Harvard Law Review Harvard Law Review Harvard Law Review

Cyberlaw / Internet

Ajemian v. Yahoo!, Inc.

Massachusetts Supreme Judicial Court Holds that Personal Representatives May Provide Lawful Consent for Release of a Decedent’s Emails.

Life is going digital. People increasingly commingle their financial and personal affairs in online accounts, creating a quandary upon their deaths. Personal representatives1×1. The Uniform Probate Code defines “personal representative” as a term that “includes executor, administrator, successor personal representative, special administrator, and persons who perform substantially the same function . . . .” Unif. Probate Code § 1-201(35) (Unif. Law Comm’n 1969) (amended 2010). It also establishes that “[a] personal representative is a fiduciary.” Id. § 3-703. and heirs may have legitimate needs for accessing a decedent’s accounts, but those accounts may also contain information the decedent wished to remain secret. To date, states seeking to legislate around this issue have considered the Stored Communications Act2×2. 18 U.S.C. §§ 2701–2712 (2012). The SCA is part of the Electronic Communications Privacy Act of 1986 (ECPA). See Pub. L. No. 99-508, 100 Stat. 1848 (codified as amended in scattered sections of 18 U.S.C.). (SCA), though the SCA was not meant for probate scenarios.3×3. See, e.g., Petition for a Writ of Certiorari at 15, Oath Holdings, Inc. v. Ajemian, No. 17-1005 (U.S. Jan. 16, 2018), 2018 WL 496964 [hereinafter Yahoo Cert. Petition] (acknowledging “[t]hat ECPA was not aimed directly at state probate law”). The SCA prohibits electronic-communication companies from disclosing a person’s communications to third parties without his or her “lawful consent.”4×4. 18 U.S.C. § 2702(a)–(b). Specifically, the SCA applies to entities that provide electronic-communication services or remote computing services. The distinction is not important here. Since 2015, a majority of states have enacted legislation governing fiduciary access to digital assets5×5. The Uniform Law Commission promulgated the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) in 2015. See Revised Unif. Fiduciary Access to Dig. Assets Act (Unif. Law Comm’n 2015) [hereinafter RUFADAA], http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20Assets/2015_RUFADAA_Final%20Act_2016mar8.pdf [https://perma.cc/WX8D-MMKV]. As of this writing, thirty-nine states and the U.S. Virgin Islands have enacted RUFADAA. Legislative Fact Sheet — Fiduciary Access to Digital Assets Act, Revised (2015), Uniform L. Commission [hereinafter RUFADAA Fact Sheet], http://www.uniformlaws.org/LegislativeFactSheet.aspx?title=Fiduciary%20Access%20to%20Digital%20Assets%20Act,%20Revised%20(2015) [https://perma.cc/2GJZ-2NCD]. that — due to political pressures — presumes that lawful consent requires a decedent’s express authorization, such as in a will.6×6. RUFADAA requires a personal representative to show evidence of a decedent’s explicit consent (unless the decedent made a designation in an online tool or a court directs disclosure) for a custodian to disclose contents of electronic communications. RUFADAA, supra note 5, § 7(4). Recently, in Ajemian v. Yahoo!, Inc.,7×7. 84 N.E.3d 766 (Mass. 2017), cert. denied, No. 17-1005, 2018 WL 489291 (U.S. Mar. 26, 2018). the Supreme Judicial Court of Massachusetts held that personal representatives may provide lawful consent on a decedent’s behalf, even in the absence of an express authorization in the decedent’s will.8×8. Id. at 773–74, 778. Ajemian thus undermines the presumption upon which a majority of states’ legislation relies, creating an opportunity for a cleaner policy debate about what the default rules of digital inheritance should be.

John Ajemian died in 2006.9×9. Id. at 768. He left a Yahoo!, Inc. (Yahoo) email account but no will, no instructions for his account,10×10. Id. and no record of his password.11×11. Brief of Defendant-Appellee, Yahoo! Inc. at 5, Ajemian, 84 N.E.3d 766 (No. SJC-12237). Even if he had left his password, it may have been illegal for his personal representatives to use it to access his account, though such actions would have been difficult to monitor. See, e.g., Naomi Cahn, The Digital Afterlife Is a Mess, Slate (Nov. 29, 2017, 11:46 AM), http://www.slate.com/articles/technology/future_tense/2017/11/the_digital_afterlife_is_a_mess.html [https://perma.cc/UPC9-2F6V]. John’s siblings Robert and Marianne asked Yahoo for access to that account, first so they could inform John’s friends of his passing and memorial service, and subsequently — upon becoming court-appointed personal representatives of John’s estate — to identify his assets.12×12. Ajemian v. Yahoo!, Inc., 987 N.E.2d 604, 608 (Mass. App. Ct. 2013). Yahoo confirmed that it retained the contents of John’s account but declined their request.13×13. Ajemian v. Yahoo! Inc., NO-09E-0079, at 2 (Mass. Prob. & Fam. Ct. Mar. 10, 2016) (opinion and order granting defendant’s cross-motion for summary judgment). Yahoo took the position that the SCA prevented such disclosure.14×14. Ajemian, 987 N.E.2d at 608–09. Moreover, Yahoo’s Terms of Service agreement included provisions allowing Yahoo to “discard any [of a user’s] Content . . . for any reason” and to act “without prior notice” to “bar any further access to [a user’s] files.”15×15. Ajemian, 84 N.E.3d at 779 (quoting Yahoo’s Terms of Service). The quoted Terms of Service are those that were in effect in 2002, when the account was created. See Ajemian, NO-09E-0079, at 8 (quoting the same provisions and indicating that they were in effect in 2002). Yahoo’s current Terms of Service agreement contains similar provisions. See Yahoo Terms of Service, Yahoo!, https://policies.yahoo.com/us/en/yahoo/terms/utos/ [https://perma.cc/U6WE-8FG3] (“You agree that Yahoo may, without prior notice, immediately terminate . . . your Yahoo account . . . .”).

After negotiations, Yahoo provided the Ajemians with email header information16×16. Email header information consists of “the names and addresses of the senders and recipients, the date, and the information reflected in the subject line of the e-mail.” Ajemian, 987 N.E.2d at 609 n.6. Disclosure of header information does not violate the SCA, see 18 U.S.C. § 2702(c)(6) (2012), or RUFADAA, see RUFADAA, supra note 5, § 8. but not the contents of John’s emails.17×17. Ajemian, 987 N.E.2d at 609. Further negotiations failed. In September 2009, Robert and Marianne filed a motion in the Probate and Family Court seeking access to the email contents.18×18. Id. at 609. The probate judge dismissed the complaint on procedural grounds, but the Appeals Court overturned that decision.19×19. Id. at 606–07.

On remand, Judge Casey of the Norfolk Probate and Family Court found that the SCA prevented Yahoo from disclosing the contents of John’s emails and allowed Yahoo’s cross-motion for summary judgment.20×20. Ajemian, NO-09E-0079, at 10. First, he found that the SCA’s agency exception, which allows disclosure to an agent,21×21. 18 U.S.C. § 2702(b)(1). did not apply because personal representatives act on behalf of the appointing court, so they are not a decedent’s agents.22×22. Ajemian, NO-09E-0079, at 4–5. Additionally, he found that the SCA’s lawful consent exception, which allows disclosure “with the lawful consent of the originator or an addressee or intended recipient of such communication,”23×23. 18 U.S.C. § 2702(b)(3). did not allow Robert and Marianne to lawfully consent on John’s behalf.24×24. Ajemian, NO-09E-0079, at 5. Judge Casey also found that the contents of John’s emails were the property of his estate and, accordingly, that Robert and Marianne “would be entitled to take possession of the emails if permitted by the SCA.”25×25. Id. at 7. Judge Casey separately determined that he could not decide on summary judgment whether Yahoo’s Terms of Service agreement constituted an enforceable contract, since there remained genuine issues of material fact as to whether Yahoo’s Terms of Service “were reasonably communicated to the decedent.”26×26. Id. at 9.

The Ajemians appealed, and the Supreme Judicial Court of Massachusetts transferred the case to itself, on its own motion.27×27. Ajemian, 84 N.E.3d at 770.

The Supreme Judicial Court vacated and remanded.28×28. Id. at 780. Writing for the panel, Justice Lenk29×29. Justices Hines, Gaziano, Lowy, and Budd joined in the opinion. agreed that the agency exception did not apply.30×30. Ajemian, 84 N.E.3d at 772–73. However, the court found that the lawful consent exception allows a personal representative to provide lawful consent on a decedent’s behalf and concluded that the SCA does not prohibit Yahoo from disclosing the contents of John’s emails to Robert and Marianne.31×31. Id. at 778.

As it faced a question of first impression,32×32. Id. at 773. The court noted that In re Facebook, Inc., 923 F. Supp. 2d 1204 (N.D. Cal. 2012), was “[t]he only potentially relevant case.” Ajemian, 84 N.E.3d at 773 n.17. The court in In re Facebook, Inc. declined to address the question of whether surviving family members could give lawful consent on a decedent’s behalf. 923 F. Supp. 2d at 1206. the court undertook a statutory interpretation analysis to assess the SCA’s lawful consent provision. Relying on the presumption against preemption, the court presumed that Congress did not intend to encroach on probate law — an area traditionally governed by state regulation — when it enacted the SCA.33×33. Ajemian, 84 N.E.3d at 773–74. Moreover, it reasoned that interpreting the SCA as limiting lawful consent to express consent would “significantly curtail” personal representatives from performing their duties, especially as financial information — that often came in paper form at the time of the SCA’s enactment — now often exists solely in digital form.34×34. Id. at 774–75; see also Gerry W. Beyer & Kerri G. Nipp, Practical Planning for Digital Assets and Administration of Digital Assets by Fiduciaries, Estates, Gifts & Tr. J. (Bloomberg BNA) (Jan. 11, 2018), https://www.bloomberglaw.com/document/X4EUPFQK000000 [https://perma.cc/JU7E-6DPZ] (“[M]any individuals no longer receive paper statements or bills and instead receive everything via email or by logging on to a service provider’s online account.”). The court noted that the statutory language does not preclude consent by a personal representative and, moreover, that Congress had elected not to use the language “express consent.”35×35. Ajemian, 84 N.E.3d at 775–77. It also cited legislative history that indicated that the enacting Congress intended for the SCA to apply to “unautho-rized interception of electronic communications,” rather than estate management.36×36. Id. at 777–78 (quoting S. Rep. No. 99-541, at 1 (1986)). The court ultimately “conclude[d] that the personal representatives may provide lawful consent on the decedent’s behalf to the release of the contents of the Yahoo e-mail account.”37×37. Id. at 778.

The court agreed that the enforceability of Yahoo’s Terms of Service could not be decided on summary judgment due to remaining issues of material fact, and it remanded the case for further proceedings.38×38. Id. at 778–80.

Chief Justice Gants concurred in part and dissented in part.39×39. Id. at 780 (Gants, C.J., concurring in part and dissenting in part). He agreed with the majority’s interpretation of the SCA.40×40. Id. However, he believed that the court should have gone further and granted Robert and Marianne’s motion for summary judgment.41×41. Id. Chief Justice Gants observed that Yahoo had not challenged the lower court’s finding that the emails were the property of John’s estate.42×42. Id. Thus, even if the Terms of Service agreement were fully enforceable, such that Yahoo could discard a user’s contents without risk of liability, it nonetheless “[could not] justify the destruction of . . . e-mail messages after a court orders that they be provided to the user or his or her personal representatives [as s]uch destruction would constitute contempt of a court order.”43×43. Id. at 781.

On March 26, 2018, the U.S. Supreme Court denied Yahoo’s parent company’s petition for a writ of certiorari.44×44. Oath Holdings, Inc. v. Ajemian, No. 17-1005, 2018 WL 489291 (U.S. Mar. 26, 2018).

Ajemian implicates an issue of growing relevance: how to weigh a decedent’s privacy against personal representatives’ needs and heirs’ desires. Most states, though not Massachusetts, have recently enacted legislation to address this question, including notably the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA).45×45. RUFADAA, supra note 5; RUFADAA Fact Sheet, supra note 5. RUFADAA conforms to an interpretation of the SCA that Ajemian now calls into doubt, as RUFADAA requires a decedent’s explicit consent for a personal representative to access the decedent’s electronic messages.46×46. RUFADAA, supra note 5, § 7(4). By interpreting the SCA to allow personal representatives to provide lawful consent on behalf of a decedent, Ajemian undermines an assumption on which a majority of states’ legislation relies, opening up the possibility of redefining the default rules of digital estate planning.

The decision in Ajemian contemplates a debate between the needs to manage a decedent’s estate and to maintain a decedent’s privacy. As people increasingly bank online47×47. As of 2013, a majority of U.S. adults banked online. See Susannah Fox, 51% of U.S. Adults Bank Online, Pew Res. Ctr. (Aug. 7, 2013), http://www.pewinternet.org/2013/08/07/51-of-u-s-adults-bank-online/ [https://perma.cc/T4XN-82HL]. and produce digital property of monetary value48×48. See, e.g., Beyer & Nipp, supra note 34 (outlining valuable digital property that a decedent may have, such as domain names, manuscripts, and virtual property). during life, yet leave behind few paper records upon death, access to a decedent’s digital assets is increasingly important for a personal representative. Whereas a personal representative used to look through a decedent’s paper records49×49. Cahn, supra note 11. and collect a decedent’s physical mail to learn of the decedent’s financial accounts,50×50. Robert H. Sitkoff & Jesse Dukeminier, Wills, Trusts, and Estates 42 (10th ed. 2017). that information might now be available exclusively in a digital account.51×51. See Naomi Cahn, Probate Law Meets the Digital Age, 67 Vand. L. Rev. 1697, 1705 (2014). Moreover, family members may desire access to secure sentimental digital property, such as photographs.52×52. See, e.g., James D. Lamm et al., The Digital Death Conundrum: How Federal and State Laws Prevent Fiduciaries from Managing Digital Property, 68 U. Miami L. Rev. 385, 390–91 (2014). However, deeply personal information, not even meant for family members, may similarly reside in a given online account.53×53. See, e.g., Natalie M. Banta, Death and Privacy in the Digital Age, 94 N.C. L. Rev. 927, 930 (2016). Consider messages to doctors, lawyers, or even paramours, as examples.54×54. See, e.g., Yahoo Cert. Petition, supra note 3, at 1, 2018 WL 496964, at *1. While physical records and mail might similarly contain such personal information — and in this way, the tension between privacy and estate administration has always existed — the digital age brings a new question of scale. The potential scope of the privacy invasion becomes much larger as the amount of stored information and the ease with which it can be searched increase. Moreover, digital accounts often contain messages going back several years, whereas a personal representative collecting physical mail would only receive such communications on a prospective basis.55×55. See Sitkoff & Dukeminier, supra note 50, at 42.

This debate has broad relevance. Most Americans use the internet regularly,56×56. See Monica Anderson et al., 11% of Americans Don’t Use the Internet. Who Are They?, Pew Res. Ctr. (Mar. 5, 2018), http://www.pewresearch.org/fact-tank/2018/03/05/some-americans-dont-use-the-internet-who-are-they/ [https://perma.cc/RX36-PG6H]. yet a majority do not have a will.57×57. See, e.g., Jeffrey M. Jones, Majority in U.S. Do Not Have a Will, Gallup News (May 18, 2016), http://news.gallup.com/poll/191651/majority-not.aspx [https://perma.cc/TNL3-NBKP]. Moreover, others have stale wills that no longer reflect their preferences.58×58. See Adam J. Hirsch, Text and Time: A Theory of Testamentary Obsolescence, 86 Wash. U. L. Rev. 609, 611–13 (2009) (introducing the challenges that stale wills pose and offering anecdotal evidence speaking to their frequency). It is uncontroverted that a decedent who leaves a will authorizing his or her personal representatives to access the contents of his or her emails provides lawful consent.59×59. See, e.g., RUFADAA, supra note 5, § 7(4) (indicating that a decedent can provide sufficient consent via will). Thus, the difficult question is how to respond when a decedent leaves no such record. Default rules will be important, as a decedent’s intent is often unknown.60×60. See Banta, supra note 53, at 965–69. Indeed, it is likely that many have not contemplated this issue. Moreover, as people who have wills are “typically older, wealthier, and more educated,”61×61. Sitkoff & Dukeminier, supra note 50, at 64 (citing Russell N. James III, The New Statistics of Estate Planning: Lifetime and Post-Mortem Wills, Trusts, and Charitable Planning, 8 Est. Plan. & Community Prop. L.J. 1, 15–26 (2015)). the underresourced are those for whom this default presumption will matter most. A potential alternative solution that is more accessible to the broader public is the use of online tools, such as Facebook’s Legacy Contact62×62. What Is a Legacy Contact and What Can They Do?, Facebook: Help Ctr., https://www.facebook.com/help/1568013990080948 [https://perma.cc/76F4-DDEF]. or Google’s Inactive Account Manager.63×63. About Inactive Account Manager, Google: Acct. Help, https://support.google.com/accounts/answer/3036546?hl=en [https://perma.cc/Q7KL-KF8N]. Under RUFADAA, an internet company’s online tool for digital assets trumps the provisions in a will. RUFADAA, supra note 5, § 4(a). However, these tools have not yet become commonplace. As of December 2017, Facebook and Google were the only two major providers that offered such tools.64×64. Beyer & Nipp, supra note 34.

The Uniform Law Commission (ULC) has attempted to bring clarity to this issue. In 2014, it promulgated the original Uniform Fiduciary Access to Digital Assets Act65×65. Unif. Fiduciary Access to Dig. Assets Act (Unif. Law Comm’n 2014), http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20Assets/2014_UFADAA_Final.pdf [https://perma.cc/92VC-H9FE]. (UFADAA), intending it “to remove barriers to a fiduciary’s access to electronic records.”66×66. Id. prefatory note. The draft Act gave personal representatives “the right to access . . . content of an electronic communication” unless the decedent explicitly stated otherwise.67×67. Id. § 4. However, “UFADAA imploded in state legislative halls” due to privacy-related concerns raised by NetChoice — a coalition of internet companies including Yahoo, Google, and Facebook68×68. About Us, NetChoice, https://netchoice.org/about/ [https://perma.cc/VA7T-YU2C]. — and its allies.69×69. Alberto B. Lopez, Posthumous Privacy, Decedent Intent, and Post-Mortem Access to Digital Assets, 24 Geo. Mason L. Rev. 183, 207 (2016). Though the internet companies nominally objected under privacy concerns, other motivations also might have driven this stance. See, e.g., Lamm et al., supra note 52, at 405–06 (describing a lingering risk of litigation (as it was still unclear how the SCA would impact the legality of disclosing such information) and the accompanying financial burdens such litigation might yield); Yahoo Cert. Petition, supra note 3, at 4, 2018 WL 496964, at *4 (describing how granting requests for communications would create not only legal uncertainty but also administrative burdens). This pressure led the ULC to promulgate a revised version — RUFADAA — the next year.70×70. RUFADAA, supra note 5.

In contrast to its predecessor, RUFADAA requires a decedent’s explicit consent for a personal representative to access the contents of a decedent’s communications. Specifically, RUFADAA requires that a personal representative provide a “record evidencing the user’s consent to disclosure” to gain such access,71×71. Id. § 7(4). so nondisclosure is the default rule if the decedent did not express any preferences.

RUFADAA attributes its explicit consent requirement to the SCA,72×72. Id. § 7 cmt. though political pressures are what drove it to interpret the SCA’s lawful consent provision as necessitating explicit consent. Indeed, the “legislative U-turn” by the ULC — from UFADAA’s treatment of decedent consent to RUFADAA’s — suggests that this was a move of “legislative pragmatism.”73×73. Lopez, supra note 69, at 217. Indeed, NetChoice endorsed RUFADAA.74×74. Id. at 214. Moreover, without NetChoice’s opposition, RUFADAA has been very successful; since 2015, three-quarters of states have enacted it.75×75. RUFADAA Fact Sheet, supra note 5. It is planned for introduction in 2018 in six more states and the District of Columbia.76×76. Id. As of this writing, Massachusetts has not yet enacted RUFADAA77×77. Id. or any other such legislation.78×78. State-by-State Digital Estate Planning Laws, Everplans, https://www.everplans.com/articles/state-by-state-digital-estate-planning-laws [https://perma.cc/79VK-9DWX].

Though the SCA governs privacy for electronic communications, it is incongruous for the SCA to impact probate questions because the SCA was not meant for estate administration and is wildly out of date. Congress enacted the SCA in 1986 to protect citizens’ privacy.79×79. Electronic Communications Privacy Act of 1986, Pub. L. No. 99-508, 100 Stat. 1848 (codified as amended in scattered sections of 18 U.S.C.); see also Cahn, supra note 51, at 1711. However, the threats that Congress legislated against were hackers and intrusive government bodies seeking to spy on citizens, not personal representatives seeking to marshal assets.80×80. Cahn, supra note 51, at 1700–01, 1710–13. Moreover, Congress could not have anticipated the extent of the digital explosion that has occurred since 1986.81×81. Id. at 1700–01. For instance, online banking was not available to U.S. consumers until 1995.82×82. See 20 Years of Internet Banking 1995–2015, Wells Fargo, https://www.wellsfargohistory.com/internet-banking/ [https://perma.cc/P3ZZ-K42D]. Despite this, the relevant portions of the SCA have not been amended since the SCA’s 1986 enactment, rendering them decades out of date.83×83. Compare 100 Stat. 1848 (enacting the SCA in 1986), and 18 U.S.C. § 2702 (1988) (first codification), with 18 U.S.C. § 2702 (2012) (current codification).

Notice what this means. As a result of political compromise, email succession law in a vast majority of states relies on a politically compelled and previously untested interpretation of an outdated act that did not contemplate fiduciary administration — not to mention cloud storage — when it was enacted.

Ajemian reframes the policy debate by rejecting the premise that the SCA bars personal representatives’ access to decedents’ electronic communications, and this leaves Massachusetts in an interesting position. Because Massachusetts has not yet enacted RUFADAA, it now has greater latitude to consider what the default digital intestacy rules should be in a contemporary context. If this debate plays out in Massachusetts so that personal representatives secure broader access, other states and the ULC may take that opportunity to revisit the language of RUFADAA. However, this result is subject to contingencies. As Ajemian involved a state court interpreting a federal statute, the extent to which other jurisdictions will follow suit remains to be seen. Moreover, the feasibility of widespread change would depend on other states’ legislatures’ willingness to about-face. In any event, until Massachusetts legislators provide direction on this question, Massachusetts estate planners must sit in limbo.