My work and professional advocacies on digital privacy and security started way back in 2001, when I was appointed as a consultant for the Information Technology E-Commerce Council on its cybercrime bill initiative, up to the time I had to leave the country to take my Ph.D in Law degree at the University of Queensland in Australia in 2003. When I came back, in 2008, the former Commission on Information Communication Technology (CICT) through its Deputy Commissioner Atty. Perez tasked me to critique the consolidated cybercrime bills that already went through the vetting process of the European Commission, which I did, and to come up with my own cybercrime bill, which was never considered. I was also a consultant of the CICT on its data privacy bill which had its own issues, and placed in the backburner for quite some time. I wrote a white paper for that, raising issues that to this very day are quite relevant.
In this age of digital confessionals and e-self-immolations in the pursuit of online fame and notoriety, there is one very basic thing that I have wondered about since 2008, which no Philippine legislator, academic or even a lecturer in the Mandatory Continuing Legal Education (MCLE) had raised, legislated, blogged or even lectured, until now. This matter involves the question of a person’s digital legacy.
Eight years after my CICT stint, I started lecturing and advocating for the necessity of a Philippine law that allows the survivors or heirs of a decedent to have access to the digital remnants of their loved one. My first MCLE lecture to incorporate this was for the Integrated Bar of the Philippines (IBP) Chapter in Ilocos Sur, Vigan last January 15, 2016 at the historic Girl Scouts Building.
This was the time, when one of idols, David Bowie passed on, and I felt that Vigan is a very appropriate place to start this advocacy because it is an international heritage site, where the past and present co-exist and collide in surprising and beautiful ways. I have continued to do so in every opportunity that I could get in my lecture tours all over the country, including in my different lectures for the MERALCO, Siguion Reyna Montecillo Ongsiako law firm, the Sycip Salazar Gatmaitan Hernandez law firm and the Santiago and Santiago law firm. The most recent lectures where I raised this matter were for the CDAS ASEA 10, in Cagayan De Oro last July 13, 2016 and the University of the Philippines Institute of Administration of Justice last July 15, 2016.
The electronic remains of a decedent may be contained in emails, social media, websites and other repositories that are owned or operated by third parties. Many cases have arisen in several jurisdictions where the survivors of the owners of email accounts or social media profiles who have passed on, are deprived of their access to the digital creations of their loved ones because of the policies and terms and conditions of usage of the third parties that own these repositories. Typically, owners of email services like Yahoo! and Gmail restrict the use of any email account to the holder of such account and prohibit the sharing of passwords or e-keys to these accounts, thus not allowing the heirs of these account holders to access their loved ones’ accounts for important information. The same policy holds true for social media providers like FaceBook, which is the most popular social media platform utilized in the Philippines. FaceBook, after being informed of the passing of an account holder would memorialize the holder’s account, effectively “freezing” the account and preventing its activation, including any further comments.
One of the most well known cases that typified the difficulties of heirs having access to their loved one’s electronic legacy is that of James Ellsworth. He is the father of Justin Ellsworth who died in Falujah, Iraq, while saving eleven marines. Justin engaged in email chats with his father and wished to publish a scrapbook of his war experiences when he returns to the U.S. after his tour, using their email correspondence as the main storyline or basis. Unfortunately, this did not come to pass. In dealing with his son’s death and his personal grief, James decided to honor his son’s wish, but he could not access his son’s Yahoo! email account for the pertinent emails that would be used in the scrapbook, because Yahoo! will not give him his son’s password or access to the account. The case went to probate court, and after a protracted period of waiting, the probate court decided that Yahoo! must furnish James copies of his son’s email messages but denied James access to his son’s email account on the ground that the account would pass on to Yahoo! since it is stored on its server. This case also did not change Yahoo!’s policy. Some are not as fortunate as James. Parents of people who killed themselves or were murdered, and left messages in FaceBook prior to their passing, were denied access to their children’s accounts’ content altogether, thereby leaving them with questions about their children’s behavior, motivation and pertinent history which their private postings could possibly answer.
It is because of cases like these that I have decided to advocate for a Digital Asset Inheritance Law. In my lectures I raise several points that legislators must consider.
The most crucial is the right granted under the Data Privacy Law (R.A. 10173) to a “data subject” which is the right of data transmissibility:
SEC. 17. Transmissibility of Rights of the Data Subject. – The lawful heirs and assigns of the data subject may invoke the rights of the data subject for, which he or she is an heir or assignee at any time after the death of the data subject or when the data subject is incapacitated or incapable of exercising the rights as enumerated in the immediately preceding section.
Under the law, this right of transmissibility would include the right to access the personal information and other data generated by the data subject that had been subjected to “data processing” which had been defined to “include but not limited to, the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data” by any personal information controller (PIC). The definition of PIC under this law is broad enough to include email account systems operators and social media providers.
The Implementing Rules and Regulations of R.A. 10173 have not yet been promulgated by the National Privacy Commission (NPC), as they are currently undergoing a series of public hearings. In fact, the I.R.R. do not even touch on this in any specific manner. So there is no guidance as to how this law may affect the rights of the survivors on accessing the digital remnants of their loved ones.
One particular concern that I note here, and in all my lectures on this matter, which is why I have been advocating for a specific law on digital asset inheritance, is that a mere I.R.R. from the NPC may not suffice due to the legal question concerning not only NPC’s status, but the actual effective implementability of R.A. 10173.
R.A. 10173 was passed last August 15, 2012. But the past administration only operationalized the NPC last March 8, 2016! The law mandated the following:
SEC. 39. Implementing Rules and Regulations (IRR). – Within ninety (90) days from the effectivity of this Act, the Commission shall promulgate the rules and regulations to effectively implement the provisions of this Act,
which should have been done way back in 2012. This not a mere technical ground but one intertwined with substantive legal merit. The Supreme Court had decided on a slew of cases that the operative act of the legal implementability of any law is the deposit of its I.R.R. with the UP Office of the National Administrative Register, which had not yet been done in this instance after almost four years from the law’s passage.
I have three specific suggestions for what this type of law should contain.
First, a specific law on digital asset inheritance must specify or include the possible electronic repositories of the digital legacy of a decedent. It must apply to all forms of electronic storage providers, like email providers, microblogging services, social media providers and cloud providers. Provision must be made for the allowance of accounts created by deceased minors, who during their lifetimes, did not abuse their accounts, and created content (even through their correspondence), which their heirs or survivors deem worthy as legacies.
This law is crucial because it would, or should trump the terms of use and conditions that are currently provided by social media and email account providers like FaceBook, Gmail and Yahoo! to deny access to the heirs of the accounts of their deceased loved ones, because these policies prohibit the account holders from sharing their account passwords or from sharing their accounts with any third party, including their loved ones.
Second, another important and significant issue that is not currently being discussed in the Philippines is the intellectual property rights connected with the digital legacy left by a decedent. For instance, an examination of the relevant Facebook policy would reveal that when a user signs up for FaceBook, s/he grants FaceBook a non-exclusive intellectual property license to use and even transfer the license to third parties that FaceBook deals with, concerning the posts, photographs, videos, or written materials that the user puts in his/her FaceBook account. Even if the user terminates the account, these third parties that FaceBook transferred it license to can continue using the digital data. A proper Digital Inheritance Law must address this seemingly iniquitous situation.
Third, this law should also consider or lay down the proper framework for the valuation of digital assets.
The Bureau of Internal Revenue, and possibly the Bangko Sentral ng Pilipinas (BSP), Department of Trade and Industry (DTI), the Department of Communication Information Technology (DCIT), the NPC, the National Telecommunication Commission, other relevant agencies and the private sector must come up with an acceptable formula and accounting method for determining the monetary value of all forms of digital assets.
The framework must take into account the reality that some of these assets would defy the normal or usual means of valuation and accounting. An example would be Bitcoins, which is an example of a cryptocurrency that is not regulated by any country or any central banking authority. Since they are virtual money that pass from online wallets or are traded in online exchanges that are not regulated by the BSP, and their values fluctuate every day, it is difficult, if not impossible, for now, to access and determine their value for Gross Estate Tax purposes. These constitute the reasons why tech savvy spouses avail of Bitcoins to hide part of their assets from the prying eyes of their less than favored spouses and why drug dealers and purveyors of digital crimes use them as their currency of choice.
To all the readers of this blog article, I request that you join me in my advocacy for such a law by circulating or disseminating this article to your favorite legislators, and to as many people and entities as you can to create the needed groundswell and support for this type of legislation. You can also leave a comment on this blog article and create a discussion for this law.
I would like to thank the excellent gorgeous IBP Vigan lawyers (who are too many to mention) who were so generous in regaling us with their stories and insights into Vigan’s past and treating us to the rich food, particularly the bagnet, that I could still savor even after so many months have passed! Vigan is one of those magical places that truly merit a world class reputation and I felt so fortunate to have experienced first-hand the true hospitality and genuine warmth of not only the lawyers but the locals, as well.
Extra especial thanks to the UP Institute of Administration of Justice, their brilliant Director, Prof. Patricia Salvador Daway, their former, and truly fabulous Director, Prof. Rowena Daroy Morales, the insightful Atty. Armand Arevalo, the generous Mesdames Mabel Perez, Zen Santos and Evelyn Cuasto and the amiable IAJ staff, who had supported my cyber law advocacies all these years!
To the lawyers in the law firms that I was fortunate to lecture at, the IBP National, Ms. Arguson, and the Arellano Law Foundation, who all trusted me to be one of their lecturers, and to every lawyer who had attended my lectures in the past, Deo Gratias!!! I trust that these bits of insights can serve as part of the arsenal for those of you who are advocating for the proper treatment of the digital legacy of their loved ones. God Bless Us! Insha Allah!