united-states united-kingdom online japan mexico
Legality about recovering deceased relative online account
<p>In the case of a deceased relative, is there any law violation in any of these circumstances in relation to an online account (let's say google, facebook, twitter, msn, etc)?</p>
<p>Countries interested: USA, Mexico, Japan, UK</p>
<ol>
<li>If I know the password and I access their account</li>
<li>If I don't know the password and I try to recover it</li>
<li>If I recover the password and access their account</li>
</ol>
<p>Does the intention matters until those points?</p>

<p>In the <strong>United Kingdom</strong>:</p>
<p>A person has no authority to access an online account of a deceased relative, unless this has been agreed with the operator of the website (etc). If a Power of Attorney over the deceased's financial affairs existed, this ceases upon death.</p>
<p>Using a person's login credentials without permission <strong>from the owner of the website</strong> would be a breach of the <em><a href="https://www.legislation.gov.uk/ukpga/1990/18/contents" rel="nofollow noreferrer">Computer Misuse Act 1990</a></em>, as amended by Part 5 of the <em>Police and Justice Act 2006</em>, and Part 2 of the <em>Serious Crime Act 2015</em>.</p>
<blockquote>
<p><strong>Actus Reus</strong></p>
<p>The offence is made out once a defendant has caused a computer, which
would include his own computer, to perform a function with intent to
secure access.</p>
<p>The access to the program or data which the accused intends to secure
must be 'unauthorised' access.</p>
<p><strong>Mens rea</strong></p>
<p>There are two elements:</p>
<ul>
<li><p>There must be knowledge that the intended access was unauthorised;
and</p>
</li>
<li><p>There must have been an intention to secure access to any program or data held in a computer.</p>
</li>
</ul>
<p>There has to be knowledge on the part of the offender that the access
is unauthorised; mere recklessness is not sufficient. This covers not
only hackers but also employees who deliberately exceed their
authority and access parts of a system officially denied to them.</p>
</blockquote>
<p><a href="https://www.cps.gov.uk/legal-guidance/computer-misuse-act" rel="nofollow noreferrer">Crown Prosecution Service legal guidance</a></p>
<p>Additional note for accessing online banking and similar accounts:</p>
<p>A person who accessed a <strong>bank</strong> computer with the intention of transferring the deceased's funds to themself (such funds being the property of the estate, not the person) thus committing theft, would potentially be committing the further offence under Section 2 of the CMA of <em>Unauthorised access with intent to commit or facilitate commission of further offences</em></p>
<p>If the person has a legitimate claim on the funds in the bank account, i.e. they are an executor or administrator of the estate, there is an established procedure to claim the funds from the bank. This does not include being given access to the deceased's accounts or statements, as these remain confidential. The bank will provide a closing balance at the date of death, together with a list of regular payments in/out of the account (those being parties the executor/administrator should advise of the death) together with a statement for any transactions after death ie during the period of executry of the estate.</p>

<p>In the US, it depends first on what the state law is, and second what platform policy is. There is a law, the <a href="https://www.uniformlaws.org/committees/community-home?CommunityKey=f7237fc4-74c2-4728-81c6-b39a91ecdf22" rel="nofollow noreferrer">Revised Fiduciary Access to Digital Assets Act</a>, enacted in most states. <a href="https://www.nolo.com/legal-encyclopedia/ufadaa.html" rel="nofollow noreferrer">Here</a> is a summary of what that law does, and <a href="https://app.leg.wa.gov/RCW/default.aspx?cite=11.120&amp;full=true" rel="nofollow noreferrer">here</a> is the version enacted by Washington. The Washington law makes an important distinction between the person's communications and their other digital assets. Both are stated in terms of the &quot;custodian&quot; (platform) disclosing information. In the case of a communication, you must have authority (e.g. be the personal representative) and prove that the person authorized access to the communications (or a court order, which would be granted only if reasonably necessary for administration of the estate). In the case of other digital assets (which would include lists of communications but not their contents), access is granted unless forbidden by the person: or, if required by the custodian. In other words, if you don't say one way or the other, only the content of communications are sealed, save for court order. But the platform itself can require proof that access is necessary to administer the estate.</p>
<p>Individual platforms may have provided something in their TOS regarding accessing a deceased's account, a number of which are summarized <a href="https://cdn.ymaws.com/www.kybar.org/resource/resmgr/2014_Convention_Images/27_ac2014.pdf" rel="nofollow noreferrer">here</a> p. 8 ff., but this was 6 years ago (before RUFADAA was circulated). None of these platforms addressed the matter of continuing to use an account with earlier permission, once the account holder dies. Instead, they simply say &quot;we won't provide you with access to the account&quot;. The TOS probably allows the platform operators to block access in case of &quot;suspicious activity&quot;. The  Computer  Fraud  and  Abuse Act does not say that permission to access an account is revoked upon death of an account holder, so if the person authorized you to access the account and did not revoke that authorization, you are authorized (eternally, or until the law or TOS changes). But each state has some such law, so there might be some &quot;revocation on death&quot; clause, somewhere. It may be contrary to a particular platform's TOS for a person other than the account owner to ever log in to the account.</p>
