E-Commerce

1. E-Commerce Distance contracts, Spam Legal and Technical Aspects of E-Commerce, Budapest, 7.-11.10.2002

2. ? ? Questions? ? ? Please ask them immediately! ? ?

3. Content • Why the need? • Distance contracts • Information requirements, right of withdrawal • Performance, inertia selling, waiving these rights • Spam • E-Mail ads • Legal aspects of Spam • Liability of providers • Mere conduit, caching, hosting • (No) Obligation to monitor

4. Why the need? • Distance selling has been around VERY long • E. g. mail order companies • Dubious Internet-shops and fears of customers • Spam is a problem only since (mostly) free sending • Paper: Cost is on sender (postage) • E-Mail: Cost is on receiver (downloading) • Liability of providers • Hotly disputed • Few actual cases, but huge potential/danger

5. What is a “distance contract”? • Contract for goods or services • With certain exemptions; see later • Between supplier and consumer • Not 2 consumers or 2 suppliers! • Organized distance sales/service provision scheme • Not for ad-hoc distance sales / exceptions • Exclusive use of distance communication • = Without simultaneous physical presence of supplier and consumer! • One personal meeting  not applicable! • Up to and including conclusion of the contract

6. Exclusions • Financial services: Investment, banking, insurance, ... • Separate directive • Automatic vending machines • Legally similar, but product directly visible • Using public payphones • Paying for the call (similar to autom. vending machines) • Construction/Sale of immovable property • Except rental (=included in distance selling directive) • Concluded at an auction • “Ordinary” auctions by telephone; but also in Internet

7. Areas not affected • The conclusion of the contract itself • When/how a contract is concluded: national law • Which law governs the contract • International private law; but minimum standards • Language of the contract • Liability for goods/services • Remedies for breaches of contract • Taxes, duties, shipping costs, VAT, ...

8. Prior information (1) • Prior to conclusion of a contract, consumers must be informed: • Identity of supplier (including geographical address) • E-Mail address • Must allow rapid, direct and effective contact • Main characteristics of goods/services • Price including all taxes and delivery costs • This is VERY difficult in international sales • Usually ignored with respect to duties and foreign taxes! • E-Commerce dir.: Clear and whether includes taxes/delivery • Arrangements for payment and delivery • Existence of right of withdrawal

9. Prior information(2) • Cost of means of distance communication • Telephone lines with additional costs • Period for which offer or price remains valid • Minimum duration of contract (permanent/recurrent) • Public/Trade register (incl. number) if applicable • Authorization body if applicable • Special rules for regulated professions • VAT identification number • Contract terms and general conditions must be provided in a way so the consumer can store and reproduce them

10. Prior information(3) • Information must be clear and comprehensible and in a way appropriate to method of dist.-comm. • Principles of good faith and protection of minors These only, if not exclusively done by E-Mail: • Different technical steps for concluding the contract • Whether or not the contract will be stored by the service provider and whether it will be accessible • Technical means for identifying and correcting input errors prior to placing the order • Languages offered for concluding the contract • Any relevant codes of conduct subscribed by the provider

11. Confirmation of information • On durable medium during performance of contract (latest: delivery), information above and the following must be given: • Geographical address of supplier for complaints • Conditions & procedures for exercising right of withdrawal • Information on after-sales services and guarantees • Only as far as such exist! • How to cancel the contract • If duration is unspecified or >1 year • Durable medium: E-Mail sufficient (printing possible) • Considerations: Written required!

12. Right of withdrawal:When? • At least 7 working days • No penalty • Exception: Cost of returning the goods • No reason required • Beginning of period: • Receipt of goods by customer • Conclusion of contract for services • Information omitted: • 3 month right of withdrawal! • Information given within 3 month  7 days start from then

13. Right of withdrawal:Exclusions • Provision of services if performance has already begun • If begin within the 7 days and with consent of consumer • Supply of goods/services with fluctuating market price • No withdrawal if price falls instead of rising! • Goods made to customer’s specifications • Goods unable to be returned by their nature • Or are liable to deterioration or rapid expiry, e. g. fruits • Audio/Video recordings if unsealed by customer • Supply of newspapers, periodicals, magazines • Only for the individual issues; for subscription itself possible! • Gaming and lottery services

14. Right of withdrawal:Consequences • Contract is destroyed • Customer must return goods • Supplier must reimburse sums paid by customer • Must be done free of charge (no handling fees, …)! • No charges because of withdrawal • E. g. devaluation can be allowed for • As soon as possible; always within 30 days • Austria: Reimbursement may be reduced: • for damage to goods • for reduced value because of usage

15. Right of withdrawal:Associated credit • If the price is fully or partly covered by credit • granted by the supplier, or • granted by a third party • On basis of an agreement between third party and supplier! • E. g. supplier organized credit for consumer • Not: Consumer gets credit from his/her (independent) bank • The credit is cancelled without any penalty • Detailed rules by member states Necessary, as otherwise consumers would have a credit they don’t need any more: Exercising the right of withdrawal would be (economically) next to impossible!

16. Performance • If not agreed upon otherwise, order (only if a contract!) must be executed within 30 days • If supplier cannot fulfill because of unavailability • Consumer must be informed • Refund of payments as soon as possible (max. 30 days) Attention! Sending the order is often NOT the conclusion of the contract! (Austria: Almost never)

17. Concluding contracts electronically • Contracts are concluded electronically exactly the same way as in the conventional way • Usually consensus is sufficient • Sometimes a real element is required • E. g. handing over the pawn (Austria) • Sometimes notaries/courts/... are required • Not available online, (but only) therefore not possible online • Sometimes a signature is required • See signature directive / presentation! Contracts must be (legally, not practically!) possible to be concluded electronically

18. Usual way of concluding a contract in distance selling 1) Supplier send catalog: Advertisement only 2) Consumer sends order: Request for a contract 2.5) Supplier send confirmation of order • Information only! • Optional; E-Commerce directive: Confirmation obligatory! 3a) Supplier send an acceptance: Contract concluded 3b) Supplier fulfills order: Contract concluded • Contract concluded at the time of sending the goods

19. Time of receipt of communication • Orders and acknowledgements of receipt are deemed to be received when the addressee is able to access it • If order is placed through electronic means • Time: When it arrives on his mail server • Even if the time is 23:55 it is immediately received on this day! • Other communication: Might be different! • E. g. when reading can be expected • E. g. at the next beginning of work-hours

20. Payment by card • A consumer can: • can request cancellation of a payment when fraudulent use has been made of his payment card in a distance contract • must be re-credited with the sums paid or have them returned • Special provisions for creditcards, which are an important means of payment in Internet-Shopping • But: Payment card is more than just creditcards

21. Inertia selling = Supplying goods/services to consumers without any order beforehand • This is explicitly prohibited • Exceptions: • No demand for payment (free gifts) • Sent to businesses (prohibited only for consumers!) • No consideration must be paid for them • Absence of a response does not constitute consent • Nothing said on safekeeping and damages

22. Automated communication • Previous consent of the consumer is required for communication with him in case of: • automated calling system without human intervention • Fax • Other means of individual distance communication • Opting-out is always possible • But see also Spam later! • E. g. bulk mail is not included, as it is no individual communication!

23. Waiving these rights • These rights (especially information and the right of withdrawal) can not be waived by the consumer • This is, as usual, not applicable to waiving after the fact • Choosing the law of a non-member country for the contract • if the contract has a close connection with any one or more member states • does not affect these rights • Regular provision in consumer protection laws

24. Spam:What is it? • General term for undesired advertisements: • By E-Mail or in newsgroups • Unsolicited • Not requested and no consent given for sending • Usually sent to an enormous number of people • Costs are on the carriers and recipients • Almost always for illegal / dubious schemes • Often possess forged headers, return address, ...

25. Identifying Spam(1) • This is very hard, no foolproof solution exists! • Workable approaches are: • Not accepting mail from “dangerous” domains • But blocks ALL mail from there, including legitimate! • Filtering for keywords • Only works for special and rare words (e. g. sexually related) • Does not work for “commercial” scam • Looking for forged/missing/added headers • DNS name does not match IP address • Looking for removal instructions / claims to comply with Spam legislation

26. Identifying Spam(2) • Looking for extensive/strange HTML use • Also all caps, lots of exclamation marks or other formatting • Filtering regular expressions • Checking for combinations of keywords or parts thereof • Complicated to set up; use existing lists • Using black-/whitelists • Known spammers change their E-Mail VERY often • Checking for suspicious/malformed sender addresses • E. g. containing many numbers, large number of addressees • Check list of known Spam messages • If detected, mail is sent to central repository • Checking each message takes long time

27. Legal regulations for Spam(1) • Privacy: E-Mail addresses are personal data • Gathering must be done legally (usually with consent) • Putting an address on a webpage will usually not be consent! • Telecommunication laws: Sending bulk messages often restricted to protect availability • E-Commerce directive: • Must be clearly identifiable + additional information • Opting-out must be possible

28. Legal regulations for Spam(2) • Privacy in electronic communication directive: • When address obtained by sale of product or service, it may be used for marketing of own or similar products • Free of charge and easy objection must be possible (=Opt-out) • Notificatio of this upon collection of data and on each contact • Disguising/concealing identity of sender or without valid address for unsubscribing is always prohibited • Member states can decide whether opt-in or opt-out • Austria: Opt-in • The last (opt-in/out) applies only to natural persons! • Legal persons must be “sufficiently protected” by national law

29. Opt-in vs. Opt-out • Opt-in: • Valuable and known-to-work-and-be-read addresses • Almost all consumers promote this scheme • Recipient must previously agree to receive mail • Without consent, nothing may be sent to them • Opt-out: • Messages can be sent to almost everyone • Some businesses and most advertising agencies promote this • Spam may be sent to everyone, except those • who registered to not receive it (Robinson-lists), or • unsubscribe after receiving the first message

30. Legal state of Spam in America • Currently no law regulating spam • Senate bill 1618: Did not became law • Currently in legislation: • Different approaches, but most are opt-out • All require truthful headers • Usually the FTC (Federal Trade Commission) responsible for taking action • Low fines (e. g. $10/illegal spam if enforced by ISP) • Sometimes incl. obligatory identification of UCE-nature • Sometimes ISP can declare themselves “UCE-free zone”

31. When sending E-Mail advertisements is (usually) legal • If the addressee explicitly requested it • In the course of / after a commercial transaction • Concerning related goods or services • To mailinglists once in response to questions for it • E. g. users seeking certain software  short ad-message • After obtaining consent from the addressee, e. g. during registration on a website Always: Allow unregistering/opting-out and honor this request

32. Liability of providers:Mere conduit • Providing access to a communication network or being an intermediary station within the network, there is no liability for the content, if you… • do not initiate the transmission • End-users are not privileged • do not select the receiver of the transmission • Effectively “distributing” the data • do not select or modify the information • Personalization providers or malicious users are not included • Includes automatic, intermediate and transient storage for sole purpose of transmission

33. Liability of providers:Caching • Providing automatic, intermediate and temporary stor-age for sole purpose of making transmissions more efficient, there is no liability for the content, if you… • do not modify the information • comply with conditions on access to the information • comply with rules regarding updates (e. g. Meta-Tags) • do not interfere with lawful techn. for obtaining usage data • act expeditiously to remove or disable access to information upon actual knowledge that the information • was removed at the source • access to it was disabled • court or administrative authority has ordered this

34. Liability of providers:Hosting • Providing storage for information from others, there is no liability for the content, if you… • do not have actual knowledge of illegal activity or information • are not aware of any facts or circumstances from which illegal activity or information is apparent • upon obtaining knowledge or awareness act expedi-tiously to remove or disable access to the information • This does not apply to persons acting under authority or control of the provider • E. g. employees

35. Liability of providers:Obligation to monitor • No general obligation to monitor allowed • information transmitted (conduit, caching) • information stored (hosting) • No general obligation to actively seek facts or circumstances indicating illegal activity allowed • There may be obligations to inform authorities of alleged illegal activities, and information to enable identifying the actual content provider • “Not known” and not “should have known”  no problems

36. Literature/Links: • Szecskay Law Firm: Hungarian E-Commerce Act:http://www.legal500.com/devs/hungary/et/huet_001.htm • SpamAssassin: http://spamassassin.org/ • Coalition Against Unsolicited Commercial Email:http://www.cauce.org/ • EU E-Commerce directive:2000/31/EC, L 178/1-16 17.7.2000 • EU electronic communications data protection directive:2002/58/EC, L 201/37-47 31.7.2002 • EU distance contract directive:1997/7/EC, L 144/19-27 4.6.1997