What's RUFADAA? Estate planning needs an update
When you hear estate planning, images of the ultrawealthy working to avoid federal estate taxes probably come to mind. Maybe end-of-life planning as well, like living wills and health care proxies. But, in today's digital world, estate planning entails much, m more.
Say you take a picture with your phone and store the image on a hard drive. If you bequeath your tangible personal property, which would include the hard drive, does your bequest also include all the files on that drive? What if the photo were stored in the cloud or posted to a social media site? There’s no hard drive involved, but you may still own the rights to the digital picture itself — or would you?
Answering these questions can be yet another compelling way to plus the value proposition for clients, something that has taken on greater significance in an era where investment management has become increasingly commoditized.
Basically, digital estate planning is concerned with the process of cataloging, organizing and planning for the disposition of one’s digital assets after death. Some assets have intrinsic financial value, such as cryptocurrencies, popular digital storefronts — e.g., eBay or Etsy pages — and valuable web domains. In other cases, digital assets may have no such value, but are gateways to accessing assets with value — e.g., the credentials to log into online banking or brokerage accounts. Digital assets can be just about anything and everything that is created, communicated, sent, received or stored by electronic means.
Increasingly, digital assets also include massive amounts of nonfinancial information as well, like email accounts, contact lists, social media accounts, pictures, videos, purchased digital music and movies and other information that has been stored in a digital format.
From the beginning of the so-called information age up until only a few years ago, access to digital assets by anyone other than the owner of those digital assets — typically the user of some online service or website — was governed almost exclusively by the service/website’s Terms-of-Service agreement, rather than by property law.
This created a number of issues when the owner of those assets died or was otherwise incapacitated and unable to effectively manage their own affairs. Heirs may have no way to log into the incapacitated or deceased owner’s account to access those digital assets, and the account providers are under no legal obligation to let others access a deceased or incapacitated individual’s accounts.
In practice, many people simply dealt with this by saying, “Well, I’ll just write down a list of all my usernames and passwords, and give them to a confidant.” However, this is not an effective and legal way to handle the situation.
In fact, when a third-party user accesses someone else’s account without being an authorized user — even if that original owner handed them the login credentials — it is technically an act of hacking. That word may conjure images of hoodie-clad figures hovering over keyboards, but the reality is that anyone who knowingly accesses a computer or account without proper authorization is hacking — an act potentially punishable by law under a variety of statutes, including the Computer Fraud and Abuse Act, and the Electronic Communications Privacy Act.
In other words, simply giving someone access to a username and password is not nearly sufficient to grant them the legal authority to access that information when a Terms-of-Service agreement does not allow for such transfers of rights — and most don’t.
Yet as more of our lives go digital, the situation needs to be addressed across a rapidly growing range of different websites and online services that might constitute or hold someone’s digital assets. Absent getting every service associated with a digital asset to change its Terms-of-Service agreement to allow for executors and other fiduciaries to access a user’s digital assets — a Herculean task at best — the only potential solution would be legislative action to create a uniform legal standard for handling such situations.
One of the key advantages of RUFADAA is it provides a framework for not just executors, but also for most other common fiduciaries such as trustees; agents appointed under powers of attorney; court-appointed guardians; and conservators of protected persons’ estates. The act also creates a clear hierarchy of instructions — a so-called three-tiered system of priorities — that provides a clear path as to how a person’s digital assets should be treated in the event a fiduciary seeks access from a service provider, i.e., a custodian.
TIER NO. 1
Under RUFADAA, any instructions provided by a user in a custodian’s online tool for how the account should be handled after death or incapacitation — for instance, via Google's Account Manager or Facebook's Legacy Contact — will have priority over any and all other instructions, including Terms of Service, as long as that online tool can still be modified or deleted at any time.
In this context, RUFADAA defines an online tool broadly as “an electronic service provided by a custodian that allows the user, in an agreement distinct from the terms-of-service agreement between the custodian and user, to provide directions for disclosure or nondisclosure of digital assets to a third person.” In essence, RUFADAA granted these online tools a power roughly akin to a digital power-of-attorney, applicable to the specific service provider/custodian offering the tool.
Accordingly, Google’s Inactive Account Manager allows Google users to notify a “trusted contact” and, if desired, to share information with that contact once an account has been inactive for a certain amount of time. Users can also instruct Google to delete certain information.
Similarly, Facebook’s Legacy Contact allows users to name someone to look after their account after they’ve passed away. Alternatively, users can request that their accounts be permanently deleted. While Legacy Contacts are not given full access to a user’s account and are prohibited from activities such as reading messages and removing or changing past posts, they are able to do things such as writing a pinned post for a profile, updating profile pictures and cover photos, and requesting the removal of a user’s account.
It’s important to note that under RUFADAA, when an individual opts to use a custodian’s online tool, they are rendering all other instructions irrelevant. That means it overrides not only the provider’s default Terms of Service, but also the client’s own Will, trust, power of attorney or other legal document that might name a person to oversee their digital assets.
Thus, even if the client has named an executor or attorney-in-fact, if that person is different from the person they instructed the custodian to share information with via an online tool, the individual named in the online tool will be granted access and the individual named in the legal document will not.
Thus far, these online tools to denote post-death control and similar arrangements are still in their infancy, but it is reasonable to think that many more custodians of digital assets will incorporate such tools into their platforms. As people continue to create, transmit and store more information online, it will become increasingly important for them to ensure a smooth transition of those digital assets to others at the relevant time.
TIER NO. 2
In the event that a custodian does not offer an online tool or if a user does not opt to use an available tool, then RUFADAA will look to a users’ legal documents, such as a will, trust or power of attorney. These documents can be used to explicitly grant a fiduciary access to any/all digital access, or to restrict such access. This is important, because prior to the development of RUFADAA — and still often the case in states where RUFADAA has not yet been adopted — these documents were largely ignored by custodians, who feared that they might be held liable if it emerged that documents weren’t up to date and they acted on outdated instructions.
RUFADAA also addresses certain rights an executor may have to a decedent’s digital assets, even if the decedent’s legal documents do not specifically address such matters. For instance, RUFADAA specifies that as long as a decedent does not leave any instructions to the contrary — via either an online tool or a legal document — a custodian must provide an executor with a catalogue of a user’s communications, if such information is requested.
Catalogues include to/from whom a message has been sent/received, the time and date of the communication and the corresponding electronic address. A catalogue does not include the actual content of any communications for which a user would still have to affirmatively grant access via an online tool or a legal document. Therefore, if individuals wish to keep private even the more limited information available via a catalogue, they should be sure to leave explicit instructions in a will or other legal document indicating such a desire to limit access, as it’s not enough for the documents to merely be silent on matters regarding digital assets to limit access.
TIER NO. 3
If a user provides no instructions via an online tool nor via legal documents, then the custodian’s default Terms of Service will dictate a fiduciary’s access to a user’s digital assets.
While this isn’t necessarily problematic, most users don’t read much, if any, of the commonly dense legalese before clicking the “Accept” button. This means that over the years, users may have agreed to just about anything without even knowing or realizing what they were signing on for.
While most Terms-of-Service agreements are fortunately more benign, many custodians’ Terms of Service are written in a manner that minimizes those custodians’ responsibility after the primary user dies — sometimes to the frustration of heirs. For instance, the Terms of Service for Verizon-owned Oath properties dictate that most accounts terminate upon the user’s death.
The premature termination of a user’s account can result in a number of complications, both financial and non-financial. For one, many people receive a host of bills via email. Knowing what a decedent’s outstanding bills are is a critical piece of information for an executor who is charged in part with satisfying a decedent’s outstanding debts. And it’s entirely conceivable that there is no record of these accounts/expenses in the physical world. Thus, the deletion of a user’s account could lead to an increase in the likelihood of bills not being paid in a timely manner after death, leading to potential penalties or other unwanted results.
Non-financial issues can be just as problematic, if not more so, when an account is terminated upon the user’s death. A lifetime’s worth of pictures, for instance, may be stored by a cloud service or similar provider, and suddenly may be lost when the account is deleted. Contact lists of friends, family and coworkers — the people who you’d want to notify of the decedent’s passing, may be lost and rendered impossible to replicate.
THE ADVISOR’S ROLE
Advisors are likely in one the best positions — if not the best — to help clients get their digital estate planning in order. Of course, as with traditional estate planning, a lawyer is still needed to provide formal legal advice and/or to complete the drafting of legal documents. Nonetheless, as with traditional estate planning, advisors should ensure that the client’s house — whether physical or digital — is in good order and that the planning documents will actually play out as intended.
Creating an accurate inventory of digital assets is a sensible first step. This is a key challenge in digital estate planning, given clients themselves may not to be aware of how expansive their digital footprint is.
A recently released report from password management tool LastPass indicated that the average employee using its tool was managing 191 passwords. That number probably isn’t going to decrease any time soon. According to the password management tool DashLane, the number of online accounts we use is rising at a rate of roughly 14% per year.
In addition to working with clients to create an inventory of accounts, advisors should consider encouraging clients to use a password management tool such as the aforementioned examples, or to explore other vendors such as Sticky Password, Keeper and Password Boss.
Note: While it’s good to help clients create their digital inventory, advisors must be careful to avoid actually taking possession of clients’ usernames and passwords to bank, brokerage and other financial websites, in order to avoid inadvertent custody of client assets.
Alternatively, compiling a physical, handwritten list of digital assets over time — to be stored in a secure location like a fireproof safe or a safety deposit box — can work. But if clients choose to create an electronic inventory list, advisors should encourage clients to make sure all usernames and passwords stored in digital format are encrypted — and when possible, use additional security measures such as multi-factor authentication.
Once the inventory of digital assets has been compiled, advisors should inquire about the client’s wishes, e.g., whom they would like to be responsible for seeing their wishes fulfilled, and what steps the client has already taken with respect to their digital estate plan. Of particular importance would be understanding if they have already made use of any online tools, since any instructions provided via one of those tools would override any other planning actions taken.
It’s also important to understand the rules surrounding digital assets for the state in which the client lives. Advisors may wish to check whether the state has adopted RUFADAA, and if so, whether there have been any major changes.
Obviously, each client’s situation is unique and needs to be evaluated based on the specific set of facts and circumstances. Nevertheless, there are some recommendations that will likely apply to a broad section of clients. These include:
- Recommending that the client consult with a qualified attorney. The lawyer can update legal documents to not only include instructions related to digital assets, but identify the relevant individuals authorized to act. Some clients may wish to use their legal document(s) to explicitly appoint a special digital fiduciary, separate and apart from the executor/fiduciary in charge of other financial or estate matters. Similarly, clients may choose to name multiple digital fiduciaries within a single legal document, each entrusted with the authority for different legal assets. This may be useful in a variety of situations, such as when:
- Fiduciaries themselves may have different levels of expertise/comfort with different digital assets. For instance, an individual may feel that one fiduciary is sufficiently capable of handling online bank and brokerage accounts, while another fiduciary may be better suited to manage their social media accounts. Or perhaps a special fiduciary is needed to handle uniquely complex digital assets, such as liquidating or transferring cryptocurrency held in cold storage to heirs.
- An individual may wish to keep certain matters private from their regular fiduciary. For instance, spouses, children or close family members/friends are typically named as an executor, power of attorney or other fiduciary, but there may be certain digital assets the individual wishes to be kept private from those individuals. Parents, for example, may not want children to have access to every text, email or other message sent between them. Indeed, in some instances, spouses themselves may not want one another to have access to all their digital content.
- Suggesting the use of a password manager. Given the amount of sensitive information stored by such a service, it is always best to make use of all available security features, including multi-factor authentication.
- Using specialized services designed to assist in the digital estate planning process. In recent years, several companies have sought to fill some of the gaps in the digital estate planning space. Such companies include Estate Map and My Wonderful Life, which was featured on ABC’s Shark Tank several years ago. (They didn’t get a deal.) Advisors wishing to help clients with such matters more directly may wish to consider one of the many industry-specific tools that have begun to emerge, such as Everplans, Yourefolio or Legacy Shield.
MAKE A MEETING
Clearly, building the digital asset inventory and implementing a sound digital estate plan is not going to happen overnight. So unless there are health issues or other factors that would make accelerating the digital estate planning process more important, advisors may wish to implement this process over several regularly scheduled meetings.
For instance, during your next review with each client, bring up the idea of digital estate planning and introduce the concept of a password manager. Over the next three to four months, or whatever your normal meeting cadence is, let the client use the password manager to build up their list of digital assets.
At the next meeting, begin discussing what the client would like to see happen with each of those various assets; whether there are any special websites/accounts involved (e.g., where all their photos are stored, or a particularly valuable business); and perhaps, begin to discuss potential issues and strategies such as updating the legal documents to ensure those digital assets are handled by the right person and are bequeathed to the right people.
Of course, once recommendations are made and a client has decided to move forward, it’s incumbent on the advisor to follow up and ensure the plan is actually put into action. Too often, without an external nudge the digital estate plan, like many traditional estate plans, dies on the vine.