Client side validation loss in profits Let's say I have found a site where you can buy some products. The site follows a typical shop flow, e.g. a shopping cart and a checkout. Now we assume that the developer made a bad decission and calculates the total amount on the client side and does not validate it any further on the server side, this amount is than passed to an online payment service. Now let's say we edit this total amount to something different then the original amount, as an example 0.01€, and pay this amount via the payment service and receive the products. Later on the site owner notices the difference and tries to sue you, what would be the outcome most likely? (keeping the ethical aspect out) Different country's have different laws so I share my thoughts with you from the german view (Other countrys welcome!): As far as I know to have a valid contract both sides have to give a "willing declaration" (Willenserklärung) following the pattern Offer + Acceptance = Contract So is a dynamically calculated price shown on your screen a valid offer you accept by submitting the digital form? Also one could argue that editing the field and sending it to the server makes it a completely new offer (stating what you're willing to pay) to the company and since they redirect you to the payment service without further notice they accept it. I would say this falls under an implied acceptance (Stillschweigende Annahme): Offer + Direct payment without further exchange = Receipt of Products (eg in a store) To set some boundaries let's say that the amount is shown as Text and not in a editable input box and the amount send to the server in some way hidden on the client. I don't know much about legals so feel free to ask if you need any other information
My thinking is that there was no meeting of the minds, thus no acceptance. ( I can see that shipping the goods implies acceptance, however I understand that acceptance implies a meeting of the minds - and there would have been subterfuge to modify the return page with the lower amount - thus at the moment of apparent acceptance there was no actual acceptance) I doubt you would have a case against the other party criminally, but quite possibly in a civil court.
Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Thus, I think it would be invalid to charge a fee for an address change if that change was made in exercise of your data subject rights. If you didn't invoke this right, it's debatable whether charging a fee would be proper. On the one hand, they can charge whatever service they want (provided that this was part of the contract you entered). On the other hand, they have an obligation to assist you with your exercise of data subject rights. This includes recognising a data subject request even if you didn't explicitly invoke the specific GDPR article. For example, refusing a request for erasure just because you didn't invoke some magic GDPR words would be clearly noncompliant in my opinion. If the company offers multiple customer service options, charging for some of them may be all right. Typically, the lowest-cost solution for a company to deal with GDPR requests is to offer an online self-service option. An email to the data protection officer would typically also be free. Charging for phone support might be fine though. In an insurance context, there could also be a legitimate claim that updating your address is not a mere correction of your personal data, but a modification of the contract (depending on what you're insuring). Another possible counterpoint (which I think is not valid though) would be that the company never stored inaccurate data and therefore doesn't have to satisfy a rectification request.
Any processing of personal data needs a legal basis, for example necessity for some contract or legitimate interest. If no other legal basis allows the processing, you need to acquire consent. Consent must be freely given. If something is gated behind consent without that consent being really necessary, this might coerce users and they would not be able to consent freely. The GDPR does not have a hard ban on this, but it explicitly calls out that this case must be considered when determining whether consent is valid. So what your company is trying to do is in a dark grey area. Not necessarily wrong, but likely so. Consent could be made free if users have an actual choice. For example, some online newspaper sites had success with a “pay or consent” wall. (Success in the sense that some data protection authorities allowed this). In your case, this could mean that users either consent to extra data collection, or that they buy some reasonably priced premium mode. But none of this is for you to decide. You can voice your doubts that the software would be compliant. You could also ask if the Data Protection Impact Assessment document for this proposed processing is available (creating such an assessment is likely mandatory in this case). But in the end, it is the company's obligation to be compliant, and this responsibility is largely shouldered by the company's data protection officer (to whom you can turn with further questions).
You ask them explicitly, maybe adding that you need that info specifically to calculate tax. IP address is not reliable because your customers could be using VPN, Tor, or be on vacation overseas. (By the way, "IP" on a website about law would more likely be understood as "Intellectual Property", not "Internet Protocol address".)
You premise is correct. The processor is someone that processes data on your behalf, and since the GDPR definition of processing is extremely broad, that is about every third party subcontractor that you use for data processing, including various cloud providers. I'm afraid it will soon become a huge mess with a gazillion contracts to sign. I disagree. Yes, the GDPR says that a contract between the controller and processor must exist, but Article 28 of the GDPR does not say anything about how the controller shall document these instructions. Basically, in cases like the one you describe where John Doe relies on a web agency for having a contact form on the web, there will be a standardized (by the web agency) service agreement between the John Doe (controller) and the web agency (processor). There is nothing stopping the parties from agreeing that this service agreement that John Doe accepted as part of the onboarding procedure is also the DPA as required by the GDPR. Putting something like the following in the service agreement would do it: The parties agree that this Service Agreement between You (controller) and Us (processor) set out Your complete and final instructions to Us in relation to the processing of Personal Data and that processing outside the scope of these instructions (if any) shall require prior written agreement between You and Us. You also agree that We may engage Sub-processors to process Personal Data on Your behalf. The Sub-processors currently engaged by Us and authorized by You are listed in Annex A. I think we will se a lot of amendments in service contracts as the GDPR gets better understood, but I don't really see a flood of DPAs in addition to these amended service contracts.
In contract law in the United States, this is a "liquidated damages" clause. It provides that when one side breaches the contract, it has to pay a certain amount of money to make up for it. Normally this is done where it is difficult to calculate the actual damages in the event of a breach, or where the parties would rather avoid calculating the actual damages--a common example is where you put in an earnest money deposit on a house and then forfeit the earnest money if you do not buy. However, there are restrictions on what kind of damages are permitted. Notably, a "penalty" usually refers to an unreasonable amount that is unenforceable as against public policy. It would ordinarily be unreasonable to make someone pay a hundred million dollar penalty for breaking a ten thousand dollar contract, for example. Liquidated damages clauses frequently say "this is not a penalty" and "the parties agree this is reasonable" to make it harder to invalidate them on public policy grounds. Instead, if the liquidated damage payment is a payment meant to reflect actual damages that are just hard to calculate, it is much more likely to be enforceable. You would need to research liquidated damages and penalties in the state whose law governs the contract to determine whether the particular clause is permissible under state law. See https://www.google.com/search?q=restatement+of+contracts+penalty&amp;ie=utf-8&amp;oe=utf-8
The website owner brings in an expert programmer who testifies that the user cannot have gotten to a certain part of the site (or download, etc.) without having clicked to accept the terms of service, and that this document they're holding is a true and correct copy of the terms of service as of that date. That's evidence in favor of the site, and an adverse party has to have stronger evidence in order to overcome it. If the person didn't save a copy of the terms themselves, they'll have a hard time on this. Then the other party's attorney tries to discredit the programmer by asking questions like "how do you know there are no bugs in the software which could have allowed somebody to reach this without agreeing to the terms of service" etc. Apparently, some sites don't require users to click indicating agreement. If the company has significantly changed the site, terms of service, etc. since the time the user registered, and doesn't keep any copies of old versions around, and admits this, they'll have a hard time enforcing an agreement (as they can't produce a copy of it). If the user kept a copy, the user might be able to present that. It's up to the finder of fact to decide what to believe and how much weight to give the various witnesses' testimony.
I find that Petri Mäntysaari: The Law of Corporate Finance: General Principles and EU Law: Volume II, p. 115-140 can pretty much explain the reasoning for this. It is in chapter 5.3 on Terms non-binding as intended. The contract might not contain all legal requirements for some reason, or a clause might become invalid due to law changes. Sometimes the contract becomes unenforceable for some reason or another in part or full. The salvatorian clause is there to fix the defective clause to become the closest estimate to the written form that is legal and not deficient instead of being just dropped from the contract. This can save a contract from becoming unenforceable or making it void in whole. Especially look at Page 140: If a contract term is invalid because of a mandatory provision of law, it will be replaced by legal background rules(§306(2) BGB). One of the standard ways to address the situation is to use a so-called salvatorian clause. [...] This [reinterpretation/fixing of deficiencies] would not happen without a specific contract term. (See §139 BGB. On the other hand see also §140 BGB. Compare DCFR II.-7:302 and II.-7:303) A caveat though: if the alteration to the clause needed is too big and substantial, the contract as a whole can become void and null, no matter what the salvatorian clause said. It cannot overcome some burdens and there are regularly courts (I know this for Germany) voiding contracts due to such serious deficiencies. Notes BGB is the German "Bürgerliche Gesetzbuch", an english translation exists §139 says "If a part of a legal transaction is void, then the entire legal transaction is void, unless it is to be assumed that it would have been undertaken even without the void part." Example: a sale lacking any payment is not a sale (which starts a legally required warranty) $140 says "If a void legal transaction fulfils the requirements of another legal transaction, then the latter is deemed to have been entered into, if it may be assumed that its validity would be intended if there were knowledge of the invalidity." Example: a sale lacking any payment can be interpreted as a gift if the intent was to do so (and does not grant warranty) DCFR is the EU Draft Common Frame of Reference, so the above rules are to be found in the document as follows II.–7:302: Contracts infringing mandatory rules - p. 565. Paraphrased: "if a clause in a contract violates a law, substitute the law for it, courts shall decide if that alters or voids the contract. They may fix contracts to cure them." II.–7:303: Effects of nullity or avoidance - p. 574. Paraphrased: "void contract (parts) can constitute unjustified enrichment, transfer of items might not have happened, courts may fix contracts to cure." From the DCFR document one can read what happens in absence of a Salvatorian clause, especially for UK law. II.–7:302: I. Contracts contrary to law 1 All European systems deal with contracts which contravene some rule of law, as opposed to contracts which are contrary to fundamental principles of morality or public policy. 5 In ENGLISH, IRISH and SCOTTISH law the standard texts all include chapter headings such as “Illegality”, or “Statutory Invalidity”. See further Enonchong, McBryde, Law of Contract in Scotland1 , paras. 19.28-19.36, and, for the confused development of Scottish law, Macgregor in Reid &amp; Zimmermann vol. II, chap. 5. II. Effects of infringement 8 The general starting point in most European legal systems is that contracts violating legal rules are void. There is often, however, considerable flexibility in the law. 14 In ENGLISH and SCOTTISH law, while an illegal contract may be void, it is more often presented as “unenforceable”, in that neither specific performance nor damages are available to the parties. Thus a party may withdraw from an illegal contract with impunity. Courts will take notice of illegality of their own motion and dismiss actions accordingly (Chitty on Contracts I27, no. 16-199; MacQueen and Thomson, Contract Law in Scotland, § 7.15; McBryde, Law of Contract in Scotland1 , paras. 13.31-13.34, 19.17-19.27).). Again, however, there is flexibility in the law on contracts infringing statutory provisions. There are several cases in which the courts have considered whether giving effect to the statute requires the nullity of the contract as a supporting sanction (see e.g. St John Shipping Corp. v. Joseph Rank Ltd. [1957] 1 QB 267; Archbolds (Freightage) Ltd. v. S Spangletts Ltd. [1961] 2 QB 374, CA). English law is currently under review by the Law Commission: see its Consultation Paper on Illegal Transactions. The Commission’s provisional proposals were to the effect that courts should have the discretion to decide whether or not illegality should act as a defence to a claim for contractual enforcement. But the discretion should be structured by requiring the court to take account of specific factors: (1) the seriousness of the illegality involved; (2) the knowledge and intention of the party seeking enforcement; (3) whether denying relief will act as a deterrent; (4) whether denial of relief will further the purpose of the rule rendering the contract illegal; and (5) whether denying relief is proportionate to the illegality involved. II.–7:303: Notes 5 In ENGLISH law the general rule is against restitution but it is possible in exceptional cases where the claimant is not in pari delicto with the recipient, or the transaction has not been completely executed, or if the claim can be formulated without reference to the prohibited contract (Treitel, The Law of Contract9 , 490-504). IRISH law is similar (Clark 314-19), and so is SCOTTISH law (Stair Memorial Encyclopaedia vol. 15, paras. 764-765), although in one Scottish case where, by statute, contracts using old Scottish measures were void, restitutionary recovery was allowed in respect of a sale of potatoes by the Scottish acre, on the ground that there was no moral turpitude in such a transaction (Cuthbertson v. Lowes (1870) 8 M 1073; see further Macgregor, (2000) 4 ELR 19-45; McBryde, Law of Contract in Scotland1 , paras. 13.31-13.34, 19.22-19.26). The English Law Commission in its Consultation Paper on Illegal Transactions suggested that a court should have discretion to decide whether or not illegality should be recognised as a defence to a claim for restitution, various factors being taken into account. In addition the court should have a discretion to allow a party to withdraw from an illegal contract and to have restitution where this will reduce the likelihood of the completion of an illegal act or purpose, although it must be satisfied that the contract could not be enforced against the claimant, that there is genuine repentance of the illegality, and that it is not too serious.