The new terms of service pushed out this week — which are mandatory for all PSN users — include an agreement that waives the right of any individual to sue Sony on a collective basis (i.e., through a class action).  More specifically, the new terms of service create a binding arbitration procedure for any dispute that cannot be resolved in small claims court, and that binding arbitration must be conducted only on an individual basis, rather than as part of a collective.

Upon acceptance of these new terms, PSN customers have 30 days in which to provide Sony notice that they are opting out of these terms.  The full document (changes highlighted in red) outlining Sony’s PSN terms of service is available here [pdf].

Given that acceptance of these new terms of service are mandatory (failure to agree results in being blocked from the service after 30 days) and that reading those terms of service through the PSN system is a multi-page effort, it is doubtful in the extreme that the average gamer will be aware of these changes, much less go to the trouble of sending Sony written confirmation that they are opting out of the waiver.  The overwhelming majority will simply click “accept” without thinking.

The terms of service severely limit the legal rights of users of the PSN service, but are presented to the end user in a fashion that encourages unthinking click-through, and makes no distinction between limiting the rights of a trained professional who considers the bargain and consents, and the rights of a 14 year old who just wants to shoot aliens with his friends.  This demonstrates two fundamental problems with such verbose click-wrap agreements.  First, the mere clicking of an agreement cannot be shown to truly offer consent, and courts should not rely on it as such, especially when the waiving of legal rights is involved.  As a result, the entire purpose of click-wrap agreements to obtain consent needs to be rethought.  Second, it cries out for an approach to communicating contractual agreements to non-lawyers that does not require a grounding in law.  Doctors are required to be able to communicate with their patients in a manner that allows the patients to have informed consent, rather than speaking only in professional jargon.  In my view, there’s no reason a similar standard ought not to spread to the legal profession.

Duffy’s identity was revealed after the police obtained his IP address from the internet sites he posted on and then connected it to his ISP user information with the co-operation of his ISP. Duffy plead guilty to two counts of sending malicious communications in contravention of the UK Malicious Communications Act, s.1, which prohibits the sending to another of any article which is indecent or grossly offensive, or which conveys a threat, or which is false, provided there is an intent to cause distress or anxiety to the recipient. The magistrate in Duffy’s case found that his internet postings met this threshold, and indeed were designed solely for the purpose of causing distress to the recipients — Duffy had posted commentary and doctored images of the deceased, for instance, on memorial pages that had been set up on Facebook.

Duffy will serve 18 weeks in jail, in addition to receiving a five-year anti-social behaviour order (ASBO) that will require him to notify police whenever he purchases an internet-capable mobile phone and bans him from using social networking websites for the duration of the order.

It is difficult to imagine such a criminal provision withstanding a Charter challenge in Canada given the broad interpretation the Supreme Court has given to ‘expression’, and its reluctance to limit offensive speech unless it is likely to incite violence. So too First Amendment protections in the US would seem to forego the development of any similar law there. Nonetheless, the Duffy case offers an interesting focal point linking issues related to online social networks, free speech, cyberbulling, criminal activity, youth development, and privacy.

More info about the Sean Duffy case from the BBC here and from the Guardian here.

The court rejected the plaintiff’s claim, arguing that “the placement of a GPS device in [his] vehicle without his knowledge, but in the absence of evidence that he drove the vehicle into a private or secluded location that was out of public view and in which he had a legitimate expectation of privacy, does not constitute the tort of invasion of privacy.”

The thrust of the court’s argument is that the plaintiff, even though he was unaware he was being tracked by the device, was ‘acting in public’, and therefore could not bring himself within the requirements of the tort as it is understood in New Jersey (essentially a straight adoption of the 2nd Restatement of Torts at 652.)

Again, this shows the fundamental weakness of tort law when it comes to dealing with modern issues of locational privacy. The requirement that the information or activity over which a privacy claim is sought would otherwise have remained out of view of the public is reflective of a dichotomous understanding of privacy that is inadequate to deal with the risks and harms posed by modern forms of surveillance technology.

Source.

This raises important legal implications for non-American businesses and private individuals who wish to take advantage of a growing number of innovative cloud-based services, not least because the overwhelming number of cloud-service providers are located in the US.

The long reach of American law enforcement threatens to lower privacy and security protections for non-Americans in significant ways. International agreements need to be secured to ensure that the data of non-Americans stored on non-American servers is appropriately secure from the grasp of the PATRIOT Act. This is not to say that judicially authorized release of information is never warranted (pardon the pun), but that the authorization ought to only come from the jurisdiction in which the individual, business, or data is located.

Source: http://www.zdnet.com/blog/igeneration/microsoft-admits-patriot-act-can-access-eu-based-cloud-data/11225

In Jones, the plaintiff brought an action against the defendant for accessing her banking records improperly.  Both Jones and Tsige were employees at the Bank of Montreal (BMO), though they had never met in person.  Tsige was in a common-law relationship with Jones’ ex-husband, Moodie.  Following a dispute over their home finances, Tsige apparently accessed Jones’ financial records to see if Moodie was in fact paying Jones child support.  BMO discovered this and disciplined Tsige.

Jones claimed both invasion of privacy and a breach of fiduciary duty, however lost on both counts.  The court concluded that despite recent jurisprudential developments indicating the possibility that a free-standing tort of invasion of privacy might be emerging in the Ontario common law (see Somwar v. McDonald’s Restaurants), at this time it cannot be said to exist (the court referred to the appellate decision in Eutenier v. Lee on this point, though given that case related specifically to the duties of the police, I am not sure it ought to be seen as entirely dispositive in the manner the court suggests).

In addition to finding that there was no fiduciary relationship between Jones and Tsige, the court concludes that Jones’ only route for relief would be to bring an action under PIPEDA, since banking falls within its ambit.  This obiter seems bizarre to me, however, since it is in no way obvious that BMO itself is responsible for the privacy breach here, and  while PIPEDA indeed applies to organizations and their agents, Tsige was not acting as an agent of BMO when she accessed Jones’ records.

The end result is then that despite having her personal financial records accessed in a malicious manner, Jones is left by the courts of Ontario with no clear remedy and may even be responsible for paying the court costs of Tsige, depending on the submissions made by the parties re: costs within the next 14 days.  What is more, Tsige suffers no judicial reprimand, only an (unstated) disciplinary action from her employer.

To reiterate, this was done all without GPS services and without Spitz requesting his movements be tracked — it was automatically generated simply by his mobile phone communicating with cell phone towers.  It very much goes to show the importance of regulations that limit retention periods for this kind of data, given how detailed a reconstruction can be made of an individual’s life.

Thanks to Jan Jakob Bornheim for the link.

via Zeit Online [Google Translate]

UPDATE (Mar 26, 2011): The NYT has picked up the story.

“I see you” – The Advent of Facial Recognition — Slaw.

But in doing so, Apple has also altered the existing terms of service for any developer wishing to sell content through the iTunes store.  Apple will receive 30% from any subscription sold through iTunes.  That in itself is not necessarily new, as Apple currently takes 30% of any revenue from an application sold in the store; of course, this now becomes an ongoing revenue stream for Apple.  Even more significantly, the new terms of service mean that if a content provider in the iTunes store wishes to offer a subscription through in-app purchasing, they cannot also offer a link in the app to direct purchasers to subscribe OUTSIDE the app (ie, through the developer’s website).  Why is this significant? It means that the developer cannot escape the 30% Apple revenue grab by making it easy for their users to purchase a subscription through alternate means.  Compounding the problem is another term of service which requires content-providers to offer the same price subscription in the app as they do outside of the app, preventing them from making up the lost income by increasing the price of the in-app subscription by 30%.

Of course, it might seem commercial suicide for the owner of a shopping centre to demand a 30% cut of every one of its tenants.  But if you’re the only shopping centre in town, then it might seem doable.  This, of course, is where anti-trust laws step in, to prevent a dominant market player from abusing its position in the marketplace.  Until Google’s Android tablets come onstream to a significant degree, it seems that Apple is in the driving seat for consumer tablets.

The broader question will be whether in five years this episode is seen as a rare strategic misstep by Apple, as they focused on rent-seeking rather than pursuing innovation.

Apple Antitrust Issues Raised by Subscription-Service Terms – WSJ.com.

Apple owes it to investors to disclose more about Jobs – The Globe and Mail.

War on grow-ops in B.C. has unexpected casualties – The Globe and Mail.