drt 6455 eCommerce Law lesson 3 – eCommerce and Liability associate professor faculty of law university of montreal university of montreal chair in e-Security and e-Business law

2 Liability Current Liabilities Future Liabilities

3 Liability ISP (Internet Services Provider) Transmission services Retention services Archiving services Editor Certification Blogger ? Payment

4 Liability ISP (Internet Services Provider) (Hosting services) Definition. General exemption Regime

5 Liability ISP (Internet Services Provider) (Hosting services) 22 AELFITAELFIT –A service provider, acting as an intermediary, that provides document storage services on a communication network is not responsible for the activities engaged in by a service user with the use of documents stored by the service user or at the service user's request. –However, the service provider may incur responsibility, particularly if, upon becoming aware that the documents are being used for an illicit activity, or of circumstances that make such a use apparent, the service provider does not act promptly to block access to the documents or otherwise prevent the pursuit of the activity. Idem for Referral services (as Google) Idem in –Unites States –European Union

6 eBay Cases –April 2008 in France = Hermes v. eBay (see Manara Comment – french)April 2008 Manara Not an editor Not a ISP In the middle = reinforced ISP liability –2000 in USA = Hendrickson c. eBay Hendrickson c. eBay VERO (Verified Rights Owner) application No liability for ISP (under exception)

7 Tyffany c. eBayTyffany c. eBay, (2008) (US)

8 Liability Transmission services (art. 36) Definition General exemption Regime. Its action is limited to an purely technical function.

9 Liability Transmission services 36. A service provider, acting as an intermediary, that provides communication network services exclusively for the transmission of technology-based documents is not responsible for acts of service users performed with the use of the documents transmitted or stored during the normal course of the transmission for the time required for the efficiency of the transmission. However, the service provider may incur responsibility, particularly if the service provider otherwise participates in acts performed by service users 1) by being the sender of a document ; 2) by selecting or altering the information in a document ; 3) by determining who transmits, receives or has access to a document ; or 4) by storing a document longer than is necessary for its transmission. Idem as in others countries –European Union –USA

10 Liability Retention (art. 37) Illustrations: 2 mains situations: –« cache » function –Retention for controling access reasons (as for security reasons). General exemption Regime. (similar to the one applies to retention services providers) Possible liability if:

11 Liability Archiving (art. 26)

12 Liability Editor Old as tge press But similar to TV 1457 CCQ –Fault –Damage –Causal link Higher Liability

13 Liability Certification (47 and f.)

14 Liability And whats happen with blog? Qualification Who control? Vaillancourt v. Lagacé (2005)Vaillancourt v. Lagacé –Moderation -> editor –Non-moderation-> ISP Whats happen in others countries? –Similar in USA –Différent in France But there are some recommendations in the same direction. (Forum des droit sur Internet)

15 Liability Blog OK Corral à Saint-AdèleOK Corral à Saint-Adèle –Liability concerning the text itself - Balance between liberty of expression / libel Arguments for the blogger –Politican person –Verification process –Permit to the politician to send a response on his blog Arguments for the Mayor –1457 CCQ –Judicial trend in Quebec –Liability concerning the commentaries Moderation Non moderation

16 Payment Liability Card issuer merchant buyer (consumer) (card user)

17 Payement Liability Banque Laurentienne du Canada c. Abdul-WahabBanque Laurentienne du Canada c. Abdul-Wahab, 2001 IIJCan 151 (QC C.S.) [45] Ceci dit, lorsque le numéro de carte est communiqué par téléphone, Internet ou autrement, sans présentation formelle de la carte, il revient au commerçant dassumer le risque de la transaction, et non à linstitution financière avec laquelle il a signé une convention de services de paiement au point de vente. En effet, les différentes étapes prévues au manuel dexploitation visent à réduire au minimum les fraudes et sont sous le seul contrôle du commerçant : présentation de la carte, signature du relevé et vérification des signatures apparaissant au relevé et à lendos de la carte. Si ces trois étapes sont remplies et si un numéro dautorisation est obtenu, le commerçant a rempli sa part du contrat et si de bonne foi[2], a droit au paiement[3].[2][3] [46] En somme, quand le commerçant prend sur lui de modifier les méthodes dexploitation, même lorsquil est de bonne foi, il doit en assumer les conséquences, car lui seul est en mesure de faire les vérifications additionnelles que peut requérir une transaction à distance et prendre les dispositions appropriées avant de remettre les biens commandés.

18 Payement Liability Canada Inc. c. Banque Laurentienne du Canada Canada Inc. c. Banque Laurentienne du Canada, 2003 IIJCan (QC C.S.) [32] Les incidents et les manquements ont été suffisamment nombreux et importants pour justifier les craintes exprimées par les témoins entendus à l'initiative de Banque Laurentienne et l'intervention immédiate. [33] Il n'était pas nécessaire que Banque Laurentienne fasse la preuve de fraude ou de mauvaise foi de La Compagnie et de ses représentants pour justifier sa décision. Le non respect des conditions d'utilisation, même en toute bonne foi, était suffisant. [34] Le retrait du terminal constituait le seul remède dont Banque Laurentienne disposait pour se protéger et, selon la convention intervenue, elle pouvait agir comme elle l'a fait. Dans les circonstances spécifiques du présent dossier, son comportement ne constituait pas un comportement abusif.

19 Liability - Future Proactive attitude of Personal Information holder –Canadian Report (2005)Canadian Report Option I – Truncate (partially blank out) payment card numbers Option II – Verify the identity of persons and organizations accessing credit reports Option III – Do not disclose social insurance numbers (SINs) on credit reports or use them as a unique identifier for consumers Option IV – Allow consumers to place freezes on their credit reports Option V – Require organizations that store personal information to notify individuals and credit bureaus in cases of security breaches Option VI – Require credit bureaus to place fraud alerts on consumers credit reports incases of security breaches or upon the request of an identity theft victim Option VII – Require credit lenders to disclose details of fraudulent debts to victims Option VIII – Require credit bureaus to block information about fraudulent debts appearing on a consumers credit report Option IX - Make organizations liable for damages Option X – Inform victims of their rights –English Report fronm the House of Lords (2007)English Report

20 In the News … McAfee Virtual Criminality Report (December 09, 2008) –More risks –More fears –More laws –More education –More technology –More liability

21 example Non Legal solution –Difficulties for laws application –SquareTrade … –Rating system Efficient but … Some problems And eBay change the rules