Colo. Rev. Stat. § 15-1-1507
C.R.S. § 15-1-1507
OFFICIAL COMMENT
The Electronic Communications Privacy Act (ECPA) distinguishes between the permissible disclosure of the "content" of an electronic communication, covered in 18 U.S.C. Section 2702(b), and of "a record or other information pertaining to a" subscriber or customer, covered in 18 U.S.C. Section 2702(c); see Matthew J. Tokson, The Content/Envelope Distinction in Internet Law, 50 Wm. & Mary L. Rev. 2105 (2009). Section 1507 concerns disclosure of content; Section 1508 covers disclosure of non-content and other digital assets of the user.
Content-based material can, in turn, be divided into two types of communications: those received by the user and those sent. Federal law, 18 U.S.C. Section 2702(b) permits a custodian to divulge the contents of a communication "(1) to an addressee or intended recipient of such communication or an agent of such addressee or intended recipient" or "(3) with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service."
Consequently, when the user is the "addressee or intended recipient," material can be disclosed either to that individual or to an agent for that person, 18 U.S.C. Section 2702(b)(1), and it can also be disclosed to third parties with the "lawful consent" of the addressee or intended recipient. 18 U.S.C. Section 2702(b)(3). Material for which the user is the "originator" (or the "subscriber" to a remote computing service) can be disclosed to third parties only with the user's "lawful consent." 18 U.S.C. Section 2702(b)(3). (Note that, when the user is the addressee or intended recipient, material can be disclosed under either (b)(1) or (b)(3), but that when the user is the originator, lawful consent is required under (b)(3).) See the Comments concerning the definition of "content" after Section 1502. By contrast to content-based material, non-content material can be disclosed either with the lawful consent of the user or to any person (other than a governmental entity) even without lawful consent. This information includes material about any communication sent, such as the addressee, sender, date/time, and other subscriber data, which this act defines as the "catalogue of electronic communications." (Further discussion of this issue and examples are set out in the Comments to Section 1515, infra.)
Therefore, Section 1507 gives the personal representative access to digital assets if the user consented to disclosure or if a court orders disclosure. To obtain access, the personal representative must provide the documentation specified by Section 1507. First, the personal representative must give the custodian a written request for disclosure, a copy of the death certificate, a document establishing the authority of the personal representative, and, in the absence of an online tool, a record evidencing the user's consent to disclosure. When requesting disclosure, the fiduciary must write or email the custodian. The form of the request is limited, and does not, for example, include video, Tweet, instant message or other forms of communication.
Second, if the custodian requests, then the personal representative can be required to establish that the requested information is necessary for estate administration and the account is attributable to the decedent. Different custodians may have different procedures. Thus a custodian may request that the personal representative obtain a court order, and such an order must include findings that: 1) the user had a specific account with the custodian, 2) that disclosure of the content of electronic communications of the user would not violate the SCA or other law, 3) unless the user provided direction using an online tool, that the user consented to disclosure of the content of electronic communications, or 4) that disclosure of the content of electronic communications of a user is reasonably necessary for administration of the estate.