Can an auto-reply be considered assent/agreement? The CEO of a certain company set multiple important public email accounts to autoreply to all messages with the poop emoji. Importantly, there is no indication that it's an autoreply. Someone had the funny idea to send the account an email with a contract to sell the company for a small (but not unreasonable) amount along with &quot;If you agree, reply with the poop emoji&quot;. And the account replied as expected. Practically, I'm sure this won't work. But, what is the legal explanation for why not? Why is this reply not considered an agreement to sell the company? Fun follow-up: Could someone get out of a contract by proving that their email agreeing to it (e.g., &quot;Yes, I agree to the contract&quot;) was an autoreply? (assuming US laws)
Why is this reply not considered an agreement to sell the company? Because a sender's opportunism regarding the bizarre contents of the autoreply preclude a finding that there is a meeting of the minds. Could someone get out of a contract by proving that their email agreeing to it (e.g., &quot;Yes, I agree to the contract&quot;) was an autoreply? It mostly depends on the element of authorization to set up the autoreply that way. If the person who wrote the autoreply was authorized by the user of the email account to set it up that way, the contract binds the user. This form of blind and reckless formation of contracts is an extreme scenario of Restatement (Second) of Contracts at §154(b). The contract might be null and void as unreasonable, contrary to public policy, and/or on other grounds. But a wide range of scenarios would fall short of warranting a nullification of the contract. (Disclaimer: I am affiliated with the linked site.)
When someone registers at your website, they enter a contract with you. You need an email address, because you need to be able to contact them (at least for the password recovery). You probably want to verify the email address, otherwise you might not be able to contact them in the future. So the email verification is required as part of the performance of the contract. But also anti-spam laws might require you to use confirmed opt-in before you are allowed to send automatic emails. So at least Article 6(1)(b) (performance of a contract) would apply, but for the confirmed opt-in also Art. 6(1)(c) (compliance with a legal obligation) might apply. That means sending the verification mail is lawful. However you probably want to write this down in the privacy policy as Greendrake commented. Note that there must not be an option for users to agree with the privacy policy, it is just a statement which you make.
How should I proceed? I am asking law friends to recommend some employment lawyers, but other than this, can I do anything else? You definitely don't need an employment lawyer for this. From a legal standpoint, the matter is very simple: If you grant their request (whether by signing or otherwise expressing your acceptance), you would be waiving any remedies currently available to you for their breach of contract. The company's attempt to override its contract with you is quite naive, but the company can always (and evidently does) try to get away with its liability nonetheless. I would not be surprised if the company subsequently tries harder to intimidate you, but that does not change your legal position &amp; merits unless you sign the waiver the company is pursuing. Asking for your post-termination availability reinforces the notion of company's poor planning and subpar management.
Thus how ought these advertisements be rectified? What's more correct to write than &quot;no contract&quot;? Words don't mean the same thing in every context. In the world of cell phone contracts, the well accepted meaning of &quot;no contract&quot; is that you are getting cell phone service on a month to month basis and may cancel at the end of any given month with no penalty, in contrast to the previous norm in the industry that you needed to continue service for a period of one or more years before you could cancel or you would pay a penalty for discontinuing it early. This usage has spread to Internet service as well. There is no need to correct or rectify this. Nobody believes that there is no agreement governing the cell phone company-customer relationship. They aren't confused or misled. McKendrick is simply using a different sense of the word than CanNet. In the same way, the word &quot;company&quot; can mean a legal entity, but can also mean, the people whom you have with you at a given time, even though they have the same root meaning. Likewise, sometimes &quot;sex&quot; means &quot;male or female&quot; and sometimes it means something you do for enjoyment and procreation. But people manage to keep the two senses of the word, which are related to each other, straight, even in statutes. Context prevents confusion. There is no need for words to have only one meaning in all contexts and even within the law, many words mean different things in different situations. This is especially true in common law systems where words are given definitions in a piecemeal case by case manner, rather than due to a single person or committee making a top down decision on what a word's legal meaning should be in all contexts.
Yes, it triggers the GDPR obligations Considerations: Can you surely identify those residing in Europe? In that case you should ask them to sign up again and confirm the consent. A lot of mailing lists are doing just that. Did they previously give consent and you can document it? If so, then you can argue that you have the required consent. Do you have business in Europe? If not then I don't think they would bother to go after you. You could just walk away from the fine. What other personal informastion are you storing? If you know who reside in Europe then you already have more info than just the email. The email address itself wouldn't be much of a documentation issue, SAR or Portability task.
You say the permission was "public", therefore I am going to assume that it cannot be argued that there was no agreement. There are two possibilities: If Company B has given consideration for the promise then there is a binding contract and Company A may be able to end it but could not seek redress for when it was in place. If there is no contract then the principle of promissory estoppel should have essentially the same effect. An agreement, including an IP licence, does not have to be in writing nor does it have to have any particular form.
No, you're not required to sign any contracts. But since you're offering a service, you do have to manage some compliance tasks. You are a data controller under the UK GDPR, regardless of whether you have a company. This brings with it various compliance requirements. For example, you MUST post a privacy notice in accordance with Art 13 GDPR that explains how you process user's information. You must sign data processing agreements with your data processors, such as your server providers. And you should reconsider transfers of data to the US, since such transfers are illegal or at least quite questionable in the wake of the 2020 Schrems II ruling. You now have prospective users that are asking you for an Art 28 data processing agreement (DPA). These are likely other organizations that are data controllers of their own. For them to use your browser extension, they either need to find a legal basis that allows them to share their user's/employee's data with you (controller to controller transfer), or they need you to act as their data processor (controller to processor transfer). The third alternative is not to use your plugin at all. Of these, a C2P arrangement is most convenient for these other orgs, but involves a bit of paperwork to set up first. If you want to act as their processor, this doesn't mean you'd have to create a company (though a corporation might be very desirable as a liability shield). Being a processor means that you're contractually bound to only use the personal data as instructed by the controller, and not for your own purposes. This restricts what you can do, and has some special compliance requirements. For example, you cannot engage new subprocessors without your controller's approval. However, processor status can also be convenient for you because you're not responsible for interacting with the controller's data subjects, e.g. you're not responsible for handling their data subject access requests. Note that it's possible to simultaneously be a controller for some users, and a processor for others. E.g. Google Docs is offered directly to users as a B2C product so that Google is a controller, but also as a B2B product as Google Workspace, where Google acts as a data processor. Personally, I'd rather not sign any contracts unless I'm doing it as a business, and adequately compensated for providing this service. GDPR is only one compliance aspect out of many, making it unwise to offer a SaaS product as a hobby. For example, copying other people's web content has copyright implications… A potential alternative for some of the organizations asking you might be to make it possible for them to self-host your backend, so that they are not required to rely on you as a data processor. If you have no plans to commercialize your software, making it Open Source could be a solution. But you're in no way required to do that if you don't want to.
The website owner brings in an expert programmer who testifies that the user cannot have gotten to a certain part of the site (or download, etc.) without having clicked to accept the terms of service, and that this document they're holding is a true and correct copy of the terms of service as of that date. That's evidence in favor of the site, and an adverse party has to have stronger evidence in order to overcome it. If the person didn't save a copy of the terms themselves, they'll have a hard time on this. Then the other party's attorney tries to discredit the programmer by asking questions like "how do you know there are no bugs in the software which could have allowed somebody to reach this without agreeing to the terms of service" etc. Apparently, some sites don't require users to click indicating agreement. If the company has significantly changed the site, terms of service, etc. since the time the user registered, and doesn't keep any copies of old versions around, and admits this, they'll have a hard time enforcing an agreement (as they can't produce a copy of it). If the user kept a copy, the user might be able to present that. It's up to the finder of fact to decide what to believe and how much weight to give the various witnesses' testimony.