Asset managers

These days, most of us have a number of digital assets: email and social media accounts, or photographs stored in the cloud, for example. When we sign up to these accounts, we are agreeing to terms that most people fail to read and have no power to change. As a result, most of us have very little idea of what rights, if any, we have over our digital assets and what will happen to them if we lose the capacity to deal with them ourselves.

In the UK, there is no legislative definition of what constitutes a digital asset, which means the legal position can be unclear. However, it is usually taken to mean information or data stored electronically – for example, in the cloud or online. Digital assets can be divided into those that are rights and interests in digital property, and those that are, in effect, digital records.

Digital property rights are intellectual property rights such as copyright, domain names, online bank accounts, cryptocurrency and gaming tokens. These have a monetary value and can be left in a will.

Digital records, on the other hand, take the form of email accounts; e-books; and photographs and videos on social media platforms such as Facebook or Instagram. Some of these may also have property rights (for example, valuable photographs or an email containing the manuscript of a novel).

This distinction is important, as it dictates how the assets can be managed when the owner loses capacity.

Taking action before losing capacity

If a client is concerned about losing capacity, the first step is usually to make lasting powers of attorney (LPAs), appointing one or more attorneys to deal with their affairs when they are no longer able to do so themselves.

In respect of digital property rights and interests, the relevant LPA is the one that relates to financial decisions. The wording on the signature page of the LPA form is as follows: “I appoint and give my attorneys authority to make decisions about my property and financial affairs, including when I cannot act for myself because I lack mental capacity, subject to the terms of this LPA and to the provisions of the Mental Capacity Act 2005.”

What this means is that, as long as the property and financial affairs LPA has not been restricted in any way, the attorney will have authority to make decisions relating to the donor’s digital property rights, as long as there is nothing in this that is prohibited under the Mental Capacity Act 2005 (MCA 2005).

The sheer volume of digital assets means it is vital that you encourage your clients to think about what will happen to their assets

This means that, in theory, there is no need to add any additional text in the preferences or instructions sections about this. Digital service providers should accept instructions from attorneys in exactly the same way that a bricks-and-mortar bank or mortgage lender would. Just as an attorney will need to show an original or certified copy of an LPA to a bank or building society in order to be able to act on the donor’s behalf, so the attorney will need to do this when managing the donor’s digital assets (the donor being the person who lacks capacity).

However, some donors may like the option of adding in a clause to give express authority to the attorney as, in practice, terms of the service agreements may not allow attorneys access to a digital asset without express authority. This could also be dealt with in a letter of wishes to be stored with the LPA.

If an attorney has access to log-in details, such as usernames and passwords, they should not use these without obtaining authority from the service provider, unless it is stated that they may do so in the user agreement. Doing so without authority may be a criminal offence under the Computer Misuse Act 1990.

In order to access digital records, it is the LPA for health and welfare that is relevant, as it gives an unrestricted attorney power (subject to the provisions of the MCA 2005) to make decisions about whether the donor should take part in social activities (including using social networks) and personal correspondence, which will include sending emails.

As with the LPA for property and financial affairs, the donor can complete section 7 to outline their preferences and instructions in how they want the attorneys to act. While this is one option, it is important to exercise caution. The Office of the Public Guardian (OPG) rejects many LPAs at the registration stage due to stated instructions that lack clarity or are not straightforward.

For this reason, it is often preferable to leave section 7 blank, and instead include a letter of wishes addressed to the attorneys, which can be stored with the LPAs. The letter can, of course, cover all health and care needs, but also social media accounts and personal correspondence.

Making an inventory

Where a donor is including instructions to their attorney regarding their digital assets, either in the body of the LPA or through a letter of wishes, it’s a good idea to encourage your client to create a memorandum or inventory of digital assets.

This inventory should include a list of all the online accounts that the donor has, for example:

• mobile phones
• bank accounts
• supermarket reward cards
• social media accounts
• intellectual property (such as a manuscript for a novel).

The donor should also include access information. The challenge is to do this legally and securely. Providing a list of passwords is problematic: first, because sharing passwords may breach user agreements; and second, because passwords are often updated and so may be out of date by the time the LPA is needed.

One option may be to provide information about how to find the passwords, and to keep those separately, for example in a locked file, or on a password-protected computer file, and to provide the password in the inventory. Another option is to use a password manager. There are online services which manage and generate new passwords, such as Sticky Password, Dashlane and Keeper. These are growing in popularity and may be worth investigating. However, if such a service is used, it is vital that the master password can be accessed by the attorney, as otherwise it may be impossible to retrieve the password-protected information.

The donor should also include instructions in the inventory about how they would like the assets to be dealt with if they lose capacity. For example, an individual who has lost capacity may have no further use for their Kindle or Facebook account and may want these closed down, or they may want their bitcoin to be sold, in which case, the attorney must be able to access the private key.

Incapacity

When an individual loses capacity, their online accounts will continue, unless steps are taken to close them down. The attorney should consult the inventory of digital assets, if there is one, and decide which accounts should continue.

The lack of specific legislation surrounding digital assets in the UK means there is little clarity on what to do once a donor loses capacity. The MCA 2005 Code of Practice states that attorneys should check the terms of service of online service providers to see whether they have a mental incapacity policy: while many providers have specific information about what to do on someone’s death, few have information on what to do in the event of user incapacity. Those which do, such as Facebook, require that anyone who wishes to remove the account of someone who has lost capacity must submit a request. Facebook will then decide whether to agree to this. Google has an “inactive account manager” feature, but an individual should set this up before they lose capacity.

Depending on what action the attorney is taking in relation to the donor’s digital assets, it is possible that they may need to register as a “controller” under the Data Protection Act 2018 (DPA 2018). Section 6 of the DPA 2018 states that individuals holding personal data electronically or using a relevant filing system on behalf of another are considered to be data controllers. Attorneys who have access to the donor’s online bank account, for example, will just be accessing the information and not storing it (it will be the bank that is doing that). This will also be the case if an attorney is contacting the donor’s doctor by phone. However, if an attorney is storing records electronically, including on email, then they may be acting as a controller. The Information Commissioner’s Office has an online tool that attorneys can use to see whether they should register as a controller.

Fraud

Financial fraud has become more sophisticated in recent years, and those with diminished capacity are at increased risk.

While doorstep fraud is still very much an issue (see ‘Danger on the doorstep’ by Louise Baxter, PS August 2017), the online world is providing a fertile ground for scammers – phone calls asking you to disclose bank account information and PINs, for example, or emails supposedly from HM Revenue & Customs … the list goes on. Some of these scams are difficult to spot for people with diminished capacity.

If there are LPAs in place, then it should be possible to protect vulnerable individuals by ensuring that they do not have this information to hand out. If there is no LPA, and an individual has lost the capacity to deal with their own affairs, the logical step is to apply for a deputyship order.

Applying for a deputyship order

A deputyship order can be made to deal with either property and financial affairs, or personal welfare, although the latter is much less common. A property and financial affairs deputy will have the right to deal with digital assets in a similar way to attorneys under the property and financial affairs LPA.

Section 2 of the deputyship order sets out the specific powers and limitations of the deputy.

These powers can apply to any aspect of the individual’s property and financial affairs, including digital property rights and interests.

Where there are particular concerns about harm to the individual who lacks capacity, the deputy can make a further application to the Court of Protection (CoP). The CoP heard two cases in February 2019, Re A (Capacity: Social Media and Internet Use: Best Interests) [2019] EWCOP 2 and Re B (Capacity: Social Media: Care and Contact) [2019] EWCOP 3, which concerned two vulnerable adults who were being targeted online. The court considered whether they should have internet access and, specifically, whether they should use social media. The local authority was acting as deputy in both cases.

The court held that the two adults should have restricted access to the internet. They were provided with mobile phones, but only for the purposes of making calls. They were able to access the internet, but only when they had someone with them who could monitor their use. These cases have relevance for attorneys and deputies who are acting for individuals with impaired capacity.

Conclusion

None of us knows what is around the corner, and the sheer volume of digital assets that most of us now have means that it is vital that you encourage your clients to think about what will happen to their assets, not only on death, but on incapacity, and to plan accordingly.