Why aren&#39;t email providers liable in some way or another for scams operated via accounts on their domains? Suppose a spam email tells you that you've earned $1m. To get the funds the email goes on to tell you to email joe.schmoe@gmail.com. My question revolves around why Gmail doesn't block "joe.schmoe@gmail.com" on the spot when it detects such an obvious fraud (which it correctly marks as spam), so that less savvy users don't take the unfortunate step of getting defrauded out of their savings with little to no recourse. A real life equivalent might seem to be a driver who waits for the hitchhiker they picked up while the latter does a bank heist, and continues on with their passenger after they're done. Surely such a well meaning albeit naive driver wouldn't stand a chance in court if they said that it's because they've a section 230-like protection. Also, given the amount of spam I receive that actually use Gmail accounts, I presume -- but have not checked -- that the accounts do not get disabled quickly by Gmail and others. (Some do answer, with amusing results.) This is on the basis that fraudsters would use an actual domain name if email account providers did block these emails quickly. Why do Gmail, Hotmail, etc. get away with enabling bank wire fraud? Is section 230 indeed the reason that they do? Has this ever been tested in court as a class action in the US or elsewhere to see where it leads? To clarify what is being asked: This is not about blocking e.g. Gmail accounts that send spam, nor is it about detecting spam. Rather, the question is about blocking e.g. xyz@gmail.com in emails that Gmail already identifies as spam (with near 100% accuracy) in a format that revolves around: Congratulations, someone gave you lots of moneys. Please email xzy@gmail.com for instructions on how to collect it. Further, the question is not why doesn't Gmail stop such emails from being sent. Rather, it is: Is section 230 indeed the reason that they get away with not shutting down accounts like "xyz@gmail.com" in the above example quickly when they detect such emails without being held liable? Has this ever been tested in court as a class action in the US or elsewhere to see where it leads?
Surely such a well meaning albeit naive driver wouldn't stand a chance in court if they said that it's because they've a section 230-like protection. Because Section 230 of the Communications Decency Act explicitly protects computer service providers from such charges. A driver is not a computer service provider, and the US legislature has never voted to offer similar protection to drivers picking up hitchhikers. You say that an email can easily be classified as fraudulent, but that's not true. Spam detection has gotten pretty sophisticated, but they still get plenty of false positives. They were a lot less sophisticated back in 1996 when the Communications Decency Act was passed.
In theory, such an action could be considered a violation of the Computer Fraud and Abuse Act, specifically 18 USC 1030 (a)(2)(C): Whoever...intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer; Where the relevant "protected computer" definition is in the same section under (e)(2)(B): As used in this section...the term “protected computer” means a computer...which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; Every computer connected to the Internet is used in interstate and foreign communication. One could imagine a situation where a prosecutor might use this particular quirk of the CFAA, for example if Jody was evading bans in order to harass someone and the prosecutor wanted to throw the book at her, but I'd guess most prosecutors would not pick up such a case if Jody's ban evasion didn't cause any damage.
You seem to have a solid understanding of the ePrivacy implications, but lack a fundamental insight: your organization does not have a right to achieve its mission or a right to disseminate unwanted marketing. But other people do have a right to not be subject to excessive marketing. Of course, reality is more complex, so it's probably not entirely impossible to do marketing. In your point 1, you note that some EU/EEA/UK countries distinguish ePrivacy protections between consumer and business subscribers. You can research the exact rules in the potential customer's country. This may allow you to email corporate/business accounts. I would strongly advise against messaging via Linkedin if there is a chance that the person is using that account for personal purposes like networking or hunting jobs, not just for conducting official company business. ePrivacy has markedly different rules for email marketing vs phone marketing. Whereas there are pretty strict rules for electronic messages and robocalls, manual cold calling can be OK from an ePrivacy perspective. However, many EU/EEA/UK countries have rules that go beyond ePrivacy, and may have a kind of do-not-call registry that you must respect. Of course manual calls take more effort than spamming emails, but recall the above point that you don't have a right to spam other people. Phone calls are probably the most appropriate approach when the company lists individuals' phone numbers on its website. This will at least give you a few seconds of attention with a real human, more than you can expect from an email that is likely to be caught by spam filters. Marketing via physical mail tends to have very lax rules. Note that every company/business that has a website will have to disclose its contact details including an address there, so this information is easy to acquire. However, chances are low that anyone would seriously engage with that marketing. You can consider alternatives to direct marketing, so that interested companies eventually come to you. Things like press releases, writing guest articles in industry publications, speaking at relevant conferences, working on search engine optimization, buying ads. On the GPDR aspects: GDPR and ePrivacy overlap, and it is necessary to comply with both sets of rules (GDPR likely applies here via Art 3(2)(a)). But where they potentially contradict each other, ePrivacy as the more specific law has precedence. For example, ePrivacy overrides the default GDPR legal basis rules when it comes to email marketing to existing customers (opt-out basis, no consent needed) or to using cookies (needs consent unless strictly necessary). Information that relates to corporations is not personal data, but information that relates to individual employees or to sole proprietors would typically be personal data. Since you are unlikely to obtain consent for using this data, you would need an alternative GDPR legal basis such as a &quot;legitimate interest&quot;. Relying on a legitimate interest requires that you conduct a balancing test, weighing your interests like marketing against the recipient's interests, rights, and freedoms. Core question in this context is whether the data subject can reasonably expect their personal data to be used like this, taking into account the nature of their relationship with you. Since there is no pre-existing relationship, claims of a legitimate interest are weak to start with. However, it may be possible to argue that when a company makes employee contact details available via its website (not LinkedIn!) then relevant marketing can be reasonably expected. I would rather not rely on such arguments, though.
Generally, you are permitted to contact people for whatever reason you would like. However, I would caution that you familiarise yourself with the various spam laws they have been enacted in your jurisdiction and also in those of your prospective recipients. Some of these laws merely impose conditions on the manner in which you can send unsolicited email, others prohibit it in certain circumstances. I don't intend to traverse each jurisdiction, but Wikipedia has an apparently comprehensive list. There's no reason why you can't refer to your employer, but you should note the relevant advertising and libel law in your jurisdiction and ensure you don't run afoul of these. Finally, consider whether you are breaching any terms of use of the site from which you are obtaining this data. Although you've mentioned it's publicly available, and the enforceability of browsewrap agreements is questionable, it may be legal hassle you don't want to incur.
A contract can’t legalise illegality Let’s assume that absent the “simulation” disclosure in the ToS, this would be fraud. The question then becomes, does making the disclosure make it not fraud? Fraud requires dishonesty and deception. These are measured by what a reasonable person would determine from the overall conduct so a small piece of truth in amongst a web of half-truths and outright lies is still dishonest and deceptive. From the perspective of US law, is Bob doing this regarded a scam? No, but only because “scam” isn’t a legal term - it’s slang for fraud and this is fraud Is this a criminal case, or a civil case? Both What evidence can Tom provide to support the lawsuit? Whatever he has. However, in practice, these types of fraudsters are rarely ever caught and it’s even more rare for the victim to recover their money. They are usually off-shore in countries with either poor rule of law or which will not extradite their nationals.
HIPAA imposes obligations on some people, but not all people. In the case of security and privacy questions, you would consult 45 CFR Part 164. A patient's actions are not subject to government sanctions, so a patient can provide or decline to provide email addresses following their own judgment. A healthcare or insurance provider would be required to securely keep PII under wraps. The regulations also do not impose obligations on unknowing potentially involved third-parties, i.e. no obligation is imposed on Google to know that an individual is using a Gmail account to transmit PII-related information. The medical provider has an obligation to store and transmit such information securely, which would mean for example that they do not send insecure plain text emails saying &quot;Sally Jones at 12345 67th Ave SW was treated for a loathsome disease, we're coding that as 0102, and we want $500&quot;. That obligation is passed on to employees via employment-contractual obligations, for example that may dictate what computer or software you can use to do the job. If the provider passes the buck to the employee (and I assume that the employee is just an employee), they have violated the security rule. In that case, they may be attempting to mitigate the consequences of their actions or at least check if there were identifiable violations of the privacy rule. In the scenario where SmithMed provides all of the infrastructure needed to bill insurance companies, it is not a HIPAA violation to inspect computer logs, email etc. to verify that the employee has been complying with security and privacy policies. It would likewise not be a HIPAA violation to inspect third-party accounts (Gmail etc) to determine whether there has been a security / privacy rule violation. That is as far as HIPAA takes you. Whether or not the ex-employee has an obligation to turn over their email account information is mostly determined by the employment contract, but it is highly unlikely that any such contract has a &quot;gimme your personal email on termination&quot; clause. It is not inconceivable that the employee negligently used their personal account rather than opening a new billing-job only account. Also depending on the email service provider, it may well be a violation of the terms of service to hand over your account information. (Instead, for a certain email provider, the company is expected to set up and pay for a company account). Those are considerations bearing on possible legal impediments to turning over the email information. Needless to say, don't share passwords etc. because that exposes you legally, but that is not about HIPAA.
You need to look at the domain registrar's TOS to determine their polices for canceling a domain after the fact in the way they did, i.e. claiming the domain is "premium" and as such allowing them to cancel and raise the price and re-offer the domain. The registrar may, in fact, have such a policy in their TOS that you agreed to when you opened an account with them and registered a domain. "Clicking through" and accepting a TOS is a binding contract. Their policy may hinge on an "escrow" hold on the domain for a certain time until your payment clears, they do due diligence, or other reasons, and by agreeing to the TOS you allowed them to reserve the right to cancel or re-offer the registration. However, such a policy is at least (I think) ethically challenged and at most could be illegal - US and local laws in your your jurisdiction may come into play - in terms of ICANN's policies. You may have success opening a complaint with ICANN, the international organization that oversees domain registrars and works to resolve complaints such as cyber-squatting, issues with the way registrars operate, etc. See Registrant Rights and Responsibilities Under the 2009 Registrar Accreditation Agreement - ICANN. If the registrar doesn't have a clear policy on the form of cancellation and re-offer you have been subjected to, your next step is definitely looking at Dispute Resolution Options - ICANN. Keep all your documents and emails, and log all phone calls or chats with the registrar. Make screenshots of your Cloudflare account and Google's web cache. And, it might be helpful to do a Google search for that registrar and "domain cancellation" or more relevant keywords to see if anything similar has happened in the past and the outcomes; those stories may give you ideas for other options. You may also need to find a local lawyer to advise you on your next steps, or talk to a free legal aid clinic in your area.
The customer list is indeed a trade secret if the shop kept its customer list secret and has an advantage from having that customer list, while others don’t have it. And I would think that is the case, because a competitor laying their hands on the list could for example send special offers to the customers in the list. The question is whether your two hairdressers took that customer list and whether the store has reasonable evidence that they did. If customers find out where their favourite hairdresser moved to that’s no legal problem. Can’t understand why no attorney wants to take the case. To the attorney it doesn’t make a difference whether they took the list or not. If they took the list then his or her job is to end the case with the smallest possible amount of damages being paid. PS. Just read in the comments that there is an accusation of "intentional interference with economic relationship". I would want a lawyer who knows the difference between perfectly legal competition which includes trying to get customers to move their business, and "intentional interference with economic relationship". PS. Really make sure that these guys appear in court. With a lawyer. Not appearing means that if the plaintiff says "Judge, these guys did X, punish them!" and they are not there to say "We absolutely didn't do X, prove it if you can", the judge will assume that they did X.