Is it unlawful to benefit from discounts on customer accounts without the customer knowing? The question has to do specifically with Amazon AWS services but maybe the question can be more generalized as in the title. Also, the jurisdiction is Japan but I imagine the practice described below could be carried out anywhere. We are using AWS EC2 services, which is sort of like renting virtualized servers on the cloud, through a 3rd party vendor. We recently found out that the vendor was applying Savings Plans, which are cost discounts you receive in exchange for long term commitments to use AWS services, and other cost saving methods to our account without our knowledge. What this means is that due to the Savings Plans, etc. the actual cost of AWS services is lower. However, in the monthly billing from the vendor we are charged the full amount (no discounts), and the vendor pockets all the cost savings. Over the last year from this practice the vendor has been able to make extra tens of thousands of dollars. The point of contention here is not that we are being overcharged or that the billing is incorrect. We are being billed what we initially agreed to, which I guess is the &quot;full price&quot;. The issue is that there is nothing in the contract that states that the vendor can benefit from discounts on AWS services that we, not the vendor, are using and paying for. In addition, we did not even know about the existence of Savings Plans and other cost saving measures and there was no explanation from the vendor, and so it could be said that the vendor willingly benefited from our ignorance. (The vendor claims that they explained about AWS cost saving measures but nobody at the office I work with remembers any such explanation). So is there anything unlawful here? Is there any legal recourse? Or is this just lawful, albeit yucky, behavior?
You have a contract with the 3rd party vendor. The 3rd party vendor has a contract with Amazon. These two contracts are not related in any way.
No, it's not legal. The General Data Protection Regulations (GDPR) apply given that you are in the UK (regardless of where the Data Processor is based). The UK GDPR is slightly modified due to Brexit, but the same principles apply. The only plausible legal basis for this actions would be that you consent to it, and you're entitled to withdraw that consent at any time. Some may claim that Article 6.1(b) applies, i.e. that it's necessary to send marketing email in order to fulfil the contract, but GDPR is clear that bundling such consent into a contract for service simply to permit the data processor additional actions isn't allowed, as I'll demonstrate. UK GDPR requires that consent to use your personal information (in this case, your email address) for the stated purpose be freely given. Consent to use your information for direct marketing is not freely given if it's inseparable from the consent to use it for some other service, as per para 43: Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. And Article 7.4 backs this up with When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. The intent of Article 6.1(b) is that only the processing required for the service you have bought is allowed (e.g. if you supply your address for delivery of stuff you've bought, the data processor can use that address to send you the stuff, but is not allowed to add a contract term that allows them to send you unwanted stuff). Examples of emails that Article 6.1(b) would allow (in my assessment) include things such as notification of upcoming downtime, or a reminder that subscriptions are due, but not unsolicited advertisements for other products. There's a grey area that's open to interpretation, where adverts are piggybacked onto actual service messages.
If I understand your question correctly, you have some clients who have paid you for services that you have not yet provided and, indeed, they have not yet requested. Is this correct? The accounting term for this is a "prepayment". The correct accounting treatment is to increase an asset account (your bank account) and create a liability account (Prepayments or something similar). You need to talk to your accountant about how to treat these for consumption and income taxes. Legally, these people are now creditors of your business - just like all of your suppliers and employees. There is no legal requirement to escrow or otherwise treat this as trust money. Basically, if your business goes bust they will lose their money. This is something that you should have dealt with in your contract with your customers - if you are running an online business then you should get a lawyer to revise your terms of service to cover things like how they can ask for a refund (and how long you have to get it to them) and how long (or if) they forfeit the funds. As it stands the money effectively becomes yours after whatever time under a statute of limitation applies to transactions of this type and size (under whatever law applies to the contract) since after that time they cannot sue to get it back.
People running web servers are generally liable for contributory culpability, when some user breaks the law by putting the material on the server. There are legal mechanisms for relieving the server guy from this burden. The best-known mechanism is "DMCA takedown", where you publish contact information so that an offended person can serve up a proper legal claim that you are distributing material that they own copyright to. If you follow the rules, you may enjoy "safe harbor" protection against contributory liability: one of the requirements is that you have to take infringing material down. The specific requirements can depend on the nature of the liability and jurisdiction, but generally involves a "hands off" involvement where the person has no knowledge of what's going on on his server. So just disclaiming responsibility does not work. There are other more serious violations, such as distribution of child porn or transmission of top secret information. Jurisdiction is not totally central to internet questions, and I could sue you (the server guy) in US courts, or (depending on the offense: copyright infringement of a particular item) in UK courts. Nailing this down specifically to Sweden is harder, but recall that The Pirate Bay had a whopping judgment against them.
No, the only purpose of a money order is that it's effectively a form of guaranteed cash that only one person can access. There are no additional protections offered by it. However, given that you are amenable to paying a little extra to facilitate your payments, you may want to consider using a credit card in the future. Provided it's not an all the time thing, credit cards will withhold payments on your behalf if a vendor fails to fulfill their obligations. This means that you're not liable for the cost of the merchant sending you the wrong thing or ignoring your order requests. I've personally done this for several things: Hotel reservation that was borderline unsuitable for human habitation. When a vendor failed to send something I'd purchased. When proceeding with this, bear in mind that the credit card company will want you to make such a claim as soon as possible and to provide as much information as possible to support your claim. If you've e-mail chains, save them. If you've been communicating by phone, write down and provide a summary of your communications. If you have an issue, don't wait a month to raise the concern, do it within a week. Probably about once a year I need to do something like this. Generally what this does is it starts a dispute process whereby the credit company will contact the vendor to get their side of the story (usually they don't respond to them either). After 60 days, the charge is dropped from your bill and presumably the credit card company refuses to pay for the disputed item. Ultimately, this gets you the best possible result. You get your money back and you didn't have to go to court to do it.
No Let's consider a similar scenario. If you made a beverage which poisoned a number of people, would you be absolved of liability because you gave it away for free? Of course not. As there is no contract between you, they would have to bring an action against you in the tort of negligence or negligent misstatement OR under consumer protection law. To succeed at tort they would need to prove that you owed them a duty of care; from Donoghue v Stevenson "You must take reasonable care to avoid acts or omissions which you can reasonable foresee would be likely to injure ... persons who are so closely and directly affected by my act that I ought reasonably have them in contemplation ...". Most cases will founder on your inability to foresee the use to which your software may be put. Consumer law is jurisdiction specific but they generally contain warranties that what you provide (gratis or otherwise) is fit for purpose, merchantable and that you do not make false and misleading statements. There is a chance that a case brought under this sort of law could succeed as you have not limited the purpose, specifically declared that it is not of merchantable quality and have (presumable) said what it does so that, if it doesn't do what you said, you have been misleading and deceptive.
The GDPR does not outlaw such processing of personal data. It merely regulates how and for what purposes you can process personal data. In general, you can conduct any processing activity as long as it has a clear purpose and a legal basis. Here, the purpose would likely be something like “conducting business with my clients” and the legal basis would be a “legitimate interest”. A legitimate interest always requires a balancing test that weighs your interests against the interests and rights of the affected persons. For example, can the affected persons reasonably expect such processing activities? In a professional setting, it can probably expected that business partners keep notes about contact persons so your intended processing could be fine. The GDPR does impose some general constraints. There are general principles like data minimization and storage limitation – you should only collect data that is necessary for your purpose, and shouldn't store it for longer than necessary. You should think about appropriate technical and organizational measures (TOMs) to protect the processing activity, for example about how your CRM is hosted, how backups are made and how security updates are installed, who has access to the personal data, and how the people with access to the personal data can be trained. For example, such training might inform your employees that they can only use the data in the CRM for business purposes, but absolutely not for personal purposes like asking Gina from reception out for a date.
Your question has two distinct aspects which have to be considered separately: criminal law and civil law. I will give an opinion on both aspects, but first I have to give you a word of warning: This case is not clear in the sense that the law can be immediately apply. For a full answer you need the services of a practicing lawyer who does the necessary research. I have a degree in German Law and I have had some practice in IT law, so I know what I am talking about, but I am currently not practicing it and I have done no research for this case. So please, pretty please, don't base any important decision on my opinion. It is a mere guidance, not more. Criminal Law The German Criminal Code (StGB) specifies two cyber crimes explicitly: Computer Fraud (Computerbetrug, § 263a StGB), which you violate when you gain some illegal monetary advantage using a computer, for example a hacker using your stolen credit card data to transfer funds to his account. Computer Sabotage (Computersabotage, § 303b StGB), which applies when you cause damage with a computer, for example a hacker attacking the power grid. The second option clearly does not apply here, but the first one could. That would depend on the answer to a couple of questions, most importantly if a user would gain some monetary advantage at your expense and if that advantage would be illegal. The first of these questions (advantage at your expense) already does not have a clear and universal answer. As it is quite common with fraud, this criminal law question has a civil law aspect (more on that on part two of the answer). The two ways how this could create an advantage to an attacker world be... A contract would not be enacted between you and the attacker, but he would take advantage of you believing in the contract's validity. This option would though probably not apply here, judging from the (spoiler alert) civil law part of the question. A valid contract would be created, but the terms and conditions would not apply and that would cause an illegal financial advantage for the attacker at your cost. Since the base contract would still be in effect and that comes with the obligation to pay, that advantage would have to be in the terms and conditions not applying. You can construct such a case, but that would depend on the terms in question, so there can not be an answer here. There is though a good chance that the terms would still apply (see below), so there will probably be no damage. The other aspect is if this advantage would be through illegal use of the system, which is an interesting question in your case, since the link is publicly accessible. But, then again you can also fake a POST, so you can argue that it is always possible to make the terms not appear. An aspect to be considered though, is that merely attempting computer fraud is already an offense. An attacker who thinks he can gain a monetary advantage from such an attack could be still punished, even if it is not even possible to commit the crime due to the circumstances (this by itself is an interesting question in criminal law). The bigger danger that I see is that your solution makes it easy for an attacker to make their own site and then use your public link to book on your site (in a man in the middle attack). That would clearly be an offense, but it would be the attacker's not your client's. But since your success depends on the trustworthiness of your site, I would recommend to look for a safer solution (such as POST with https). To summarize that part: There is a possibility that accessing the site in the described way is a crime, but I would say it is rather not due to the lack of damage. It is though possible that an attacker still commits a crime by attempting such an attack. You should in any case make your site safer to make it harder to commit MITM attacks. Civil Law The civil law side is whether the terms can be accepted in the described way. This is a case for the law of general terms and conditions (Allgemeine Geschäftsbedingungen or AGB). In a few words, for AGB to apply, the have to be notified to the client and he has to accept them. If your site is used how it is supposed to be, both conditions are met. In the (invalid) way you have described, the first condition is in question. Since the user knows that using the described URL means accepting the terms, I would consider the second condition to be satisfied. So how can the terms apply if the user has not seen them? In case you provide no shortcut to the accepted link and you also prevent that it can be found in another way (e.g. through a search engine), the direct link would be equivalent to someone signing terms and conditions without reading them, although he has had a chance to do so. That would still make the terms apply, because the client would have been given the chance to read them, which is the only thing the seller needs to do. So chances are that your terms would still apply (thus negating the financial advantage necessary for a crime). However, AGB law is a complex subject that is generally handled by specialists. Any opinion of someone who is not such a specialist has to be handled with care. That includes my opinion.