ONLINE SHOPPING: AN OVERVIEW OF THE LEGAL PITFALLS FACING BUSINESS TO CONSUMER E-COMMERCE WITHIN THE CONTEXT OF THE SOUTH AFRICAN LAW
1. Introduction
Purchasing goods and/or services online is quick, convenient and allows the purchasing or selling of services and/or goods outside the borders of a country. The online parties, especially the purchaser, generally known as the consumer, is seldom concerned with the meaning of the term, 'e-commerce' and the legal ramifications of online purchasing but is more interested in the advantages of cyber shopping that can vary from purchasing a plane ticket to books or accommodation to software.
However, once the parties encounter a problem with the online purchase, they look for direction from the commercial law to provide a solution to address the legal pitfall.
This discussion will be an overview of the pitfalls that may be encountered with online purchasing within the context of the South African law. The discussion relating to the law governing online purchasing in South Africa is not only of importance to a non-South African consumer who trades with a South African based website, but it will also affect a website owner who wishes to trade outside the borders of his country with South African consumers.
The discussion focuses on the online contract of purchase between a consumer (offeror) and an merchant and vendor and/or electronic supplier (offeree) of goods and services, so called business to customer ecommerce (B2C ecommerce).
Obviously, not all the pitfalls can be discussed in depth. Central to online purchasing is the contract of purchase that embodies the legal relationship between a consumer and an online merchant or vendor. Although a contract may be valid and enforceable, pitfalls such as dispute resolution, consumer protection, privacy protection, security of payment and crime detection and prevention, to name but a few, may nonetheless be encountered with the B2C contract of purchase.
Much has been written on the online contract per se, but these discussions lack an overview, however brief, of the legal pitfalls facing online B2C purchasing on a domestic and international level. Such a discussion, although quite ambitious, goes a long way in facilitating an understanding of the laws that regulate the various issues in respect of online B2C contracts of purchase by focusing on the problems that may be encountered from the South African legal perspective. It also illustrates which trust-enhancing mechanisms should be part of an online B2C e-commerce.
2. The Internet in South Africa
2.1 Legal regulation of the Internet
The history of the origin of the Internet is certainly well known and for that reason will not be discussed.
However, one must be mindful of the remark by Oliver Wendell Holmes, a former judge of the United States of America, that "(w)e must study the history in order to understand the path of the law." One cannot have a true understanding of the evolution of legal regulation in South Africa without giving a historical perspective on the commercialization of the Internet.
The legal position in South Africa from 1993 to 2002 serves as a good example of the consequences of inadequate legal protection in respect of conduct on the Internet. When the Internet became commercial in South Africa in 1993, the Internet became part of society without much fanfare. Very little attention was given to the Internet, probably a consequence of the fact that South Africa was involved in a process of political transformation and constitutional development. South Africa was furthermore urged not to regulate the use and access to the Internet and warned that "excessive regulation or control of the Internet would backfire." The warning went as far as to state that "the Internet and its technology would render the controls worthless" and that regulation should be conducted "not with fear and prejudice."
The result of not regulating the Internet in South Africa was legal uncertainty in respect of various e-commerce aspects, for example, it was not clear whether a valid online contract could be concluded by means of an electronic communication. South Africa may be a developing country, but the government realizes the advantages of the development and growth of e-commerce and that includes establishing legal certainty by means of state regulation of conduct and information on the Internet.
The implementation of the ECT Act in 2002 was a major step forward in establishing an e-commerce legal framework by addressing various aspects of e-commerce. The ECT Act was also the first comprehensive legislation that deals exclusively with an electronic medium.
2.2 The effect of foreign and international legal regulation of the Internet
South Africa has the advantage that international law and foreign law may be considered in the process of drafting its own e-commerce legislation. This illustrates the effect of globalization on a country. In respect of state regulation of the Internet, three dominant powers or approaches to Internet regulation have developed, namely the approach of the European Union (EU), the United States of America (USA) and China. Other countries align themselves with one of these approaches. As indicated, the focus in the discussion will be on the South African legal framework governing B2C contracts of purchase with a comparative analysis, where relevant, to the legal position in the EU and the USA.
The Constitution is the supreme law in South Africa and therefore when it comes to the drafting and interpretation of legislation, all legislation must comply with the South African Constitution. Section 39(1) of the Constitution provides that when the Bill of Rights is interpreted, the legislature or court or any other tribunal may consider foreign law and it must consider international law.
Part 1: An overview of the legal pitfalls in respect of online B2C purchasing within the context of the South African law
In part 1 the focus will not be on a discussion of the various issues relating to online purchasing but the emphasis will be on the problems that can be experienced with online purchasing. These problems are embodied as legal pitfalls.
3. Understanding the problems in respect of an online contract
3.1 Introduction to the online contract
Central to online purchasing, is the legal relationship between the contracting parties, namely the consumer (offeror) and online merchant or vendor (offeree). The legal relationship is embodied in an online B2C contract of purchase. Establishing the validity and enforceability of the contract of purchase is the starting point in respect of B2C e-commerce.
A contract of purchase may be defined as an agreement that creates legal obligations which is, or intended to be enforceable in law. An online contract of purchase means that the contracting parties made use of electronic communications to conclude the contract of purchase. This means that the parties moved from a physical medium, which consists mostly of paper-based, face-to-face negotiations to an electronic medium which is a global, paperless, faceless and in many instances, cross-border conclusion of a contract.
2.2 Sources of an online contract
The sources of the online contract are the South African common law (unwritten law that derive from the Roman-Dutch and English law) and legislation, namely the ECT Act.
In general the national laws of a country govern the main aspects of contract law and that is also the legal position in respect of the South African law of contract. The International Chamber of Commerce (ICC) supports freedom of contract as a general principle that should drive decisions in respect of choice of law and forum. In a nutshell, a binding contract comes into existence when two or more parties with appropriate legal capacity reach consensus regarding the terms of the agreement. Consensus is expressed by means of an offer made by the offeror and acceptance by the offeree.
2.2.1 Common law requirements
The South African law of contract requires that the following common law elements of a contract be present for it to be a legally binding agreement between parties, namely the capacity to act, consensus, lawfulness and physical possibility. If the electronic communication between two or more parties complies with the common law requirements for a contract, then it may be inferred by taking cognizance of the provisions of the ECT Act, that a valid electronic contract of purchase has been concluded.
2.2.2 Brief overview of the provisions of the ECT Act
Chapter III of the ECT Act consists of two parts and addresses the following aspects:
i. Chapter III part 1 confirms that a valid online contract may be concluded by means of an electronic communication.
Normally the online purchasers in a B2C contract do not sign the contract but express their intent to contract by clicking the mouse on a specific icon on the screen. The ECT Act provides that such conduct constitutes a valid purchase and sale agreement, although an electronic signature was not used. This conduct can be compared to the use of click-wrap (web-wrap) and shrink-wrap agreements. Although there has been no court case in South Africa on the validity and enforceability of shrink-wrap and click-wrap contracts, click-wrap agreements should be enforceable. The South African courts may, in respect of shrink-wrap agreements, follow an approach similar to that of the United States courts that take a cautious approach to shrink-wrap contracts by evaluating the facts on the basis of each case. It is advisable for a South African based website to make use of click-wrap agreements in the light of the United States judgment, Specht v Netscape Communications Corp where the court stated that a click-wrap contract used by a software company was invalid and unenforceable.
ii. Chapter III part 2 consists of the so-called default provisions. These provisions are only applicable where the parties in an online contract of purchase did not agree on the time and place of contract conclusion. In the latter instance, time and place will be determined by section 22(2) of the ECT Act that provides: "An agreement between parties by means of data messages is concluded at the time when and place where the acceptance of the offer was received by the offeror." After much debate, it has been accepted that the absence of a contractual provision in respect of the place and time of contract formulation, the information (reception) theory is applicable and not the expedition (postal) theory. The contract is formed in the country (place) where the offeror (buyer) receives the acceptance, in other words, where the offeror's computer is located. E-mail acceptance is deemed effective from the moment that the e-mail drops into the recipient's mailbox and not when it is actually read. Snail considers section 22(2) a modified version of the information (reception) theory. It is interesting that South Africa deviated from the UNCITRAL Model Law on E-Commerce that does not prescribe such a stipulation as to not interfere with the existing national laws of the various countries.
2.3 Effect of international law and foreign law
2.3.1 International law
In accordance with section 39(1) of the Constitution, a South African court must take note of the international law when interpreting statutory legislation. Similarly the international law plays a role in respect of the validity and enforceability of electronic contracts.
The United Nations Commission on International Trade (UNCITRAL) adopted in 1996 and amended in 1998 the UNCITRAL Model Law on E-Commerce to assist countries in drafting and enacting laws to enable electronic contracting. In 2001 the UNCITRAL Model Law on Electronic Signatures (UNCITRAL Model Law on E-sign) was drafted. The United Nations Convention on the Use of Electronic Communications in International Contracts followed the two Model Laws. The United Nations Convention aims to harmonize the provisions of the two Model Laws to form an international law instrument that provide guidance on electronic cross border contracts.
It is important to note that although the two Model Laws and the United Nations Convention on the use of Electronic Communications in International Contracts are not legally binding on South Africa, it influenced the drafting of the ECT Act and as already indicated, form the basis of many provisions in the ECT Act that addresses the recognition, validity and enforceability of the electronic contract. The latter has the benefit of aligning the South African law of online contracts with similar legislation worldwide.
2.3.2 Foreign law
Section 39(1) of the Constitution also states that the court may take note of foreign law, which includes foreign case law. To ensure valid and enforceable contracts, it is advisable for the South African website to take note of the United States judgments that stated that disputes may be prevented if the terms and conditions on a website are not only clearly visible on the homepage but before proceeding through the site, the visitor must click on an "I agree" button.
3. Consumer protection
Closely related to a B2C purchase contract, is consumer protection.
3.1 Brief overview of the provisions of the ECT Act
A ‘consumer' in terms of the ECT Act refers only to natural persons and does not apply to transactions between suppliers and companies. Chapter VII of the ECT Act contains consumer protection provisions aimed at ensuring trust and confidence in the use of online shopping. A contract may be valid and enforceable, but if it does not provide the necessary consumer protection, the consumer may cancel the agreement.
Chapter VII determines that a business selling goods or services over the Internet must supply the online consumer with 18 specific pieces of information. The South African website must also provide additional information, either required in terms of other South African legislation or which is necessary to protect the organization in the way it interacts with consumers and surfers on its website. If the South African e-vendor fails to provide all the information or the consumer did not have the opportunity to review the entire transaction, to correct any mistakes, and to withdraw from the transaction before finally placing an order, then irrespective of the nature of the goods and/or services involved, the customer can cancel the electronic transaction within 14 days of receiving the goods or services in question. If the transaction is cancelled, the consumer must immediately return the goods and/or stop using the services and the e-vendor must refund the payment made by the consumer minus the direct cost of returning the goods.
Since a consumer cannot evaluate the goods online, chapter VII contains a ‘cooling off' period of 7 days for goods and services purchased over the Internet for the consumer to cancel the transaction. If the consumer cancels the transaction, the vendor must refund the consumer within 30 days of cancellation.
The ‘cooling off' period excludes certain electronic transactions, such as, to name a few, accommodation, transport, catering, the selling of newspapers and provision of financial services. However, the supply of digital goods such as digital music downloads, e-books and software are not included in the list of exclusions. Such goods may be purchased, installed and used by the consumer who may then elect the ‘cooling-off' right and return the goods to the supplier. The effect is that the market for digital downloads in South Africa is not profitable.
A South African consumer will be afforded the consumer protection even when contracting with a vendor in a foreign jurisdiction with a different legal system. However, it is uncertain how this provision will be enforced on an international level. It may be that a foreign vendor decides not to do business with South African customers or may, in all probability, ignore this provision.
3.2 Effect of international law
According to Buys the EU favors statutory regulation of consumer protection as opposed to the United States that prefers market regulation of consumer protection (self-regulation). South Africa favors the EU approach and this is reflected in the strong consumer protection afforded in Chapter VII that is very similar to provisions provided in the European Union Directive on E-Commerce 20000/31EC (EU Directive on E-Commerce) and the EU Distance Selling Directive 97/7/EC. The Organization for Economic Cooperation and Development (OECD) published the "Guidelines for Consumer Protection in the Context of Electronic Commerce" aimed at eliminating uncertainties when buying online. Although South Africa does not belong to the OECD, it assists the South African consumer that buys from a website in a Member Country of the OECD where the supplier website adheres to these guidelines.
4. Security of payment
4.1 South African position
The ECT Act provides that the South African retailer must utilize a sufficiently secure payment system for electronic transactions. The vendor will be liable for damages suffered by a consumer if the consumers' banking information is leaked or handed over to a third party or stolen as the consumers' cyber shopping environment would in such an instance not be secure.
4.2 International position
A South African consumer may encounter a problem with a refund in the event of non-authorized transactions and non-delivery of merchandise. In respect of a consumer transacting with a supplier website that is a Member State of the EU, the EU Directive 97/7/EC protects consumers and grants them the right to have their payments refunded where there has been fraudulent use of their credit card.
5. Resolution of disputes in respect of online shopping
An effective e-commerce regime provides not only recourse through a national court system but also the use of out of court settlement mechanisms, so-called alternative dispute resolution mechanisms (ADR). ADR is an alternative procedure to expensive and time-consuming court litigation that does not always justify the amount involved in the dispute.
5.1 Jurisdiction and choice of law in respect of a dispute in court
Jurisdiction (indicating in which state's court a case will be instituted) and choice of law (the applicable legal system) are relevant in the event of a B2C cross-border dispute.
5.1.1 South African position
The ECT does not provide for civil jurisdiction nor does South Africa have any specific legislation regulating civil jurisdiction in e-commerce cases. Where a B2C selling website does not provide for jurisdiction, then jurisdiction in respect of cross-border disputes may be problematic. A situation may arise where a South African consumer or seller (e-business) may be in the position to institute litigation in a South African court, but experience a problem with the enforcement of the civil judgement in a foreign jurisdiction. Compared to the position in respect of international and foreign law, the South African government will have to address jurisdiction relating to e-commerce to ensure legal certainty.
5.1.2 International and foreign law
Regarding jurisdiction in the EU, the Brussels Regulation on Jurisdiction and the Enforcement of Judgments in Civil and Commercial Matters provides that in respect of a consumer contract, the consumer can institute the case in his own state or where the defendant is domiciled. However, a claim can only be instituted against a consumer in the consumer's state. The Rome Convention on the Law applicable to Contractual Obligations deals with the applicable law (choice of law). The Rome Convention harmonizes the rules of conflict applicable to contracts. It provides that in respect of B2C contracts, the applicable law will be the consumer's country (country of destination). The Rome Convention and the Brussels Conventions are not formally part of the EU but rather take the form of international arrangements sitting alongside the EU law. The Hague Convention on Choice of Court Agreements contain international rules for determining the court in which foreign parties can be sued and when countries must recognize the judgments of foreign courts, but e-consumer agreements do not fall within the scope of the Convention.
In the USA personal jurisdiction is the court's authority over a defendant and arises only when a defendant has sufficient ties to a state that makes the defendant answerable in that state's courts. When a connection is found between the state and the defendant, the defendant is served a summons about the lawsuit against him. In International Shoe Company v State of Washington the court found that a defendant does not have to be physically present within the jurisdiction of the court, but may have sufficient contacts within the forum for that court to exercise personal jurisdiction over the defendant. The ‘minimum contacts' is the standard by which the USA courts determine whether a non-resident party to a lawsuit has interacted enough with a consumer or consumers in another state to have to show up in court and defend itself in that state's forum. This leads to a distinction between passive and interactive websites and relevant in this regard is the case, Zippo Manufacturing v Zippo Dot Com Inc. The more interactive a site is (i.e. the more exchange of information between the web site and the consumer) and the more commercial the web site's nature, the more likely a court is to find that contact exists between the site owner and the consumer and that the web site owner must appear in the court of the consumer.
However, since the decision in Calder v Jones, the courts in the USA are moving towards a broader, effects-based approach when deciding whether or not to assert jurisdiction. Under the effects-based approach the court does not focus on the specific characteristics of a website but focuses on the actual effects that the website had in the jurisdiction. It means that a court may assert jurisdiction over an out-of-state entity where the effects of that entity are felt within the court's jurisdiction.
A comparison can be drawn between the EU and the USA approach. The EU relies on the Brussels Regulation to determine jurisdiction whereas in the USA the court must decide which forum has jurisdiction. The Brussels Regulation focuses on the consumer's side of the transaction in order to provide as much consumer protection as possible with the consumer being able to choose the forum. The USA courts decide which forum will have jurisdiction by applying either the minimum contacts test by considering the actions of the supplier or the more recent test, the effects-based doctrine which focuses on the effects of the website in the jurisdiction.
Above illustrates that Internet jurisdiction (including enforcement of foreign judgments) is still an unsettled body of law and therefore the website provider should pre-empt the question by setting the jurisdiction in the terms of the contract. Choice of law and forum clauses written into the sales contract will go a long way toward settling the question of jurisdiction.
5.2 Alternative Dispute Resolution (ADR) in respect of out of court settlement
5.1 Provisions in the ECT Act
It is advisable that the South African supplier website has an embedded link to an alternative dispute resolution (ADR) in the instance of a dispute. However, if the South African website does not provide it, the consumer may in terms of section 49 of the ECT Act lodge a complaint with the Consumer Affairs Committee for the non-compliance with the provisions of the ECT Act. One of the biggest hurdles that face online dispute resolution (ODR) in South Africa is the lack of an ADR culture.
5.2 Effect of international and foreign developments
In 1999 the OECD released the "Guidelines for Consumer Protection in the Context of Electronic Commerce" for the development of fair, effective and transparent self-regulatory procedures, including ADR to resolve consumer disputes arising from B2C e-commerce, specifically cross-border transactions. On domestic level the EU and the USA have alternative dispute resolutions and are working on cross-border co-operation on the basis of common minimum standards laid down in codes of conduct.
6. Privacy or data (information) protection of personal information
A distinction is drawn between data privacy and communications privacy. Data (information) privacy means the control of an Internet user in respect of who has access to his/her personal information, when and how; no personal information may be processed without the permission of the affected Internet user. Communications privacy means protection against interference and/or intrusion regarding his/her communications such as websites visited, e-mails sent and received and use of search terms, for example surveillance. In the discussion the emphasis falls on information (data) privacy. It is not about the conflict between security and communications privacy for crime prevention, detection and investigation purposes.
6.1 South African legal position
The South African government recognizes that privacy is not protected adequately and the South African Law Commission is in the process of drafting privacy and data protection legislation. Although chapter VIII of the ECT Act protects privacy of personal information, it establishes only a voluntary regime for the protection of personal information online and it does not prescribe an enforcement mechanism of these provisions with the consequence that the contracting parties themselves will have to agree on it. It is clear that privacy in respect of B2C contracts of purchase does not provide adequate protection. Section 14 of the Constitution protects privacy, but South Africa does not have legislation that deals specifically with privacy. This lacuna will hopefully soon be addressed. Since the EU is one of South Africa's trading partners, it is therefore advisable that a South African supplier website complies with the EU Data Protection Directives. A website must have a privacy policy as a consumer trust-ensuring mechanism.
6.2 International law
Privacy is a significant international issue. Since the Internet itself is not a privacy protecting medium, the best approach to privacy protection would be comprehensive Internet data protection/privacy legislation as implemented by the EU. South Africa's proposed data and privacy protection legislation will be similar to the EU Directives.
The EU follows a strict statutory approach to data protection of personal information. The European Union implemented two data (information) protection directives, namely a general directive, Directive 95/46/EC on the protection of individuals with regard to the processing of personal information and on the free flow of information and a specific directive, 2002/58/EC (the Directive on Privacy and Electronic Communications) in respect of processing of data specifically on an electronic medium such as the Internet. Both directives provide for obtaining consent before processing personal information of an Internet user. The directives build on the principle that privacy is a fundamental human right and is very similar to the OECD Privacy Guidelines.
One of the most controversial provisions of the Directive deals with the transfer of personal data to countries outside the EU. Private data gathered in EU Member States may not be transferred to another country outside the EU where the legal system does not meet an adequate level of privacy protection for natural persons. The European Commission may find that a third country does ensure an adequate level of protection thus allowing data transfers to take place freely to that country. The Commission has approved transfers to the United States but only to companies that abide by the safe harbour principles. Data controllers have a general duty to notify local data protection authorities of international data transfers.
Data protection is not an area where the private sector is able to regulate itself without some sort of legislative interference. For example, when an e-business becomes insolvent, it may be that the ‘assets' of the business consist of personal information about the business' customers. A viable question is whether the personal information of the customers of the online business may be sold or will it violate the privacy rights of the customers? The EU Directives are clear in this regard.