Blockchain based insurance policy brokerage - requirements and restrictions I have some questions regarding the concept and legality of a blockchain based peer-to-peer insurance platform. A little background: The basic idea is for people being given the possibility to &quot;insure&quot; another users private property, whatever that may be in any specific case. The insurer would then have the opportunity to claim profits on a timely schedule, while the insured could claim the collateral provided by the insurer, if the requirements both parties agreed upon were to be met. The insurance contracts themselves would be initialized, maintained and eventually resolved through a series of transparent open sourced smart contracts. Smart contracts are essentially little programs, that run on the blockchain. The can be reviewed by anyone interested. Questions: Is it legally necessary to formally record such a relation between two (or more) private persons? With the crypto space currently being so very unregulated, are there even laws applicable to this matter? How difficult would it be for users of such a service to declare the income generated through anything related to the platform? Would this be regarded as a form of self-employment, would they have to register a company or any of the likes? Would the platform itself, being the service provider, have to be registered in any way? The main aim of the platform would of course be income generation. Legal accountability: Would we need to explicitly declare a disclaimer to prevent being sued if a user considers the rejection of their claim unjust? Since this is a peer-to-peer system, the platform itself will mostly be uninvolved in the decision process. Instead this will be the duty of an independant third party comprised of individual users. Could the platform be held accountable in case of lost user funds? Only if the platform were at fault? (as in, did the platform's source code cause the issue?) Can a strictly blockchain based platform even be sued? Only if it is legally registered? Is there an exact legal counterpart as to the role the platform would assume in this system? It provides the framework upon wich the insurance policies are designed, contracts are established and payouts are issued. It does not directly take part in insurance business. Feel free to let me know, if any further clarification is needed. Edit: Since jurisdictional specification was suggested, let's assume it to be Switzerland and the U.S.A.
Although crypto space may be little regulated, insurance is in most jurisdictions highly regulated. Any such arrangement would need to comply with current laws on insurance, until and unless modified laws to cover this sort of thing are passed, and then it would need to comply with those. Tax authorities generally allow one to declare &quot;other business income&quot; or &quot;other investment income&quot; without forming a legal entity. I cannot say how such income would be classified in any given jurisdiction. Whether the platform, or some legal entity associated with the platform, would need to be registered will depend on the current laws and regulations governing insurance, and on the way in which teh contracts are structured. A disclaimer cannot prevent one from being sued. The contracts would need to carefully and explicitly state who is liable for what. Programs cannot be held accountable for anything. Legal entities, including operators of programs, can be. If negligence in the creation or operation of a program causes a loss, the operator may well be liable. Programs cannot be sued for anything. Legal entities, including operators of programs, can be. It may well be essential to constitute the &quot;platform&quot; as a legal entity of some sort. Otherwise its operator will be liable for its actions. I cannot be sure. I once encountered a somewhat similar system in which insurance was provided by individuals exchanging contracts, so that in a sense each member insured all the others. There was a company that supervised and provided legal and administrative services to the group of individuals, and collected fees for this. That sounds a bit similar to the suggested platform, but I don't know exactly how that company was organized. The system was called &quot;NJ CURE&quot;. I don't know if it is still in operation.
You can’t “mislead or deceive” in “trade or commerce” in Australia It is flat out against the law to mislead or deceive - you can’t lie, you can’t conceal salient facts, you can’t tell half truths, you can’t even tell the truth, the whole truth and nothing but the truth if that could be misleading. The fines are huge (for example), plus the contracts are unenforceable, plus the reputational damage is extreme. The types of practice that you describe would result in orders to return the premiums, plus fines plus probably revocation of the licence to be an insurer in Australia if they were systemic. This is particularly true of insurance companies - the legislation that applies to them is enumerated here.
What Big Tech is doing is spending a lot of money on lawyers and appeals – doesn't matter if it costs millions if you can make money in the meanwhile. Facebook stores a lot of user data in the US. Initially, this was allowed because the US was recognized as offering an adequate level of data protection under the Safe Harbor and later the Privacy Shield Framework. Then Schrems I and Schrems II happened and the adequacy recognition was ruled to be invalid. Does Facebook pull back their user data? No. The GDPR offers alternative reasons why you might process data in foreign countries, such as “standard contractual clauses” (SCCs) or “binding corporate rules” (BCRs). Now, Facebook claims that they are using SCCs. Is this valid? Almost certainly not due to the issues of US law analyzed in the Schrems II case, but it can take years for the next round of court cases to work its way through the system. And when Facebook's use of SCCs is ruled invalid they will probably try BCRs next, and once that is over a decade will have passed and the US might actually have achieved an adequate privacy level by then. You do not have Facebook-style money to spend on lawyers and endless rounds of appeals, so you should avoid legally risky things such as outsourcing data processing activities to companies in the US (this doesn't mean you can't be compliant if you are a US entity). I mentioned adequacy decision previously. There is a list of countries that the EU considers to be sufficiently safe. Currently, the more notable countries involve Canada, Israel, Japan, New Zealand, Republic of Korea, Switzerland, and the United Kingdom, in addition to EU/EEA countries of course. If you want to process data in a location that is OK for both the UK and the US, then looking at companies in one of these countries is a good idea. For example, if most of your users are in the US but you would like your servers to be in a country with an EU adequacy decision, then looking at Canada could make sense. Even outside of this list, you can process data if you implement additional safeguards via SCCs. However, this requires a case by case analysis of the legal environment in that country. One problem with the US is that it has national security laws that impose requirements on companies in a manner that is incompatible with SCCs. A company bound by these US laws cannot enter into such a contract where it guarantees the privacy of your user's data. Countries other than the EU have much more tedious data residency laws. The GDPR does not impose any data residency requirements in the sense that data must not leave a particular country – you just have to ensure that the data is properly protected. In contrast, Russia and China have real data residency requirements that are fundamentally incompatible with the GDPR.
You're misreading the law. You need to keep reading the section you referenced (emphasis added): The disclosure...shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business Thus, the option to have the disclosure sent by mail only applies to consumers who do not have an account with the business. Since presumably a large number of sites only maintain personal information for users with accounts, such sites need not provide a mail option. Further, it doesn't say there needs to be a button: you just need the ability to say you'd like it mailed to you in the request somehow, and then they need to comply when you do.
As was mentioned in a comment, in the United States, businesses are generally registered at the state level. The information collected, and the extent to which or manner in which the public has access to it, varies from state to state. There may still be states where that's a paper-only process, but I'd guess in most of them it's accessible online, at least for basic information. For example, in Michigan the Department of Licensing and Regulatory Affairs has a Business Entity Search tool. If a business deals directly with consumers, it may be a member of the Better Business Bureau. Even if it isn't, but consumers have complained about it, the BBB will make public the information it has about the purported business. If a company is publicly traded (that is, it's corporation that issues stock, and the stock is traded on a stock exchange), it is required by law to be registered with the Securities and Exchange Commission. The SEC's EDGAR tool will display the company's filings, which should include annual and quarterly reports. If the company is or wants to be a government contractor, it generally needs to register with the General Services Administration, and certain information about successfully registered entities is publicly viewable in that system. (Conversely, the same system also lists "Excluded Parties" who are prohibited or partially restricted from doing business with the government.) Depending on what the business does, it may also be subject to registration with and regulation by additional state or federal agencies. For a full picture, however, unless you're dealing with the obvious agent of a Fortune 500 company, you'll probably want to get information from a private credit-check service as well; for example, as also mentioned in a comment, Dun &amp; Bradstreet for the business itself, or for a really small business a personal credit report on each of the owners and officers.
To do so I used some images and Gifs which may be under copyright but since I don't earn money for myself and there is no company backing me I was hoping that there is some protection for private persons like me who just want to showcase the project. Sorry. If your website is public facing (i.e. not password protected and available only to family and close friends), you need to follow copyright law. There is no exception to copyright just because a project is run by an individual for non-commercial purposes. I am also insecure about the GDPR regulations since I give users the ability to create an account and try it out. Your profile says you're in the EU. Then you need to comply with the GDPR. Is there any way to protect me against greedy lawyers and companies? Could I write something like: "This website is a peace of art" and save myself with arguments like "artistic freedom" or "free speech"? Nope. A controversial website run by Peter Sunde had at one point a "free speech" disclaimer (similar to the one you propose) posted. However, Sunde did never use this defense in court: Finnish court slaps Peter Sunde with €350k fine. If he had shown up in court, I am pretty sure the court would have told him that such a disclaimer has no legal merit. The only protection that will make you completely safe is to adhere to the law.
This would appear to be a simple application of contract law - the exchange of money for a promise (to sell at a fixed price in the future). Option contracts are only regulated if they relate to options over securities (like company shares) - not if they are over personal property (like baseball cards).
Is it legal in the US for a company that rents out car parking spaces, to bundle the renting of a parking space to buying insurance for the content of the parked car? Yes. Honestly, I'm a little surprised that I've never see this practice in real life. All things not prohibited are allowed, and there is nothing, per se illegal about bundling services and requiring them to be purchased as a package deal (there may be some licensing issues for insurance sales involved, but those would probably be easily overcome). Sometimes bundling gives rise to an anti-trust violation, but neither the parking lot operation business nor the car insurance business are so consolidated that this would fairly be viewed as some kind of anti-competitive practice.