2016 through its changes in terms and conditions

In October of 2015, we launched the first fruit of our Legal LAB, the Tracker of Terms and Conditions. It was a tool to track changes in terms and conditions. Although it wasn’t perfect, through it we were trying to reach a goal that seemed reasonable and useful: to know when and how the services change their terms and conditions.

So, the Tracker of Terms and Conditions was born.

But, why is it important to know how and when the services change their terms and conditions? Because at the end of the day, the terms and conditions are a contract. A contract that it is established by one of the parties, usually the company, and the user can only accept o reject the content. So, the user does not have the option to negotiate the terms.

This contract creates rights and obligations for both parties, but only one party has control over them (the company). Even though the law protects the user against plenty of unfair practices that the company may try to introduce through the terms and conditions, not all of them are reported. Besides, there are modifications on the legal texts of a storing, messaging or hosting service that are important to it but not unfair.

In summary, to know when and how the terms and conditions change, can be useful and good to: 1) report unfair practices according to the law and; 2) to find out about some of the surprises that the small print can include.

We love to track how the terms and conditions change (a little too much, maybe) :p, that’s why we follow them daily and from time to time we highlight the important ones. In fact, thanks to that we “announced” that Apple had bought Topsy 5 days before the official announcement (Topsy changed its Privacy Policy too soon). In any case, during a full year plenty of changes happen, and in 2016 we have tracked more than a few. To be precise, during 2016 we have detected 10.512 changes in terms and conditions.

However, before we start looking at the data, what do we understand as a “change”? Well, when there is a modification on a legal text such as Terms of Use, Privacy Policy, Cookie Policy or some other text that could be understood as terms and conditions (more than a few).

If the change is normal (a grammar mistake was fixed, a comma added or some text was translated from English to Spanish, for example), that’s a non-important change.

If the change goes beyond fixing a mistake (it adds or modifies rights and obligations for the user), then we take into account if the date from the “Last Update” section was updated too. Because that would be useful for a user who would want to know if that text has been modified from its last visit.

Let’s not forget that the terms and conditions usually say that we should check them regularly to see if something has been added or changed. Perfect, but they should provide some sign of it, right? Well, that’s what we track.

Having said that, if the change did not modify the “Last Update” section, we tag that change as Bad or an important modification that was not notified to the user.

If the change updated the date from that section, then we tag the change as Good or an important modification that was notified to the user.

And now, let’s check some data about the changes that we tracked in terms and conditions during 2016.

 1.- The trend during the year

We detected 876 changes per month. Taking into account that right now we track a little bit more than 5.200 services, not bad! September, with August, were the most active months, especially thanks to Privacy Shield coming into effect (although I’m sure that the holidays had also some effect there).

Therefore, if September was the most active month, there are no surprises and the most active Day and Week are from September, too.

Going back to the Privacy Shield effect, it definitively was the legal event with the biggest impact in terms and conditions in 2016. After so many months of uncertainty once Safe Harbor was invalidated, it seems that when the new legal framework was approved as the instrument for international data transfers, plenty of services started to update their Privacy Policies. With August and September being the peak.

This is something that we can affirm with certainty. The thing is that since Safe Harbor was invalidated, we have been tracking the terms and conditions of more than 90% of the services adhered to it.

2.- Who changed them more?

Truth be told, it’s a tricky question to answer.

We track a little bit more than 5.200 services and more than 7.100 texts. It’s not a lot, taking into account how many terms and conditions are out there, but we think that is a good number to get some useful data.

However, we track texts in Spanish and English, usually from the same service. Why? For starters, we are from Spain. So first we want to track the terms and conditions that are closer to us. So, we always track the Spanish version.

On big services, we also track the English version. So, we can see if there are differences between the main version and a country specific one (and there are differences). For example, last year Facebook introduced some changes on its Payments Terms, but only the English version was changed, not the Spanish one. Likewise, during 2016 Google has updated its Privacy Policy in Spanish, but no in English.

In addition, it’s not always easy to separate the Terms of Use and the Privacy Policy of a service. Because although each text uses a different URL, they share the same website.

Therefore, sometimes we get duplicates from a change, because the Spanish and English versions change equally. But that is not always the case. So, we try to control as much as we can to get the full picture.

Nevertheless, that makes it harder to get the usual ranking about who changed more their terms and conditions.

For that reason, we have created different charts that show different aspects of the changes tracked: on a global escale, changes notified to the user and changes not notified.

This ranking takes into account all the changes detected, including Normal, Good and Bad ones. This way, we can see what service was more active on a global escale during 2016. But as you can see, we point out the services where we track the Spanish and English versions. So, where we could expect more duplicates.

In any case, those remarkable numbers, especially in some cases, always have an explanation.

For example, Sarenza changes almost daily some texts because they update the conditions of their promotions regularly. And that’s why they are at the head of the pack. William Hill has plenty of terms and conditions, but in addition to that, the Super Suplente Promotion Policy changed almost daily during months some of its content (the matches affected by the promotion). At the end of the day, that brought 84 extra changes. :p Arsys modified its website and that produced plenty of small changes, the non-important ones, but that were taken into account. Udemy, between English and Spanish texts being tracked, plus the translations of some of its clauses, rose quite a bit.

And on every service there is a story.

Therefore, we could say that this is the ranking of the services that made us work more.

Now, let’s take a look to the changes that were not notified to the user. In that case, who was the worse one? I mean, what services changed more its terms and conditions on an important way without pointing that out at all.

In this case, Fnac would be the leader. The service changes regularly terms and conditions, but the funny thing is that those texts don’t even include a “Last Update” section. Although truth be told, a change from Fnac usually affects 2-3 of their texts. So, there are some duplicates in that final number. But at the end of the day, those are changes on different texts, and that’s why we count them.

On the other hand, Pinterest is an interesting case. The service rarely does a change in terms and conditions without alerting the user. But they have two policies (the Acceptable Use Policy and the Advertising Guidelines) that change regularly and without notifying the user. That’s why the service is in this ranking.

Finally, I think it’s important to point out that in this Top 10 there are 3 airlines. Although AirEuropa includes some duplicates for the special format of their terms and conditions, without taking them into account it was still in the ranking. It seems like the transport terms from airlines need some extra attention.

Finally, who was the most trustworthy? I mean, who changed more their terms and conditions on an important way, but always notified the users about it.

Sarenza also leads the pack here. And although the most usual changes from Sarenza are the non-important ones, it’s good to know that they notify the user. Arsys is trustworthy too. As well as Amazon Web Services (AWS) or Go Daddy, one of the few services that notified every change done during 2016. Facebook, although is number 6 in the global ranking, rarely does a big change in terms an conditions without giving notice. At least, on the big texts (the less important ones include more non-notified modifications). Unity is very reliable too, as well as Booking. On the other hand, Apple is an interesting case. The company does not change a lot their terms and conditions. And their changes are extremely well notified. But there are some lesser known polices that are updated very regularly, such as the Trademark List. That’s why Apple is on the list, mainly.

Something that deserves some extra attention, is the fact that on this ranking there are 4 providers of hosting (AWS, Go Daddy, Arsys and 101 Domain). Therefore, we could say that some of the most trustworthy services in relation to changes in terms and conditions are hosting services. After all, they do an important job and the level of transparency is up to the task.

3.- Conclusions

All in all, we detected 10.512 changes in terms and conditions during 2016. Those numbers can be reduced to:

Obviously, the non-important changes win. But more significant, the important changes that were notified to the users exceed the ones that weren’t. In fact, if we just focus on the important changes, notified or not, we could reduce everything to:

Therefore, during 2016 the services notified the users 55% of the times when an important change was introduced on their terms and conditions. Definitively not bad, especially taking into account that in the report that we did in 2014 (although with only 946 changes back then), only 44% of the important changes were notified to the users. So, we could say that there is an improvement.

In any case, the comparison will be more useful in 2017, when the amount of data to compare will be more similar.

In the end, we also have to say that there have been important and well known services that notified 100% of their important changes in 2016. For example: WhatsApp (although only had 1 :p), Go Daddy with 20, Snapchat with 12, Google with 16 (including Spanish and English), Spotify with 12 (including Spanish and English), Skype with 16 or SuperCell with 13.

Some of those services made important changes on their terms and conditions last year, and in some cases that caused more than a few headlines. But I think it’s important to point out that even in those cases, the services were very transparent about them.

In summary, we could provide way more data about changes in terms and conditions (among others, by industries, taking into account a period of time or according to the effect of a new law on the way the terms and conditions changed) And we will probably do it during 2017. But as a recap of 2016 in relation to terms and conditions, we think this is a good overview.

The good news is that 55% of the important changes were notified to the user. The bad news is that there are still 45% of those changes that gave no notice at all.

We’ll have to keep an eye on during 2017 too.

Happy new year!

—–

Seguir a @jorge_morell

La entrada How the terms and conditions changed more than ten thousand times during 2016 se publicó primero en Términos y Condiciones.

Translated by: Bárbara Román Méndez

Smart Contracts: theory, practice and legals aspects

Smart contracts are probably one of the most trendy terms on the new technological initiatives developed by sectors as diverse as Legaltech, which we already covered thoroughly, Fintech (projects related to the new financial industry) or Insurtech (projects related to the new Insurance sector).

The thing is, why the concept of smart contract can join together sectors so different? My idea is that the smart contract is seen as a legal tool that if it ends up being commonly used, it could seriously alter the way we trade daily. In other words, taking into account that the smart contract is software, many of the advantages associated with it (for example, promptness, predictability and automation), could end up reaching these areas on a large scale.

However, if smart contracts are the legal instrument that joins such diverse industries, there is a technological element that allows today’s smart contracts and connects even more sectors. We are talking about blockchain. What’s that? Well, the technology under which currencies such as bitcoin or ether work nowadays. In fact, some people are starting to consider blockchain as one of the most revolutionary achievements coming from the Internet.

In summary, out of this somewhat cryptic introduction we should focus on to two terms. This long post will be all about them from a theoretical, practical and legal perspective. This way, we’ll talk about plenty of theory related to smart contracts, how to make one (even mortals such us :p) and some legal aspects worth mentioning. The trip won’t be short, and although I’ve tried to simplify the content as much as possible (getting rid of important concepts in order to get a better understanding of the basics), it won’t be easy. Having said that, let’s go!

As we said, all this story revolves around two terms that we should try to memorise. We are talking about Smart Contract and Blokchain.

1.- Back to the origin, what is a smart contract?

A smart contract is the use of computer code in order to articulate, verify and execute an agreement between parties. While a regular contract uses natural language, the terms of a smart contract use computer code, like the one from a script. That’s why we say that a smart contract is software.

Once the smart contract is written, a computer executes it according to the terms and inputs established in the contract. This way the smart contract auto-fulfills its own terms or conditions. For this reason, a smart contract will usually use instructions and conditions typical of computer code. And these instructions will follow the usual pattern of: “If this happens, do that. But if it does not happen, then do this instead”.

Then, once the execution of the contract begins, both parties lose the control over its compliance (we’ll come back to this when talking about the legal aspects).

Therefore, a smart contract is a computer program with conditional instructions that one (or more) computers verify and execute in order to assure its liability.

It sounds new and futuristic, doesn’t it? However, as in so many other instances, the smart contract is not a new concept.

The term itself was coined by the Hungarian jurist and cryptographer Nick Szabo during the 90’s. Even though he had already talked about them earlier (in 1996 on Smart Contracts: Building Blocks for Digital Markets and shortly after that in Formalizing and Securing Relationships on Public Networks), a brief paper written in 1997 and called The Idea of Smart Contracts is considered as the stepping stone on the concept of smart contracts.

On this paper, Szabo starts talking about how when we formalise our relationships through contracts, we establish the appropriate setting for an ideal level of security.

According to Szabo, the vending machine is probably the original smart contract: a device designed to transmit the property of a good (the can) in exchange for the appropriate input (the coins). Taking into account that the machine controls the goods, because they are sealed inside, the device is capable to enforce the terms of the contract.

Nevertheless, Szabo states that his idea of smart contract goes beyond the vending machine. According to him, it would be possible to embed the contract into any valuable object that is digitally controlled. He even calls it “Smart property” on his glossary. In any case, the starting point is always a mature security system that is required to protect the good or the service. Then, the continuous refinement of the safety system will bring it closer to the typical logic of the contracts (he gives a very good example about vehicles). Finally, during this refinement process based on the cryptographic security of the good is where the smart contract will be born.

“Nick Szabo: Block Size Increase a ‘Huge Security Risk’ “, by The Cointelegraph

1.1.- Therefore, what could you do with a smart contract?

Now we know that nowadays a smart contract is a contract that self-executes according to what both parties agreed on within the code; that its terms are written in a language that can be interpreted and executed by a computer; and also that such computer becomes the administrator and executor of that contract.

According to that definition, what could we do? There are no limits to it, to be honest. Theoretically, it could be programmed in order to:

1) Start up an option to purchase shares at a fixed price during a specific period of time just by just sending a message.

2) Verify and pay sports betting once checked the result in internet.

3) Check the beginning and end of a waiver period when shopping online, following the tracking of an order.

4) Verify the votes on a survey to find out if Game of Thrones is better than Star Wars? :p

And so on.

As we can observe, a distinctive feature of smart contracts is that the need for reliable human intermediaries is completely gone. Not because the mediation is unnecessary but because its role is taken by the computer that verifies and executes the code.

All this sounds really attractive. However, if the concept is almost 20 years old and its potential is so big, how is that no one has talked about smart contracts until recently?

The truth is that until recent achievements, smart contracts have mostly been great in theory. Even though we do have some examples of smart contracts, the DRM systems or Digital Rights Management necessary to manage licenses on digital content are among the most visible systems and as we mentioned earlier putting those into practice was almost impossible.

Smart contracts have been subject to 3 important limitations since their origin.

A) To begin with, how could the smart contract control the real assets in order to make someone fulfill the agreement? The soda vending machine has a physical control over the good since it is locked inside the machine itself. But how could the computer code do the same to control assets such as money or shares?

B) The money in its digital format, the same as the money reserves banks have, is subject to a very strict regulation, just like its use by people in general. Then how to make contracts that include economic transactions? Which by the way, are the most common used ones by far.

C) Last, which computer would receive a vote of confidence so as to execute the terms of the agreement? It should be a computer in which both parties could place their trust in. That is to say, the parties should not only agree on the term code, but also on the computer that will interpret and execute it. Besides, the computer should be verifiable by the parties in order to avoid fraud, manipulation or unauthorized access.

It is due to these limitations that very little has been done with smart contracts during the last few years. But, then?

1.2.- Then Bitcoin arrived llegó Bitcoin (and Blockchain with it)

The issue about smart contracts had a big turnaround with the arrival of Bitcoin on January 3, 2009 (even though its real significance will be fully valued years after).

To somewhat simplify, Bitcoin is a payment system and digital money or assets (I know there is some argument whether it is currency or not, but to make things easier will called like this, invented by the mysterious Satoshi Nakamoto (for those who love conspiracies, there are theories stating that Nick Szabo is actually Nakamoto).

The user of Bitcoin has a personal wallet, which allows him/her to send and receive bitcoins. All this makes most users believe that Bitcoin is the same as “Internet Money”.

Nevertheless, what is really interesting for smart contracts, and probably the true revolution, is the technology that makes Bitcoin possible.

In this sense, Bitcoin as a decentralized payment system allows transactions that take place among users without a need for intermediaries. Those transactions are verified by the network itself where Bitcoin moves and are registered in a database called blockchain.

Here is our second big concept.

1.3.- What is blockchain?

Blockchain, or the chain of blocks in its Spanish version, is an authorized and distributed database which allows appending all kind of data that can´t be reviewed or altered later on.

In its most poetic analogy, blockchain is a book with essentially endless pages and in which almost anything can be written (from a song to a computer program). However, whatever is written can´t be modified, although it can be looked up at any time. In fact, it is accessible to everyone. And indeed, the fact that there are millions of eyes observing what has been written in the book, almost makes it materially impossible for anybody to manipulate whatever is written.

Getting a bit more technical now.

What is particular to this database called blockchain is the way it is kept and updated, as this grants it a high level of trust. Since blockchain is not controlled by one single person, entity or organization, there is no one that has final control over it and its content.

So, the logical thing to ask is: Who maintains, updates and ensures blockchain then? All computers that are part of the chain (which can be up to hundreds or millions)

That way, each computer that is part of the blockchain always keeps a copy of all the annotations made. Each copy is maintained synchronized with the other copies. In case of discrepancy between the existing copies, the most common version is given the highest score by mathematical consensus . Then, that copy will be the one shared within the computer network and where additional annotations will be entered.

Or in other words, in order to successfully alter a blockchain 51% of it should be attacked and modified simultaneously (so that the mathematical consensus gives priority to the most common database, which in this case would be the altered one). However, this is something materially impossible for blockchains on which cryptocurrencies such as bitcoin or ether run, given their size.

On the other hand, as blockchain is constituted as an append-only database (t. i., it allows only to write and retrieve old data, but not to delete or alter any of them), whatever has been written there can never be deleted. In addition, since each annotation in the chain is secured by a cryptographic process, the chain itself is able to thus detect and reject any attempt to distribute an altered copy of the registered transactions.

Therefore, the constantly synchronized, distributed and authorized character of blockchain guarantees that there is only one record of the annotated transactions. That for example prevents a person from spending the same bitcoin in various transactions at the same time, and thus solving the so-called double-spending problem in systems with digital currencies.

As if that were not enough, those blockchains on which currencies like bitcoin or ether run are public, all transactions that have been made are visible (with nuances) to anybody. Also, we have to add that this is an open-source technology, which makes it easier to know what the software is doing or not at all times. That is, transparency at its best.

All this is what makes blockchain such an interesting technology, as it provides a system to create databases whose annotations will be highly reliable, as their manipulation is so unlikely to happen. These annotations can go from basic text to computer code (a code that the blockchain itself can execute).

As a closing point of this chapter, a very interesting and recently held TED talk on blockchain and its great potential:

1.4.- But how does blockchain affect smart contracts?

The patient reader who has reached this point, almost half of the post!, will surely say: “That’s all good and well and I have my brain half fried, but how is this all going to work with the smart contracts?” That is a good question.

By now, we already know that blockchain is a technology. That means there is not just one single chain of blocks. In fact, there can be endless chains. (if anybody wants to create his/her own one, s/he can fall back on services such as Chain or Slock.it)

By using the blockchain technology we can create payment systems (and their equivalent currencies), such as Bitcoin, Ethereum or Ripple, probably the three most popular ones. But it is not essential.

In fact, not even the public, auditable and 100% distributed characteristics of blockchain are necessary. That is, the financial sector is working on private and semi-controlled blockchains (which raises the question of whether these projects really use the chain of blocks). In addition, side-chains are also used (in Bitcoin), which are like lateral chains to the main one that allow innovation without having to start all over again and that can be nourished from the main chain (probably they are useful for smart contracts).

Having said that, out of the 3 most popular blockchains, Ethereum is probably the one that fits best for smart contracts. That is, although the blockchain on which Bitcoins sustains allows to make smart contracts, the process there is more complex.

It was that complexity of the Bitcoin chain that made that the Russian developer and cryptographer Vitalik Buterin suggested the creation of a blockchain other than Bitcoin in 2013. One that would have very much in mind the development of applications such as for instance the smart contracts. This is how Ethereum and the current enthusiasm for smart contracts originated.

But getting back to the nexus between smart contracts and blockchain, we have commented that the concept of the smart contract has existed for almost two decades now and yet has been barely used due to three major limitations: 1) the difficulty of the computer code to influence real assets; 2) the strict regulation concerning the movement of assets such as money and 3) the difficulty to find a trustworthy computer when executing the smart contract.

Well, blockchain as a technology solves completely or for the most part these three limitations. Ethereum, also referred to by some people as the blockkchain 2.0, makes this even a bit easier. But how does blockchain get around these limitations?

As far as the first limitation is concerned, blockchain allows the existence of fully digital assets, such as money, stocks, bonds, records and other that can be controlled by the smart contract computer code. The blockchain doesn´t have control over the asset itself, but over the cryptographic key that can be associated to it. And since that key cannot be altered, we know that bitcoin is that one and not another one. In addition, the huge digitalization of the economy and society, together with the arrival of the Internet of Things (which allows internet connection to the table where we eat), eliminates the problem even those related to physical objects.

As for the second limitation, obviously the strict regulation on the use of money still exists. But blockchain has generated the creation of new payment systems and currencies that in practice are operating regardless of any current regulation. Therefore, by creating an alternative road, the influence of this regulation has been considerably reduced.

Finally, the third limitation is also completely solved thanks to the blockchain. The computer on which to execute the smart contract code is the blockchain itself. That means, not just any specific computer that can be hacked, but hundreds of thousands of synchronized computers that guarantee that the contract cannot be modified and that it will be executed as instructed. The mathematical consensus becomes mathematical confidence with no need for third-party human intermediaries nor unreliable computers.

The (computer) code becomes more legal than ever.

Just as a curiosity, are there any projects already using blockchain in a legal environment? To only mention a few: 1) Blockai and its records of intellectual property for photographers and cartoonists; 2) Ujo enabling musicians to charge their fans directly and resolving at the same time the issue of licences through smart contracts; 3) NevTrace and its record of refugees for migratory crisis or 4) Sweden and their testings for a property record on blockchain.

Therefore, the combination of smart contracts and blockchain is what can make the first one the legal instrument of the future and the second one the technology that can force to redo many of the known schemes.

2.- Let’s go from theory to practice!

After presenting all the theory, it’s time to get our hands dirty.

However, if smart contracts are software, do we need to know how to program in order to create them? No we don´t, but it can definitely help. Especially now that we are still on very early stages. Besides, if one knows how to program his/her own contracts, we will have maximum control. Even though this could create problems that we will address later on in the third section.

Therefore, where should we start from?

As explained in A Lawyer´s Introduction to Smart Contracts, the smart contract is just another component within the system. For that reason, the smart contract would be the final infrastructure component that allows to create and operate such contracts. The module such infrastructure has, which permits its creation would be the Smart Contracts Platform (from now on SCP). On the other hand, we also have another component that could be added to the SCP and make our life much easier, which is the Smart Contracts Management System (from now on SCMS).

In other words, the platform for smart contracts or SCP would be for instance the blockchain of Bitcoin or Ethereum. As well as any other blockchain that allows to interpret, execute even store smart contracts created within it.

Whoever wants to work directly on this layer will need to have some knowledge on programming in order to be able to create his/her own smart contracts. If you wish to do it on the blockchain of Ethereum, for that purpose below we include a tutorial to get started. If you prefer Bitcoin click here to start.

Meanwhile, SCMS are a superstructure placed above the SCP that allow us to use smart contracts just as if they were another service. This way, we could have at hand in a graphic way, also very easy to use the following: a database of the signed smart contracts, a calendar in which to program the beginning and the end, an editor to create drafts of the contracts or a place to store and check the activity records. As said before, all with a graphic interface and without a need for programming.

Thus, blockchain would be the foundations of a house, whereas the SCP would be the furniture and the SCMS the facade, the tiling and the paint.

If we don´t know how to or don´t want to program a smart contract and all its aspects, we might be more interested in a SCMS because it is the closest we can get to a “Smart Contract as a Service”.

Are there many like it? Not too many by now. Codius could fit but it requires some knowledge on programming. The browser/wallet Mist from Ethereum allows something similar but very simple. The Smart Contract presented in this section is one of the most useful, powerful and easy to use ones I have ever seen. An American company that allows to create different types of smart contracts on the blockchain of Bitcoin and Ethereum, besides programming smart coupons and making payments according to the geographical area of a good. All of this without the need to program. 

If someone wishes to try out the service, it is now free, I suggest that you do it on the test platform (which is more hidden than the regular one). That way one can experiment with it more freely.

What was the main goal when creating our smart contract? To experiment with the concept and to do it with a smart contract not related to payments, which is the most common type. Therefore, our intention was to use the smart contract just for verification, exchange and/or information supply.

2.1.- Using the changes in terms and conditions to create a contract

We have already mentioned that the smart contracts are computer coding based on the idea “If this happens try this. But if it does not happen, then try that”. Therefore the contract requires an external source of information in order to check regularly if “this” happens or not. That source might well be for instance the results of a Google search, through an SEO smart rank. For example, “When a website gets on the first page of Google, make the payment”. This option is provided by the service through the contract “Service Level”, for example.

But maybe the best external sources in order to verify and execute a smart contract are those that are based on text formats that can easily be interpreted by a computer program. This way we will be able to rely on more precise data. We are not referring to formats such as PDF, but sources in Javascript JSON format.

In this sense, the information gathered in our Tracker of Terms and Conditions regarding all the texts that are monitored, is stored in JSON format. This means that in relation to every modification detected, data such as the name of the service, the type of document, the date of the change or the percentage of modified text, are being stored in a format that later on can be read and verified by a computer program. In this case, this computer program will be our smart contract

What do we want our smart contract to do? Since the terms and conditions change very often and since those changes are not always reported, we suggest a scheme in which to configure through smart contracts its obligation to inform and even the acceptance of the conditions when they are modified. All this according to the percentage of change in the monitorized document. Which besides obeying the law, automating a legal obligation and reducing the costs of its compliance, can also offer an extra in transparency and liability which the blockchain provides.

In other words, terms and conditions always include a term related to an eventual modification of the texts. Those modifications are tiny many times but other times they are substantial and even then the user is not notified nor his consent required again. Part of the problem is that the concept “substantial change” is barely defined. Well, our proposal/experiment is to have that term solved through a smart contract.

The process followed to achieve this, at a small and experimental scale, has been the following:

2.2.- Let’s do a smart contract!

First of all, we create a false Privacy Policy and we start monitoring it with the Terms and Conditions Bulletin. In the wording of the Policy we will establish in natural language that whenever a substantial change in the conditions occurs, we will notify this via email, a notice on the web and also the user will be asked for consent again. Also, we point out that a “substantial change” will mean an alteration of at least 15% or more of the text (as for the test, this was the most objective way to try to assess something like this).

Next, we create a test profile in “SmartContract”, we click on “Create Contract”, choose the option “Bitcoin Oracle” and click on “Create Oracle”. We are interested in this option because of the possibility of establishing conditions that can assess whether a value rises, stays the same or falls.

Then, we can start “drafting” the smart terms of our smart contract (see image below). We must also add a description to the contract, attach the files we want (in our experiment a full copy in PDF format of the Privacy Policy), and finally sign and send the contract. At this stage, the contract can be saved in our profile while we are working on it, like in editing mode.

In our smart term we will choose the option of monitoring performance, since we want to know when substantial changes in our Privacy Policy occur, t. i., whether the alteration is equal to or higher than 15% of the text. Whenever this happens within the established period of time, in addition to recording this in the blockchain and providing our users with a maximum of transparency about our way of acting, we could also link and automate this result to the actions stated in the written term in the Policy. That is, the sending of an email, the notice of the web and the request for consent. And all this depending on the result of this smart contract.

So, we are going to create two smart terms. To begin with, in “IF the API location” we put the JSON version of our Privacy Policy. For this first term we choose the option “HAS a value equal to 15”. Then, we click on “Data Path” and select “variationPercentage” in the window that will be displayed with all available data for that document. Finally, we select an expiration date and add a new “Smart Term”. In this second term we will repeat the previous process, but for the second field now we have to choose “HAS a value more than 15”.

We fill out the field “Description”, attach the files we deem necessary, sign and send the contract to some gentle soul who can make the experiment even more social (it does not have to be a user of the service). It should show something like this:

Now that the contract is in progress, we just need (or not) to make changes on the external source the smart contract is regularly monitoring, t. i., our false Privacy Policy. This way, by adding or deleting text of the monitored document, we can force the compliance or breach of our smart contract.

And with this and a headache :p, we do have a smart contract.

Everything mentioned in this second section is the practical version of the theory described in the first section. Therefore, here we have created a smart contract on blockchain (with all its implications). Although the experiment is extremely simple and incomplete, I think it helps to understand the concept of smart contracts in reality. It proves at the same time the existence of powerful and easy services that already permit the use of this new legal instrument with no need of programming knowledge. In other words, something we can already use as lawyers, and our clients as well.

That said, let´s go ahead with the tests! Since this little experiment barely scratches the surface.

By the way, if somebody wants to use the Terms and Conditions Bulletin as an external source for her/his smart contracts or even monitor a specifically created text (like the one used in this example), please go ahead and feel free to use those already available. Or else contact us for any specific case.

Finally, we are going to look roughly at some legal outlines on the previously discussed.

3.- Finally, what about the legal part?

We should have by now some idea about what a smart contract is from a technical point of view, what it can be used for and how it could be created. However, what happens legally speaking?

There are already several good articles on the legal aspects of smart contracts, two good examples are the already mentioned A lawyer´s Introduction to Smart contracts or Smart contracts: an approach to the concept and basic legal matters (in Spanish). As all this is already getting a bit too long :p, I merely will comment on a few issues that strike me, with extra reference sources.

There we go:

1.- Although it is very common to hear of smart contracts as instruments that are neither contracts nor smart, the truth is that they can perfectly well accommodate all the inherent parts of a contract and even come to “think” for themselves. It is true that many smart contracts are no more than a simple redirection of an amount from one account to another, nothing else. But we can create a pure smart contract, as some people call it, a contract that is perfectly legal, both in form and substance. Therefore, it all depends a little bit on the use of it.

2.- As for its intelligence, most of the smart contracts are truly robots that under the principle of absolute neutrality simply do as instructed. But there are some developments in that area that will lead them to more. From the inclusion of AI in its writing and compliance to such complex and curious experiments as the DAO or Decentralized Autonomous Organizations. What is a DAO? Very briefly, a smart contract of smart contracts. Or, as some say, when a bot runs the company. Its conception and development are very interesting, as well as its defects and legal consequences (the biggest DAO was hacked a few months ago).

3.- One last remark on its intelligence, I find the idea that over time a smart contract can “represent me legally” interesting. In other words, a smart contract can perfectly identify a user, control certain digital goods of this user and contract or not services depending on the programmed instructions. Therefore, it is only a matter of time before somebody creates his “digital representative”.

4.- The wording, correction and interpretation of smart contracts will be a more complex task, especially at the beginning. First of all, because they are not written in natural language. Secondly, due to the fact that they are so fast and automatic in its execution, it will be important to analyze in depth their lack of errors in the code (a legal debug will be necessary). Apart from this we have to keep in mind that they may include third-party unknown or unaudited code. In any case, natural language contracts will not disappear, they will simply live together or even get mixed (our example was like that). After all, the flexibility of natural language will very often be sought by both parties.

5.- The fact that smart contracts are executed and stored on a distributed network like blockchain is a problem in terms of the applicable law and jurisdiction (if the parties don´t indicate it in the contractual terms). Especially in those contracts in which the parties are not identifiable or even the content of the contract is encrypted. That means, if the contract is verified, executed and stored in millions of computers at the same time, it is everywhere and nowhere simultaneously. What jurisdiction is applicable if the parties have not said anything?

6.- The fact that smart contracts are stored on blockchain, with no possibility for them to be altered and with a maximum level of transparency, can lead to problems in regards to privacy and confidentiality of information. In fact, this is boosting the creation of new private blockchains. And what will occur with the right to be forgotten in a blockchain? Isn´t there going to be some kind of clash between the established in the new European Data Protection Regulation and what technology permits? Probably that´s why we are already working on (private) editable blockchains.

7.- The logical thing is that systems like the one used in the example will be the usual way of creating smart contracts. In that case, the terms and conditions of the service can be of help in regards to applicable legislation and jurisdiction. Therefore, it is also reasonable to assume that these services will be the main focus when it comes to regulation by the governments. We can´t forget that these services will have access to thousands of contracts, to the personal and confidential information they might include and that they will be in charge of their custody. Should they look after the legality of their object? Maybe prevent them from encrypting against any possible setback? Will any legal knowledge be necessary in order to provide templates of smart contracts? They are a computer program after all, that nowadays are mostly created by programmers, not by lawyers, but there is a strong legal connotation to it. In fact, there are already markets to buy and sell smart contracts.

8.- Finally, services like the one used and other similar services have the potential to foster that a few people seriously affect big businesses that are highly regulated, such as sports betting, lotteries or loans. That means, if we can create easily replicable templates of smart contracts on a big scale, it is just a matter of time before somebody ends up creating from his home place an alternative to Bet365 or any other service like these. But obviously without meeting the many necessary requisites for this type of businesses.

Summing up, the legal part of smart contracts is going to pose new interesting challenges. In any case, so far my first contact with them or “Smart contracts are for the summer”. :p

This has been good practice to me, in order to learn in some detail everything surrounding this new area of knowledge. At the same time, this mega post aims (just with the right amount of technical terms) to put in order many of those ideas with the intention that more people can have access to it. As what has been explained here is just the tip of the iceberg and there is still much more to explore.

Although it is true that all that is happening around smart contracts and blockchain is still in its initial bubble stage, over time it will ease down and the revolutions will give room to real applications. But it is undeniable that the technology and its uses have a great potential already present and available. Even for mere mortals. ;D

Happy smart contract!

—–

Seguir a @jorge_morell

La entrada How to create a smart contract using terms and conditions se publicó primero en Términos y Condiciones.

Gotta catch all your rights and obligations too

Pokémon GO went live less than two weeks ago in just a few countries, but it has already become one of the phenomenons of the year. In fact, it already is the biggest mobile game ever in USA and it is quickly approaching the level of use of services such as Google Maps and Snapchat. All of that in less than two weeks.

The concept is classic Pokémon: you gather the best Pokémon to train them later and compete against different trainers and through tournaments around the world. The huge difference here is that the world is not virtual anymore, now the real world is the playground.

The thing is that thanks to augmented reality, the Pokémon do not live in a virtual world now. Instead they live and walk in the real world. For example, the garden of your neighbor. Through our mobile devices we can locate them (the camera + geolocation), catch them, train them and then compete against the rest of the world.

That means that the immersion and interaction goes through the roof, because to catch the Pokémon you have to physically move to the places where the app points out that they are living. Something that has generated more than a few complaints from players with disabilities, whose options to play get very limited.

When all the planet is the game board and the player needs to move around to play, plenty of things can go wrong. That’s why we already have plenty of crazy stories since the launch of the game: 

• Places banning the hunting of Pokémon
• Infidelities being discovered through Pokémon GO
• The Mayor of Rio asking for the use of the game during the Olympic Games
• Or cops and robbers taking advantage of the excursions of the players

And that’s just the beginning…

But let’s go to the point, what do the terms and conditions of Pokémon GO say? Well, its Terms of Service, Privacy Policy, Copyright Policy and Trainer Guidelines have some very interesting aspects.

Let’s go for it!

13 details about its terms and conditions

1.- The agreement is signed with Niantic Labs, a company born within Google that would become independent in 2015. That year, and with the announcement of the development of Pokémon GO, Google, Nintendo and The Pokémon Company invested in the growth of the company. So now the three of them are part of Niantic Labs.

2.- The use of Pokémon GO is personal and no commercial. Therefore, all those small and medium businesses interested in using it to gain new clients would be infringing its terms and conditions. In any case, the sponsored locations are coming.

3.- To play it you have to be at least 13 years old. Having said that, the minors under 13 years need that their parents register at The Pokémon Company International through the Trainer Club. During that process, the username, email and date of birth has to be filled. That way the parents can consent. In addition, if you are a USA resident, you have to verify that you are the father o mother of the minor through an specific process. Then, if the parents want to remove the consent for an account of a minor under 13 years, they can use this form.

4.- If you want to access the service you need a Google, Facebook or Pokémon Trainer Club account.  The required personal information will be gathered from the data of these accounts (for example the email). Then the Pokémon GO account can be created. In the case of a Trainer Club account, the date of birth, name and surname will also be needed. The access to the service through third party accounts, such as Google, created some uproar in relation to the privacy of Pokémon GO. The reason was that using a Google account implied full access to the content of it (that meant way more than just the email). In any case, the bug was fixed a few days later.

5.- The data compiled by the game, through the different phases, is: username or real name (according to the option chosen by the user), country, language, the data gained through cookies and beacons (such as web traffic and aggregate use), the IP, the user agent, the browser used, operating system, web of origin, search terms, time invested, clicked links and something very important from a privacy point of view, the location (through GPS, Wifi triangulation or phone towers).

6.- Who has access to the data and how it is shared? Let’s take a look to an important privacy aspect:

a) With The Pokémon Company (the International too) personal data is shared (from adults and minors under 13 years old) to solve any problem produced during the register process. The Pokémon Company International also compiles the data about the consent given by the parents in relation to minors under 13 years registered on the game.

b) With service providers that allow the proper functioning of the game (for example, web hosting), personal data is shared (from adults and minors under 13 years) just to provide the service.

c) The non-personal data from adults (the minors under 13 years are excluded) is shared for research, analytics, demographic profiling and other similar purposes.

d) If a third party acquires the company, personal data (from adults and minors under 13 years) could be shared. In any case, a notice would be sent 30 days prior to the exchange, so the user could oppose to it.

e) With governments, law enforcement officials or private parties to comply with the law, for example a legal process.

f) In any case, you can refuse further collection, use or disclosure of your personal data (from minors under 13 too). For example, by preventing that the personal information of an adult or minor user ends up in USA (the place where the personal data is transferred and processed). Something like that can be requested at: pokemongo-privacy@nianticlabs.com However, that possibly means that the access and use of Pokémon GO gets very limited. Therefore, it is more like playing to the gallery…

7.- The content shared by the user through the app is licensed to Niantic Labs perpetually, on a non-exclusive and irrevocable way, with the option for a possible transfer and/or a sublicense, free of charge and on a worldwide scale. So, the content is shared veeeery generously.

8.- The Pokémon obtained can be exchanged for others but within the service and not for virtual money, real money, real goods or real services. In any case, there are already users taking advantage of the business side of Pokémon GO (for example, “taxi” services to carry someone to the location of a Pokémon).

9.- The game obviously includes micropayments, but they have to be done by 18 years old users or users under that age but with parental consent to make the purchase. The micropayments allow refunds, but only until the purchase is completed. Once is done, there is no option.

10.- If a Pokémon GO account is not used during 1 year, the account is deleted and everything related to it will be lost. In any case, a closed account will be kept “for a reasonable amount of time from a commercial point of view”. If the virtual money or in-game content is expected to be interrupted or changed some way, a notice will be sent 60 days in advance.

11.- There are plenty of forbidden conducts, but taking into account the kind of game that Pokémon GO is, there is an important one: you should not try to access a place or location where you don’t have the right to enter. It is kind of obvious, but definitively something to remember because there are already places that are banning the access to Pokémon GO players. In fact, if you don’t want your home or business appearing in the map of Pokémon GO as a gym, Pokéstop or whatever, Niantic Labs is providing a form just for that. The form can also be used to alert about dangerous or inappropriate places shown on the map as events or items.

12.- The online and offline communications of the user with different players, are entirely its responsibility. In fact, Niantic Labs says that they don’t investigate or ask about the records or precedents of a user.

13.- If there is a problem, the laws from California will the be ones to take into account. In addition, unless the user opts-out of it, it is subject to an individual arbitration without an option to go to court. Both conditions are unfair according to European law, but they would be applicable to a user from USA, for example.

In summary, Pokémon GO is quite reasonable on the terms and conditions subject. It has a couple of details worth mentioning: a) the concern about the consent from the parents on users under 13 years and b) the possibility to refuse the collection or use of the gathered personal data (although in practice it limits a lot the game). Another interesting point is the detailed regulation of the micropayments and the (non) commerce of virtual items for real goods and services (although that is already happening). Google being part of Niantic, although on a small scale, could cause some concerns about the use of the personal data and the privacy of the service. However, nowadays there isn’t any big red flag in this sense. Finally, the non commercial use of the app is going to cause more than a few troubles, seeing the potential for small and medium services.

In short, there is no doubt that this is one of the phenomenons of the year. So, have fun and catch them all.

Happy poke-excursion!
—–

Seguir a @jorge_morell

La entrada Pokémon GO – 13 details about its terms and conditions se publicó primero en Términos y Condiciones.

This is what happens when you do not update your legal terms in 4 years

WhatsApp, the indisputable king of worldwide messaging, is celebrating a curious anniversary: the 7th of July its terms and conditions (Privacy Policy included) turned 4 years without being updated. Yes, they are very outdated.

Bu why is this significative? We have talked about it before, but the important thing to remember is that the terms and conditions are a contract formed by clauses previously established by one the parties (the company), where the other party (the consumer) can only accept them. That means that the user cannot negotiate those clauses, having just the option to accept them or not.

This kind of contract is used by multiple services that regularly need to sign an agreement with a huge amount of users. Those contracts, the terms and conditions, in summary say: “This is what we do, do you take it or not?”

The legal protection for this kind of contracts is more extensive. For example, to protect the users from unfair clauses that could try to impose the user a conduct or an action that they did not have the power to negotiate.

For that reason, the law compels the companies (the parties that usually establish the terms and conditions), to be very clear, transparent and precise about them. In fact, if the user does not have a real chance to read those terms when the contract is being entered into, those clauses wouldn’t be part of it (according to art. 7 a) of the Spanish Ley sobre Condiciones Generales de Contratación).

WhatsApp has been adding new features to the service for the last 4 years. More than a few of them have important effects on the rights of the user, for example its privacy (the blue double check, the VOIP calling service, the buyout by Facebook or the end-to-end encryption of the chats).

However, those and of more aspects of the service are non-existent on the terms and conditions accepted by a user when registering in WhatsApp. In fact, some of the clauses totally contradict what the user can do on the service.

Having said that, let’s take a look at those absences and contradictions.

The 37 contradictions of WhatsApp

1.- The owner of WhatsApp is Facebook, not WhatsApp (FB acquired it in 2014). However, there is no mention of it. So for example, to whom should I address to exercise my right of access?

via GIPHY

2.- The use of the service should be personal. In fact, the commercial use is expressly forbidden. Nevertheless, plenty of businesses and even public institutions use WhatsApp everyday beyond the personal license. Without any problem at all.

3.- Although WhatsApp prevents the automated delivery of messages, a user can access services and tools that just provide these kind of service. And again, without consequences.

4.- WhatsApp is still preventing search engines to make cache copies of its website. Although in fact they are available.

5.- The texts, graphics, software, and more components of WhatsApp are owned by Facebook, not WhatsApp. Although this isn’t what the terms say.

6.- A third party cannot use the messages of the users with a commercial purpose. However, it’s easy to find businesses that use the message of a user without a problem to advertise a product, for example.

7.- Although the terms talk about the possibility of sending “other communications”, the option of sending video, audio, files such a PDF or making a call is not mentioned at all. Neither its implications.

8.- The feature “Last seen” is automatic, according to the terms. So, without an option for disabling it. But actually, for the last couple of years it has been possible to deactivate it.

9.- Although the new end-to-end encryption system should assure the confidentiality of a conversation, even from WhatsApp, that option is not mentioned at all on the terms and conditions. In fact, the text still says that there is not guarantee of confidentiality. Despite what has been published.

via GIPHY

10.- To send advertisement or making job solicitations is forbidden. Nevertheless, WhatsApp has become a regular channel to manage a rent or for customer service. Again, without any major consequences.

11.- The lack of interest or the extension a message could suppose its deletion (yeah, that’s on the terms). However, nothing like that has ever happened as far as we know.

12.- It is established that the service is provided from the United States and it could be inappropriate to access it from another country. Actually, more than 1000 millions persons are using WhatsApp from all over the world.

13.- You must be 16 years old to use the service. Nevertheless, plenty of users under that age use it without much of a problem.

14.- It is established that the user adheres to the courts of California, although Whatsapp has already had important trials in Brazil, Germany or India (and not always winning).

15.- The possibility of personal information from WhatsApp being shared with Facebook is not referenced. Something that Facebook does through its Data Policy.

16.- The option about billing and having to pay for the use of the service is still there, although the service is free since January 2016.

via GIPHY

17.- The cookies that the website can install are mentioned (although not a lot of people visit the website for using WhatsApp). However, there is no mention of cookies or similar technologies that the app could install on your device.

18.- WhatsApp says that it does not compile personal data beyond the phone number. Nevertheless, it has been demonstrated that it gathers more information, for example through the VOIP calls.

19.- The data retention policies of WhatsApp are still a mystery, as was pointed out and criticized by the Electronic Frontier Foundation. Specially now that we can save the messages.

20.- The terms still talk about specific programs of advertising where the user may have the option to opt-out or in. The thing is that advertising in the service has been discarded as a monetizing way.

21.- The existence of the blue double check, its implications and the option to limit it, are not mentioned.

22.- On iPhone, you can save a conversation to iCloud. Something not referenced or explained.

23.- The terms still talk about the transfer of personal data to USA, even from Europe. Not taking into account the recent changes on the subject with the invalidation of Safe Harbor.

via GIPHY

24.- The terms says that in case of acquisition by a third party, the info from the users could be transferred to the new owner. In fact, this already happened in 2014 when Facebook bought it.

25.- The option to import data from a Facebook profile, the data imported through that process and the link created by that, is not mentioned at all.

26.- The existence of WhatsApp Web is not referenced, neither the data that could be gathering.

27.- The terms say that it’s not possible to limit the visibility of a profile according to different users. However, the settings from the app let’s you establish it to No one, Contacts or Everyone.

28.- The options “Delete account” and “Change phone number” are not mentioned. Neither its implications.

29.- The option about “Use of Storage” (the total of messages sent per user/group), is not mentioned. Neither the use of that information by WhatsApp.

30.- The possibility to activate the files saving is not referenced.

31.- The possibility to export a chat and its implications… no one knows or answers.

via GIPHY

32.- The possibility to silence a user or group is not mentioned either. For example, if I always silence groups with specific users, does it have any consequences?

33.- The option to create groups, its differences and management is not referenced.

34.- The feature that let’s you take a picture from the own app, and the metadata that could be gained from that, is not mentioned.

35.- The possibility to make a call from the app is not mentioned, neither its implications.

36.- The option to create “Distribution Lists” and its variations is not discussed.

37.- The possibility to see if someone is “Online”, even if some other features are disabled, is not mentioned.

To sum it up, we wouldn’t be lying if we say that the terms and conditions of WhatsApp have serious irregularities nowadays. Starting with the language (the terms are only available in English). In fact, that is something that a court in Germany has already established as a problem, compelling WhatsApp to translate the terms to German. But the terms and conditions of WhatsApp right now are a problem due to the huge difference between what you legally accept and what you finally use.

We’ll keep waiting for the changes…

Happy whatsapping!
—–

Seguir a @jorge_morell

La entrada 37 contradictions between WhatsApp and its terms and conditions se publicó primero en Términos y Condiciones.

4 years ago I started writing Terms and Conditions. Time goes by and the life events that come with it even more…

If truth be told, this have been quite a trip so far. Thanks to Terms and Conditions I’ve had the chance to meet some very interesting people, to access to some good professional offers, to reach out to mass media that sounded too good to be true and even to contact with institutions that seemed unattainable. Any bad things? Yeah, sure. In any case, I’ve learnt from them the same or even more than from the good ones. So, nothing to complain about.

All in all, and even taking into account everything that has been done so far, I still think that this is just starting. There is still a long way to go. In fact, I have the feeling that this 5th year is going to be specially intense.

But let’s check what we have in store for today, we are debuting the widget for the Tracker of Terms and Conditions! Developed by the great Alberto de Rodrigo.

What is a widget?

It is a small program that allows the user to access something that he or she uses frequently, and that can embedded on a website.

In the case of the widget of the Tracker of Terms and Conditions, it is a small application that allows you to embed on a website the most recent changes tracked globally, the ones from a specific service or even more.

How could I use it?

Some ideas:

• If you want to inform about the most recent changes in terms and conditions from your website, the widget can we useful.

• If your website is for example about Apple and you want to: 1) monitor all its terms and conditions, 2) check when do they change and 3) show that info to your users, the widget can be useful.

• If you want to write a post about general conditions of the agreements used by the online gambling sites and you want to show how many terms are applicable to its users all at once, the widget can be useful.

How do I generate it?

• Click here.
• Choose if you want to show the changes/texts from all the services o just from one
• Choose which kind of changes do you want to show (or/and the latest added texts).
• Choose just the Spanish or English texts (or all of them)
• Choose how many results should the widget show
• Generate the code and Copy/Paste it on your website or post

All in all, a small step for Terms and Conditions. But this game has always been about this, to advance step by step. And this won’t be the last one.

Happy Sunday!

—–

Seguir a @jorge_morell

La entrada 4th Anniversary – Now with a widget for the terms and conditions changes se publicó primero en Términos y Condiciones.

On March 15th, that means today, we celebrate the World Consumer Rights Day. By coincidence, the European platform for online dispute resolution (or ODR) went live just a month ago.

But, what is this platform about online dispute resolution developed by the European Commission?

The ODR is a one-stop counter for those cases where a user from the European Union (EU) bought online from a service based in the EU, and something went wrong. If the user wants to submit a complaint against the trader (in some countries it can happen the other way around too), and he or she wants to reach an out-of-court settlement, the platform is the meeting point for all the parties involved: the one submitting the complaint, the one receiving it and the dispute resolution body that will deal with it.

This way, the consumer who lives in the EU, that bought something online and who wants to complain for a problem related to that deal, can reach out to this European platform for online dispute resolution so:

• He or she can submit a complaint.
• He or she can choose a dispute resolution body to deal with the complaint (although both parties have to agree on and taking into account the country where the consumer lives).
• The dispute resolution body handles the complaint.
• The complaint has an outcome.

All of that without abandoning the platform, in the 23 languages from the EU and being always up to date on the complaint or even future ones.

You can find here all the different stages in the procedure.

Does the platform have any problem? Mainly that it is completely voluntary. The trader who receives the complaint is not obliged to agree to the online dispute resolution system. So, if 10 days after submitting the complaint, you have not received a reply, you will have to try other means of redress such as a consumer organization or even a court procedure.

In the particular case of Spain (as well as some other countries like Germany, Croatia or Poland) there is another important problem, they still have to choose the dispute resolution bodies that comply with the requirements from the European Commission. Therefore, the platform does not offer anyone to solve the complaint. That means that the consumers from these countries cannot use the European platform for online dispute resolutions until this issue is fixed.

The thing is that they had more than enough time to do that, almost three years in fact…

Anyway, the initiative is good and it can become useful. If you want more information about the ODR and its procedure, the FAQ section is worth the time.

Having said that, according to article 14 of the Regulation 524/2013, the traders established within the Union that engage in online sales or service contracts, shall provide:

1. Information about the existence of the ODR platform (for example a link in the email if the offer is made by email).
2. A link to it in the website of the trader.
3. Their email addresses (the ones from the traders).
4. Information about all of that in the general terms and conditions applicable.

Well then, taking into account that the Tracker of Terms and Conditions monitors how and when the services change its terms and conditions, here we have 13 services that are already mentioning the ODR or the European platform for Online Dispute Resolution according to the regulation:

• Amazon
• Air Europa
• Badoo
• Fnac
• Expedia
• HomeAway
• PC Componentes
• Pixmania
• Redcoon
• Seedrs
• Top Rural
• Tous
• William Hill

All of them inform about it (with more or less detail), some of them are already saying that they will reply to a complaint from a consumer and a few of them are are already saying that they won’t (that would be 1&1, in Spanish, or Jimdo). As we said, the ODR is voluntary.

Nevertheless, there is an obligation to inform about it. And although those 13 services are not the only ones informing about the platform, right now there is not an abundance of services mentioning the online dispute resolution European platform in its T&Cs.

In any case, let’s not forget that it is still very soon. So, time will tell.

Happy Consumer Day!

La entrada 13 services already mentioning the online dispute resolution European platform se publicó primero en Términos y Condiciones.

MailChimp, the popular email marketing service, updated its terms and conditions last week: Terms of Use, Privacy Policy and the Acceptable Use Policy.

The changes are many and some of them with special significance on a day-to-day basis.

First of all, it seems obvious that MailChimp wants to get the most information out of its users. For starters, by linking all the information already gathered to our account, as well as other data that could be collected (probably from external sources). Second, an important paragraph has disappeared on the subject of advertising. MailChimp said that if someday a Privacy Policy change to use or share more personal data happened, and the reason was for marketing purposes, you would be able to opt-out without termination. Apparently, that will no longer be possible.

Third, to improve the service and to guarantee its quality. Now a new clause allows MailChimp to have access to the subscriber data, totally or partially, to detect abusive or illegal behavior related to the distribution lists and spam.

Even then, MailChimp still shows an interest for protecting the privacy of its users: Do Not Track is partially accepted, there is a new email address specifically related to the privacy subject and they guarantee the right to access the personal data free of charge (when that’s not the case in every country).

What’s more, another significant change is setting up percentage rates to establish if the services, products or content that we are promoting through MailChimp can be or not the subject of an investigation, to the point of suspending our account. The thing is that if we have a hard bounce rate over 5% or a spam complain rate over 0,1%, our account can be reviewed, throttled, suspended or disabled.

Some other interesting changes are related to Safe Harbor, charges for add-ons or its mobile app.

Now let’s take a closer look to all those changes. I’ve included a comparative of every document, taking into account the snap from the Tracker of Terms and Conditions.

Terms of Use from MailChimp – Comparative

• The previous section 25, related to “Liquidated Damages”, has been deleted. The new section twenty-five is the one about “Attorney fees”.

• Section 20, related to “Compliance with laws”, says that you may not use the service for any unlawful or discriminatory activities, including acts prohibited by the Federal Trade Commission Act, the Fair Credit Reporting Act, the Equal Credit Opportunity Act or other laws that apply to commerce.

• In section 20 too, the mention of the “European Economic Area” has been deleted. Now it just points out to signing up the Data Processing Agreement.

• Section 17, related to “General Rules”, has lost the clause that said that “unsolicited bulk email” means spam in favor of the Acceptable Use Policy.

• Section 13, related to proprietary rights owned by MailChimp, now it includes trade secrets too.

• There is a new section 11, related to the charges for add-ons. It establishes aspects such as when the charge will happen or that additional terms may apply.

• Section 7, related to “Monthly Plans”, points out now that payments are due for any month on the same or closest date to the day the first monthly payment was made. That’s not new, the novelty is that the previous version of the text also took into consideration the day the user signed up on the service. But not anymore.

• A small paragraph about what the Acceptable Use Policy was for has been deleted.

• The Copyright Policy is now included as one of the documents that can be considered as the terms and conditions of the service. Only the mention is new, the text was already available.

• Section 36, related to “Amendments and Waiver”, has lost a clause about the possible application of additional terms. Although that clause has been gained by section 41, related to the “Entire Agreement”.

Privacy Policy from MailChimp- Comparative

• Section 11, related to the Distributions Lists, points out an important change. Before the modification, the terms and conditions said that the distribution lists were not sold or shared. The new version of the text just says that they are not sold. The thing is that now MailChimp can obtain aggregate information from the distribution lists, so it can use that data to detect ilegal behavior. That means that a distribution list can be shared with an Internet service provider or an organizations anti-spam as a way to fight against abusive conducts.    

• Sections 14 and 15 have two important updates on the subject of “Compliance”. First of all, the reference to Safe Harbor and how MailChimp adhered to it, has disappeared. So, in case of a data transfer from Europe to USA, the users of the service located in the EU or Switzerland must request the updated data processing agreement (which incorporates the corresponding Standard Contractual Clauses). In second place, now the Privacy Policy expressly says that the service operates in United States, that the information from its users is processed and transferred to that country and that we consent that. 

• The new section 16 is about the users of MailChimp that live in Australia. The platform says that is subject to the Privacy Act 1988 or Australian Privacy Act, although with some specific points.

• There is a new section 18, related to the “Do Not Track” option. MailChimp does not monitor or follow any Do Not Track browser requests, although some of features of the platform may.

• Section 17 now says that there is no charge for an individual to access or update his or her personal information.

• For questions related to the security of the personal information there is a new channel of communication: privacy@mailchimp.com

• Section 5, related to “Information Collected”, says that data such as the operating system, birth date, purchase history, localization, gender or occupation, is shared with the service too. That information, as well as other pieces of data, is processed and transferred to United States. The collected information is stored in association with the user account, as well as other information that MailChimp could gather about us (external sources probably).

• There is a new section 7, related to the data collected  by the users, that mainly establishes how the data from the subscribers can be accessed by MailChimp. That means that a user from the service is responsible for obtaining the appropriate permission so MailChimp can collect and process the information about those individuals (the subscribers).

• Section 2, related to “Changes”, has lost an important paragraph about advertising. Before the modification, the terms and conditions of MailChimp said that if a Privacy Policy change to use or share more personal data for marketing purposes happened, you would be able to opt-out without termination. Well, that clause has been deleted.

• In section 2 again, the term “material” has been included when talking about the kind of changes that MailChimp will notify its users. That means that now the service will notify only the material changes of the terms and conditions (although the term “material” is not defined). Nothing else.

• Section 1, related to “Definitions”, includes as a new concept “Aggregate Information”. This information could be about a user of the service or the subscribers and includes data such as: emails, names, IP addresses, location or demographic information.

• MailChimp keeps using the TRUSTe seal, although now it has reduced the extension of the text that talks about it.

• There is a new paragraph about the information that MailChimp collects through the use of its mobile app. It doesn’t say anything very surprising. In fact, it points out that the information gathered is not associated with any other personal data from the user.

• The reference to the Flash cookies has been deleted.

• There is a new section 9, related to contests and sweepstakes.

• Section 1, related to “Definitions”, now establishes the concept of “Subscriber”, a person that a user of MailChimp has contacted through the service.

Acceptable Use Policy from MailChimp- Comparative

• As was already said, there are two new percentage rates to establish the termination of an account. First, the hard bounce rate must be less than 5%. Second, the spam complaint rate must be less than 0,1%. If a user has rates above those levels, the account will be reviewed and could be suspended, throttled or disabled.

• Besides, if the platform detects that you are sending bulk mails, you must be able to point out to an opt-in form or show other evidence of consent for the bulk email. That clause was already there before the update, but now there is more emphasis on it.

• The section related to “Best Practices” has been reduced considerably. Although you can find all that content through blog posts linked there. For example, before the update it said that the permission to send promotional content lasted for 12 months. Now a post from the beginning of 2016 about the same subject reduces that period to 6 months.

• There are new services, products or content that should not be promoted through MailChimp, such as selling Likes or followers for a social media platform.

• Now services as Mandrill or Tinyletter are also subject to the Acceptable Use Policy, as well as the rest of the terms and conditions of MailChimp.

And that’s it for today.

Happy mailing!

La entrada MailChimp wants to squeeze more data from its users | Starts rating your spam se publicó primero en Términos y Condiciones.

Síguenos en |     

In September of 2015, Terms and Conditions debuted its new logo and a new initiative, a Legal LAB. Well then, after some hard work, the first fruit of the LAB is here, the Tracker of Terms and Conditions.

WHAT IS THE TRACKER OF TERMS AND CONDITIONS?

A big evolution of the previous and more primitive version that I’ve been using for the last two years as a “handmade” way to track when and how the terms and conditions change.

The new tracker is an active surveillance tool that almost in real time tracks and monitors what service has changed its terms and conditions, when has that change happened, what document changed, the percentage of text that was modified and how did it change relative to the previous version of the document.

WHO ARE THE CREATORS?

From the Terms and Conditions “Legal LAB”, the creators of the Tracker of Terms and Conditions are: Jorge Morell Ramos, this humble servant :p, and Alberto de Rodrigo Aparicio, a developer obsessed with the idea to make the most out of the legal engineering. For more information.

WHAT INFORMATION DOES THE TRACKER OF TERMS AND CONDITIONS OFFER?

Besides the data already mentioned and shown below in the picture  (who changes it, when does it change, what does it change and how does it change), the tracker also says what kind of change it was. That means that every change detected is tagged taking into account if it was notified or not to the user and the type of content modified.  

That way, using a color-system, the user can know if an important change was notified or not (green or red) or if the change was not important (orange). For more information.

Then, using your RSS feed reader, you can be up to date with all the changes, or just the ones from a particular company or service. Just follow the breadcrumbs > > > from a specific change.

HOW MANY SERVICES DOES THE TRACKER OF TERMS AND CONDITIONS MONITOR?

Nowadays, a little over 5.200 services and more than 7.000 terms and conditions. However, those numbers grow daily (sometimes more, sometimes less).

About the numbers, one important fact is that right now the tracker monitors the privacy policies of more than 4.000 services that were adhered to the now invalid Safe Harbor Framework. That means that 90-95% of the services that complied with Safe Harbor are tracked by the Tracker of Terms and Conditions.

HOW MUCH DO I HAVE TO PAY FOR THE INFORMATION FROM THE TRACKER OF TERMS AND CONDITIONS?

Nothing.

The last change from every text is available for everyone and this is not going to change for the time being. But as has already been said, the purpose of the “Legal LAB” from Terms and Conditions is to do legal engineering and share the knowledge gained out of it.

So, all the info is available for free and probably more is coming in the future.

Well then, here it is the Tracker of Terms and Conditions.

I hope it can be useful.

Happy tracking and read you later!

La entrada When and how do the terms and conditions change? We know it! :D | The Tracker of Terms and Conditions is born se publicó primero en Términos y Condiciones.

Hello world, I start a new adventure

The goal of this new initiative is to analyze and comment the huge amount of pages from the terms and conditions that invade our digital life and that we accept without much hesitation.

The idea has been around for quite some time now, but I wasn’t doing much with it. The subject has always interested me but I couldn’t find a good website about it in Spanish, or even in English. Beyond the major cases that happen from time to time, I was looking for one site exclusively devoted to analyze the terms and conditions of the digital services and products that we use. Because let’s not fool ourselves, the world of the terms and conditions stands for way more than Facebook, Google or Twitter.

Then some few weeks ago I read something that made my mind up. According to this, we would need 76 work days to read all the privacy policies that we blindly accept during a year. “Nonsense!”, I thought.

Well then, let’s see if we can help to reduce that period a little bit, and at the same time we improve the security and visibility of the terms and conditions that we accept.

I know that there will be days where I’ll feel like giving up. I know that I’ll have to invest quite some time reading and looking up for information, but I think that in the end it’ll be positive because I’ll have to explore new subjects and go over the ones that got rusty.

Needless to say that my goal is not to analyze the terms and conditions of the usual services, although that will happen too. The idea is to review the usually unknown ones that nevertheless are used by millions of users every day.

See you soon, then!

—–

Seguir a @jorge_morell

La entrada Hello world! :-) se publicó primero en Términos y Condiciones.