Skip to content
Naked Security Naked Security

Facebook ordered to let grieving mother in to dead daughter’s account

The girl's parents want access to her account to see if her death was the result of cyberbullying.

Germany’s highest court has ruled that access to social networks can be inherited when people die, overturning a previous court’s decision that kept a grieving mother locked out of her daughter’s account after the girl was hit by a subway train.
A year ago, a German court denied the mother’s request to access her dead daughter’s Facebook account – access she had been seeking for years in an effort to determine whether the girl had purposefully thrown herself in front of a train at a Berlin station in 2012, and if cyberbullying was behind what could have been her child’s suicide.
The girl’s parents already had her Facebook account password: according to the Guardian, their daughter had shared it with them in return for being allowed to open an account when she was 14. She died at the age of 15.
But when they tried to access the account, the girl’s parents found that it had been memorialized.
That means that Facebook completely removed the dead girl’s data, changed the privacy setting so that only confirmed friends could view her profile or search for it, removed her status updates, and locked the account so that nobody in the future could log in. As Facebook describes in its policy, the account was transformed into “a place where people can save and share their memories of those who’ve passed”.
On Thursday, Germany’s Federal Court of Justice said that social media accounts are no different than personal letters and diaries in that they, too, can be inherited. From an English translation of the court’s decision:

From a hereditary perspective, there is no reason to treat digital content differently.

Last year, a lower court had ruled that the girl’s rights to private telecommunications included her electronic communications, which, it decided, were meant to be read only by those with whom the girl had communicated.
The case brings up the complicated question of who has the right to unlock our social media accounts, our bank accounts, our eBay accounts, our creative output on Instagram, or any other aspect of our online presences or intellectual property after we die.
In the US, state laws have differed. The first law to pass in the US, in Delaware, ruled that digital assets including email, cloud storage, social media accounts, health records, content licenses, databases and more would become part of a person’s estate upon death, and the entities who control access to those assets would be required to provide the legal executor with control over the deceased’s digital assets.
Such a law has made service providers such as Facebook squirm. Back when Delaware was passing its law, a coalition of 21 technology and media companies argued against such legislation, raising issues such as those regarding liability: particularly relevant when an email contains information about a third party.
Others have called such fears a red herring, given that before the internet, doctors and drug counselors kept files with confidential information that could be accessed by a fiduciary if they died.

That fiduciary would bear the liability if confidential information was released in either digital or analog form.
Facebook, along with the tech industry at large, has also argued that digital assets laws are in direct conflict with a federal law, the Electronic Communications Privacy Act, which prohibits custodians of digital assets from releasing them to a third party without the sender’s or receiver’s permission or a court order.
That’s what a Rhode Island law stipulated: it requires that executors get a court order to access email accounts of people who die and indemnifies the provider from liability.
Thursday’s decision from Germany’s highest court made it clear that such data protection laws are irrelevant in the case of access to dead people’s digital accounts:

[Data protection] regulation protects only living persons.

A spokesperson for Facebook in Germany gave this statement to the Guardian:

We feel [for] the family. At the same time we have to ensure that personal exchanges between people on Facebook are protected. We represented a different position in this dispute, and the drawn-out court case shows how complex the matter is in legal terms.


I don’t agree with Facebook on this one; it’s not complex at all. Their own policies or T’s&C’s may have made it compex for them (and quite unnecessarily for the bereaved relations of the deceased). Thankfully the German court have made the right decision and this should, like all legal processes, set a strong example for future matters like this.


There’s a setting option in your FB profile that allows you to authorize a friend or family member to be your “agent” to get into your FB account after you’ve passed away to get into your FB account to notify friends and family and to authorize FB to shut down the account and I’ve authorized my daughter as my authorized agent so she can do what’s necessary to close it down.


“At the same time we have to ensure that personal exchanges between people on Facebook are protected. ”
Right. This is Facebook, remember? It shouldn’t read “protected”, it should read “monetized”.


Why didn’t Facebook follow Google’s footsteps?+
Make a plan for your Google Account if you pass away or stop using Google
Take control of what happens to your Google Account if you’re unexpectedly unable to use your Google Account, such as in the event of an accident or death.


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!