Addressing The Risks of Doing Business Online

NOTICE. THE INFORMATION PROVIDED IN THIS ARTICLE IS OF A GENERAL NATURE AND IS DESIGNED FOR INFORMATIONAL PURPOSES ONLY. THE INFORMATION DOES NOT CONSTITUTE LEGAL ADVICE. Because every business situation is unique, and every legal situation dependent on the particular facts of the case or transaction, you should seek the personal assistance of a qualified attorney who can thoroughly review and analyze all aspects of your specific business or legal situation.

Advertising Every Web site, regardless of whether it employs banner, pop-up or other advertising can itself be considered a form of advertising. Therefore, traditional advertising laws apply with equal force to the content and messages that make up a Web site. When a Web site adds cross-marketing and promotional advertising this implicates contractual issues.

When evaluating online legal risks, the first question to ask is whether the Web site complies with applicable advertising laws. Certain products or services advertised on the Web site may not be available or legal in all areas. You should indicate the jurisdictions for which your Web site is intended. Determine which messages must be uniform and which must be tailored for specific audiences and beware of comparative advertising restrictions. Also note that licensed professionals -- doctors, lawyers, etc. – face additional advertising restrictions.

If your Web site contains pricing information, examine applicable trade laws for antitrust, deceptive or predatory pricing issues. Examine internal systems for channel conflict or global pricing issues such as currency shopping.

If you are using banner advertising, or placing your advertising message on Web sites that you do not control, document your relationship. Pay particular attention to contractual issues such as rights and obligations for timing, placement, trademark usage, context and integrity, payment, maintenance and enhancement or modification. It is recommended that you also view a demo of the finished product prior to its launch.

Indirect Sales Often, to avoid channel conflicts, companies will choose to use their online presence as a vehicle to drive sales to Value Added Resellers (VARs) or telephone sales representatives. Where pricing information is available from the Web site, ensure it is uniform, comes from independent sources and include statements that the price seen on the Web site may vary from that of the reseller.

Although the Web is viewable 24/7, everywhere and anywhere, geographic issues do arise. The population for whom the message is intended should be clear. Do not run afoul of international laws that may cover certain transactions such as domestic liquor laws or import/export restrictions. Do not process transactions with ineligible jurisdictions. One notable case involves the auctioning of Nazi memorabilia on the French version of Yahoo. Due to a French law making it illegal to exhibit or sell objects with racist overtones, a Paris court ordered U.S.-based Yahoo to block access to the Nazi material from French Internet users. Yahoo sued in a California District Court. The Judge there ruled last year that the First Amendment barred the French court from regulating Yahoo's speech on the Internet. The French plaintiffs have appealed the ruling to the 9th Circuit and that appeal is still pending.

Personal Data Collection Almost all Web sites collect and extrapolate information about their users. Ostensibly this information is used to enhance the users’ experiences by providing customized services. This is an area of growing concern and there are steps you can take to ensure the fair use of information while allowing individuals to participate in decisions on the disclosure and use of their personal information.

If the Web site makes use of personal information, a link to the company’s Privacy Policy should be prominently placed on the home page and easily accessible throughout the Web site. The Privacy Policy should at a minimum contain information addressing issues of notice, choice, access, security and enforcement.

Notice. Consumers are entitled to notice of collection, use and disclosure of personal information. Notice should say what is collected how the Web site operator intends to use it, to whom the information will be disclosed, and the consequences of refusing to give the information; it should also address the issues of choice, access and security.

Choice. Consumers should have choices about how their information is used or disclosed beyond the original purpose for which it was provided (e.g., to complete a transaction). Choice may be “opt-in” (“click here to receive valuable information from our sponsors”) or “opt-out” (“click here if you do not want to receive new product announcements”). “Opt-in” affords stronger privacy protection because it establishes a default rule against disclosure and use.

Access. Consumers should have access to stored information about them and an opportunity to correct inaccuracies or delete data.

Security. Web sites should develop and employ policies and procedures to protect the security of the data and ensure its integrity and accuracy.

Eli Lilly and Company (Lilly) agreed to settle Federal Trade Commission charges regarding the unauthorized disclosure of sensitive personal information collected from consumers through its Prozac.com Web site. On June 27, 2001, a Lilly employee sent an e-mail message that included all of the recipients' e-mail addresses within the "To:" line of the message, thereby unintentionally disclosing to each individual subscriber the e-mail addresses of all 669 subscribers. The FTC complaint alleged that Lilly's claim of privacy and confidentiality on its Web site was deceptive because Lilly failed to maintain or implement internal measures appropriate under the circumstances to protect sensitive consumer information, which led to the company's unintentional disclosure of subscribers' personal information (i.e., e-mail addresses).

A Company should employ a four-stage information security program to establish and maintain reasonable and appropriate administrative, technical, and physical safeguards to protect personal information against any reasonably anticipated threats or hazards to its security, confidentiality, or integrity, and to protect such information against unauthorized access, use, or disclosure. Specifically, company’s should:

• designate appropriate personnel to coordinate and oversee the program; • identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of personal information, including any such risks posed by lack of training, and to address these risks in each relevant area of its operations, whether performed by employees or agents, including: (i) management and training of personnel; (ii) information systems for the processing, storage, transmission, or disposal of personal information; and (iii) prevention and response to attacks, intrusions, unauthorized access, or other information systems failures; • conduct an annual written review by qualified persons, within ninety (90) days after the date of service of the order and yearly thereafter, which shall monitor and document compliance with the program, evaluate the program's effectiveness, and recommend changes to it; and • adjust the program in light of any findings and recommendations resulting from reviews or ongoing monitoring, and in light of any material changes to company operations that affect the program.

Enforcement. These principles must be enforceable to be effective. You should have procedures in place to address infractions.

The issues outlined above are certainly no substitute for consulting a qualified lawyer to examine the risks of your particular venture. Next month we will examine issues of Online Delivery, Online Sales combined with payment processing and traditional delivery, Online Sales combined with payment processing and Online Delivery and Dialogue or Interactive Services.



To learn more about this author, visit David M. Adler's Website.

Like this article? Share it with your friends

Related Articles
MANAGING RISK
	A risk management approach should continuously monitor risk through activities such as identifying, analyzing, mitigation planning, tracking, and controlling risks. Additionally, risk management programs balance the...
MITIGATING RISKS FOR AFRICA'S GROWTH BUSINESSES (SMEs)
	PRESENTATION AT THE JAI/ADB 2ND ND AWIB TRAINING WORKSHOP SEPTEMBER 19-23, TUNIS, TUNISIA BY PETER KIBIRITI, CEO, CORPORATE AFRICA LTD CEO,NAIROBI, KENYA AUGUST 2005
Internet Branding
	A lot of people, especially small business owners, are wary of relying to heavily on the Internet for business means. Sure, it can drive traffic here and there, but why risk another dot com fallout like what happene...
A sinking "Titanic"
	Perseverance is one of the main requirements for a small or medium business owner who wants to be successful in today's complex business world. However, it will not help you as business owner to persevere while sail...
“Ten Most Significant Risks and Costs of Unethical Behavior in Business, According To Your Strategic Thinking Business Coach”
	The business world has been shocked and rocked by major corporate scandals involving unethical behavior. The real “poster” companies of ethics violations include: Enron, Tyco International, WorldCom, Global Crossi...

---

Related Forum Posts
	Willing to Fail Your Way to Success
	Always Assumed a Man...
	good question!
	Re: Would you risk your friendship for your business?
	Calculated Risks
	Risks using independent contractors
	Need Advice for online Business.
	Online vs. Offline Marketing