a record or other information pertaining to a subscriber or customer of an electronic communication service or remote computing service (not including the contents of communications), including to any person other than a governmental entity.

This bill:

1. Establishes the Privacy Expectation Afterlife and Choices Act, and provides for the voluntary disclosure of electronic records, information, or contents of electronic communications by a provider to the personal representative of the estate or the trustee of the trust of a deceased user, as specified.

2. Authorizes the provider to decline to respond to a request because of a concern that complying with the request may violate any other legal authority, be contrary to the wishes of the user, or be otherwise inappropriate.

3. Authorizes a probate court that has jurisdiction of the estate or trust of the deceased user to order a provider to disclose to the personal representative or trustee a record, information, or contents of an electronic communication if the court makes specified findings of fact based on a sworn declaration, indicating the good faith belief and efforts of the personal representative or trustee, or any other admissible evidence.

4. Creates a procedure, as specified, if no probate proceeding has been opened, authorizing a personal representative or trustee to file a verified petition seeking an order compelling the provider to provide the requested records, information, or contents of communications or stored contents, and requires the personal representative or trustee to file the petition in the superior court of the county agreed to by the user in the terms of service agreement or, in the absence of that agreement, the county in which the deceased user resided at death.

5. Subjects the disclosure of the contents of the deceased user’s account to the executor or administrator of the estate or the trustee of the trust to the same license, restrictions, terms of service, and legal obligations, including copyright law, that applied to the deceased user, and does not require a provider to permit a requesting party to assume control of a deceased user’s account.

Background

In order to address privacy concerns with computer and other digital and electronic communications, ECPA updated the Federal Wiretap Act of 1968. (The Electronic Communications Privacy Act of 1986 (ECPA), Bureau of Justice Assistance, Office of Justice Programs, U.S. Dept. of Justice (July 30, 2013).) ECPA, as amended, “protects wire, oral, and electronic communications while those communications are being made, are in transit, and when they are stored on computers. [ECPA] applies to email, telephone conversations, and data stored electronically.” (Id.) ECPA reflects a general approach of providing greater privacy protection for materials in which there are greater privacy interests. (Id.) Notably, ECPA is primarily targeted at limiting government access to private user information. However, this federal law applies to communications sent or received by users and restricts all access to the records and contents of those communications, including access by an executor, administrator, or trustee of a deceased user. California state law provides specified discovery procedures for parties in civil actions, including probate actions that administer the trust or estate of a decedent, to obtain documents that are stored electronically. Those laws were enacted under AB 5 (Evans, Chapter 5, Statutes of 2009), which established the EDA.

In California, SB 849 (Anderson, 2014) would have authorized a decedent’s personal representative to request, and would have authorized an electronic communication service or remote computer service to provide, access to the electronic mail account of a decedent or to copies of the content of the account, subject to any applicable service agreement. SB 849 was held in the Senate Judiciary Committee after testimony.

In July 2014, the National Conference of Commissioners on Uniform State Laws (NCCUSL) approved the Uniform Fiduciary Access to Digital Assets Act (UFADAA), which was recommended for enactment in all states “to vest fiduciaries with the authority to access, control, or copy digital assets and accounts[,] . . . remove barriers to a fiduciary’s access to electronic records[,] and to leave unaffected other law, such as fiduciary, probate, trust, banking, investment, securities, and agency law.” (NCCUSL, Uniform Fiduciary Access to Digital Assets Act (Apr. 2, 2015) p. 1.)

UFADAA was recently revised this past July, and is now supported by technology stakeholders. This bill does not enact the revised UFADAA, but, instead, provides for the disclosure of electronic communications, as specified, by providers to personal representatives or trustees of deceased users for the purpose of administering the deceased user’s estate or trust and resolving issues regarding assets or liabilities of a decedent’s estate.

Comments

The author writes, “Most people expect the contents of these online communications to remain private, even after they pass away; it’s likely the recipients of those messages likely expect the same. According to a recent Zogby poll, over 70 [percent] of Americans say their private online communications and photos should remain private after they die, unless they gave prior consent for others to access. Only 15 [percent] say that estate attorneys should control their private communications and photos, even if they gave no prior consent for sharing. With no statute currently in place in California protecting the online information of the newly deceased, families are left responsible for accessing their loved ones information, often times causing unnecessary financial and emotional burdens’ during a time that is already painfully difficult.”

Prior Legislation

SB 849 (Anderson, 2014) See Background.

AB 5 (Evans, Chapter 5, Statutes of 2009) See Background.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 9/4/15)

Facebook (co-source)

Technet (co-source)

AOL

California Chamber of Commerce

California Hispanic Chambers of Commerce

California State Council of the Service Employees International Union

Civil Justice Association of California

Internet Association

Mental Health America of California

State Privacy and Security Coalition, Inc.

Yahoo

OPPOSITION: (Verified 9/4/15)

California Bankers Association

ARGUMENTS IN SUPPORT: Supporters argue that this bill is a narrower version of the original version of UFADAA since it only deals with electronic communications stored online, as well as having an opt-in rule. Supporters contend that by having a narrowed approach, this bill focuses on updating law, addressing a portion of online interaction that has, up to this point, been silent on the responsibilities of the parties involved when in probate. Further, supporters state that providing such clarity can help families, as well as other parties involved, in determining what to do with the personal information and communications of the decedent that is stored online.

ARGUMENTS IN OPPOSITION: Opponents argue that, although there have been conversations and negotiations with the sponsors over the past months, a consensus approach to the issues to be resolved by the bill has not been reached. The opposition notes that the alternative approach to this bill, the revised UFADAA, at a minimum, includes important definitions that ought to be adopted in statute, and, if there is a disagreement over some of the basic elements, or distinctions in terms between the states, the ability to comply with this bill will be frustrated to the detriment of beneficiaries. Opponents recommend withholding passage of this bill this year with a commitment to working through the interim because the underlying public policy is too important to rush since the result impacts privacy rights and the rights of beneficiaries.

ASSEMBLY FLOOR: 79-0, 5/11/15

AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood

NO VOTE RECORDED: Atkins

Prepared by: Tara Welch / JUD. / (916) 651-4113

9/10/15 23:08:55

**** END ****

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2015-2016 Regular Session

Bill No: AB 691 (Author:Calderon)

Version: September 4, 2015

Hearing Date: September 10, 2015

Fiscal: No

Urgency: No

Consultant: TMW

PURSUANT TO SENATE RULE 29.10

SUBJECT

The Privacy Expectation Afterlife and Choices Act

DESCRIPTION

This bill would establish the Privacy Expectation Afterlife and Choices Act and provide procedures for the disclosure of electronic communication records, information, or contents, as specified, of a deceased user of an electronic communication service or remote computing service (provider).

BACKGROUND

In order to address privacy concerns with the use of computers and other digital and electronic communications, Congress passed the Electronic Communications Privacy Act of 1986 (ECPA) to update the Federal Wiretap Act of 1968. (The Electronic Communications Privacy Act of 1986 (ECPA), Bureau of Justice Assistance, Office of Justice Programs, U.S. Dept. of Justice (July 30, 2013) <https://it.ojp.gov/ PrivacyLiberty/authorities/statutes/1285> [as of Sept. 9, 2015].) The ECPA has been revised over the years by several pieces of legislation, including the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA Patriot Act), “to keep pace with the evolution of new communications technologies and methods, including easing restrictions on law enforcement access to stored communications in some cases. . . . The ECPA, as amended, protects wire, oral, and electronic communications while those communications are being made, are in transit, and when they are stored on computers. The [ECPA] applies to email, telephone conversations, and data stored electronically.” (Id.) The ECPA reflects a general approach of providing greater privacy protection for materials in which there are greater privacy interests. (Id.)

Notably, the ECPA is primarily targeted at limiting government access to private user information. However, this federal law applies to communications sent or received by users and restricts all access to the records and contents of those communications, including access by an executor, administrator, or trustee of a deceased user. California state law provides specified discovery procedures for parties in civil actions, which include estate and trust proceedings, to obtain documents that are stored electronically. Those procedures were enacted under AB 5 (Evans, Chapter 5, Statutes of 2009), which established the Electronic Discovery Act.

However, internet service and electronic storage providers are subject to both federal and state electronic communications privacy laws, which may conflict when a person, other than the user sending or storing electronic communications or the recipient of an electronic communication, attempts to obtain the records or contents of the electronic records and communications. This is problematic when the executor, administrator, or trustee (fiduciary) of a deceased user or recipient is tasked with marshalling the decedent’s assets and liabilities in order to administer the decedent’s trust or estate. Since many individuals are now receiving invoices and billing in electronic form as a way to go “paperless,” performing many financial transactions online, as well as primarily corresponding through electronic means, obtaining the decedent’s electronic communications may be the only way for the fiduciary to determine the assets and liabilities of the decedent. By 2014, seven states had enacted laws to grant some degree of access of a decedent’s electronic communications to fiduciaries.

In California, SB 849 (Anderson, 2014) would have authorized a decedent’s personal representative to request, and would have authorized an electronic communication service or remote computer service to provide, access to the electronic mail account of a decedent or to copies of the content of the account, subject to any applicable service agreement. SB 849 was held in this Committee after testimony was taken.

In July 2014, the National Conference of Commissioners on Uniform State Laws (NCCUSL) approved the Uniform Fiduciary Access to Digital Assets Act (UFADAA), which was recommended for enactment in all states “to vest fiduciaries with the authority to access, control, or copy digital assets and accounts[,] . . . remove barriers to a fiduciary’s access to electronic records[,] and to leave unaffected other law, such as fiduciary, probate, trust, banking, investment, securities, and agency law.” (NCCUSL, Uniform Fiduciary Access to Digital Assets Act (Apr. 2, 2015) <http://www.uniformlaws. org/shared/docs/Fiduciary%20Access%20to%20Digital%20Assets/2014_UFADAA_Final.pdf > [as of Sept. 9, 2015] p. 1.)

UFADAA was recently revised to clarify the application of federal privacy laws and give legal effect to an account holder’s instructions for the disposition of digital assets. (NCCUSL <http://www.uniformlaws.org/Act.aspx?title=Fiduciary%20Access %20to%20Digital%20Assets> [as of Sept. 9, 2015].) According to NCCUSL, the 2014 UFADAA provided fiduciaries with default access to all digital information, but the revised act protects the contents of electronic communications from disclosure without the user’s consent, and fiduciaries can still access other digital assets unless prohibited by the user.

This bill does not enact the revised UFADAA, but, instead, would provide for the disclosure of electronic communications, as specified, by providers to personal representatives or trustees of deceased users for the purpose of administering the deceased user’s estate or trust and resolving issues regarding assets or liabilities of a decedent’s estate.

CHANGES TO EXISTING LAW

Existing law authorizes a decedent’s personal representative or the public administrator to take possession or control of all of the decedent’s property to be administered in the decedent’s estate, and requires the personal representative to take all steps reasonably necessary for the management, protection, and preservation of, the estate in his or her possession. (Prob. Code Secs. 7601(a), 7602, 9650(a)(1), (b).)

Existing law defines “fiduciary” to mean the decedent’s personal representative or the trustee of the decedent’s trust. (Prob. Code Sec. 16323.) Existing law defines “personal representative” to mean the executor, administrator, administrator with the will annexed, special administrator, successor personal representative, public administrator, as specified, or a person who performs substantially the same function under the law of another jurisdiction governing the person’s status. (Prob. Code Sec. 58(a).)

Existing law provides that the personal representative has the management and control of the estate and prescribes fiduciary duties to the personal representative, including using ordinary care and diligence in managing and controlling the decedent’s estate. (Prob. Code Sec. 9600.)

Existing law requires the personal representative to file with the court clerk an inventory of property to be administered in the decedent’s estate together with an appraisal, which must be filed within four months after letters are first issued to a general personal representative; however, the court may allow such further time for filing an inventory and appraisal as is reasonable under the circumstances of the particular case. (Prob. Code Sec. 8800.)

Existing law, if the personal representative refuses or negligently fails to file an inventory and appraisal within the time allowed, upon petition of an interested person, authorizes the court to: (1) compel the personal representative to file an inventory and appraisal; (2) remove the personal representative from office; and (3) impose on the personal representative personal liability, which may include attorney’s fees, for injury to the estate or to an interested person that directly results from the refusal or failure. (Prob. Code Sec. 8804.)

Existing law requires the account to include both a financial statement and a report of administration, as specified, and requires the statement of liabilities in the report of administration to include information as to whether notice to creditors was given, as specified, creditor claims were filed, as specified, creditor claims were not paid, satisfied, or adequately provided for, and whether any real or personal property is security for a claim, whether by mortgage, deed of trust, lien, or other encumbrance. (Prob. Code Sec. 10900.)

Existing law provides that if a report of status of administration is made, the report must show the condition of the estate, the reasons why the estate cannot be distributed and closed, and an estimate of the time needed to close administration of the estate. (Prob. Code Sec. 12201(a).) The court is authorized to require the personal representative to appear before the court to show the condition of the estate and the reasons why the estate cannot be distributed and closed. (Prob. Code Sec. 12202(a).)

Existing law authorizes a trustee or beneficiary of a trust to petition the court concerning the internal affairs of the trust or to determine the existence of the trust; proceedings concerning the internal affairs of the trust include proceedings to determine questions of construction of a trust instrument, the existence or nonexistence of any immunity, power, privilege, duty, or right, determining the validity of a trust provision, ascertaining beneficiaries and determining to whom property shall pass or be delivered upon final or partial termination of the trust, to the extent the determination is not made by the trust instrument, and settling the accounts and passing upon the acts of the trustee, including the exercise of discretionary powers. (Prob. Code Sec. 17200.)

Existing law, establish, under the Electronic Discovery Act (EDA), procedures, evidentiary privileges, and judicial review for the request and production of electronically stored information, as defined. (Code Civ. Proc. Secs. 1985.8, 2031.285.)

Existing law authorizes claims of evidentiary privilege on the ground that the matter sought to be disclosed is a communication made in confidence in the course of the lawyer-client, lawyer referral service-client, physician-patient, psychotherapist-patient, clergy-penitent, husband-wife, sexual assault counselor-victim, domestic violence counselor-victim, or human trafficking caseworker-victim relationship, the communication is presumed to have been made in confidence and the opponent of the claim of privilege has the burden of proof to establish that the communication was not confidential. (Evid. Code Sec. 917(a).) Further, a communication between persons in one of these types of relationships does not lose its privileged character for the sole reason that it is communicated by electronic means or because persons involved in the delivery, facilitation, or storage of electronic communication may have access to the content of the communication. (Evid. Code Sec. 917(b).)

Existing law makes document production provisions under the Civil Discovery Act, which includes the Electronic Discovery Act (EDA), applicable to civil actions and trial courts in which the civil action is pending, and defines “electronic” to mean relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities, and “electronically stored information” to mean information that is stored in an electronic medium. (Code Civ. Proc. Sec. 2016.020.)

Existing federal law, under the Electronic Communications Privacy Act (ECPA), limits the disclosure by an electronic communication service or remote computing service of electronic communication of a user and provides definitions for “electronic communication,” “user,” electronic communications system,” and “electronic communication service.” (18 U.S.C. Sec. 2510 et seq.)

Existing federal law, the Stored Communications Act (SCA), defines “remote computing service” to mean the provision to the public of computer storage or processing services by means of an electronic communications system. (18 U.S.C. Sec. 2711(2).)

Existing federal law prohibits a person or entity providing an electronic communication service to the public from knowingly divulging to any person or entity the contents of a communication while in electronic storage by that service, and prohibits a person or entity providing remote computing service to the public from knowingly divulging to any person or entity the contents of any communication which is carried or maintained on that service:

• on behalf of, and received by means of electronic transmission from (or created by means of computer processing of communications received by means of electronic transmission from), a subscriber or customer of such service; and

• solely for the purpose of providing storage or computer processing services to such subscriber or customer, if the provider is not authorized to access the contents of any such communications for purposes of providing any services other than storage or computer processing. (18 U.S.C. Sec. 2702(a)(1)-(2).)

Existing federal law also prohibits a provider of remote computing service or electronic communication service to the public from knowingly divulging a record or other information pertaining to a subscriber or customer of such service (not including the contents of communications) to any governmental entity. (18 U.S.C. Sec. 2702(a)(3).)

Existing federal law authorizes disclosure of the content of electronic communications to an addressee or intended recipient of such communication or an agent of such addressee or intended recipient, as otherwise authorized under ECPA or the SCA; or with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service. (18 U.S.C. Sec. 2702(b).)

Existing law authorizes disclosure of a record or other information pertaining to a subscriber or customer of an electronic communication service or remote computing service (not including the contents of communications) as otherwise authorized, with the lawful consent of the customer or subscriber; or to any person other than a governmental entity. (18 U.S.C. Sec. 2702(c).)

This bill would establish the Privacy Expectation Afterlife and Choices Act and provide for the voluntary disclosure of electronic records, information, or contents of electronic communications by a provider to the personal representative of the estate or the trustee of the trust of a deceased user, as specified.

This bill would authorize the provider to decline to respond to a request because of a concern that complying with the request may violate any other legal authority, be contrary to the wishes of the user, or be otherwise inappropriate.

This bill would authorize a probate court that has jurisdiction of the estate or trust of the deceased user to order a provider to disclose to the personal representative or trustee a record, information, or contents of an electronic communication if the court makes specified findings of fact based on a sworn declaration, indicating the good faith belief and efforts of the personal representative or trustee, or any other admissible evidence.

This bill, if no probate proceeding has been opened, would authorize a personal representative or trustee to file a verified petition seeking an order compelling the provider to provide the requested records, information, or contents of communications or stored contents, and would require the personal representative or trustee to file the petition in the superior court of the county agreed to by the user in the terms of service agreement or, in the absence of that agreement, the county in which the deceased user resided at death.

This bill would subject the disclosure of the contents of the deceased user’s account to the executor or administrator of the estate or the trustee of the trust to the same license, restrictions, terms of service, and legal obligations, including copyright law, that applied to the deceased user, and does not require a provider to permit a requesting party to assume control of a deceased user’s account.

COMMENT

1. Stated need for the bill

The author writes:

Prior to the digital age, the memorabilia of our lives was stored in a cardboard box in our parent’s attic or under their bed. Today, a significant portion of the information about our lives is kept online on our personal accounts. Whether it’s Facebook, Twitter, YouTube or even email, the information stored online are today’s version of the photo albums, videos, and hand-written journals of yesterday.

Most people expect the contents of these online communications to remain private, even after they pass away; it’s likely the recipients of those messages likely expect the same. According to a recent Zogby poll, over 70 [percent] of Americans say their private online communications and photos should remain private after they die, unless they gave prior consent for others to access. Only 15 [percent] say that estate attorneys should control their private communications and photos, even if they gave no prior consent for sharing.

With no statute currently in place in California protecting the online information of the newly deceased, families are left responsible for accessing their loved ones information, often times causing unnecessary financial and emotional burdens’ during a time that is already painfully difficult.

2. Concerns with recent amendments

This bill would establish procedures for the disclosure of electronic communication records and content to a deceased user’s personal representative or trustee. Proponents of this bill assert that this bill would give Californians the right to decide what happens to private information after they die and assert that the bill creates a clear path for legitimate requests for records needed to settle an estate. Proponents argue that the bill honors a person’s wishes by allowing a personal representative or trustee to see contents of electronic communications if the person consented to disclosure, permits a court to order communication records on behalf of an executor or trustee, complies with existing federal privacy law, avoids revealing the wrong information to the wrong people, and protects the privacy of living people who shared private messages with the deceased person before they died.

Although this bill raises the overall policy issues discussed in the Committee’s analysis of July 13, 2015, the September 4, 2015, amendments to this bill raise additional issues, and the bill is now opposed by the California Bankers Association (CBA), the Executive Committee of the Trusts and Estates Section of the State Bar of California (TEXCOM), and Judicial Council of California (Judicial Council).

1. Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA)

According to NCCUSL, the RUFADAA was recently approved and represents a consensus reached among stakeholders, including technology firms, privacy advocates, bankers, and the trust and estate bar. NCCUSL asserts that the “consensus was the result of a concerted effort by all parties over the last few months to agree on a reasonable regulatory framework that will balance the privacy interests of internet users with the need for fiduciaries to perform their tasks and ensure the orderly transfer of a decedent’s assets to heirs. It gives legal effect to an internet user’s wishes when they are known, and provides reasonable default rules that apply if the user has not expressed a contrary intent. The act represents the best opportunity to enact uniform legislation for an industry that operates in every state.” NCCUSL notes that the RUFADAA is undergoing a final style review and the final act will be published within a few weeks for consideration by state legislatures. In the meantime, NCCUSL recommended that this Committee “take no action on digital assets legislation until the [RUFADAA] is available for its consideration.”

In addition, CBA asserts that “[d]espite the short time our members have had to review the [RUFADAA], we conclude that the [RUFADAA] is superior to the current version of AB 691. Therefore, we urge the adoption of the [RUFADAA], or at a minimum, a hybridized version.” CBA argues that the RUFADAA includes important definitions that ought to be adopted in statute because, to the degree that there is ambiguity over the definitions and key terms, the more challenging AB 691 will be to administer for all parties. CBA asserts that its members are interested in being able to comply with the law, but disagreements over some of the basic elements, or distinctions in terms between states, will frustrate the ability to comply with the law to the detriment of beneficiaries.

2. Confusing and ambiguous terms in the bill

Judicial Council asserts that its probate committee has reviewed multiple versions of AB 691 during this year and has identified a variety of problems with the legislation from a court administration standpoint. Judicial Council states that this bill, among other things, requires the court to determine that disclosure of the digital assets of the decedent “is not in violation of another applicable federal or state law.” Judicial Council argues that it is unclear how a court would be able to make such a finding. Judicial Council asserts that the bill would require the fiduciary to make a sworn declaration regarding facts the fiduciary can establish in this context but the bill does not appear to eliminate the court’s responsibility to render its own conclusion on this legal issue. TEXCOM argues that this requirement in the bill “is a legal conclusion and not a finding of fact as characterized by the bill. Second, and more importantly, state superior courts, probate attorneys and California decedents and their heirs generally are not experts in federal privacy laws, data storage laws or other laws that might be relevant to a fiduciary’s access to digital assets. Few, if any, are equipped to assert or determine a finding that the disclosure of such records does not violate other laws from other areas of expertise. Requiring state courts and fiduciaries to establish the absence of a violation seems unnecessary given that AB 691 separately specifies that a provider shall not be compelled to disclose communications if such disclosure would violate another applicable law. The providers and their counsel are highly sophisticated and knowledgeable about the relevant laws. The provider should be the party to establish whether there is any violation of such laws.” (Emphasis in original.)

Judicial Council also notes that the bill includes a number of vague phrases that are confusing and will be difficult for the court to interpret. Judicial Council states that the bill requires the court to find that “the request is not in conflict with the will, trust, or other written, electronic, or oral expression of the deceased user’s intent regarding access to, or disposition of information contained in or regarding the account of the deceased user.” (Emphasis added.) Judicial Council argues that this requirement necessitates “proof of a negative. For example, the fiduciary could state that to the best of his/her knowledge, the decedent never made any oral statement anywhere to anyone regarding contrary intent about the account. However, the bill imposes an absolute requirement on the court that it must find that the request does not conflict with any other statement the decedent has ever made, in any form, at any time, which would appear to be impossible as a practical matter.” On this point, TEXCOM notes the “impossible task that will be required as a strict analytical matter for the court to establish” that the request for electronic communications does not conflict with any written, electronic, or oral expression of the deceased user’s intent.

TEXCOM argues that this bill uses vague terms which are confusing for the public to understand and for courts to apply. TEXCOM asserts that the bill “allows a provider to refuse disclosure of digital content to a fiduciary in all cases, even if the decedent consented to disclosure, ‘because of a concern that complying with the request may violate any other legal authority, be contrary to the wishes of the user, or be otherwise inappropriate.’ This standard for unilateral denial is unacceptably vague and arbitrary, and is likely to result in confusion, prolonged or additional judicial proceedings and litigation over its interpretation.” In addition, TEXCOM notes that this standard should include a reasonable element (“reasonable concern”) to require the provider to demonstrate some legitimate basis for unilateral denial of disclosure.

3. Burden on the courts

This bill would establish a non-probate procedure through which the decedent’s personal representative or trustee could seek an order compelling the provider to disclose the requested records, information, or contents of communications or stored contents. This procedure would require the personal representative or trustee to file a petition in the superior court of the county agreed to by the deceased user in the terms of service agreement or, in the absence of that agreement, the county in which the deceased user resided at death.

Judicial Council notes that this non-probate process for a personal representative or trustee to use to compel the provider to disclose requested digital information pertaining to the deceased user fails to contain any statutory provisions governing notice or service of such a proceeding before that order is issued. Judicial Council argues that requiring notice to providers would create an opportunity for the providers to participate in the proceeding if they want to object before the order is issued; however, this bill, instead, allows a provider served with an order compelling disclosure of information to make a motion to vacate or modify that order after the order has been issued by the court. According to Judicial Council, “[t]he bill will therefore result in unnecessary proceedings to vacate or modify orders, forcing fiduciaries and courts to adjudicate the same issues a second time.”

Staff notes that the non-probate procedure would be subject to the venue selection clause contained in the terms of service agreement entered into by the decedent; accordingly, the decedent’s family member or trustee may be litigating the disclosure request in a court in another state. TEXCOM asserts that venue should be located in the county in which the deceased user resided at death, as it generally is for adjudication of post-death administration of a decedent’s affairs.

Notably, the bill does not actually require the provider to release the electronic records, information, or content unless it receives an order from the probate court with jurisdiction over the decedent’s estate or trust. Given that the non-probate procedure could result in an order from a court in another state that does not have jurisdiction over the decedent’s estate or trust, the non-probate procedure established by the bill may be ineffective in directing the provider to release the records.

Judicial Council also states that the bill does not establish a timeline “for a provider to respond to an otherwise lawful request for information, and the bill allows a provider to decline to respond to such requests any time the provider determines, in its sole discretion, that it would ‘be otherwise inappropriate.’ These provisions have the potential to result in unnecessary court hearings and, in the council’s view, may unduly prolong the final administration of estates and trusts.”

TEXCOM states that the bill requires the court to determine that there are “no other owners of, or persons or entities who have registered with the provider with respect to, the account of the deceased user,” yet providers may be the sole parties that have this information. Accordingly, TEXCOM argues that it is probably impossible for a fiduciary or others to determine this fact conclusively if the providers refuse to cooperate with information requests.

TEXCOM further argues that “[i]ndividuals generally do not expect or wish that administration of their estates will be consumed by delays and costs resulting from cumbersome judicial proceedings and litigation, to the detriment of their heirs and beneficiaries.” Judicial Council asserts that, as presently drafted, the bill will be difficult for courts to administer and will likely result in unnecessary confusion and ancillary litigation over its vague and ambiguous terms. CBA argues that the “underlying public policy is too important to rush since the result impacts privacy rights and the rights of beneficiaries.” CBA, Judicial Council, and TEXCOM request that the bill be made into a two-year bill in order to allow the council and all other stakeholders sufficient time to work with the author and sponsors over the interim on an alternative approach modeled after the RUFADAA.

The Electronic Frontier Foundation (EFF), neutral on the bill, has also indicated the need for continued discussions of the provisions in the bill and desires that the bill be made a two-year bill. EFF asserts that further dialogue on the bill could result in agreement on the necessary technical changes and nomenclature corrections to garner support from the courts and the privacy communities. EFF further states: “Similar to our colleagues at the [American Civil Liberties Union (ACLU)], we believe that with more time and effort, it is possible that these problems could be resolved to the satisfaction of all concerned. Regardless of whether the author retains the existing language in the measure, or amends the bill to reflect the revised UFADAA, we would welcome and support a conversation for turning this legislation into a two-year bill.”

Support: AOL; California Chamber of Commerce; California Hispanic Chambers of Commerce; California State Council of the Service Employees International Union; Civil Justice Association of California; Google; Internet Association; match.com; Mental Health America; TechAmerica; Yahoo!

Opposition: California Bankers Association; Executive Committee of the Trusts and Estates Section of the State Bar of California; Judicial Council of California

HISTORY

Source: Facebook; TechNet

Related Pending Legislation: None Known

Prior Legislation:

SB 849 (Anderson, 2014) See Background.

AB 5 (Evans, Chapter 5, Statutes of 2009) See Background.

Prior Vote:

Senate Judiciary Committee (Ayes 6, Noes 0)

Assembly Floor (Ayes 79, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 0)

Assembly Judiciary Committee (Ayes 10, Noes 0)

**************

 THIRD READING  

Bill No: AB 691

Author: Calderon (D), et al.

Amended: 9/4/15 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 6-0, 7/14/15

AYES: Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

NO VOTE RECORDED: Jackson

ASSEMBLY FLOOR: 79-0, 5/11/15 - See last page for vote

SUBJECT: The Privacy Expectation Afterlife and Choices Act

SOURCE: Facebook

TechNet

DIGEST: This bill establishes the Privacy Expectation Afterlife and Choices Act and provides procedures for the disclosure of electronic communication records, information, or contents, as specified, of a deceased user of an electronic communication service or remote computing service (provider).

Senate Floor Amendments of 9/4/15 restructure the bill and modify the disclosure processes.

ANALYSIS:

Existing law:

1. Authorizes a decedent’s personal representative or the public administrator to take possession or control of all of the decedent’s property to be administered in the decedent’s estate, and requires the personal representative to take all steps reasonably necessary for the management, protection, and preservation of, the estate in his or her possession.

2. Provides that the personal representative has the management and control of the estate and prescribes fiduciary duties to the personal representative, including using ordinary care and diligence in managing and controlling the decedent’s estate.

3. Requires the personal representative to file with the court clerk an inventory of property to be administered in the decedent’s estate together with an appraisal, which must be filed within four months after letters are first issued to a general personal representative. However, the court may allow such further time for filing an inventory and appraisal as is reasonable under the circumstances of the particular case.

4. Requires the account to include both a financial statement and a report of administration, as specified, and requires the statement of liabilities in the report of administration to include information as to whether notice to creditors was given, as specified, creditor claims were filed, as specified, creditor claims were not paid, satisfied, or adequately provided for, and whether any real or personal property is security for a claim, whether by mortgage, deed of trust, lien, or other encumbrance.

5. Requires the personal representative to either petition for an order for final distribution of the estate or make a report of status of administration within one year after the date of issuance of letters in an estate for which a federal estate tax return is not required, and within 18 months after the date of issuance of letters in an estate for which a federal estate tax return is required.

6. Provides that if a report of status of administration is made, the report must show the condition of the estate, the reasons why the estate cannot be distributed and closed, and an estimate of the time needed to close administration of the estate, and authorizes the court to require the personal representative to appear before the court to show the condition of the estate and the reasons why the estate cannot be distributed and closed.

7. Establishes, under the Electronic Discovery Act (EDA), procedures, evidentiary privileges, and judicial review for the request and production of electronically stored information, as defined.

8. Limits, under the Electronic Communications Privacy Act (ECPA), the disclosure by an electronic communication service or remote computing service of electronic communication of a user, and provides definitions for “electronic communication,” “user,” electronic communications system,” and “electronic communication service.”

9. Prohibits a person or entity providing an electronic communication service to the public from knowingly divulging to any person or entity the contents of a communication while in electronic storage by that service, and prohibits a person or entity providing remote computing service to the public from knowingly divulging to any person or entity the contents of any communication which is carried or maintained on that service:

• On behalf of, and received by means of electronic transmission from (or created by means of computer processing of communications received by means of electronic transmission from), a subscriber or customer of such service; and

• Solely for the purpose of providing storage or computer processing services to such subscriber or customer, if the provider is not authorized to access the contents of any such communications for purposes of providing any services other than storage or computer processing.

10. Authorizes disclosure of the content of electronic communications with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service.

11. Authorizes disclosure of a record or other information pertaining to a subscriber or customer of an electronic communication service or remote computing service (not including the contents of communications), including to any person other than a governmental entity.

This bill:

1. Establishes the Privacy Expectation Afterlife and Choices Act, and provides for the voluntary disclosure of electronic records, information, or contents of electronic communications by a provider to the personal representative of the estate or the trustee of the trust of a deceased user, as specified.

2. Authorizes the provider to decline to respond to a request because of a concern that complying with the request may violate any other legal authority, be contrary to the wishes of the user, or be otherwise inappropriate.

3. Authorizes a probate court that has jurisdiction of the estate or trust of the deceased user to order a provider to disclose to the personal representative or trustee a record, information, or contents of an electronic communication if the court makes specified findings of fact based on a sworn declaration, indicating the good faith belief and efforts of the personal representative or trustee, or any other admissible evidence.

4. Creates a procedure, as specified, if no probate proceeding has been opened, authorizing a personal representative or trustee to file a verified petition seeking an order compelling the provider to provide the requested records, information, or contents of communications or stored contents, and requires the personal representative or trustee to file the petition in the superior court of the county agreed to by the user in the terms of service agreement or, in the absence of that agreement, the county in which the deceased user resided at death.

5. Subjects the disclosure of the contents of the deceased user’s account to the executor or administrator of the estate or the trustee of the trust to the same license, restrictions, terms of service, and legal obligations, including copyright law, that applied to the deceased user, and does not require a provider to permit a requesting party to assume control of a deceased user’s account.

Background

In order to address privacy concerns with computer and other digital and electronic communications, ECPA updated the Federal Wiretap Act of 1968. (The Electronic Communications Privacy Act of 1986 (ECPA), Bureau of Justice Assistance, Office of Justice Programs, U.S. Dept. of Justice (July 30, 2013).) ECPA, as amended, “protects wire, oral, and electronic communications while those communications are being made, are in transit, and when they are stored on computers. [ECPA] applies to email, telephone conversations, and data stored electronically.” (Id.) ECPA reflects a general approach of providing greater privacy protection for materials in which there are greater privacy interests. (Id.) Notably, ECPA is primarily targeted at limiting government access to private user information. However, this federal law applies to communications sent or received by users and restricts all access to the records and contents of those communications, including access by an executor, administrator, or trustee of a deceased user. California state law provides specified discovery procedures for parties in civil actions, including probate actions that administer the trust or estate of a decedent, to obtain documents that are stored electronically. Those laws were enacted under AB 5 (Evans, Chapter 5, Statutes of 2009), which established the EDA.

In California, SB 849 (Anderson, 2014) would have authorized a decedent’s personal representative to request, and would have authorized an electronic communication service or remote computer service to provide, access to the electronic mail account of a decedent or to copies of the content of the account, subject to any applicable service agreement. SB 849 was held in the Senate Judiciary Committee after testimony.

In July 2014, the National Conference of Commissioners on Uniform State Laws (NCCUSL) approved the Uniform Fiduciary Access to Digital Assets Act (UFADAA), which was recommended for enactment in all states “to vest fiduciaries with the authority to access, control, or copy digital assets and accounts[,] . . . remove barriers to a fiduciary’s access to electronic records[,] and to leave unaffected other law, such as fiduciary, probate, trust, banking, investment, securities, and agency law.” (NCCUSL, Uniform Fiduciary Access to Digital Assets Act (Apr. 2, 2015) p. 1.)

UFADAA was recently revised this past July, and is now supported by technology stakeholders. This bill does not enact the revised UFADAA, but, instead, provides for the disclosure of electronic communications, as specified, by providers to personal representatives or trustees of deceased users for the purpose of administering the deceased user’s estate or trust and resolving issues regarding assets or liabilities of a decedent’s estate.

Comments

The author writes, “Most people expect the contents of these online communications to remain private, even after they pass away; it’s likely the recipients of those messages likely expect the same. According to a recent Zogby poll, over 70 [percent] of Americans say their private online communications and photos should remain private after they die, unless they gave prior consent for others to access. Only 15 [percent] say that estate attorneys should control their private communications and photos, even if they gave no prior consent for sharing. With no statute currently in place in California protecting the online information of the newly deceased, families are left responsible for accessing their loved ones information, often times causing unnecessary financial and emotional burdens’ during a time that is already painfully difficult.”

Prior Legislation

SB 849 (Anderson, 2014) See Background.

AB 5 (Evans, Chapter 5, Statutes of 2009) See Background.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 9/4/15)

Facebook (co-source)

Technet (co-source)

AOL

California Chamber of Commerce

California Hispanic Chambers of Commerce

California State Council of the Service Employees International Union

Civil Justice Association of California

Internet Association

Mental Health America of California