Naked Law

Not a boring facebook story

You cannot say that working at Ivell Marketing & Logistics is boring, as one employee found out to her cost at the end of February. Ivell Marketing & Logistics is a firm with offices in Shanghai, Xiamen, Guangzhou, Kaohsiung and Clacton-on-sea. 

One employee, Kimberley Swann, 16, had been working in the Clacton office for three weeks when she was fired by the firm after sounding off on her Facebook page about her job being boring. The comments were brought to her employers' attention by the employee's Facebook friends who worked at the same firm. Her employer decided that the disrespect and dissatisfaction shown undermined the employer-employee relationship and made it untenable.

As Miss Swann had been employed for less than one year, she is unable to bring a claim for unfair dismissal. We will, therefore, never know whether an Employment Tribunal would have found the dismissal unfair. (Miss Swann's mother however is in no doubt that it was, pointing out that Kimberley "says Clacton is boring but we're not going to throw her out of the house for it.")

This case highlights that comments on social networking sites cannot be regarded as private. The BBC have published their report and interview with the employee in question on-line. 

One crumb of comfort for Miss Swann and other Facebook users is that Facebook has reverted to its original terms and conditions of use after a row erupted over changes proposed at the beginning of February which The Consumerist summarised as meaning that "anything you upload to Facebook can be used by Facebook in any way they deem fit, forever, no matter what you do later".

Mark Zuckerberg, the founder of Facebook, commented on 17 February "Over the past few days, we received a lot of questions and comments about the changes and what they mean for people and their information. Based on this feedback, we have decided to return to our previous terms of use while we resolve the issues that people have raised."  Which news is certainly welcomed by several members of the Naked Law team, amongst others.

Incidentally, for those that are interested, the actual comment made by Kimberley Swann was: "ma job it pointLESS". However, Ivell Marketing did not cite Miss Swann's blatant disregard for the English language as a reason for her dismissal.

M & S not necessarily an ideal customer

The ruling of a Chancery Court judge at the end of last month suggests that it may no longer be possible to provide software maintenance under an SLA in respect of some licensed software but not all.

 

In October 2007, Marks & Spencer decided not to pay Data Direct Technologies Ltd for future maintenance under an SLA the parties had signed up to in 1997.  The legality of this decision was the subject of a court case for which the judgment was given on 26 January 2009. 

 

The disagreement as to whether money was owed under the terms of the SLA arose because of a paragraph in a Product Schedule to the SLA, which was drafted as follows: 

 

"Maintenance shall be provided in accordance with the Agreement and the Maintenance Schedule appended to the Agreement.  At the Customer's option, annual maintenance for the licence extension (including upgrade) contained herein for the period 26th October 2007 to 25th October 2008 shall be 17.5% of £750,000 i.e. of the licence fee paid subject to an annual RPI increase." 

 

M&S tried to argue that, thanks to the words "at the Customer's option", it was only obliged to pay Data Direct if it exercised its option to purchase maintenance.  Naturally, M&S said it had not exercised this option.

 

The judge wasn't swayed by this reasoning.  He held that M&S was liable to pay for the maintenance of the licence extension as it had not given the notice required under the Maintenance Schedule to the SLA, which required M&S to give 30 days' written notice of any intention to cancel maintenance.  It was common ground between the parties that notice of this nature had not been given by M&S prior to 26 October 2007.  What had actually happened was that on 23 October 2007, M&S had sent an email to Data Direct saying that it had decided not to renew the maintenance for 2007-2008.  Not a great move from the retail giant.

 

Although M&S appeared to have a point when it argued that if the intention had been to refer to the right to cancel maintenance words such as "subject to the right to cancel under clause X" would have been more apt than "at the Customer's option", the key point for the judge was that a reasonable person would not have thought that these provisions created an option to elect for maintenance in respect of the licence extension only.

 

This lawyer is somewhat surprised that the case made it all the way to court.   Maybe an out-of-court settlement would have been reached if the other side had needed a few items from the new Per Una collection or a load of new underpants.  

Safer surfing for young social networkers

In an attempt to stamp out cyber-bullying, seventeen social networking websites agreed on 10 February 2009 to put safeguards in place to protect young internet users from unwittingly giving out personal information. The move was part of the European Commission's "Safer Internet Day" and the seventeen websites, which include Facebook, MySpace, YouTube and Bebo have promised significant progress will be made by April 2009 towards ensuring that young people using these sites will be protected.

The measures to be implemented include enabling users to report abuse with a single click, making the default setting for online profiles and contact lists set to "private" for users under 18; ensuring that private profiles of users under 18 will no longer be searchable, and placing privacy options in more prominent locations so users know who can see what they've posted online.

Online social networking is a popular past time, with about 42 million people regularly using social networking websites. This number is expected to double by 2012, and it is obviously important that barriers to prevent privacy violation and illegal activities are put in place and maintained. A "block bullying online" video will be broadcast on public and private TV channels all over Europe throughout 2009.

Too much Latitude on privacy?

Fellow Naked Lawyer Peter might think that Latitude is a sedate music festival held annually on the Suffolk coast, but in fact it’s Google’s new location tracking technology.

It allows users to share their current location with each other and can display individual locations on a map. As someone that has never used Facebook for the simple reason that there are lots of people I don’t want to be able to track me down, this idea slightly alarms. We all know that our locations are largely trackable in retrospect via CCTV, credit card and mobile phone usage etc. In many cases this has significant benefits, in tracking criminals or if you’ve got lost on a mountain (although the lack of cameras and cash points might be an issue there). But do you really want people to know precisely where you are at any time?

According to the Guardian’s report, Google say that all its tracking features are “opt-in” and that different privacy levels can be set for each contact. But there are still a couple of major issues. Firstly, will people understand the settings and/or the implications of allowing people to view their locations? As a lawyer, I tend to read the small print, but most people don’t – just look at the publicity around users’ failure to grasp the security settings on Facebook. Secondly, what is Google itself going to do with all this location data? On what terms might it disclose it to others (whether in real time or afterwards)?

I can only imagine that there have been and will continue to be some major headaches for Google’s data protection lawyers as they get to grips with the implications and draft their privacy policies. Given the all too familiar headlines about loss and misuse of personal data, Google will no doubt be keen to look whiter than white.

Freedom to be Private

The UK doesn't have a distinct 'law of privacy'. Privacy law has grown organically in recent years from a series of pre-existing laws, mainly surrounding breach of confidence and human rights legislation.

There have been a number of high profile cases which have affected the development of the law. These include Douglas v Hello (Catherine Zeta-Douglas and Michael Douglas wedding photos), Campbell v Mirror Group Newspapers (photos of Naomi Campbell leaving a clinic), or indeed the JK Rowling decision (JK Rowling's son entitlement to rivacy).

Last summer the High Court awarded Max Moseley £60,000 in damages for invasion of privacy when a video of him engaged in 'unconventional activities' was posted online. It subsequently formed the basis of a series of news articles, most notably in the News of the World (which resulted in this case).

This last case seems to have stirred the ire of a number of journalists, angry that the law of privacy has moved in a direction which they perceive restricts their freedom of speech. The Times commented on the growing 'privacy rights being created by the Courts'. Paul Dacre, Daily Mail editor, has also commented that the decisions have taken away their right to 'freedom of expression'.

On the back of this, Jack Straw is reported to have told the Joint Committee on Human Rights that, 'It is my intention — and I understand this is exactly what is going to happen — that there should be a select committee of MPs to look at the law of privacy'. It seems we should watch this space for potential legislative intervention.

This writer isn't a big fan of a moralising press trying to use freedom of speech as a justification for the publication of any sensational new story. There are competing rights involved here, and a sensible balanced approach needs to be taken between the rights of the individual to privacy and the rights of others to publish material they deem of public interest. 

The organic development of the law on privacy could, therefore, justify a systematic review. The cases on this area have focussed on a small number of high profile individuals, with more time being spent on the interesting and contrversial facts and participants than on the law behind the cases. What is needed instead is a focus on the (tedious) detail that is required to make an effective legal framework. This issue doesn't just affect the press, it affects the right of the individual to privacy, or indeed to freedom of speech. 

It is particularly important that this law is clear in a world where anyone could breach another's privacy simply by clicking 'post'.

Apple's patent for "pinching" IP

The big technology news last week concerned the patent granted to Apple by the US Patent Office to protect the iPhone's multi-touch user interface (patent number 7479949). Apple's patented invention translates imprecise user gestures into precise, intended commands that are easy to use, configure and/or adapt through heuristics (the trial-and-error based engineering technique that reduces the calculations necessary to arrive at a solution to a problem).

The heuristics disclosed in the patent allow electronic devices with touch screen displays to behave in the manner desired by the user despite inaccurate input by the user. This is good news for those of us with fat fingers, as we don’t have to spend a lifetime trying to perfect the "pinching" and "swiping" techniques in order to change screen shots on the iPhone. But the patent is bad news for Palm, whose Pre ("coming soon" according to their website) is reported to have an "iPhone-style touchscreen".

If the technologies employed in the Pre infringe Apple's patent, Palm will either have to go back to the drawing board or licence the technology from Apple. Given the much-publicised antipathy between Apple and Palm (see "Apple vs Palm: Geeks with grudges"), it would seem unlikely that such a licence would be granted.

Tim Cook (Apple’s acting CEO) may think that competition is good and "makes us all better" but whether he welcomes competition from Palm, whose executive chairman, Jon Rubenstein introduced the Pre by talking about how he retreated to Mexico to lick his wounds after leaving Apple, remains to be seen.

Apple’s new patent may also impact upon future versions of the Nintendo DS, which already uses touch screen technology, and the Sony PSP, as Sony were rumoured to be playing with similar heuristics technology for the next PSP (see here).

How do ya’ like them apples?

Cloud nine(ty nine point nine percent service level)

I got an interesting perspective on cloud computing service levels from a member of CHASE recently. I said that I anticipated that SLAs would increasingly become a headline issue for cloud computing as more corporates were looking at moving key services to the cloud.

His response: SLAs are simply not a practical way forward. Cloud suppliers are unlikely to offer meaningful compensation for loss of key business systems. The best route is to have two different cloud providers, and some form of fail-over between them. Apparently this is technically challenging, but can be achieved in a lot of cases.

Another attendee at the event had found that SLAs were not always all they are cracked up to be. He had a 99.9% SLA on power availability, but found when his servers were power-cycled twice in a week, causing chaos for the web site they were hosting, the compensation was miniscule because the actual downtime was only brief. 

The moral - treat SLAs with caution! Do they really achieve your business objectives?

What flavour of SAAS would you like?

Unsurprisingly, we have been drafting and reviewing a spate of agreements for the provision of "software as a service" recently.  Plenty has been written elsewhere about the increasing trend for software to be hosted by suppliers and delivered to customers "as a service" (see for example some of the predictions made through the SCL this year).

While reviewing the latest agreement designed to govern the provision of SAAS that has hit my desk, it occurred to me that I will again be discussing the distinction between a "hosted software" agreement (which essentially combines the features of a software licence with a hosting agreement) and a "software services" agreement (under which the supplier provides specified services using certain software).  And the flavour of SAAS does make a big difference.

I am currently looking at an example of the former - so, for example, the specification/performance warranty is time-limited (to 90 days); if the customer uses the "service" after this time and it does not perform in accordance with the spec, there is no claim against the supplier (though there might be through the support services/helpdesk).  This is quite different from a services agreement where the services happen to be delivered through software.  In this case, a customer might reasonably expect the services to perform in accordance with the spec whenever they are requested.

Though this might seem like a niggly lawyers' point, it does mark a notable difference that may not always be picked up by customers.  Quite reasonably, customers not familiar with software contracts and the basis for the time-limited warranty might assume that the services will continue to perform as promised whenever the services are accessed.  In other words, some customers think they are buying "software services" when they are actually buying a right to access "hosted software".  Also quite reasonably, software suppliers will argue that unless they are to make unpopuler charging increases, they should not have an additional exposure in relation to the use of their software simply because it happens to be hosted by them instead of installed on a customer's system.

Savvy customers will have to get used to taste-testing their SAAS before they buy.

An attack on rights, or a necessity?

New law being implemented in March as part of an EC Directive, will require internet service providers (ISPs) to keep information about every e-mail sent or received by every person in the UK for a period 12 months.

 

Under the Regulation of Investigatory Powers Act passed in 2000 and the Anti-Terrorism Crime and Security Act 2001 (Part 11), companies like Telcos and some ISPs are already under an obligation to keep this information in case it is needed by a police or security service investigation.  The existing European Data Retention Directive also seeks to ensure that investigators have access to this information for the purpose of police investigation, as they do under UK law, but does not call for centralised, government-run databases as is predicted will evolve from the new e-mail laws.

Under the new provisions, details of which can be found in the Consultation pubslished in August 2008, not only will ISPs collate data from an estimate of three billion emails per day, but they will also be paid between £25 and £70 million to ensure that they obey the law.  Critics argue that spending billions to keep tabs on someone on the off chance that they may be a criminal is not a productive use of tax payer’s money.  It is interesting to note that although the data is said by the Home Office to be useful to combating crime, only the timing, number and location of each communication are kept; the content is not stored.  Although privacy laws would have something to say about it, what is the use or storing the emails for combatting crime if the content is not stored?  Is there in reality another purpose behind the measures?

 

To further exacerbate criticism, although on paper the new law will apply to all ISPs, the Home Office is apparently planning for small ISPs to be exempt.  But what happens when our criminal friend doesn’t get caught as he’s using a small ISP, after the government has spent billions in attempting to catch him?

Is software escrow worthwhile?

Is there really any value in software escrow?

This was the topic of an interesting discussion I had at the Legal Affairs Group meeting of the IT suppliers' association Intellect earlier today.

Given the current climate, you might expect an increase in enthusiasm for software escrow. The idea is that if a software supplier becomes insolvent (or, in some agreements, if they fail to provide adequate support) the source code, which is held by a third party escrow agent, is released to the licensee.

However, the IT lawyers I spoke to unanimously agreed that they had never actually come across an instance of a licensee client obtaining source code from escrow and then using it to maintain their copy of the relevant software. 

I have previously spoken to programmers who have said that using software source released from escrow may be unrealistic - it would be a nightmare to try and decipher millions of lines of someone else's code, even assuming that it was complete and fully documented.

Does anyone know of any case study of a licensee who has obtained software source code held in escrow and then gone on to use it to support their installation of the software?