E-commerce and Legal Compliance

Transcription

1 E-commerce and Legal Compliance Moving all or part of your business online can be an exciting time, opening up a range of opportunities and new markets for you and your business. Hand in hand with these opportunities comes the exposure to a whole host of unique issues and areas of potential liability. Whether you are launching your business online or already have an existing online business, it is important to ensure that your website and your online business is compliant with relevant laws and regulations to protect your position in the event of a dispute or complaint. This article provides an overview of the terms and conditions and policies that can help you achieve this. E-commerce terms and conditions Your terms and conditions set out the terms of your legal relationship with your customer, however, using your standard terms and conditions on your website simply does not go far enough in complying with the law and regulations governing e-commerce. The first consideration to bear in mind in relation to your e-commerce terms and conditions is that the content will vary depending on whether your customers are businesses or consumers (being customers purchasing other than in the course of business). Unsurprisingly, consumers are offered greater protection than business customers and selling to consumers means that you are subject to a whole raft of additional legislation. However, this does not mean that business to business suppliers get off lightly. As one of the hazards of trading online is not knowing who your customer is and whilst you might expect all or majority of your customers to be business customers, there may be instances when your website is accessed and used by consumers. Protecting yourself and your business in such cases requires you to either have two sets of terms and conditions, one catering for business customers and one catering for consumers, or to incorporate terms relevant to both business customers and consumers within one set of terms and conditions. In the interest of efficiency, the latter is often the preferred option. Of course if your customers are predominantly consumers, you may prefer to have just one set of terms and conditions applying to all customers, as this would cut down on an additional administrative layer. Updating existing e-commerce terms and conditions Having e-commerce terms and conditions on your website is only the beginning of the process. It is also important to ensure that there are regularly reviewed and updated. Diarising an annual review of your e-commerce terms and conditions and other website policies will enable you to comply with any new legislation, such as the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 which came into effect in June In the event that your e-commerce terms and conditions were drafted prior to this date, you should arrange for them to be reviewed to ensure that

2 they meet any additional requirements imposed by the regulations. The main provisions of the regulations, which only apply to consumer contracts, include: A requirement to make it clear where proceeding with the transaction will trigger payment (for example by labelling the order button with order with obligation to pay ); A right to cancel the contract within a 14 day cooling off period, although this can be extended by up to 12 months if information about the right to cancel is not provided; An obligation to deliver goods within 30 days unless otherwise agreed; and A ban on the use of premium rate telephone numbers in relation to existing contracts. It is important to note that the above only details some of the provisions of the new regulations, speak to a lawyer for a full review of your existing e-commerce terms to ensure compliance with the regulations. Cookies Curb your excitement, we re not talking chocolate-chip cookies here. Instead we re looking at website cookies which are files that are implanted by website operators, or advertisers, into the hard disks of users and collect information such as user preferences, names, addressed, e mail addresses and passwords. Often seen as a necessary element of contracting online, they are typically used to provide a better shopping experience for the customer. However, businesses should be aware that European Directives impose certain requirements in relation to the use of cookies, the most recent of which came effect in In the event that your website policies pre-date this and had not been reviewed since then, it is advisable to arrange such a review to ensure that you comply with the requirements of the directive. The requirements of the Directives are two fold and can be summarised as the requirement for consent and requirement to provide information. The requirement for consent entails obtaining user s consent to the use of such cookies, prior to the cookies being implanted. In the UK, such consent can be explicit, for example by using pop-up windows or splash pages (similar to age verification pages) or implied whereby consent can be inferred by continued use of a website which has a prominent cookie notice. A cookie notice, which links to your cookie policy, is therefore an essential part of being a website operator in this country. The information obligations imposed by the Directives require that clear and comprehensive information should be provided to the user about the purpose for which the cookies are stored and accessed. As such, having a detailed understanding of which cookies are used on your website and the purposes for which they are used is crucial, and a cookie audit is an effective way to achieve this.

3 Cookie Audit A cookie audit can be a useful way to gain an understanding of the cookies used on your website and comprises of the following steps: 1. Identify the cookies operating on your website list all cookies, including third party cookies (for example placed by advertisers) and make sure that any redundant cookies are deleted; 2. List the purpose of each cookie, does it perform a function essential for the running of the website or a non-essential function; 3. Identify what data each cookie holds, including whether the cookies are linked to other data held about a website user, in which case the provisions of data protection legislation may apply; and 4. List the types of cookies used. Session cookies expire at the end of a session and are less intrusive where as persistent cookies are more permanent. Once a cookie audit has been conducted, the information gathered can be incorporated into a cookie policy, which can help you get one step closer to a legally compliant website. Privacy Policy In providing your goods and services online, you will undoubtedly be collecting personal data and therefore be subject to certain legal obligations under the provisions of the Data Protection Act 1998 (DPA). The first data protection principle within the DPA is the requirement for fair and lawful processing of data. For website operators, this requirement can be broken down into three elements: 1. Ensuring that website users are aware of the identity of the person or organisation responsible for operating the website and of anyone else who collects personal information through the website, such as advertisers; 2. Ensuring that users are aware of the purpose for which the information is collected and how it will be used; and 3. Providing any addition information to users to ensure that the processing of data is fair, for example, users must be made aware of any disclosures of data to third parties. Similar to a cookie audit, a data audit to assess the information collected from users and the reasons for such collection is good practice and the information gathered from such an assessment can be

4 used to draft a privacy policy which details the business practice on collecting, storing and using such personal data. It is, however, important to note that a privacy policy used in isolation will not suffice to comply with the requirements to Data Protection legislation. In addition, a privacy notice which provides brief information about the use of data and which links to the privacy policy should be prominently displayed wherever personal data is collected, ideally prior to the collection of such data (for example just above the submit or agree button). Failure to comply with the provisions of the DPA can have serious consequences, including criminal proceedings and liability for fines and damages and it is therefore essential to ensure that you have a well drafted privacy policy and notice to offer you some protection against such sanctions. Acceptable Use Policy In entering the e-commerce arena, your website is accessible to anyone around the globe with an internet connection and from the outset you need to ensure that you have a policy in place surrounding the access to, and use of, your website. Such a policy can be relied upon to protect you in various ways by: protecting your intellectual property and preventing the unauthorised reproduction of material on your website; preventing unauthorised access to your website; and avoiding unwanted and undesirable behaviour such as hacking, introducing viruses and uploading illegal or defamatory content. An acceptable use policy also allows you to remove any offending material from your website and suspend, or permanently disable, a user s right to access your website. A well drafted policy can allow a website owner to make a claim for damages in the event that a user breaches the terms of the policy, for example by introducing viruses. What Next? You now have an overview of the various policies and documents that can be used to protect your position online and ensure legal compliance. If you have some or all of these policies in place already, it is a good idea to seek legal advice and have these reviewed by a lawyer to ensure that they are up to date, and if you do not have any website policies or terms, you are potentially exposing yourself to a great degree of risk and should strongly consider seeking legal advice. However, before you do consult a lawyer, there are some things you can do to ease the drafting process and to ensure that your policies meet the needs of your business: Know your selling process, from the processing of an order to its delivery. Your e-commerce terms can then be drafted to incorporate this process; Test your online selling process. By testing the process yourself, you will get an idea of what works and what does not, for example, is there space for your privacy notice before users submit personal data?

5 Consider the complaints you have had in the past, particularly if you already trade online. Discuss these with your lawyer to identify ways to overcome the complaints or cater for them within your policies; Consider undertaking some training or training your staff to ensure that relevant legislation, regulations and policies are adhered to. It is no use having well drafted policies if they are not followed; and Once you have your policies in place, diarise to have these reviewed regularly. Finally... You should now be well protected online and all that is left for you to do is enjoy and exploit the benefits and opportunities offered by e-commerce. This article is not intended to constitute legal advice and professional advice should be sought for individual circumstances. Should you require any advice on purchasing a small business, a member of the Grindeys team would be happy to assist you.