Legality about recovering deceased relative online account In the case of a deceased relative, is there any law violation in any of these circumstances in relation to an online account (let's say google, facebook, twitter, msn, etc)? Countries interested: USA, Mexico, Japan, UK If I know the password and I access their account If I don't know the password and I try to recover it If I recover the password and access their account Does the intention matters until those points?
In the United Kingdom: A person has no authority to access an online account of a deceased relative, unless this has been agreed with the operator of the website (etc). If a Power of Attorney over the deceased's financial affairs existed, this ceases upon death. Using a person's login credentials without permission from the owner of the website would be a breach of the Computer Misuse Act 1990, as amended by Part 5 of the Police and Justice Act 2006, and Part 2 of the Serious Crime Act 2015. Actus Reus The offence is made out once a defendant has caused a computer, which would include his own computer, to perform a function with intent to secure access. The access to the program or data which the accused intends to secure must be 'unauthorised' access. Mens rea There are two elements: There must be knowledge that the intended access was unauthorised; and There must have been an intention to secure access to any program or data held in a computer. There has to be knowledge on the part of the offender that the access is unauthorised; mere recklessness is not sufficient. This covers not only hackers but also employees who deliberately exceed their authority and access parts of a system officially denied to them. Crown Prosecution Service legal guidance Additional note for accessing online banking and similar accounts: A person who accessed a bank computer with the intention of transferring the deceased's funds to themself (such funds being the property of the estate, not the person) thus committing theft, would potentially be committing the further offence under Section 2 of the CMA of Unauthorised access with intent to commit or facilitate commission of further offences If the person has a legitimate claim on the funds in the bank account, i.e. they are an executor or administrator of the estate, there is an established procedure to claim the funds from the bank. This does not include being given access to the deceased's accounts or statements, as these remain confidential. The bank will provide a closing balance at the date of death, together with a list of regular payments in/out of the account (those being parties the executor/administrator should advise of the death) together with a statement for any transactions after death ie during the period of executry of the estate.
Can a city request deletion of all personal data that uses a certain domain for logins? Well, they can, but they have no legal backing to make it happen. Their chances of succeeding are about as good as me requesting a Ferrari, a Yacht and a Mansion. I can make that request. People will laugh. I will not get it. I'm a little worried that I shouldn't allow certain domains to be used as logins in the first place, especially ones that might be school related You have no way to know who owns what email address. And it's none of your business. Your only interest should be in whether the address is owned by the person that is creating the account. You probably already do that by sending a confirmation link to the email address when people sign up. I'd like to have some idea for future reference if there's any case where the GDPR would require me to comply with such a request The only way you have to comply with such a request is if the owner can prove their identity. As far as I understood, the &quot;Finnish city&quot; was three degrees away from that. They could not provide any proof they are who they said they are, they could not provide a finite list of accounts they claimed to own and they could not even provide proof they own those accounts. They literally just wrote an email with zero legal meaning. I want to figure out the right way to reply to emails like this one The correct way to handle this is have a feature on your website where the account owner can delete their own account. GDPR compliant. Then you make a text template explaining how to use that feature and reply with that template to every request, no matter how stupid (like this case) they are. If they cannot identify themselves to you by proving they have access to their &quot;own&quot; email, they have no business wasting your time. Legally, they could provide you with a different method of identification. In case of a Finnish school, that would probably need to be power of attorney from all children's legal guardians and a specific way to identify the accounts that is consistent with the data given (for example if they entered their full name and address on your website). You would probably in your rights to demand a certified translation if it's all in Finnish. Apart from the fact that you as a private US citizen have no real means to check the validity of all that paperwork, personally, if I saw hundreds of pages of certified translated paperwork, I would probably just comply. Not sure it it were actually enough, but it certainly gets an A+ for effort to delete data from a private website. But a real lawyer might give better advice with a real case on their hands. Is deleting the data actually more of a legal liability than not deleting it in some cases? (People shouldn't be able to delete other people's accounts.) Indeed. You should not delete people's data because a random punk on the internet sent you an email. You need to identify who the request is from and if they are allowed to make such a request. Whether you have a legal duty to actually keep data, is up to you or your lawyer to find out. It depends on your data and laws. It is perfectly legal to make a website with a textfield that deletes any data you enter after a second. Destruction of data you own is only a problem if you break other laws with it. For example the IRS might not be amused if you destroyed invoices and other proof of taxable income. &quot;Some dude claimed I must in an email&quot; is not going to fly with them. That said, again, please, identify who you deal with, find out if their claim is valid. Don't do stuff because random internet punks write you an email. Because the next mail you get, will be from a Nigerian Prince. Please wisen up before opening that one. People on the internet, through stupidity or malice, might not have your best interests at heart. Don't believe random emails.
Would any offence be committed for: Having this on your person? Buying or selling this? Leaving it around for people to plug in to a computer? In the abstract, I don't think that this conduct would violate either Section 36 of the U.K. law or U.S. law, although, obviously, purposefully destroying a computer itself (i.e. actually using the device without the consent of the owner of the computer) would violate many U.K. laws and would also violate many U.S. laws at both the state and federal level. I also don't think that possession or buying or selling this product would be a crime absent some intent that it be used illegally, in which case there might be an "attempt" to commit a crime offense, or an offense that would make one part of a conspiracy to commit a crime. In the "leaving it around" example, there is arguably an intent to use it to harm another improperly, although the phrasing is ambivalent. While many statutes in the U.S. criminalize possession of burglary tools, or drug paraphernalia, sometimes with an associated intent element (although even these crimes often have an express or judicially implied intent to use element), I'm not aware of any statute that criminalize possession of tools for malicious destruction of property. So, if the tools aren't possessed or used in a manner intended as a step in the facilitation of a crime, I don't think that any law is violated. So far as I know, the U.S. does not have a counterpart to Section 37 of the British statute cited above (it isn't a terribly easy thing to search for to definitively rule out the existence of such a law because federal law has many uncodified crimes in unexpected statutes and there are many sets of state criminal statutes, not all of which are codified either). The example giving in the comments by @gnasher729 of possession of a hammer which could be used to do the same things that this object could be used to do is instructive. Arguably, this USB-like tool is more specifically targeted at malicious conduct. But, for example, when I used to work as a radio news reporter, we had a machine that was basically a high powered magnet that was specifically designed to destroy all information on magnetic media. This was, in part, so that it could be reused, but it was also so that confidential interviews wouldn't fall into the wrong hands once they were no longer needed, in much the way that one might shred paper documents. It isn't so implausible to think that a device like this one might be necessary for individuals or firms with national defense secrets embedded in their hardware and software to have on hand in order to destroy a sensitive computer in order to prevent a security breach, if necessary. In a case like that, leaving one of these devices around the office unlabeled might be negligent, but wouldn't have the intent necessary to be an intended crime. And, it is hard to imagine that the device itself, which seems pretty simple, would itself involve any technology that is a national security secret, so it probably wouldn't violate export control laws. Of course, possession, purchase or sale of such a specialized device, or leaving it around unlabeled would certainly be powerful evidence of an intent to use the device in a wrongful manner, and hence, of an attempt to commit a crime. Indeed, possession of such a device or purchase of one might very well be sufficient to establish probable cause to seize the device and arrest the person holding it on charges of an attempt to destroy a computer. But, this device would be merely powerful evidence of an intent to commit a crime, rather than something that is a crime to commit in and of itself. There are no international laws that govern this kind of thing. The only international laws applicable to individuals pertain to war crimes and nuclear and chemical weapons. Even then, most international laws direct member nations to adopt domestic laws on the subject rather than being self-executing.
My friend should have taken his property with him, but presumably the host can't just keep it, especially after reaching out to them? Correct. However, the host does not have to do anything to facilitate its return i.e. they don’t have to post it to you. So long as they keep it for your friend to collect and don’t appropriate it for their own use, they are not breaking the law. If they do appropriate it, that is called theft or its tort equivalent, conversion. As my contract was with Airbnb and the host works from them, is there any responsibility on their part, e.g. Could I hypothetically open a small claims case against them? Or would any small claims case be directly against the host themselves? This is not true. You and the host each have a contract with Airbnb for the use of the platform. The contract for the accommodation is between you two and doesn’t involve Airbnb at all. In any event, there is no contractural issue here.
You've identified exactly the right question: whether the person's subjective expectation of privacy, when viewed objectively, is the "justifiable under the circumstances". (Smith v. Maryland) The Supreme Court hasn't addressed how this test applies to ISPs and website requests. However, this question has been addressed by several circuit courts of appeal. I'll build a list of example cases. Many find that there is no reasonable expectation of privacy in this information, but there are some cases that go the other way, and there is some nuance regarding exactly what information is being given away. US v. Beckett (11th Cir. 2010): the information consisted of the identifying information transmitted during internet usage and phone calls that is necessary for the ISPs and phone companies to perform their services. It is unreasonable for Beckett to have been unaware that such information was being transmitted to the ISPs and phone companies and so he “assumed the risk that the company would reveal to police the [information].” United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2007): Analogously, e-mail and Internet users have no expectation of privacy in the to/from addresses of their messages or the IP addresses of the websites they visit because they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information. Like telephone numbers, which provide instructions to the "switching equipment that processed those numbers," e-mail to/from addresses and IP addresses are not merely passively conveyed through third party equipment, but rather are voluntarily turned over in order to direct the third party's servers. Regarding your secondary question about a "secret machine" that the government develops to get access to contents of an envelope without opening it, that is very similar to the situation in Kyllo v US 533 U.S. 27 (2001) (internal quotations removed): [...] obtaining by sense-enhancing technology any information regarding the home's interior that could not otherwise have been obtained without physical intrusion into a constitutionally protected area constitutes a search-at least where (as here) the technology in question is not in general public use. [...] Reversing that approach would leave the homeowner at the mercy of advancing technology-including imaging technology that could discern all human activity in the home.
Intent would greatly factor into the case. As mentioned, possession of child pornography is illegal. There was a case, where a man had inadvertently downloaded such images. In the case, it was shown that there was sufficient evidence that it was accidental and without his knowledge. Presumably, if you by happenstance created an identical code through encryption/compiling, there would be a lack of evidence of intent or evidence of your intended use. For example, your stored password manager file happens to store data identical to an illegal image. The password manager output is provable and repeatable to show that it was simply circumstantial. If you have hundreds of such outputs that all "just happen to be illicit images" you would probably fall on the wrong side of reasonable doubt. As to whether you can keep the data, the programmers for the password manager would probably update their system to modify the output to avoid bad press. The general idea is that the "illegal number" is so incredibly specific that accidental cases are very unlikely to occur, and if it did, that there would be forensic evidence indicating intent and use.
As a baseline, you may assume that your code will be used legally. It sounds like this still applies in your case: there is an entirely reasonable and legal use for login code, so you had no reason to assume that there might be a problem. This puts you legally in the clear. To be liable, you'd need to know or at least reasonably suspect that your code would be used to violate the law.
Debts do not just die with debtors. The creditors have legal rights to wet their beaks in whatever monies/valuables are left from the deceased. Expect the $1k CC debt to be deducted from the IRA and/or the account left it her name.