On 12 July 2018, the German Federal Supreme Court (Bundesgerichtshof – “BGH”) ruled that a Facebook user account passes to the user’s heirs (Case no. III ZR 183/17).

This is the first time the BGH has had the opportunity to deal with the provisions of the new EU General Data Protection Regulation 2016/679 (“GDPR”).

While the full judgment has not yet been published, the BGH’s press release of the same date gives some insight into the BGH’s considerations:

• The heirs of a Facebook user who is deceased (“User”) shall have the right to access the User’s Facebook account. This results from the general inheritance law provisions of the German Civil Code (Bürgerliches Gesetzbuch – “BGB”), pursuant to which the User’s contract with Facebook is transferred by law to the User’s heirs, in particular the fundamental German civil law principle of ‘universal succession’ under Section 1922(1) BGB. In practice, this means that the situation is similar to the one regarding diaries or private letters, the rights to which pass to heirs under Section 1922(1) BGB.
• Facebook’s contractual obligations to maintain confidentiality are not in conflict with the heirs’ right to access: The BGH focusses on the relevant user account rather than on the relevant User. In the view of the BGH, other Facebook users who have corresponded with the User cannot reasonably expect that their communications will be sent to a specific individual, i.e. the User, only. Rather, they can only demand that Facebook makes their correspondence available solely to the relevant user account to which their communications were directed. Furthermore, other Facebook users cannot reasonably expect that their communications will not be made accessible to third parties.
• The BGH stresses that the statutory requirement to protect the secrecy of telecommunications, as set out in Section 88 of the German Telecommunications Act (Telekommunikationsgesetz – TKG), is not in conflict with the heirs’ right to demand access. The reason is that the User’s heirs do not qualify as third parties within the meaning of the secrecy of telecommunications.
• Finally, on the basis that the GDPR does not apply to deceased persons, the BGH clarifies that the GDPR does not prohibit the heirs’ right to access the User’s Facebook account. Furthermore, the BGH takes the view that the transfer of personal data concerning other Facebook users who have corresponded with the User can be legitimised by both Article 6(1)(b) GDPR (“necessary for the performance of a contract”) and Article 6(1)(f) GDPR (“legitimate interests”).