©2001 A. Paul Mahaffy. All rights reserved.

Although millions of dollars have already been made and lost in the new economy, many are still anxious to cash in. As a CGA, you know you have skills that sell, and now you are eyeing the Internet as a new means to sell them. After all, you think to yourself, how difficult can setting up an online business be? You reserve your domain name with a credit card, cobble together a Web site with some help from the kid next door, get it hosted by your neighbourhood Internet Service Provider (ISP), and then wait for the work requests to pour in.

Sure, there may be some downtime before your online brand gets the recognition it deserves. And the IPO may have to wait a few months. In the meantime, you may also have to depend on more traditional ways of doing business to pay your ISP hosting fees. But maintaining a Web site is a low-overhead operation, so you can hang in there.

Or so you thought. One day, you get a phone call from some people in a far-off land. Or you receive a letter, an e-mail or even a personal visit. They're not happy about something on your Web site. It may be your site's domain name (www.ILoveTax.ca) or the name you've given to your online service ("Big Bad Tax Tips"). Or it may be the graphics that neighbour kid used when designing your site. Maybe it's a link you've made to another site or even a message posted in your site's chat room.

You may then find yourself accused of trademark and copyright infringement, breaking consumer protection and competition laws, engaging in defamation, distributing pornography and more. You could even find yourself subject to civil claims for damages or injunctions, or, worse still, to criminal prosecution.

It probably had never occurred to you that your Web site could get you in trouble beyond the Canadian border. After all, your site is lawful from a Canadian perspective. But remember that anyone from anywhere in the world can access your Web site. So, even if you think you should be subject only to the laws and the courts of the province and country in which you live and work, you can actually become subject to the laws and the courts of any land in which people can view and use your Web site. Yes, you can fall within the grasp of a very long arm of the law. And that's part of the trouble with e-commerce - the laws that apply to it are many and far between.

A Web of Jurisdictions

The Internet is a collection of thousands of independent computer networks scattered around the world. While this may make it seem anarchic, it is certainly not unregulated. The popular notion of the Internet as a lawless society is not a result of an absence of laws that deal with the Internet; it is a result of the confusion created by the existence of too many laws. These laws, which originate from countries worldwide, are difficult to reconcile when applying them to e-commerce.

Your online business, therefore, can become subject to the rules and regulations of distant jurisdictions, even though you may never have intended to reach their residents. To add more confusion to the mix, online transactions may comply with the laws of one jurisdiction while at the same time run afoul of the laws of another.

Ordinarily, a province or country asserts jurisdiction over activities that take place within its own territory or over the people who reside there. Unfortunately, it is often difficult to determine where online activities actually take place and where people participating in those activities actually reside. Do these activities "take place" where the Web site is developed, where it's hosted (on a server), or where the user is located? There is no clear answer. As a result, more than one province or country may claim that an online activity took place or affected people within its boundaries.

A few recent court decisions illustrate just how easy online activities, which appear to be in one jurisdiction, are subjected to lawsuits or prosecution in another.

Setting Precedents

Take the British Columbian case of Braintech, Inc. v. Kostiuk [(1999), 171 DLR. (4th) 46], for example. Vancouver-resident John Kostiuk made some unflattering remarks about Vancouver-based Braintech on an Internet bulletin board aimed at investors. Braintech sued Kostiuk for defamation. Now here's the twist. The company sued him not in Vancouver but in Texas, a state well known for its generous damage awards. The District Court of Harris County in the State of Texas granted Braintech a $300,000 US judgment against Kostiuk even though he didn't even physically appear before the court. Why did the Texas court assert jurisdiction? Braintech maintained an office in Texas, had some Texan shareholders, and Texans were able to read Kostiuk's remarks online.

The lawsuit did not end there, however. Braintech then went before a Vancouver court to enforce the Texas judgment. Kostiuk argued that the decision should not be enforced because the Texas court never had jurisdiction. The Supreme Court of British Columbia disagreed and upheld the decision. Kostiuk then went before the British Columbia Court of Appeal and successfully argued that his posting some bulletin board comments was not equivalent to entering the boundaries of Texas, so the state should not have any jurisdiction. The Court threw out the Texas judgment.

In the New York case of Bensusan Restaurant Corporation v. King [(SDNY 1996), 937 F. Supp. 295, aff'd 126 F. 3d 25 (2nd Cir. 1997)], a Columbia, Missouri jazz club named "The Blue Note" was sued for trademark infringement by the better-known New York jazz club of the same name. The New York club argued that the Missouri club's Web site, which promoted the "Blue Note" name and sold tickets to club performances, was accessible to patrons of the New York club who might assume the two clubs were somehow associated. Fortunately for the Missouri club, the United States Court of Appeals for the Second Circuit decided it didn't have jurisdiction because the Web site wasn't purposefully directed at New York and didn't have a sufficient enough connection with the state.

Both the Braintech and Bensusan cases show how someone engaging in online activities in one jurisdiction can end up being sued in another, and probably incur considerable cost to avoid liability. Luckily for the defendants, the courts found both to be insufficiently connected to the distant jurisdiction in which they were being sued.

However, in the case of State of New York v. World Interactive Gaming Corp [Sup. Ct. N.Y. Cty., July 22, 1999] the opposite was found. The Supreme Court of New York court found a sufficient connection to the distant jurisdiction to create liability. World Interactive, a Delaware corporation, delivered an online gambling operation through its Antiguan subsidiary, which set out to limit access to the Web site to residents of jurisdictions where gambling is legal. However, a New York court found their good intentions didn't follow through in practice. It seemed that a resident of New York, where gambling is illegal, could give a false address in order to access the Web site, since the site was not equipped with address verification. In fact, the New York attorney general obtained access to the site by providing a false address and then obtained an injunction in the New York Supreme Court preventing the site from dealing with New York residents.

The decisions in these and similar cases suggest that the operation of a Web site that is accessible to persons who reside in other provinces or countries is not a sufficient reason for those other provinces or countries to assert jurisdiction. The Web site must be more than just accessible to them; it must direct some action at those residents. The courts seem to make a distinction between information that is "pushed" on to residents and information that is merely "pulled" by them.

Some degree of interactivity between these residents and the site is necessary before those other provinces or countries can claim jurisdiction. Has the site, for example, deliberately reached out to non-residents or entered into contracts with them?

Protective Measures

There are some ways to protect your online business from liability in distant jurisdictions, but they come at a cost. For starters, you could limit the interactivity of your Web site. You could, for example, restrict site access to residents of specific jurisdictions by means of blocking software, as well as post a notice on the site explaining these restrictions. You could also have a section in your online agreements or terms of use that specifies the particular laws and courts that govern your Web site's activities.

You could also post a disclaimer on your Web site that warns users that, since you operate the site from offices in a city in Canada, you make no assertions that the site's content is appropriate for, or complies with the laws of, any other jurisdiction. You could further note that compliance with local laws is the responsibility of each user.

But there is only so much protection an online business can achieve by using such measures without jeopardizing its ability to expand into new markets. After all, a major benefit of doing business via the Internet is to reach the vast potential customer base outside of existing sales territories. On the other hand, in order for businesses to fully realize the benefits of going online, they need to be reasonably certain which laws apply to their activities.

The governments of major trading countries are trying to meet this need by harmonizing e-commerce laws, policies and self-regulations across international borders in order to make law enforcement and compliance easier. The European Union, for instance, has been particularly active on privacy and e-commerce.

However, some fear that, instead of facilitating e-commerce by providing certainty and encouraging freedom, these government-only initiatives will dampen e-commerce by imposing highly restrictive standards and conditions, which may be too broad or vague in application.

Continuing Debate

In the meantime, online businesses need more voluntary codes of conduct and other private-sector initiatives to clarify which laws should govern online transactions. Some business organizations have been advocating a universally adopted custom and eventual law (conventions followed by observing businesses by incorporating them as terms in their contracts) that would see business-to-business dealings governed by the law the parties choose and business-to-consumer dealings governed by the seller's jurisdiction.

Under this "rule-of-origin" approach, online businesses would not have the impossible task of trying to familiarize themselves with the laws of every jurisdiction where every potential consumer resides. They could also avoid having to develop a number of jurisdiction-specific Web sites and selling procedures. While large, established businesses are often familiar with setting up operations that comply with local laws in many jurisdictions, smaller and newer ones aren't. The "rule-of-origin" approach is intended to encourage all businesses to get online. Although a definite help to businesses, such an approach could effectively deny consumer recourse against sellers too far away to sue.

So the debate continues. Whatever rules and arrangements will eventually result, online business owners need to stay informed so they can avoid that long arm of the law.

BACK TO ARTICLES INDEX