E-commerce and the Law

Chris Wood April 10 2000

E-commerce and the Law

Chris Wood April 10 2000

E-commerce and the Law


Chris Wood

The modern CEO’s worst nightmare lives alone in a small apartment in a low-rise complex on a tidy street in Victoria. He is courteous, offering a visitor the best chair in the house—the office-style one with the cracked seat in front of the computer—perching himself on the only other support the place provides, a stool. He folds pale hands together in his lap and addresses every question with the same measured intensity. “I oppose filtering software,” says 23-year-old Matthew Skala, “on philosophical grounds.” But that’s not why he chose to demonstrate his program-hacking skills on Cyber Patrol, a popular software “filter” that allows parents to keep children off objectionable Web sites.

That was for reasons that sound more like bravado. Other filters had already been decoded, Skala says, “and Cyber Patrol was more technically sophisticated than most, so it was an especially attractive target.”

Picking up where a like-minded young Swede named Eddy Jansson had left off, Skala, a graduate student in computer science at the University of Victoria, spent six weeks “reverse engineering” the complex software. Finally, on March 11, he unveiled his success on the Internet. He and Jansson posted a program that showed the list ofWeb sites Cyber Patrol is meant to block, as well as the registered adult user’s secret password. To any adolescent eager to circumvent parental limits, “cphack”—as Skala and Jansson called their creation—provided a master key to a global porn shop on the family computer. To executives of Massachusetts-based Microsystems Software Inc., which makes Cyber Patrol, and giant toymaker Mauel Inc., its corporate parent, it was more like a bad dream: some cyber-sman kid with a modem was threatening to min an entire business line.

Before it was over, Mattel’s effon to contain the damage set off legal battles in three countries, saw Skala and Janssoris program replicated on dozens of “mirror” sites around the world, and contributed a new phrase to the evolving lexicon of cyberspace: the “spam subpoena.” It also underscored just a few of the unsettling new le-

is expected to reach $4 trillion, and governments are only beginning to wrestle with how to keep those revenues within the crosshairs of the tax man.

Canadians face the most immediate impact from the sweeping new personal information act, known to many lobbyists as the privacy law. “It is a big piece of legislation,” says Patricia Wilson, a partner in the Ottawa law office of Osler Eioskin & Harcourt LLP. “Aside from gun control, it’s probably the biggest piece of regulation that this government has enacted.” The new statute will bring Canadian rules on what business may do with customers’ or employees’ personal

Where do you sue a Web site? How do you protect privacy? Is an online contract valid? Governments grapple with the Net.

gal issues facing companies and consumers doing business on the Net. “The law always trails society,” notes Skalas Victoria lawyer, Ed Letain. Confronted with the frenetic pace at which business is moving into uncharted territory online, legislators, regulators and the courts are straining to bring the law up to Internet speed. Legislation due to be passed this week in Ottawa, and a bill on Saskatchewan’s order paper, represent significant milestones in taming the wild e-frontier. But the new federal Personal Information Protection and Electronic Documents Act, despite its generally low-key passage through Parliament as Bill C-6, may yet face the same kind of uproar that has greeted legal initiatives on cyberspace in other countries. When it comes into effect, likely in January, the measure will be the most forceful federal intrusion into provincial jurisdiction in decades. Even so, it fails to squarely address the biggest legal headache for e-commerce: the question of where “here” is in a virtual marketplace. The HE toughest nut may be taxes: by 2003, worldwide e-commerce

information into line with standards required by the European Union, which are far more restrictive than those in the United States. The act also provides a legal basis for treating digital documents and so-called electronic signatures as equivalent to their paper-andink counterparts—an important safeguard for online contracts.

Adopting principles developed by the Canadian Standards Association, the act will require tens of thousands of Canadian companies and most non-profit organizations to have a formal policy for handling personal information, and to name someone who can be held accountable for it. In a measure that takes direct aim at Web sites that collect and sell data about visitors, the new legislation will require businesses both onand off-line to disclose what they collect—and for what purpose. In most cases (there are exceptions for purposes like law enforcement), consumers must also get a choice not to give up personal information, without losing access to a company’s goods or services. Consumers will be able to report alleged violators to the privacy commissioner, and companies that fail to co-operate with an investigation face fines of up to $ 100,000.

It is a very tricky issue to get right. Privacy and e-commerce advocates alike oppose a bill introduced by Britain’s Labour government, designed, like C-6, to get in step with European e-commerce standards. Critics say it could force British Internet providers to turn information about a client’s Web-surfing habits over to police without a search warrant and that it threatens company directors with jail if they cannot produce the software “key” to encrypted data. In the United States, political analysts have called privacy the growth issue of the new decade. “It’s no longer Big Brother we have to worry about, it’s Big Browser,” New York state Attorney General Eliot Spitzer told the inaugural meeting of a Congressional Privacy Caucus last month. In Canada, privacy groups applaud Ottawa’s initiative to shield Canadians from the kind of micro-profiling that some U.S.-based Internet companies have attempted. “This is a very good privacy code,” says Darrell Evans, executive director of the B.C. Freedom of Information and Privacy Association, “that should protect Canadians from the worst abuses.”

‘It’s no longer Big Brother we worry about—it’s Big Browser’

But its protections may yet come under fire. Buried deep in the Liberal bill is a highly unusual constitutional time bomb. Traditionally, Ottawa sets the rules for federally regulated businesses such as transportation and communications, and for commerce transacted across provincial borders. All other business has been left to the provinces to regulate. But in a precedent-setting move, the new legislation gives the provinces three years to enact laws mirroring the federal requirements. If they don’t, Ottawa will apply its rules to all business within a province. (There is an exception for Quebec, which already has a privacy code that qualifies.) “They kind of threw down the gauntlet to the provinces,” observes Wilson. “It’s a new way of setting national standards.”

So far, no province has come forward with a matching bill. At the moment, several are working on measures similar to a more narrowly focused bill making its way through the Saskatchewan legislature. Based on a model law developed by the United Nations, the Electronic Information and Documents Act “will provide some certainty to the world of ecommerce,” says Saskatchewan’s justice minister, Chris Axworthy. The act, he adds, will ensure that in transactions under the province’s jurisdiction, “anything done electronically will be treated the same way as things done on paper.” Privacy, however, is not covered.

In fact, many of the thorniest legal issues facing online business remain unresolved. Most involve disputes over whose rules apply in the borderless realm of cyberspace. In Mattel’s case, the company filed one suit against Skala in British Columbia and began another against Jansson in Sweden, as well as suing both men in Massachusetts. Earlier this year, Toronto-based iCraveTV bowed to a U.S. court ruling that its Internet re-broadcast of off-air television signals infringed American law—even though iCraveTV insisted its service targeted only Canadian viewers and was legal in Canada.

for links on this story

In another widely cited case, BrainTech, Inc., a B.C. company, sued a man from the same province who slagged its stock in an online chat room. But it chose to do so in Texas, arguing it had a small office there and that the critical comments were accessible there on the Internet. A Texas judge agreed, and awarded BrainTech more than $600,000 in damages. But when the company tried to collect in British Columbia, the provinces appeals court struck down the Texas judgment. The Supreme Court of Canada later upheld the B.C. ruling.

Commerce and politics can collide as well. A score of organizations—ranging from Internet providers to free-speech advocates—sued Virginia Gov. James Gilmore III last October, after he signed a law extending to the Internet a state ban on the display of anything that might be deemed “harmful

to juveniles.” The suit says the law improperly asserts state jurisdiction over the entire Internet.

Legal experts say many cross-border conflicts can be resolved under existing principles. Can you or your government sue a Web site in your areas courts when it is based somewhere else? A key test is whether the site allows you to interact with it—entering personal preferences, buying goods or services—rather than serving as a passive source of information. A mega-site like Yahoo! allows people to interact, and is potentially liable in jurisdictions around the world. As new legislation takes hold in Britain, the United States and elsewhere, Canadian companies are increasingly finding their Internet operations under scrutiny by foreign regulators, as well as those at home. “These businesses are out of the chute and across the world almost immediately,” says e-commerce lawyer Jim Mutter, an adjunct professor at the University of British Columbia. “They may not be aware of the breadth of requirements that will be applied.”

Those may soon include tax liabilities. While Canadas government has been silent on Internet taxes, the 29-nation Organization for Economic Co-operation and Development and an advisory committee to the U.S. Congress have tackled the issue. Both ran up against the same problem. “Who is going to tax the transaction?” asks Mutter. “Is it the state where the buyer is located? Or is it the state where the vendor is? It’s not at all clear.”

Canadas leading authority on Internet law, University of Ottawa professor Michael Geist, has one novel idea to help end the confusion. In a research paper he completed in January for the Ontario government, Geist suggests the province could issue a “seal of approval” to appear on participating Web sites, attesting that the company accepts Ontario law. He thinks this might attract rootless e-businesses from elsewhere to “locate” in Ontario.

Similarly innovative tactics are emerging almost daily, as businesses and their legal advisers wrestle with the new realities of the virtual marketplace. In the case of Mattel vs. Skala, one such development created cyber-speaks latest phrase. After Skala and Jansson agreed out of court on March 24 to sell their “cphack” program to Mattel for a dollar (and a promise not to distribute any more copies), the company sent dozens of e-mails to Web sites that had posted the program, ordering them to remove it. Critics accused Mattel of resorting to “subpoena by spam” (Web talk for widely disseminated junk email). Mattel’s spokesmen retort that the e-mails were temporary restraining orders, not subpoenas, and sanctioned by the Massachusetts court.

In any case, the makers of Cyber Patrol had one advantage most companies don’t. Their filtering software is programmed to update its list of blocked Web sites once a day, when the user logs on to the Internet. Since “cphack” first began showing up on mirror sites, Cyber Patrol has been adding their addresses to the banned list as fast as they can be identified. As for Skala, he’s gone back to completing his master’s degree—while turning down a sudden raft of programming job offers.