Archive for the ‘terms of service’ Category

Avoiding Microsoft’s Inadvertent Website Disclosure Mistake – A Lesson for Company Websites

Saturday, February 5th, 2011

Warning: trim() expects parameter 1 to be string, array given in /home/ebusine4/public_html/libraries/joomla/html/parameter.php on line 83

Warning: Parameter 2 to plg_ijseo_redirect() expected to be a reference, value given in /home/ebusine4/public_html/libraries/joomla/event/dispatcher.php on line 136

Warning: Parameter 2 to plgContentEmailCloak() expected to be a reference, value given in /home/ebusine4/public_html/libraries/joomla/event/dispatcher.php on line 136

Warning: Parameter 2 to plgContentLoadModule() expected to be a reference, value given in /home/ebusine4/public_html/libraries/joomla/event/dispatcher.php on line 136

Warning: Parameter 2 to plgContentPagebreak() expected to be a reference, value given in /home/ebusine4/public_html/libraries/joomla/event/dispatcher.php on line 136

The Wall Street Journal reported this past week that Microsoft Corp.’s earnings release was inadvertently made available through the company’s website. The Journal reports that Microsoft’s second-quarter earnings release was available more than an hour before Microsoft’s expected release time.

This incident is not at all uncommon when it comes to business websites. This incident is also a good reminder for decision-makers and business owners to make sure what is being presented on the company website is appropriate  for your operations and complies with any applicable regulations. For example, as a publicly traded company, Microsoft’s “early” release of earnings caused it to consult Nasdaq officials and could bring into play obligations under the Securities and Exchange Commission regulations.

While not every company will have to worry about reporting to Nasdaq or Securities and Exchange Commission officials when it comes to website content, every company does have to worry about its online image, its own operations, and a patchwork of state and federal laws specific to Internet operations. In that regard it is important to establish procedures to prescreen all new web content and to periodically review existing content.

Website Audit Checklist

The following (in no particular order) is a good check list for both:

  • Content
    • Is it accurate and up to date?
    • Are any links broken or otherwise up to date?
    • Does it inadvertently disclose confidential, proprietary, or otherwise sensitive company or employee information?
  • Intellectual Property
    • Are appropriate copyright notices in place?
    • Is there website content that may Infringe upon others’ intellectual property?
    • Should you include a Digital Millennium Copyright Act Notice and designate an agent with the U.S. Copyright Office to receive notifications of claimed infringement?
  • Are website visitors required to agree to Terms of Use? If so have you taken the appropriate steps to protect your company with Terms of Use that will likely be enforced and that will favorably protect your company? Areas to consider include:
    • How are users asked to agree to the Terms of Use? Is agreement optional or mandatory. If mandatory, how do visitors consent to the Terms of Use?
    • When terms will be updated and how will such updates be communicated to visitors.
    • Do the Terms of Use cover:
      • Warranties and limitations of warranties;
      • Limitation of liability;
      • Choice of law;
      • Exclusive jurisdiction and venue (In other words, do the Terms of Use reduce the risks that the company will be sued in multiple jurisdictions?);
      • Alternative dispute resolution; and
      • Integration clause.

As a best practice, it is a good idea to at least require all visitors to your website to affirmatively represent their agreement with your Terms of Use before allowing significant activities to take place, such as making an online purchase, posting content, or joining a group. And if your site allows user to post content, there is a number of other conditions you will want to discuss with your attorney about putting in place, including incorporating a Digital Millennium Copyright Act Notice and designation with the U.S. Copyright Office.

In regard to privacy and data collection, the following areas should be considered:

  • If applicable, is your website security appropriate and up to date? This is especially important if your site allows for conducting online transactions.
  • Does the site collect visitor information? Is it personally identifiable information? If so, does the website have a posted Privacy Policy covering the following:
    • Are visitors advised of what information is collected and how user information will be treated?
    • Where is the privacy statement posted?
    • How user information is treated?
    • How user information is share?
    • How does the website address personal information of children under 13?
    • When terms are updated how are such updates communicated to visitors?

It is critical that your actual Privacy Policy accurately reflect your company’s actual practices in handing user information. Otherwise your company may violate various privacy laws and regulations, including Federal Trade Commission regulations, Gramm-Leach-Bliley, HIPAA, COPPA and other applicable state privacy laws.

Ideally, the preceding areas will be jointly addressed with your legal counsel and your IT/Webmaster.

Conclusion

The preceding points to consider should not be considered legal advice. But it is good business advice because conducting such an audit is an important component of an effective Internet risk management program that will – if done properly – contribute to your company’s overall bottom-line by reducing legal and business risks for your Internet operations.



Jurisdiction and Your Website – Limiting Where You Can be Sued

Wednesday, January 12th, 2011

Warning: trim() expects parameter 1 to be string, array given in /home/ebusine4/public_html/libraries/joomla/html/parameter.php on line 83

Warning: Parameter 2 to plg_ijseo_redirect() expected to be a reference, value given in /home/ebusine4/public_html/libraries/joomla/event/dispatcher.php on line 136

Warning: Parameter 2 to plgContentEmailCloak() expected to be a reference, value given in /home/ebusine4/public_html/libraries/joomla/event/dispatcher.php on line 136

Warning: Parameter 2 to plgContentLoadModule() expected to be a reference, value given in /home/ebusine4/public_html/libraries/joomla/event/dispatcher.php on line 136

Warning: Parameter 2 to plgContentPagebreak() expected to be a reference, value given in /home/ebusine4/public_html/libraries/joomla/event/dispatcher.php on line 136

A recent case out of the Seventh Circuit Court of Appeals provides an important example of why certain precautions and issues should be proactively addressed by companies conducting business over the Internet.

The case, Poulsen Roser A/S v. Jackson & Perkins Wholesale, Inc. (N.D. Ill. Nov. 15, 2010) involved trademark infringement claims under the Lanham Act arising out of the defendant’s website. The central issue before the court was whether merely having a website accessible within the forum state was enough for a court to properly exercise personal jurisdiction over a non-resident litigant.

For background purposes, jurisdiction refers to whether a court may properly exercise authority over a party involved in litigation. There are two types of jurisdiction: The first is general jurisdiction and common examples supporting general jurisdiction include forming your business under the laws of the forum state or having a physical presence such as an office or facility in the forum state. A finding of general jurisdiction enables a court to exercise jurisdiction over a party regardless of whether the claim at issue is related to its activities in the state or has an in-state effect.

In contrast, the second type of jurisdiction is referred to as limited or specific jurisdiction. This type of jurisdiction extends only to claims arising from a party’s activities that were either within the forum state or had an in-state effect. But personal jurisdiction cannot be exercised if it would violate a party’s constitutional right to due process. Generally (or at least under the law of the Sixth Circuit, which is where I routinely practice) courts focus on three requirements in deciding jurisdictional due process issues: First, the defendant must purposefully avail himself of the privilege of acting in the forum state or causing a consequence in the forum state. Second, the cause of action must arise from the defendant’s activities there. Third, the acts of the defendant or consequences caused by the defendant must have a substantial enough connection with the forum state to make the exercise of jurisdiction over the defendant reasonable.

Back to the issue of Internet jurisdiction and the Poulsen Roser case, the Court upheld the prior analysis regarding the corporate defendants’ Internet contacts. Those internet contacts were insufficient for establishing jurisdiction. In reaching this conclusion, the Court expressed concern about creating universal jurisdiction based upon merely having a website and cautioned:

We note the legitimate concern that “[p]remising personal jurisdiction on the maintenance of a website, without requiring some level of ‘interactivity’ between the defendant and consumers in the forum state, would create almost universal personal jurisdiction because of the virtually unlimited accessibility of websites across the country.” Jennings, 383 F.3d at 550. Courts should be careful in resolving questions about personal jurisdiction involving on-line contacts to ensure that a defendant is not haled into court simply because the defendant owns or operates a website that is accessible in the forum state, even if that site is “interactive.”

Poulsen Roser, quoting Illinois v. Hemi Group LLC, ___ F.3d ___, 2010 U.S. App. LEXIS 19126, 2010 WL 3547647, at *4 (7th Cir. 2010). In upholding the dismissal on jurisdictional grounds, the Court rejected what is commonly referred to as the Zippo sliding scale for determining Internet-based jurisdiction. Under the Zippo test (so named because it arose out of Zippo Mfg. Co. v. Zippo Dot Com, Inc., 952 F. Supp. 1119, 1124 (W.D. Pa. 1997)), whether a business’ website subjects the business to personal jurisdiction in a given forum depends on a “sliding scale” of the website’s level of interactivity: a website that is “passive” (i.e., merely offers information to the user) would not support jurisdiction while a website that is “interactive” (i.e., allows the user to exchange information with the host computer) would support jurisdiction.

In reaching its decision, however, the Court critically noted that the plaintiff only presented evidence that “merely establishes that some of the Corporate Defendants advertise their products on the Internet and have the ability to sell products in Illinois through dealers …There is no indication, however, of whether or how a customer can order products to be shipped to Illinois via the Internet.” This language suggest that had there been a showing – no matter how slight – of an actual sale or other interaction accomplished through the defendant’s website by an Illinois resident that jurisdiction would be proper.

The Take Away:

Essentially what the Poulsen Court said is that courts should be careful in resolving questions about personal jurisdiction involving Internet contacts to ensure that a party is not brought into court simply because that party owns or operates a website that is accessible in the forum state regardless of whether the site is “interactive.” But the Court’s reasoning seems to suggest that only slight interaction may be required in order to properly exercise jurisdiction over a defendant’s whose only contact with the forum state is through a website. For companies, especially smaller companies and entrepreneurs conducting business through a website, it is important to carefully evaluate your website presence and whether it poses an unreasonable risk of establishing a basis for jurisdiction and thereby force your company to litigate in some distant, inconvenient jurisdiction. Assuming it does, the next step is to limit this potential result by specifying where jurisdiction for any claims or disputes may be brought. Choosing the jurisdiction in advance is commonly accomplished through a carefully drafted terms of use for your website.