Dovi Henry, a poet and University of Toronto French major, had been missing for more than two months when his body washed up at an Ontario Place marina in July 2014. Naked except for a pair of threadbare socks, the corpse had decomposed to the point that race and sex were not immediately apparent. The coroner’s office was unable to determine the cause of death.
For roughly the next two years, the unidentified remains lay in repose at a Toronto morgue while Dovi’s mother, Maureen Henry, did all the things one does when their child goes missing: notified the police, contacted his friends, combed the streets, grieved. There were small leads—one friend thought Dovi might have gone to Germany—but nothing panned out.
In April 2016, Henry googled “unclaimed black male remains.” The search turned up the website of the Ontario Provincial Police (OPP) Missing Persons and Unidentified Bodies Unit—and a listing that seemed like a possible match. She called the OPP, and after examining Dovi’s dental records, a forensic dentist confirmed it.
The following month, the family held a memorial at the Mercury Lounge, the Ottawa venue where Dovi had joined friends at a poetry reading on May 5, 2014—his twenty-third birthday. This was the last known time he was seen alive. A tall, slim man, Dovi grew up in Ottawa, where he attended a program for gifted students. According to Henry, he was known as a sensitive person who connected easily with others. At the University of Toronto, he joined the Delta Upsilon fraternity. By 2012, Dovi’s second year, his friends, family, and frat brothers noticed significant changes in his demeanour. He became erratic, argumentative, depressed. That year, he decided to take a break from school and returned to Ottawa, where he worked as a tutor and gave poetry readings at night. At times, he appeared disturbed and incoherent. In January 2014, he moved back to Toronto, where he may have occasionally eaten meals at a Salvation Army shelter during the period leading up to his death.
But, having found her son’s body, Henry was not ready to close the book on his life. There were too many unanswered questions. Though the coroner had been unable to determine a cause of death, the police told Henry they considered it a suicide and refused her request for a homicide investigation. Henry believes foul play may have been involved. In 2009, she says, she received a phone call from someone threatening to kill Dovi; she also says that, around the same time, her other son, Osita, received a Facebook message making the same threat about his brother. In March 2014, in one of the last emails he exchanged with his mother before he disappeared, Dovi said that “someone tried to kill me.” The family hired a private investigator, who learned of a drug debt from 2012. (Dovi smoked pot regularly and may have used other substances.) The investigator also interviewed several members of Delta Upsilon, one of whom stated that “Dovi had gotten in with the wrong people” and “would bring strange people to the house.”
In 2017, hoping to gain insight into Dovi’s final months at the frat house, his mother asked the Toronto police if they could obtain access to Dovi’s phone and digital accounts. They told her they did not believe they had grounds to apply for a search warrant but said she was welcome to go to court and attempt to persuade a judge herself.
She did, and in October 2017, Henry received a court order directing Bell, Facebook, and the Canadian subsidiaries of Apple and Google to provide her with access to Dovi’s accounts. Persuading the judge turned out to be the easy part; enforcing the court order was another matter. Bell readily complied, as did Apple, unlocking Dovi’s phone. Neither yielded useful information as he had not been using his phone at the time of his death. (He’d left it at his aunt’s house in Toronto before disappearing.) In fact, when the phone was opened, more than three years after Dovi had last used it, his Facebook and Google accounts were logged out; he had visited an internet café while without his phone and may have changed his passwords. Facebook and Google, however, have yet to comply with the ruling.
Lacking funds to hire a lawyer, Henry, an occasional teacher, has represented herself in court for the past two-and-a-half years, facing attorneys from both tech giants. She refuses to back down. The court fight remains her best tool for finding the truth, but Henry also sees it as a struggle to reclaim her son’s humanity from Silicon Valley servers.
For big tech companies, our collective digital lives are valuable marketing data—data that fuels the sale of ads personally designed for and delivered to each of us based on detailed “psychographic” profiles generated by algorithms. But it’s unclear what happens to those digital lives after we die. Should digital assets remain under the lock and key of a corporation? Or should they be inheritable by our next of kin—just as physical assets are now?
This is the legal quandary posed by Henry’s case. The judge determined she was entitled to Dovi’s passwords, which would give her access to not just his messages but a trove of other data that the companies make available to users, including location information, search history, IP addresses, ads clicked on, purchases, voice commands, and more—a rich, intimate picture that likely includes details one might not readily share, even with their closest family members and friends.
As Dovi’s personal representative in the matter, Henry—as estate lawyers often put it—“steps into the shoes of the deceased.” It’s the standard legal procedure for settling a family member’s estate, but it’s also one that takes on new meaning in the digital age. While it’s easy to sympathize with Henry’s need to find out what happened to her son, her potentially precedent-setting case raises the question of where to draw the line for others who seek to step into similar shoes. Planning for postmortem access to digital assets and accounts is becoming increasingly common among estate lawyers—you can specify who gets access to what. But what about when a young person dies without a will? It’s not hard to imagine reasons why the deceased may not want their next of kin peering into their digital history. Under what circumstances should a grieving parent or spouse have that right?
Our everything-digital era has made it easier to preserve every last scrap of information about our lives, but eventually, many of us will have to face the question of who really controls our photo albums, letters, diaries, and other personal mementoes stored in the cloud or on password-protected hard drives. As it is, tech companies do not readily hand over passwords or account contents to third parties upon request, including family members of the deceased. Terms-of-service agreements generally prohibit it. Tech companies also contend that privacy laws prevent them from doing so. But a growing number of court cases in jurisdictions around the world, often involving parents whose children have perished under mysterious circumstances, have begun to push back against this reading of the law.
In Germany, the parents of a fifteen-year-old girl who was hit by a train in 2012 sued Facebook for access to her account in hopes of determining whether their daughter’s death had been a suicide or an accident. The precedent-setting case went to Germany’s highest court, which ruled in 2018 that “online data” was no different from “private letters or diaries,” and thus a social network account automatically passes to the next of kin upon death (unless the person’s will specifies otherwise).
Similar cases in the US have tested the boundaries between privacy and inheritability. After a fifteen-year-old boy killed himself near his family’s farm in Virginia, his parents spent a year attempting, unsuccessfully, to gain access to his Facebook account in the hopes of gaining insight into his inner life. Their plight sparked the Virginia legislature to pass a bill in 2013 that provides parents access to the online accounts of deceased minors.
The US Uniform Law Commission—an association tasked with determining which state laws should be adopted across the country—drafted a bill that would have extended those rights to any executor of an estate, regardless of the age of the deceased. But then Silicon Valley lobbyists got involved. After the bill was introduced by twenty-six state legislatures from 2014 to 2015, a business association that included Facebook, Google, and other internet companies began pushing an alternative version, which would require fiduciaries to get court orders to access deceased persons’ accounts. The bill’s proponents ultimately caved to the pressure and introduced the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), a watered-down law that hews more closely to the internet companies’ proposals. The legislation has since been adopted in forty-four states.
Canadians who find themselves in Henry’s shoes, or who simply want access to their deceased loved ones’ photos and iTunes songs, confront a different set of legal hurdles: a federal privacy law that is murky on the question of fiduciary access. In 2016, in an effort to clear up the issue, the Uniform Law Conference of Canada (ULCC) drafted the Uniform Act on Fiduciary Access to Digital Assets (UAFADA). Unlike the similarly acronymized American law, the Canadian version provides default access to online assets wherever a fiduciary would already have access to physical assets.
John Gregory, former president of the ULCC, says that, in theory, there is no need for laws like UAFADA and RUFADAA. The Western legal system has never really differentiated between tangible and intangible assets, so information stored online should be treated as an inheritance no different from documents in a filing cabinet or safe deposit box. The purpose of the Canadian version, he says, is to avoid complex and costly court cases by making explicit how that old-fashioned legal principle applies in a modern digital context.
The implications go far beyond rare, heart-wrenching cases like Henry’s. A 2013 survey by digital-security company McAfee found that the average Canadian valued their digital assets—which include entertainment files, such as music, TV shows, e-books, and video games—at around $32,000. According to Gregory, our descendants shouldn’t have to forfeit those assets. “Back in the eighteenth century, they weren’t thinking of my magic sword in World of Warcraft, which I could sell on eBay,” he says. Nevertheless, digital assets “are still assets, and if they’re monetizable, I think the trustee should get them.”
To date, no provincial or territorial legislature has enacted the bill. (Alberta has its own version, which gives fiduciaries access in limited circumstances.) But, even if the provinces and territories were to adopt UAFADA, it might not be much help to the Henry family and others in their position: when the company holding a deceased relative’s data is based in the US, as most large internet companies are, then the question of who controls one’s digital afterlife is, ultimately, a matter of geopolitical chess.
As cases like Henry’s stack up, they threaten to redefine the default rules of the data economy. Every lawsuit by a distressed family seeking access to a loved one’s account is a threat, a crack in the regulatory wall that protects internet companies’ core assets—our data.
And corporations will go to great lengths to protect that data. In November 2017, Google Canada, which Henry had named in her lawsuit, informed her that it had no power to provide Dovi’s account information, which resided with its mother company in the US. After amending the court order to include Google and Alphabet, Google’s parent company, Henry was told they wouldn’t provide the information without a US court order because doing so would put them in violation of the Stored Communications Act, a US law that regulates the disclosure of personal information held by internet companies.
A David-and-Goliath fracas ensued. In August 2018, Google presented the court with testimony from Albert Gidari, an American internet-law expert, detailing the reasons why Google could not provide Dovi’s account information unless Henry could prove in a US court that “her son provided consent to such disclosure.” With the help of pro bono lawyers at the courthouse office, Henry responded with a written cross-examination of the expert and an analysis of Ajemian v. Yahoo!, Inc., a closely watched US case in which the court held that providing the family of John Ajemian (who died in a cycling accident) with the contents of his Yahoo account would not violate the Stored Communications Act. In 2018, Yahoo appealed to the Supreme Court, which declined to hear the case.
In her critique, Henry assailed Google’s expert for implying that American laws have “endless extraterritorial application over the rest of the world.” Should anyone seeking data belonging to a deceased relative be forced to travel from wherever in the world they reside and navigate the US court system to obtain this small courtesy from the overlords of Silicon Valley? In their response, Google’s lawyers noted that Henry “has no US legal expertise or training” and characterized her critique as “an improper, inflammatory, and unfounded attack.”
At least Google responded. Facebook ignored the court order altogether, forcing Henry to file a motion of contempt, which would compel the court to enforce the order against the company. Last September, I attended the contempt hearing at the Ontario Superior Court, in Ottawa, with Henry, whom I found sitting outside the courtroom with her daughter, Anikamadhu, and a couple of Dovi’s friends who had come to lend support. A lawyer for Facebook soon arrived, greeting Henry awkwardly in his barrister’s robe.
The bailiff opened the door and we filed into the courtroom. After everyone was settled, Facebook’s lawyer, Gabriel Poliquin, rose to address the judge and said he had only been hired the week before and was seeking a postponement of the hearing because the company never received the original court order documents. Henry’s face tightened as she stood to respond. She produced a stack of postal receipts from a large envelope and held them up to the judge—the court order documents “were delivered and signed for,” she said, explaining that a different lawyer, named Elisabeth Neelin, had contacted her on Facebook’s behalf in December 2017 regarding the case. “If Facebook had not received those documents, how would Ms. Neelin have been able to contact me?” she asked in a quiet, determined voice. “I would like to proceed with my motion.”
The judge, Justice Stanley Kershman, was not the same as the one who had heard the case previously, and he spent several minutes shuffling through stacks of documents on his bench, attempting to familiarize himself with the details. Eventually he concluded that, regardless of whether Facebook had received the documents from Henry, she had failed to file some of the paperwork correctly and would have to redo it. In other words, back to square one—before she could file a motion of contempt, Facebook would have the opportunity once again to respond to the original court order, prolonging the battle.
As Kershman was wrapping up, one of Dovi’s relatives, a tall, thin man in a three-piece suit, asked to speak. He wanted the court to provide reassurances that Facebook was actually taking the case seriously. The social network, he said, “is making a mockery of all of this. Facebook has billions of dollars. Facebook is able to keep us in court for years and years. Facebook has ignored what we are saying as if we are just some small ants.” He continued, his voice rising. “Facebook is really doing something here that is not respectful of the Canadian legal system.” Unmoved, Kershman said none of that negated the paperwork requirements and dismissed the court.
But, in general, Canadian judges seem to be sympathetic to the family’s view. The premise that American tech companies are not subject to foreign authorities has recently been called into doubt by Canadian courts. As part of a London, Ontario, homicide case, a judge ruled that Facebook Canada had to turn over data to Canadian investigators even though that data was held in the US. A British Columbia case involving Craigslist, which does not have a Canadian subsidiary but operates in the country, determined that the company must provide data requested by Canadian authorities nonetheless.
Jill Presser, a privacy-law expert in Toronto, says that, while not every Canadian court case involving cross-jurisdictional access to data produced by Canadians has reached the same conclusion, current case law, on balance, “says it doesn’t really matter where the data’s located. What matters is whether the court has jurisdiction over the corporation that has possession of the data.” Canadian courts, she says, have determined that “commercial decisions made by tech companies about where to store their data shouldn’t be permitted to”—in the elegant parlance of legalese—“frustrate the administration of justice.”
US courts have made similar rulings, and in 2018, Congress passed the Clarifying Lawful Overseas Use of Data Act, which gives American law enforcement agencies increased powers to access US citizens’ digital accounts held on overseas servers. Canada has yet to enact a corollary, says Presser.
Ultimately, it’s a diplomatic issue—Canadian authorities may have to rely on their US counterparts to enforce legal action across the border. Even with the power of the Canadian legal system on Henry’s side, Silicon Valley seems to be winning.
Tech companies hold tremendous power as gatekeepers of our online lives. But the gates, of course, have a purpose: privacy. Historically, legal scholars have concluded that privacy rights are extinguished upon death. However, some privacy advocates think that concept needs to be updated for the digital age. Ann Cavoukian, the former Information and Privacy Commissioner of Ontario, sympathizes with the Henry family but worries about the precedent a case like theirs could set. “When people have very sensitive activities taking place in their lives—in terms of personal history, sexual orientation, activities that their family members may not be aware of—surely that should be protected if that is the wish of the individual. If they were protecting it during their life, why would they want that shared afterward?”
When my grandmother passed away, two years ago, my family and I spent days sifting through her belongings, reading letters and thousands of other personal documents. Had we emptied her drawers without her permission while she was still alive, it would have felt like a violation of privacy. But this felt like a rite of passage. It was an emotional experience, a part of finding closure, but also a practical matter. We had decisions to make about what to keep and what to dispose of—which required knowing what was there. And executors of someone’s estate have a duty to close bank accounts, notify creditors, settle debts, disconnect utility services, and so on, all of which requires access to sensitive information.
Jill Presser, the privacy lawyer, doesn’t think it’s ethically or legally defensible to transpose that scenario onto those whose lives have been, from an early age, tracked and recorded by internet platforms. Born in 1915, my grandmother was in her eighties when personal computers became standard in every home, and she had never used the internet when she died. Our digital footprints are far greater in scope and often more personally revealing than the tangible records that remain when we depart this world, Presser says. The smartphones in our pockets generally know where we are and more or less what we’re doing most of the time. Much of our communication with others is preserved, which means that their privacy would also be at stake if our digital legacies were exposed.
“We’re having conversations digitally that we used to only have orally, so when you look at someone’s digital legacy, you are seeing things that, in many cases, would not have been available to you before, even when you read your mom’s correspondence or diary,” says Presser. “It used to be that mom would go to the library and nobody knew what she was reading; now you can go online and see her search history. It used to be that, if you had some really hot love letters, you could tear them up, burn them, or shred them; but now we leave digital traces that are almost impossible to delete. We can’t assume that, just because we’ve got a blood relationship or a marriage tie to somebody, we should automatically be entitled, after they die, to look at everything they’ve ever done online.”
Presser agrees that legislation is needed in Canada but doesn’t think the ULCC’s bill to provide default fiduciary access is the right approach. For her, it’s more a question of where the lines should be drawn—executors of an estate gaining access to the deceased’s online banking information for the purposes of settling the estate is one thing; access to a lifetime’s worth of digital communication, web searches, and location information is another.
“The old rule that our right to privacy doesn’t survive us really needs to be rethought,” says Presser. “On the one hand, privacy has to remain a core value. On the other hand, there has to be the ability for a family member to chase down details of a loved one’s untimely passing or otherwise gain closure when a family member passes away. It kind of tugs in two directions.” She thinks it’s premature to enact legislation. First, she says, “we need to have a more nuanced, in-depth conversation about what the legislative framework would look like.”
John Gregory, the former ULCC president, sees such privacy concerns as overstated. The trustees of one’s estate may have access to sensitive personal information, but they are legally bound to act in accordance with that person’s wishes; or, in cases where a person dies without a will, in their best interest. As fiduciaries, they have no right to distribute that information or to enrich themselves from it, he says. “If my trustee goes into the back of my sock drawer and finds all my love letters from my mistresses, or my pornography collection, or whatever it is I don’t want anyone else to see, they don’t get to talk it around at the cocktail party. They have an obligation of secrecy. The privacy interest is protected by the law governing the trustee, so it doesn’t have to be governed by the law applicable to the internet service provider.”
John Wunderlich, a Toronto-based privacy consultant and digital entrepreneur, is concerned that the digital-legacy privacy debate obscures a more pressing issue: “Grandma’s diary is no longer a book sitting in the attic—it’s Facebook property. After her death, it’s not her children who would inherit the rights to it. That’s a profound, profound change.”
That may sound like hyperbole, but access is arguably a proxy for ownership, and if a law prevents one from accessing something they own, such as an inheritance, their property rights have been effectively transferred to the gatekeeper—in Wunderlich’s view, that’s the world in which we now live, at least according to the internet platforms’ interpretation of the law. The platforms’ position, however, is that they are simply following laws meant to protect privacy.
“Please,” exclaims Wunderlich. “How many billions do these companies spend on lobbyists? I’m all in favour of corporations following the rules, but with big industries, you always have to worry about regulatory capture. These are new industries—very large, very wealthy—and the regulations haven’t caught up.”
In Wunderlich’s view, the industry is not interested in protecting privacy so much as the value of the data it gleans from users. In the case of the Henry family, he says, “If the son had control of his digital identity, his mother could have inherited that and could exercise it in the same way that an executor exercises any other rights after death. I think the whole thing stems from a failure of our legal systems to catch up with the idea of digital identity.”
Henry’s tussle with Google came to a head at a hearing last April, when she says the judge suggested it might be more expeditious to seek a US court order, as the company had asked, rather than fight them in Canada. She is currently pursuing that in California, where a similar case is unfolding—the family of Daphne Caruana Galizia, the Maltese journalist who became known for her lead role in the Panama Papers investigation before being killed by a car bomb in 2017, is seeking the contents of her Google account. Henry is hoping the case sets a successful precedent for her own.
She is awaiting Facebook’s response in Ottawa, but a company spokesperson told me their position is the same as Google’s—the Stored Communication Act ties their hands—so it seems possible that Henry will need to revive her motion for contempt. Then it would be a matter of enforcing the order on an American company. There are established procedures for doing so, says Robert Currie, a law professor at Dalhousie University’s Schulich School of Law, but it’s a lengthy and complex process—in other words, the legal fees are substantial. “We’ve got lots of experience with getting Canadian court orders enforced across borders. Legally, it’s not a big deal, but it’s expensive.” I asked him if there was any chance a nonlawyer representing themselves in court could pull it off. “Oh—no, never.”
What Henry lacks in financial resources and legal knowledge, she makes up for in perseverance. She’s written letters to members of Parliament but so far has received little more than condolences in return. The office of Navdeep Bains, the minister of innovation, science, and industry, replied: “The Government of Canada expects organizations to comply with the laws of the countries in which they operate.” But, “regrettably,” it said, it was “not in a position to bring about a resolution to the matters you have described.”
Dovi’s digital assets remain locked in American server farms, but he did leave behind physical items that have offered the family a measure of solace. These include notebooks filled with handwritten poetry. With the help of one of Dovi’s literary friends, Henry gathered a selection of his poems into a book, which she plans to self-publish—a long-time dream of her son’s. Titled Winter through Windows, the volume portrays a version of Dovi that was never monetized by an algorithm and that his family didn’t have to go to court to obtain: a young man, yearning to see the sublime in mundane corners of life, for whom the world was “paradise, with us in it.”
