Planning for your digital life and after life

1. Planning for your digital life and after life Presentation to Canadian IT Law Association Nancy Cleman Sternthal Katznelson Montigny LLP June 18, 2014

2. IF WE DON’T CARE WHO WILL? NOT BEING ABLE TO GOVERN EVENTS I GOVERN MYSELF • Essays of Michel de Montaigne

3. Yesterday • Recipe books • Photo albums • Vinyl Records • Books & CDS • Family Videos • Board games • Address books • Paper files http://www.home-designing.com; 1954 Armstong Kitchen

4. Today? Tomorrow? • Epicurious.com • Facebook • iTunes • E-readers (Kindle) • On line folders • On line games • Cell phone contacts Thinkstock

5. The List Can Go On and On …. • Paper statements • Cheques • Bill payment • Business contacts • Piggy bank • On line statements • Phone banking • Internet banking • Linked In • Bit Coin

6. Living On After We Are Gone • If we do not take charge of what happens upon our death or disability we risk leaving a digital foot print that was unintended. • On the one hand it is akin to leaving the house unlocked and letting people in to use your things without care or attention; • On the other hand, it is leaving a locked treasure chest filled with valuables for which no one has the key

7. Take a close look at your client’s digital assets: Rosemary McCracken • “Nine months ago, I calculated the value of my digital assets at $7,000,” said Duncan Stewart, Toronto-based director of research for technology, media and telecommunications at Deloitte Canada. “Today they’re worth about $12,000. Canadians’ digital assets are growing at rate of about 100% a year.” • Discusses possibility of separate wills for digital and non digital assets ( if permitted by law) • http://www.insurance-journal.ca/2014/05/13/take-a-close-look-at-your-clients-digital-assets/

8. Remember when all a person had to do when someone died: • Was go to the safety deposit box to obtain a copy of the will or mandate and all the important documents • Look into a file folder with the list of bank accounts and insurance policies • Look through an address book with the names of the people to contact

9. The digital age has changed the way we live our lives • Smart phone = address book, camera, diary, mobile banking, social media hub; personal and business communication tool • Who has access? Who should have access? • What should happen to this information?

10. What Can We Do to Protect Our Privacy • Who is the guardian of our privacy if we cannot speak ? • How can we be sure that our legacy is protected and respected ? • If we don’t take care, we risk leaving a digital warehouse for others to use; or lose important information and assets.

11. Steps to Take Conduct an inventory and keep it current, including: • Login information for mobile devices, tablets and computers • Email accounts & passwords • Back up email accounts • Security questions • Information on hardware, computers ; smart phones • Social media – list of accounts and user ID and passwords • Cancel automatic renewals

12. List of digital assets • Computers; tablets; • Smart phones and their content • Social media ( personal and professional) • Photos and videos • Contact lists; address books; • Calendars • On line shopping accounts; on line stores • Music; books; • Financial records;

13. continued • Medical records • Bank statements and banking • Electronic financial records; portfolios • Emails • Cloud storage • Blogs • Websites • Businesses run on line • Bit coin & digital currency • On line gambling accounts

14. Designate a Digital Executor/ Agent • Once you have the information decide what should be done- keep the account? Close it? • Find out what can be done – you may not control the web site where you store the information • Have you ever read the “terms and conditions” or “privacy policy”? ( see links on the site) • Designate a person to manage this information and these decisions

15. Letter of Direction • In addition to a memorandum/letter of direction with the information on where to access the information, consider what should happen • If you don’t give direction it is often left to the executor or liquidator to make decisions (if they can access the information) • He or she may do something with which you would not agree. • Do you want your Facebook page to live on forever?

16. Questions to Ask –Identity theft • Does the person use social media to link to other accounts? • For example does he or she use Facebook to log into shopping sites? • Do these sites contain credit card information? • Can you map or track this information? • There is a concern of people hacking into sites and assuming identity of deceased persons

17. You get what you pay for • Many people use social media sites or free web sites to share data and information • Many of these sites are located in the USA • If a person is incapacitated or dies unless safeguards are put into place the data housed on these sites may not be accessible • The area is in a state of flux; • It is important to check the terms of these sites • They are being regularly updated to address this issue

18. Sample policies • The next few slides will examine the policies of several web sites and what happens if someone dies and a third party needs access to the sight. • Most sites only deal with death and do not take into account disability or people who are no longer capable of making a decision ( mentally or physically) • Social Media sites often do not provide access to a user’s account. They may act on certain instructions but to do so they require a lot of information to protect the identity of the account holder:

19. Facebook • When a person passes away, we memorialize their account to protect their privacy. Here are some of the key features of memorialized accounts: • No one can log into a memorialized account and no new friends can be accepted • Depending on the privacy settings of the deceased person's account, friends can share memories on the memorialized timeline • Anyone can send private messages to the deceased person • Content the deceased person shared (ex: photos, posts) remains on Facebook and is visible to the audience it was shared with • Memorialized timelines don't appear in People You May Know and other suggestions

20. How do I submit a special request for a deceased user's account on the site? • We will process certain special requests for verified immediate family members, including requests to remove a loved one's account. This will completely remove the timeline and all associated content from Facebook, so no one can view it. • For all special requests, we require verification that you are an immediate family member or executor. Requests will not be processed if we are unable to verify your relationship to the deceased. • Examples of documentation that we will accept include: • The deceased's birth certificate • The deceased's death certificate • Proof of authority under local law that you are the lawful representative of the deceased or his/her estate. • If you are an immediate family member and would like to request that we remove your loved one's account from the site, please contact us. You may also use this form if you have a special request regarding the deceased user's account.

21. How do I report a deceased person or an account that needs to be memorialized? Memorializing the account: It is our policy to memorialize the account of a deceased person. In order to protect the privacy of the deceased person, we cannot provide login information for the account. However, once it has been memorialized, we take measures to secure the account. If you need to report a timeline to be memorialized, please contact us. Removing the account: Verified immediate family members may request the removal of a loved one’s account from the site. You're reading the Desktop Help answer. Learn more in our other Help Centers.

22. Information to provide Facebook Your full name Your email address Full name on the deceased person's account Account email address of the deceased person The email that may have been used to create the account Web address (URL) of the timeline Please note that we require verification that you are an immediate family member or executor for account removal or special requests. Relationship to the person

23. Consider the level of detail • Immediate family (spouse, parent, sibling, child) • Extended family (grandparent, aunt, uncle, cousin) • Non-family (friend, co-worker, classmate) • How can we help you? • Please memorialize this account • Please remove this account • I have a special request • I have a question • When did the person pass away?

24. Facebook • Facebook won’t disclose passwords or transfer ownership of an account • There have been cases where parents wanted access to an account of a child who passed away; those who were successful had to go to court to gain access • Facebook updated user’s privacy settings to remain the same after one’s death; • Allows friends and family of the deceased to request “ look back” compilations

25. Twitter • Won’t disclose passwords • Has a process to de activate an account with request from a family member; (what if a business is using Twitter?) • There is now a service that allows a person to “tweet” after death • Twitter is unable to provide account access to anyone regardless of his or her relationship to the deceased

26. What happens to your Twitter account on death: • In order for us to process an account deactivation, please provide us with all of the following information: • The username of the deceased user's Twitter account (e.g., @username or twitter.com/username) • A copy of the deceased user’s death certificate • A copy of your government-issued ID (e.g., driver’s license) • A signed statement including: • Your first and last name • Your email address • Your current contact information • Your relationship to the deceased user or their estate • Action requested (e.g., ‘please deactivate the Twitter account’) • A brief description of the details that evidence this account belongs to the deceased, if the name on the account does not match the name on death certificate.

27. Twitter continued; • A link to an online obituary or a copy of the obituary from a local newspaper (optional) • Please send us the documentation by fax or mail to the following address: • Twitter, Inc.c/o: Trust & Safety
1355 Market St., Suite 900San Francisco, CA 94103Fax : 1-415-865-5405 • Note: This is a United States number, so please be sure to include the appropriate international dialing code if you're sending from outside the United States. • We conduct all of our communication via email; should we require any other information, we will contact you at the email address you have provided in your request. If you have any questions, you can contact us at: privacy@twitter.com.

28. Deceased LinkedIn Member - Removing ProfileHow do I close the account of a LinkedIn member who passed away? • Last Reviewed: 11/27/2013 • Report Answer Inaccuracies • Expand All • Collapse All • Unfortunately, there may be a time when you come across the profile of a colleague, classmate, or loved one who has passed away. If this happens, we can close that person's account and remove their profile on your behalf. • To start this process, please answer some questions about the person who has passed away. The form can be completed and signed electronically via DocuSign here: • https://www.docusign.net/MEMBER/PowerFormSigning.aspx?PowerFormId=91e28b6c-bc93-47ed-8d1e-1f81083529d6 • We'll need to know the member's name, the company they worked at most recently, your relationship to them, and get a link to their profile. It's also very helpful if you can provide us with the member's email address so we can find and verify their account. • After you fill out this form, it will be automatically sent to us for review and we'll be in touch

29. 3.1 Rights to Access, Correct, or Delete Your Information, and Closing Your Account (march 26,2014) • You can change your LinkedIn information at any time by editing your profile, deleting content that you have posted, or by closing your account. You can also ask us for additional information we may have about your account. • You have a right to (1) access, modify, correct, or delete your personal information controlled by LinkedIn regarding your profile, (2) change or remove your content, and (3) close your account. You can also contact us for any account information which is not on your profile or readily accessible to you. If you close your account(s), your information will generally be removed from the Service within 24 hours. We generally delete closed account information and will de-personalize any logs or other backup information within 30 days of account closure, except as noted below. • With respect to SlideShare accounts and activity, if you would like us to delete your record and/or remove a particular comment you have made on SlideShare.net, or to provide a copy of any personal data to which you may be entitled, please contact us at privacy@slideshare.com. We will remove your information from SlideShare.net within 24 hours and delete and/or de-personalize it from our systems within 30 days of closure, except as noted below. • Please note: Information you have shared with others (for example, through InMail, network updates, content sharing, or LinkedIn Groups) or that others have copied may also remain visible after you have closed your account or deleted the information from your own profile. LinkedIn Groups content associated with closed accounts will show an unknown user as the source. In addition, you may not be able to access, correct, or eliminate any information about you that other Members copied or exported out of LinkedIn, because this information may not be in our control. Your public profile may be displayed in search engine results until the search engine refreshes its cache.

30. 3.2 Data Retention • We keep your information for as long as your account is active or as needed. For example, we may keep certain information even after you close your account if it is necessary to comply with our legal obligations, meet regulatory requirements, resolve disputes, prevent fraud and abuse, or enforce this agreement. • We retain the personal information you provide while your account is in existence or as needed to provide you services. LinkedIn may retain your personal information even after you have closed your account if retention is reasonably necessary to comply with our legal obligations, meet regulatory requirements, resolve disputes between Members, prevent fraud and abuse, or enforce this Privacy Policy and our User Agreement. We may retain personal information, for a limited period of time, if requested by law enforcement. LinkedIn's Customer Service may retain information for as long as is necessary to provide support-related reporting and trend analysis only, but we generally delete or de-personalize closed account data consistent with Section 3.1., except in the case of our plugin impression data, which we will try to de-personalize at the time of collection, but in any event, we will de-personalize within 7 days.

31. Email Accounts • Do they contain important emails or information? • What about business documents or information? • Be careful that they are not appropriated by third parties who use them to contact people after the email owner has died • What is your plan? Should you print out certain documents? Do you want the account deleted? • This applies to business as well as personal • An issue for entrepreneurs.

32. Accessing a Deceased Person's Gmail Account • Accessing a deceased person's mail • We extend our condolences for your loss. If you need access to the Gmail account content of an individual who has passed away, in rare cases we may be able to provide the contents of the Gmail account to an authorized representative of the deceased person. • At Google, we’re keenly aware of the trust users place in us, and we take our responsibility to protect the privacy of people who use Google services very seriously. Any decision to provide the contents of a deceased person's email will be made only after a careful review. • Before you begin, please understand that Google may be unable to provide the Gmail account content, and sending a request or filing the required documentation does not guarantee that we will be able to assist you. The application to obtain email content is a lengthy process with multiple waiting periods. If you are the authorized representative of a deceased person and wish to proceed with an application to obtain the contents of a deceased person's Gmail account, please carefully review the following information regarding our two stage process:

33. Part 1-Information Required We require the following information: • Your full name • Your physical mailing address • Your email address • A photocopy of your government-issued ID or driver’s license • The Gmail address of the deceased person • The death certificate of the deceased person. If the document is not in English, please provide a certified English translation that has been prepared by a competent translator and notarized • The following information from an email message that you have received at your email address, from the Gmail address in question: • The full header from the email message. See instructions on how to find headers in Gmail and other webmail email providers. Copy everything from 'Delivered-To:' to 'Content-Type:' • The entire content of the message • Mail or fax this information to: • Google Inc.Gmail User Support - Decedents’ Accountsc/o Google Custodian of Records1600 Amphitheatre ParkwayMountain View, CA 94043Fax: 650-396-4502

34. Part 2- access Gmail • Part 2 • After a review, you will be notified by email and informed whether we will be able to move beyond Part 1 to the next steps of the process. In some cases, this waiting period may take up to a few months. During this process, please be aware that Google will not delete the deceased person's account before responding to your request. If we are able to move forward based on our preliminary review, we will send further instructions outlining Part 2. Part 2 will require you to get additional legal documents, including an order from a U.S. court and/or additional materials. • Please note that submitting these materials will not guarantee that we will be able to provide Gmail content so we strongly recommend not embarking on Part 2 until you hear back from us regarding Part 1. Because of our concerns for user privacy, if we determine that we cannot provide the Gmail content, we will not be able to share further details about the account or discuss our decision. Once again, we offer our condolences to you at this time and appreciate your patience and understanding.

35. Google inactivity account manager • What should happen to your photos, emails and documents when you stop using your account? Google puts you in control. • You might want your data to be shared with a trusted friend or family member, or, you might want your account to be deleted entirely. There are many situations that might prevent you from accessing or using your Google account. Whatever the reason, we give you the option of deciding what happens to your data. • Using Inactive Account Manager, you can decide if and when your account is treated as inactive, what happens with your data and who is notified.

36. The digital memorandum needs to be updated • Like a will or a mandate what if the designated person is not available • What if there is a divorce ? • It is an issue in business- what if there is a shareholder dispute? • What happens if heirs disagree?

37. Update Legal Documents • Consider drafting specific clauses for enduring powers of attorney and or wills designating specific persons and giving them specific rights with respect to digital accounts, on line accounts, bank accounts, etc.

38. UNIFORM FIDUCIARY ACCESS TO DIGITAL ASSETS ACT In the US, several states have statues that address fiduciary authority over digital assets The Uniform Law Commission is drafting legislation -Uniform Fiduciary Access to Digital Assets Act ( UFADAA). In its draft legislation to be presented at its upcoming meeting in July 2014 it states: “The purpose of this act is to vest fiduciaries with the authority to access, control, or copy digital assets and accounts. It is important to understand that the goal of the Uniform Fiduciary Access to Digital Assets Act (UFADAA) is to remove barriers to a fiduciary’s access to electronic records and that the other law, such as fiduciary, probate, trust, banking, investment securities, and agency law remain unaffected by UFADAA.”

39. UFADAA • A draft of the legislation is available at : • www. uniformlaws.org • The next meeting is in July 2014;

40. QUOTE FROM THE PREFATORY NOTE June 6, 2014 • “the number of digital assets held by the average person increases, questions surrounding the disposition of these assets upon the individual’s death or incapacity are becoming more common. Few laws exist on the rights of fiduciaries over digital assets. Few holders of digital assets and accounts consider the fate of their online presences once they are no longer able to manage their assets. And these assets have real value: according to a 2011 survey from McAfee, Intel’s security-technology unit, American consumers valued their digital assets, on average, at almost $55,000. Kelly Greene, Passing Down Digital Assets, WALL STREET JOURNAL (Aug. 31, 2012), http://goo.gl/7KAaOm. These assets range from online gaming items • to photos, to digital music, to client lists. There are millions of Internet accounts that belong to dead people. Some Internet service providers have explicit policies on what will happen when an individual dies, others do not; even where these policies are included in the terms-of-service agreement, most consumers click through these agreements. “

41. Terms of PASSWORDBOX. COM • Digital Identity Management • The PasswordBox Application is a digital identity management service that gives you the ability to save your passwords, credentials, frequently visited websites and favorite websites by storing all passwords, notes and form-filling data. Your passwords will be encrypted on your device by a master password that only you know. You only need to remember this master password to open your PasswordBox and decrypt your encrypted passwords on your device. After being encrypted on your device your passwords will be sent to PasswordBox in an encrypted format through a secure connection for storage in order to enable synchronization on your other devices. PasswordBox never stores your master password on any server so your passwords cannot be retrieved by anyone but you. • Transfer of Digital Assets in Case of Death • The Services allow you to transfer the login information of your important digital assets such as websites, email accounts, social media accounts and sharing sites (collectively “Digital Assets”) to your designated heirs (“Heirs”). Upon your death, your Heirs are responsible for contacting PasswordBox and providing necessary proof of death such as a death certificate and identification before being granted access to your Digital Assets in accordance with the instructions contained in your account. PasswordBox will verify your death certificate with the relevant authorities to avoid fraud. You may change, modify, revoke or delete your Heirs at anytime by logging into your account. • Sharing of Digital Assets • The Services also allow you to share the login information of your important Digital Assets with your designated sharee ("Sharee") with end-to-end encryption. There are many things that Sharee may do with those Digital Assets (for example, copy it, modify it, re-share it). Please consider carefully what you choose to share. PasswordBox is not responsible for any sharing of Digital Assets by you and disclaims any liability or responsibility in respect of your sharing of Digital Assets.

42. Article from the Guardian April 16, 2014 • Law Society urges people to leave instructions for their digital legacy • Solicitors organisation warns that too much valuable, intellectual property is in danger of being lost when we die • http://www.theguardian.com/money/2014/apr/16/law-society-instructions-digital-legacy

43. Make Sure Your Documents are Legally Correct and up to date • Important documents should be prepared by professionals in your jurisdiction. • In Quebec it is a notary or a lawyer. Wills must respect the form of the jurisdiction. • By way of example a recent decision of the Quebec Superior Court ( Affaire succession Bellemore , September 7, 2012 )held that a will typed on a computer and signed by hand did not constitute a holograph will and was not accepted (2012 QCCS 4283)

44. Consider updating your documents • Add language to powers of attorney and wills • Prepare memorandums • Have a strategy for your passwords and information

45. Powers of Attorney/Mandate • Used with permission of Sharon Nelson .” • The following is the language she came up with her attorney for “our wills and Powers of Attorney”. • POWERS OF ATTORNEY • To give the Agent power over digital assets: • “Digital Assets. My Agent shall have (i) the power to access, use, and control my digital devices, including but not limited to, desktops, laptops, tablets, peripherals, storage devices, mobile telephones, smart phones, and any similar digital device which currently exists or may exist as technology develops for the purpose of accessing, modifying, deleting, controlling, or transferring my digital assets, and (ii) the power to access, modify, delete, control, and transfer my digital assets, including but not limited to, my emails received, email accounts, digital music, digital photographs, digital videos, software licenses, social network accounts, file sharing accounts, financial accounts, banking accounts, domain registrations, DNS service accounts, web hosting accounts, tax preparation service accounts, online stores, affiliate programs, other online accounts, and similar digital items which currently exist or may exist as technology develops, and (iii) the power to obtain, access, modify, delete, and control my passwords and other electronic credentials associated with my digital devices and digital assets described above.” • For greater emphasis to banks, include in the provision giving the Agent powers regarding financial accounts: • “….and to access, modify, delete, control, and transfer my digital financial accounts.”

46. Wills • “My Executor shall have the power to access, handle, distribute, and dispose of my digital assets, and the power to obtain, access, modify, delete, and control my passwords and other electronic credentials associated with my digital devices and digital assets. [ALTERNATIVE:  I authorize my Executor to engage to assist in accessing, handling, distributing, and disposing of my digital assets.] If I have prepared a memorandum, which may be altered by me from time to time, with instructions concerning my digital assets and their access, handling, distribution, and disposition, I direct my Executor and beneficiaries to follow my instructions as outlined in that memorandum. “Digital assets” includes the following: • (1) Files stored on my digital devices, including but not limited to, desktops, laptops, tablets, peripherals, storage devices, mobile telephones, smartphones, and any similar digital device which currently exists or may exist as technology develops; and • (2) Emails received, email accounts, digital music, digital photographs, digital videos, software licenses, social network accounts, file sharing accounts, financial accounts, banking accounts, domain registrations, DNS service accounts, web hosting accounts, tax preparation service accounts, online stores, affiliate programs, other online accounts, and similar digital items which currently exist or may exist as technology develops, regardless of the ownership of the physical device upon which the digital item is stored.” • . • Used with permission of the author, Sharon Nelson (snelson@senseient.com/www.senseintcom; twitter.com/sharonnelsonesq.) She asked that we also thank her attorney.

47. Plethora of Web Sites and Resources • Death and Digital legacy.com • Legacylocker.com • CirrusLegacy.com - your digital legacy secured • Murfie.com - store your physical copies • Securesafe.com • RecordMeNow.org • ifIdie.net ( Facebook app that let’s you record a message) • PASSWORDBOX.CA • www.thedigitalbeyond.com Thinkstock

48. Information Can Be Locked Away • If User ID and password information is not available to your trusted advisor, the information can be lost forever . • In an effort to protect privacy and identity while people are alive, strict rules may prevent access after they have died; • If your advisors don’t have a record of what you have they won’t know what to look for or where to look

49. Create a Digital Memorandum • Create a memo to record your digital life and how to access it ; • In addition to a list of bank accounts and insurance policies it is now important to identify • Email accounts and passwords. • Social media accounts • On line bill payment • Digital devices and passwords ( smart phones) computers • Email addresses to recover passwords

50. Digital Memoranda cont’d. • Leave clear instructions to the people in charge of the estate so they can access the assets and manage the estate; • Identify if possible if you want your social media site to survive or be cancelled. • It is important to plan for this during your life time when you can make decisions. • Personal property extends beyond the movables and what we can see; • We need to consider our digital foot print so it can be managed as effectively as our papers