Standards Development

Scope

The Standard will provide guidance on how to manage a person’s digital accounts and assets after death and provide clarity as to what consumers’ rights are in relation to their digital media.

Purpose

The creation of digital accounts, ownership of digital products, and use of digital services are now common and ordinary, yet they raise significant implications for the constitution of our personal property, its archiving, and its inheritance. With the use of all sorts of social media sites, cloud-based accounts, personal blogs and websites, email and messaging services, as well as the accumulation of online collections of photos, videos and music, unavoidable questions arise as to what happens to them when a person dies.

The death of a person who owns digital accounts and products raises questions about their digital legacy and how it should be managed. This digital legacy and/or digital assets could include social media profiles on platforms like Facebook, Twitter, LinkedIn or Sina Weibo; email on Outlook or Gmail; digital financial assets such as cryptocurrencies; payment services such as PayPal, Afterpay and WeChat Pay; gaming accounts and in-game valuables on distribution services such as Steam, development platforms like Unity, online games such as World of Warcraft; images on Flickr or Google Photos; videos on YouTube or TikTok; music on Spotify or iTunes; websites on a personal domain; blogs on WordPress, Tumblr, or Medium; documents on Google Drive or DropBox; and eBooks on Kindle or Kobo; and messages on Telegram or WeChat. They may also include digital vaults, which are secure online platforms for storing digital assets. These range from password managers (Lastpass, 1password) to legacy-oriented vaults (Everplans, GoodTrust, My Life & Wishes) which are generally designed to be shared with family members.

Digital technologies record and archive most people’s lives and these materials are valued by family and friends who wish to remember them once they are deceased. Digital legacies have both emotional and material value, with sentimental and financial worth.

It is unclear who has the rights to access, own and bequeath digital legacies with questions of their management involving the people who own them prior to their death; the bereaved and executors of an estate who seek access after a death; the platforms and service providers who store this content in their databases and the governments and regulatory bodies who create and enforce legislation about consumer rights to digital legacies.

In a context where public awareness of managing the digital archives of deceased persons is lacking, so too are recognized standards. Platforms and service providers offer widely varying and often unclear policies on who the data belongs to, and although digital legacies are increasingly recognized as important to death, grieving, and remembering, legal and practical complexities around accessing these legacies abound. There are an increasing number of services designed to be impossible to access without the right key, regardless of any legal order: cryptocurrency wallets, end-to-end encrypted messaging services such as Signal.

An international standard will be useful in addressing digital legacies to help address the consequences of the lack of consumer knowledge about what happens to personal digital “footprints” – accounts, data and content after death. The existing information on digital legacies that consumers can access is typically located in unclear terms and conditions often located on their social media platform’s website. Consumers may also learn about digital legacies when contacting their social media platform directly. Even if consumers do gain access to policies related to digital legacy, these policies often vary across different platforms. There needs to be clarity as to what consumers’ rights in relation to their digital media after death are.

An international standard is needed to address the issue because:

• Online platforms and service providers have inadequate procedures for managing digital legacies:

o Many online systems and service providers do not have procedures in place to cater for the death of a user.

Google appears to be one of the only innovators in this regard, through its Inactive Account Manager, and Facebook now allows people to appoint a legacy contact to manage a profile after someone dies. Other major services such as Twitter and LinkedIn also have options to deactivate an account or convert it to a memorial account.

o The lack of these services creates privacy concerns for the deceased and unnecessary complications for the next of kin.

o There are significant internal inconsistencies and recourse to ad-hoc arrangements in how some companies deal with the death of a client, especially relating to personal data.

• The general public is not sufficiently aware of the need to take responsibility for their digital assets:

o A lack of clear or consistent options from service providers means that individuals need to take responsibility for their digital assets.

This includes creating and maintaining a local archive of important digital assets, making decisions regarding the disbursement of them, and leaving clear and accessible instructions to enable them to be accessed, deleted, or passed on as appropriate.

o There are inadequate products and services available to facilitate creating personal digital archives. Digital service providers could offer much more leadership in this respect. Death industry service providers (esp. Funeral Directors, Will makers, Estate Managers, Intellectual Property lawyers) also need to be brought into the management of digital legacies.

An international standard could set down a benchmark for professional responsibility.

o There are also neither established mechanisms nor customs for re-purposing the digital artefacts of the deceased.

o Concepts of digital property and the rights consumers have over digital files are not always clear and consumers need be aware of what can and cannot be bequeathed.

o Protocols and practices for bequeathing digital assets alongside material and financial assets in the context of a legal will and ‘digital register’ needs to be further developed and more widely communicated.

• The issue relates to property, privacy and rights:

o Ownership of digital media, and the conditions of posthumous access to it, will usually depend upon the particularities of the terms of service agreement that were entered into when the deceased signed up for an online service. This is made more complicated by contractual rights, intellectual property rights, and various forms of copyright law.

o Ambiguities as to where digital media may be held – it could be held locally on a hard drive or remotely on a server, in another country and in another legal jurisdiction.

o For digital assets, there needs to be the same well-established procedures for locating, valuing, and transferring ownership of physical property; this means that many years of photos, videos, and documents uploaded to an online service may be lost forever if posthumous access to them is not arranged and local copies are unavailable.

o Much online communication is private in nature, and terms of service agreements are designed to protect this privacy, even in death. Email is a good example of this privacy issue. Email services such as the US-based Gmail and Hotmail are conscious of this, and have strict rules that forbid access to the email associated with a deceased person's account.

• The benefits to consumers or the public interest: o Standardising digital legacies will enable consumers to better understand what will happen to their digital media after death, hence, benefitting consumers by empowering them to be more in control of how their digital legacy is handled.

o The uncertainty surrounding digital legacies is why the ISO Council needs new or revised policies or actions within ISO as they relate to consumers' needs in the digital space. o Standardising digital legacies will inform consumers of the rights that they have, particularly in relation to ownership of their data and any rights to privacy

o I.e. consumers’ data can be stored globally, for example one social media platform may store its users’ data in a different country or perhaps across multiple countries, even if the platform is located in another location or if its users’ live in different countries (e.g. the United States’ Foreign Intelligence Surveillance Act (‘FISA’) Act). This is concerning, especially if consumers’ data is held in countries with repressive governments.

o Standardisation of digital legacies will ensure that no consumers are left out and that consumers are safe; just as other consumer safety standards related to goods have been standardised in the past, so too should new and rapidly developing technology be standardised.