A recent Ontario Superior Court case gives some interesting guidance on regulatory jurisdiction over Internet activities. Civil jurisdiction is not completely resolved, but there are lots of cases, and criminal jurisdiction is also ‘known’ to some extent. What regulators can do or should do is often harder. I speculated a bit on that topic in a presentation on jurisdiction a few years ago: www.euclid.ca/jurisdiction2005.ppt (pages 15 – 20).

In Ontario College of Pharmacists v. 1724665 Ontario Inc., 2013 CanLII 13655 (ON SC), the court held that a call centre in Ontario that was acting for a company in Belize . . . [more]

The Law Commissions of Scotland, England and Wales have proposed a clarification of British law about unfair terms in consumer contracts, to ensure that that law applies to end-user licence agreements for software and online services (EULAs).

Canadian jurisdictions do not (so far as I know) have legislation with ‘unfair terms’ in the name, while the UK has implemented the EU Directive on Unfair Terms. (French courts held a decade ago that online contracts, notably the AOL (2004) and Tiscali (2005) subscriber agreements, were subject to the comparable French law – and invalidated a large proportion of the . . . [more]

The European Union is adopting regulations on alternative dispute resolution (ADR) and online dispute resolution (ODR), according to a press release and associated documents, including a draft ODR regulation. This is aimed at consumer e-commerce in particular.

I have not yet found in the documents answers to some questions that occur to me off the cuff. (The answers may be in there somewhere – feel free to provide via comments.)

• Who pays? It appears to be taxpayer-funded, rather than relying on user fees. There is mention of a cost of 4.6 million Euros (annually?).
• What law applies? This list

The Liquor Control Board of Ontario (LCBO) regulates the sale of alcohol products in Ontario. Fans of wine not available on the shelves of the LCBO’s outlets may form wine clubs that order particular wines through the LCBO. Until recently, the LCBO collected the names and addresses of all the members of the clubs placing these orders.

Acting on a complaint by a manager/member of such a club, the Information and Privacy Commissioner of Ontario recently ordered that the LCBO stop collecting this personal information. In response, the LCBO stopped filling orders from the wine clubs.

According to the CBC . . . [more]

The EU last week published a draft directive on network security that requires communications operators (including utilities, banks etc) to report threats or attacks on their operations to national security agencies. In the US, President Obama is about to issue an Executive Order on critical infrastructure security that will provide for notices of imminent threats to operators of such operations. (Drafts of the Order have been circulating for months.)

Any word on official Canadian attention to such matters?

Do you know of any legal barriers that would prevent especially state-based operators of information systems (whether ‘critical’ or not) from defending . . . [more]

A private correspondent has suggested to me that call centres that record incoming calls ‘for quality assurance purposes’ often store the recordings offshore, including in the US. The correspondent wondered if there was any concern that the information in the calls might therefore be subject to investigation or copying by US law enforcement under the PATRIOT Act.

Both the Canadian and the Ontario Privacy Commissioners have commented on allegations of special risk of having personal information in the US because of that statute. Neither have supported the concerns. A recent summary of the discussion is found in the Ontario IPC’s . . . [more]

Here’s a question raised on a US legal technology list that seems relevant to Canadian law too.

What’s the duty of care of mobile devices as pertains to patches/updates provided by the vendor and/or provider?

Example:

I bought an Android phone in June 2012, which received an over-the-air OS upgrade in late July to Android 4.0.4. This release was provided to me well after the version was released to the public. Also, since that time, 2 other versions of Android (4.1 and 4.2) have been made available. There are known security vulnerabilities in the 4.0.4 release.

Yet I’ve certainly not

A US appeals court has reversed an order banning a convicted sex offender from having a Facebook account. Would such an order be made and upheld in Canada? What limits might be possible, and how would they be enforced? For that matter, how could the order itself be enforced? It’s not hard to get a FB account in another name, though it may be contrary to the terms of service to do so.

Could a no-contact order be made for FB use, e.g. not to friend or comment on any FB page relating to or about a designated person?

Meanwhile, . . . [more]

The High Court of England and Wales (Technology and Construction Court) has held that an employer has no proprietary right in emails sent by the company’s CEO that would give the company the right to see the content of the emails. The case is Fairstar v Adkins [2012] EWHC 2952 (TCC). (For various reasons no claim arising from copyright or confidentiality could be made, and the employment contract did not deal with the question.)

The court reviews a great deal of English (and a bit of Canadian) law on the point. It also considers the practical implications of holding that . . . [more]

Back in August I posted a column on Slaw about a Quebec administrative tribunal decision that referred to Facebook and Wikipedia evidence.

The tribunal, the Commission sur les lésions professionnelles (CLP), has returned to the social media admissibility question Campeau et Services alimentaires Delta Dailyfood Canada inc., 2012 QCCLP 7666 (CanLII).

A worker was injured and had to take a lot of time off work. At one point her injuries caused her a case of depression that also kept her off work. To test whether this was serious, the employer created a fictitious account on Facebook, giving the alleged . . . [more]

Two privacy stories raise interesting issues.

1. Journalistic violation of privacy: PIPEDA s. 7(1)(c) gives an exemption from the rules about collection of personal information for journalistic purposes.

Section 32 of the Data Protection Act (UK), by contrast, provides a journalism exception only if, in addition,

(b) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and

(c) the data controller reasonably believes that, in all the circumstances, compliance with [the provision being violated] is incompatible with the

The official report of the October 2012 meeting of the Working Group on Electronic Commerce of UNCITRAL is now online as the first document at this site. (16 pages including formalities)

You will recall that the project is looking for international rules to govern the creation and use of electronic transferable records (ETR), that is, documents that entitle their holder to the delivery of goods or money. The meeting decided that there was enough interest in the topic among businesses and member states to pursue the topic further.

At the outset, the group determined that the elements of negotiability . . . [more]