By Alan Gahtan and J. Fraser Mann - August 25, 1997
Many organizations have set up or are in the process of setting up a presence on the Internet. This paper highlights some of the general legal issues that should be considered by an organization contemplating the development and operation of a Web site.
Each computer connected to the Internet is assigned a unique numeric address, called an Internet Protocol (IP) address. A numeric address is difficult to use, and a domain name, which is a mnemonic associated with a particular IP address, makes Internet resources much easier to access.
A domain name that consists of a business entity’s trade mark or trade name, or that is related to its mark or name, can make it easier for customers and other persons to locate that entity on the Internet. The use of such a related domain name can also be a means of enhancing the goodwill associated with a particular business entity or product.
Most organizations register a domain name prior to commencing the development of their Web site. Many prudent organizations have even registered a domain name notwithstanding that they are not planning to launch a Web site in the near future. This is done to protect the availability of the domain name and prevent a third party from registering the domain name for its own use or to sell to the organization at a future date.
Domain names are generally registered on a "first come, first served" basis. However, disputes may arise when the owner of a trade-mark is denied use of that mark as a domain name because another party has already obtained a domain name registration for the mark. The potential for conflict is exacerbated by the fact that trade-mark law allows the same mark to be used by sellers of different goods and services as long as there is no confusion in the marketplace regarding the origin of such goods and services. By contrast, Internet technology allows only one entity to utilize a particular domain name.
Canadian entities can select between registering a domain name under the ".ca" country-specific "top level domain" (TLD) or one of the generic TLDs such as ".com" (for commercial entities) or ".org" (for organizations). There are advantages and disadvantages to either choice which should be considered.
Work is also currently under way to expand the list of TLDs to include seven new generic international TLDs. Organizations, including those that have already registered a domain name, may wish to monitor such developments with a view to registering new or additional domain names (which can all be configured to point to the same Web site).
Web sites are sometimes developed internally within an organization. However, the more common practice is to engage the services of a third party Web developer. Larger scale projects can cost between $30,000 and a few hundred thousand dollars. A Web site development agreement can be a useful tool to help keep the project within budget and on track and to clarify ownership interests in the final product.
The development of a Web site should be in accordance with pre-defined specifications. Where these are not available at the commencement of a project, the development should be divided into phases whereby the development of the specifications is a deliverable to be produced under the first phase. New ideas are likely to emerge once the project gets underway. It is therefore important to incorporate a procedure for dealing with changes in the scope of the project or the specifications.
Any content to be placed on an organization’s Web site should be reviewed to ensure that appropriate rights have been acquired to permit such use. The organization should ensure that the content is actually owned by the organization or that the organization has sufficient rights to permit such use. In many cases, copyrighted material acquired from third parties may have been obtained for a limited purpose or for use only within Canada. Placing such material on a Web site with global access may result in infringement.
Copyright assignment and publicity releases may need to be acquired. For instance, if a Web site is to contain a picture, the operator should ensure that appropriate rights have been obtained under copyright and that any persons depicted in the photograph have consented to the use of their images or likeness.
In the case of any content provided by third parties, it is desirable to obtain appropriate warranties and indemnities.
An organization’s Web site should include a notices and disclaimer page which sets out applicable copyright and trade-mark notices, disclaimers and other terms regarding use. For instance, visitors should be advised that the information contained on the site should not be relied upon as legal, business or tax advice and that the operator is not providing any warranty regarding the reliability of the content. The copyright notice may need to be set out in a particular manner to ensure protection under international copyright conventions.
The link to the notices and disclaimers page should be sufficiently descriptive in order to provide visitors to the Web site with adequate notice of its presence. For instance, it is advisable to utilize a label such as "legal terms" or "legal notices".
Due to the nature of the Web, a visitor to a Web site may not necessarily go through the main or home page in order to access a page on a particular site. They may end up on a particular page on a site from a link to that page on a third party’s site or as a result of a search conducted using one of the popular search engines on the Internet. Any notice placed only on the home page of a Web site will not be seen by such visitors. It is therefore critical to place important notices, or links to such notices, on practically each page on the Web site in order to ensure that regardless of the path chosen, each visitor will be given notice of such material.
Certain types of content placed on a Web site should be accompanied by additional and more prominent notices or disclaimers. Examples include downloadable software programs, data that may be relied upon (for instance, stock market or interest rate information) or tools (for instance, financial calculators). The owner of a Web site containing such content may wish to set out the notices and disclaimers in an on-line contract, which is discussed further below.
Hosting of a Web site internally is most appropriate when an organization requires a full time connection to the Internet for other purposes, such as providing employee access to the Internet, when there is a requirement for a high level of security and where it is necessary to link the Web server to internal databases or systems in order to support real-time transactions.
External hosting, on the other hand, may be less expensive and some service providers can provide redundant links to reduce the impact of a failure or heavy traffic in one segment of the Internet. In the event that an organization’s Web site is or will be hosted with an Internet service provider, rather than on an internal Web server located at the organization’s premises, use should be made of a Web hosting agreement to document pricing, service level and other terms applicable to such services.
One of the issues to be addressed in such an agreement is whether the client’s Web site is to be hosted on a dedicated server or a shared Web server. In the latter case, service level guarantees would be desirable.
When selecting a service provider for Web hosting, one key issue is the bandwidth between the service provider as servicer and a primary Internet backbone. The service provider may need to go through one or more upstream service providers before connecting to a primary Internet backbone and this may affect overall performance.
There are a number of legitimate reasons why a company will wish to permit its employees to have access to the Internet, including its use for e-mail and transmission of files; use to obtain access to various information sources; use for advertising its products; and use for electronic commerce.
There are also a number of risks and potential abuses associated with such employee access. Even if an employee is not using e-mail or the Internet for illegal purposes, or for purposes that may result in liability of the employer, the improper use may result in the loss of valuable computer resources or employee time. For example, one survey conducted in the U.S. found that some employees were using the Internet to look for other jobs.
In most cases, employee e-mail or Usenet postings carry the employer’s name or trade-mark as part of the employee’s e-mail address. Defamatory, political or religious statements sent outside the organization by employees may therefore be attributed to the employer.
Defamatory or other harmful statements made within an organization can also result in liability or increased damages resulting from other actions. In a Nova Scotia case, an employer was found liable for aggravated damages of $40,000 after firing an employee and having its management send an e-mail within the company making negative comments concerning the employee.
Employers have an obligation to provide a work environment free of discrimination and harassment. Pornographic images downloaded by employees and displayed on their monitors can lead to a finding that the employer created a "hostile" work environment. They can also attract negative publicity. In December 1996, an employee working for the Department of National Defense was arrested and charged with possessing and distributing child pornography.
Because of these potential abuses, employers are intercepting communications, but this could be a problem because of legislation and common law principles that protect privacy of communications. The interception of private communications, whether electronic or otherwise may be prohibited. For instance, in Canada, the Criminal Code makes it an offence for any person to use a device to willfully intercept a private communication, or to disclose or to use any unauthorized interception, unless one of the parties to the communication provides implicit or explicit consent. Other sources of privacy rights may also be applicable.
The question of whether an employer’s monitoring activities constitute a violation of the criminal law or an employee’s privacy rights may depend on whether the users of the system had a reasonable expectation that their messages would not be intercepted by any person other than the intended recipient.
The use of passwords to gain access to an organization’s computer system and references to e-mail messages and mailboxes as being private are factors to be considered in determining the reasonable expectation of users. However, this expectation of privacy may be negated if users are advised as to the circumstances in which a message sent through the system may be subject to interception. Each party’s rights and expectations can be clarified through the use of a corporate policy governing use of the system and through the use of sign-on messages which are displayed whenever users log into the system.
Such a policy should establish clearly that the employer is the owner of the system and content distributed on the Web site. It should also set out what are permitted and prohibited communications. The scope of such a policy can also be broadened to also encompass use of the organization’s internal e-mail system and/or other computer facilities.
One of the effects of operating a Web site is that it may subject the owner to the laws of another jurisdiction. This may occur by way of a civil law suit, criminal prosecution or an action by regulators. For instance, the Attorney General of Minnesota has been especially aggressive in prosecuting entities whose Web sites are accessible to residents of the state for violations of Minnesota law, notwithstanding that such entities are not located in the state.
Any content placed on a Web site should be reviewed for compliance with the laws of any jurisdiction where an organization wishes to market, promote or sell its products or services. This item is especially relevant for entities operating in a regulated industry. For instance, the British Columbia Securities Commission has issued a notice that any person or entity providing investment advice to residents of British Columbia must comply with the British Columbia Securities Act even if they are not located in B.C.
In general, courts will assume jurisdiction over a party if that party has some connection with the jurisdiction. Such a connection may be established in a number of ways. The party may be located or domiciled in the court’s jurisdiction, the party may be carrying on business in the court’s jurisdiction, the party may have entered into a contract which was made in that jurisdiction or which included a provision that it would be governed by the laws of that jurisdiction or a party’s conduct may have resulted in damage in the court’s jurisdiction.
One of the concerns for an organization operating in Canada is that its operation of a Web site accessible to residents of U.S. jurisdictions may be sufficient to bring that organization within a U.S. state’s "Long Arm" statute. In order to comply with U.S. constitutional limitations, the assumption of jurisdiction by a U.S. court requires a defendant to have created or maintained certain minimum contacts with the jurisdiction.
Advertising on a Web site accessible to residents of a particular state has been found by some U.S. courts to be equivalent to a "continuous stream" of advertising being directed into the forum state. Many U.S. courts have assumed jurisdiction even without proof that the site was actually seen by a resident of the state.
As well, the fact that parties to a contract formed through the Internet may be located in different jurisdictions may have implications for the interpretation and enforcement of the contract. Selling of products to buyers located in another jurisdiction may subject the transaction to consumer protection legislation or other laws of the buyer’s jurisdiction. As an example, California’s Business and Professions Code applies to any transaction conducted using the Internet or other electronic means of communications and imposes certain obligations on on-line sellers to residents of California. These provisions require sellers to ship goods or provide service within thirty days of payment and also impose certain disclosure requirements.
Canadian entities operating or contemplating the operation of a Web site should consider inclusion of appropriate disclaimer clauses. They should consider the foreign jurisdiction in which they wish to do business, and then comply with the laws of that foreign jurisdiction, and they should restrict access to their Web site by persons located outside any such jurisdiction.
An organization operating a Web site that will engage in a sale of products or other forms of electronic commerce should consider its obligations to collect and remit taxes. In some cases, the product being sold consists of information and services that are delivered electronically via the Internet (e.g., an online newsletter or a downloadable software program). In other cases, the product is tangible personal property where the sales transaction occurs through the Internet but where the physical product is delivered to the purchaser through the mail or a courier service. In still other cases, the product that is being purchased through the Internet is in fact a service and not a good.
The analysis of potential tax liability may require consideration of multiple forms of taxes and the obligations that may be imposed by the jurisdiction where the Web site operator is located and the jurisdiction of the purchaser.
Operators of Web sites may need to review compliance with applicable privacy legislation or any voluntary privacy standards that may have been adopted by their organization. Organizations operating in certain industries may be subject to industry-specific statutory requirements with respect to the use that may be made of information provided to the organization. As an example, the Alberta Financial Consumers Act provides that personal financial information provided by a consumer for the purpose of obtaining advice about or investing in certain financial products may be used only for the purpose for which it was given, unless the consumer otherwise consents.
In addition, certain jurisdictions such as Quebec, have privacy legislation that regulates the collection and use of personal information. If any personal information is to be requested from residents of such a jurisdiction (for instance, for the purpose of submitting comments or a complaint), then the Web site operator may need to comply with the requirements of such legislation.
Any promotional material placed on a Web site should be reviewed with the Internet in mind. Materials placed on a Canadian Web site can be viewed by a global audience. Consequently, consideration should be given to the fact that certain advertising activity that is legal in Canada may be illegal in other countries.
Most jurisdictions do not specifically regulate advertising on the Internet but have adopted rules concerning the advertising of certain regulated products and services. Regulated products may include tobacco, drugs and alcohol. Other rules may govern the advertising of services, such as financial services or legal services or may be applicable to certain types of transactions. For instance, in a credit transaction, the lender may be required to provide the borrower with certain specific information concerning the cost of borrowing.
Contests and sweepstakes on the Internet may be subject to a wide variety of legislation in different jurisdictions. Many jurisdictions require extensive disclosure. In some jurisdictions, sweepstakes must be registered and a bond posted to cover the value of the prizes. In addition, the overall impression conveyed must not be misleading.
Different rules may apply to games of chance, such as lotteries or sweepstakes, as opposed to games of skill, such as contests. In some jurisdictions, it may be lawful to require an entrant to provide consideration as a condition of participating in a game of skill, but the imposition of the same requirement as a condition of entering a game of chance may result in the activity being characterized as an illegal lottery. It may therefore be important to provide an alternative method for a consumer to enter a sweepstake other than through the purchase of a product or service. Where both chance and skill are involved, courts may consider which element predominates. In some jurisdictions, additional restrictions may be applicable to certain types of promotions or industries.
General rules regarding the use of trade-marks should be adhered to. In addition, any reference to a trade-mark as being "registered" should be clarified to identify the applicable jurisdiction. For instance, a trade-mark that is registered in Canada may not be registered in the U.S. Visitors accessing the Web site from the U.S. should not be mislead into thinking that the trade-mark is also "registered" in the U.S. unless this is in fact the case.
Use of interactive or discussion facilities on a Web site may attract liability if users place defamatory or other inappropriate messages on it. If discussion facilities are to be used, it is recommended that users be asked to register themselves (and their identities verified by return e-mail) before they are given access. Alternatively, an organization operating such a facility may wish to review any message submitted by a user outside the organization before such message is made accessible for viewing by the general public.
Operators of a Web site should warn users regarding confidentiality issues. Unless protected using encryption, information transferred across the Internet can be intercepted. E-mail is generally not secure and should not be utilized to exchange confidential information.
If confidential information is to be collected using the Web site, a "secure form" should be used to collect such information. Such facilities utilize encryption to protect confidential information between a user’s Web browser program and the Web server.
If a secure form cannot be used, an alternative may be to include a prominent warning regarding confidentiality on any web form where confidential information is being sought or may be provided. For instance, the National Association of Securities Dealers allows for the submission of complaints against a brokerage firm or one of its brokers using a complaint form that can be filed on-line. NASD advises anyone wishing to submit a complaint through the Internet that "[e]lectronic transmissions on the Internet are not always secure" and that the person wishing to file a complaint "may wish to communicate only basic information to [NASD] using the Internet, and send any specific confidential or sensitive information by regular mail or [through] a telephone call [...]".
If software or other products of an electronic form are to be accessible from a Web site, the provision of such products (even if provided on a no-fee basis) should be in compliance with Canadian export controls. Certain types of items, which may include software containing cryptographic components or other types of restricted technology listed on Canada’s Export Control List require the obtaining of export permits. Export permits are also required for any export to a country listed on the Area Control List. Canadians are also prohibited from exporting to a country subject to embargo by the United Nations (i.e., Iraq).
There have been a number of recent lawsuits involving the use of links on Web sites to third party sites and the use of a feature available on Web browser programs known as "frames". This feature, provided in recent versions of Web browser programs, allows the screen to be split into multiple windows or frames. Individual frames can be instructed to load material from the same or a different Web site. Inappropriate use of frames technology may also depreciate the value of trade-marks or otherwise cause confusion.
If an organization wishes to utilize frames technology to enhance its Web site, no content relating to the organization should remain on a visitor’s screen once that visitor leaves the organization’s Web site.
Links to external Web sites should be checked often to ensure that the materials on such external sites do not raise any legal issues or otherwise reflect negatively on the reputation of the entity operating a particular Web site. Linking directly to sub-pages on a third party Web site will be of increasing concern to operators of Web sites that depend on revenues from commercial advertising. By-passing the process of navigating to a specific sub-page from such a site’s home page can result in a loss of numerous additional advertising opportunities.
A small minority of Web sites provide notice to visitors of their Web site when they are about to leave the Web site. While this is good practice, most Web sites do not go to such lengths. A more common approach is to provide a notice on any page that contains links to external sites that selecting any of the links contained on that page will transfer the visitor to a third party’s Web site and that the operator of the current Web site has no control and assumes no responsibility in respect of the content available at the third party sites.
References or links to third parties may imply an endorsement. Although some Web sites include links to third party developers or service providers, Web site operators should consider not including such links unless they bear on the purpose or content of the site.
Content placed on a Web site should be kept current. Virgin Atlantic Airlines, a U.S. carrier, was fined U.S. $15,000 by its regulator for advertising an expired fare on its Web site.
People generally understand that information in printed form may not have been updated since publication and therefore are more cautious in relying on such information. However, there is a stronger implication that material maintained in electronic form and made available using the Internet is up-to-date. Any content placed on a Web site that may be relied upon by others should be kept up-to-date. Each page should contain a notice that the contents may not be current and contain a date of last revision. It may also be prudent to insert a notice for certain types of content that the on-line version is for information purposes only and that the official version is located at the organization’s office or another designated location.
In the physical world, business cards and an office are two indicia of authority. In the on-line world, a listing in an electronic directory on an organization’s Web site may serve the same purpose. Consequently, any listings of employees or officers should be updated following any terminations or other departures.
Most users of the Internet utilize popular Web search engines to locate information on the Internet. These search engines will automatically index all pages contained on a Web site. A search on a particular key word or individual’s name using an Internet search engine can provide a link directly to a page on an organization’s Web site which contains information that may no longer be valid. For instance, if a professional organization or regulatory organization were to post notices of disciplinary actions undertaken against its members, references to suspensions or other disciplinary actions which are no longer valid may need to contain a note to that effect.
On-line contracts may be used to license certain types of content or to support on-line transactions. Although the issue of enforceability has not yet been addressed by a Canadian court, certain ways of structuring an on-line contract may enhance a finding of enforceability. For instance, it is important that the user be required to scroll through the actual terms before being presented with the acceptance option.
There should be an effort made to highlight any unusual or onerous provisions (e.g., provisions limiting or excluding liability for damages). If the supplier is doing business in Quebec, the Civil Code requires certain types of provisions to be brought specifically to the attention of the other contracting party.
The on-line contract should deal expressly with the time and place of acceptance. The general rule is that acceptance occurs when communication of acceptance is received by the offeror. The so-called "mailbox rule" provides that an acceptance occurs when the acceptance is posted. A recent case in Ontario found that acceptance of a contract by fax occurred when the fax was sent rather than upon receipt. To avoid application of this rule, a Web site operator should make it clear in any on-line offer placed on the Web site that the contract is made only when acceptance is received.
It is also important to state in the offer that the contract is made where the merchant is located. This, together with a governing law clause, should result in the contract being governed by the laws where the Web site operator is located.
Another issue that must be considered with on-line contracts is that there are still various legal requirements for certain types of contracts or consents to be "in writing" and in some instances to be "signed".
In Canada, the Uniform Law Conference of Canada established, in late 1996, an Electronic Commerce Project with the objective of removing legal obstacles to electronic commerce. The conference is considering various steps, such as implementing the UN Model Law on Electronic Commerce, and establishing rules for digital signatures.
Another initiative by the federal government is to establish a public key infrastructure for electronic filings to be made with the government. This infrastructure involves the use of public key/private key cryptography. Under such a scheme, a person has a public key which is shared with other parties and which can be used to decrypt or encrypt messages, and a private key which is not shared with others. Designated third parties would have the responsibility of providing certification as to ownership of the keys used for electronic communications.
Where services are to be offered through an organization’s Web site, modifications may be required to existing customer or member agreements in order to properly cover the provision of services through the new delivery channel. For instance, a financial institution desiring to provide Internet banking services would need to update its customer agreements to deal with the use of that alternative delivery channel.
Businesses operating in Quebec who maintain Web sites may need to ensure that the contents of their Web sites comply with Quebec’s language laws. Article 52 of the Charter of the French Language requires that catalogues, brochures, leaflets, commercial directories and all other publications of that nature be in the French language. A translation may be provided as long as French is given equal prominence. The Office de la langue francaise (OLF) has taken the position that this definition is broad enough to include content placed on Web sites, sent by fax or electronic mail.
Micro-Bytes, a computer retailer located in Pointe Claire (Quebec), received a warning letter from the OLF in late May, advising that the company’s Web site violated Quebec’s language law. In response, Micro-Bytes removed most of the content from its site until it was able to prepare French language translations.
According to a notice issued by the OLF on June 21, 1997, all companies which have a place of business or an address in Quebec are required to provide Quebec consumers with a French language version of any commercial publication. A company which does not have a base of operation in Quebec (i.e., no place of business nor an address in Quebec) will not be compelled under Quebec laws to use French on its Web site. Any entity with substantial links to Quebec should also consider whether they must comply.
Exemptions may apply to non-commercial messages such as those of a religious, political, ideological or humanitarian nature which may be published in a language other than French. Cultural or educational products may also be advertised exclusively in the language used in the product without a French version.
Various options for protecting any content placed on an organization’s Web site should be considered. These include copyright, licensing through a contract formed on-line, and technical mechanisms.
Copyright law provides a relatively inexpensive and easily enforced bundle of rights for protecting information on the Internet. Some of the rights granted to copyright holders which are useful for protecting works on the Internet include the exclusive right to reproduce the work, either in whole or in substantial part, and the right to communicate the work by telecommunication. Copyright can protect text information, graphics, icons, audio-visual clips, Java programs and other types of works commonly placed on Web sites.
Copyright protection is the subject of a number of international conventions with the result that a work that is copyrightable in Canada can, through such conventions, generally be protected in many other countries without the requirement for any special registrations in those countries.
The use of on-line agreements to grant only a limited license to use materials on a Web site, can supplement or enhance the protection afforded by copyright law. If properly structured, the use of a license agreement to be accepted by conduct could be analogous to use of a shrink wrap agreement.
The development and operation of a Web site can involve numerous legal issues. Borden & Elliot’s Computer and Technology and Law Group has provided advice and assistance in many of the areas mentioned to numerous clients.
Related Sources: Canadian Legal Resources | Cyberlaw Encyclopedia | Entrepreneur Resources | Canadian Technology | Precedents | Alan Gahtan
© 2005 Alan M. Gahtan. All Rights
Reserved | Use is subject to these Legal
Terms
Disclaimer: Not all materials may be applicable in your jurisdiction. Not intended to be a
substitute for professional advice. No implied endorsement of, or affiliation with, any
linked sites. Path to individual pages may change - please link to home page only.
Linking Info