Effective EU and US approaches to spam? -Moves towards a co-ordinated technical and legal response - Part II

Communications Law

Volumn 10, Issue 4, 2005, Pages 111-120

  Hladjk, Jörg ^a,b,c  

^a LLM Computer and Communications ^*  (Germany)

^b Brussels Office of Hunton and Williams LLP   (Germany)

^c GOETHE UNIVERSITY   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 33745464037     PISSN: 17467616     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Review

References (72)

1. Although such measures are likely to De caugnt by most existing anti-deceptive practice legislation.
2. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, OJ L201 31.7.2002, p 37, http://europa.eu.int/eur-lex/pri/en/oj/dat/2002/l_201/1_20120020731en00370047. pdf.
3. Furthermore, while this provision is easy to comply with where emails are concerned, it may prove rather difficult to insert such information in an SMS.
4. Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM Act), Public Law 108-187, Dec 16, 2003, http://frwebgate.access. gpo.gov/cgi-bin/getdoc.cgi?dbname=108_cong_public_laws&docid=f:publ187.108. pdf.
5. In addition, it provides that even if the header information is correct, the use of a false or fraudulent domain name or internet protocol address would render the email misleading and will be caught by the relevant provision.
6. FTC, 'National Do Not Email Registry, A Report to Congress', June 2004, www.ftc.gov/reports/dneregistry/report.pdf.
7. FTC Report, ibid, p i.
8. FTC Report, supra n 6, p i.
9. Council Directive 84/450/EEC of 10 September 1984 relating to the approximation of the laws, regulations and administrative provisions of the Member States concerning misleading advertising, OJ L250, 19.09.1984, p 17, http://europa.eu.int/eur-lex/lex/LexUriServ/LexUriServ.do?uri=CELEX:31984L0450: EN:HTML The Commission has recently made a proposal to replace and update the Directive - see COM (2003) 356 final.
10. Directive 2000/3 I/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the internal market, OJ L178 17.7.2000, p 1, http://europa.eu.int/eur-lex/pri/en/oj/dat/2000/l_178/l_ 17820000717en00010016. pdf. As a general rule, 'commercial communications' must comply with the rules applicable to them in the Member State of establishment of the service provider. This rules does not, however, apply to the permissibility of unsolicited communications by electronic mail (see Art 3 of the E-Commerce Directive and its Annex). In the (limited) cases where natural persons would not be protected by the E-Privacy Directive (eg natural persons who are not subscribers) against unsolicited commercial communications, under the E-Commerce Directive, Member States must also ensure that service providers undertaking unsolicited commercial communications by electronic mail consult regularly and respect the opt-out registers in which natural persons not wishing to receive such commercial communications can register themselves (see Art 7 of the E-Commerce Directive).
11. FTC, 16 CFR Part 316, 'Label for Email Messages Containing Sexually Oriented Material, Final Rule', www.ftc.gov/os/2004/04/ 040413adultemailfinalrule.pdf.
12. For example, a common 'dictionary attack' involves sending of millions of randomly generated emails to users at hotmail.com, aol.com or yahoo.com.
13. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L281 23.11.1995, p 31, http://europa.eu.int/eur-lex/lex/LexUriServ/LexUriServ/do?uri=CELExerciserEX: 31995L0046:EN:HTML.
14. See also Article 29 Data Protection Working Party, 'Opinion 5/2004 on unsolicited communications for marketing purposes under Art 13 of Directive 2002/58/EC', adopted on 27 February 2004, p 6, http://europa.eu.int/comm/ internal_market/privacy/docs/wpdocs/2004/wp90_en.pdf.
15. These issues were discussed by the Article 29 Data Protection Working Party in 'Privacy on the Internet - An integrated EU Approach to Online Data Protection - Working Document', adopted on 21 November 2000, 5063/00/EN/FINAL WP 37, http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2000/wp37en. pdf, in particular at p 77.
16. Proposal for a Council Framework Decision on attacks against information systems (COM (2002) 173 final), 19 April 2002, http://europa.eu.int/eur-lex/en/ com/pdf/2002/com2002_0173en01.pdf. Many Member States can already prosecute illegal access or abuse to servers or personal computers as a criminal offence.
17. Art 15 of the E-Privacy Directive refers to Chapter III of the Data Protection Directive, which covers judicial remedies, liability and sanctions: 'Article 22 - Remedies: Without prejudice to any administrative remedy for which provision may be made, inter alia before the supervisory authority referred to in Article 28, prior to referral to the judicial authority, Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question. Article 23 - Liability: 1. Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered. 2. The controller may be exempted from this liability, in whole or in part, if he proves that he is not responsible for the event giving rise to the damage. Article 24 - Sanctions: The Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Directive and shall in particular lay down the sanctions to be imposed in case of infringement of the provisions adopted pursuant to this Directive.'
18. In yet other countries, enforcement relies mainly on consumer protection authorities (including consumer ombudsmen): 'Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on unsolicited commercial communications, or "spam"', Commission of the European Communities, Brussels, 22 January 2004, p 14, http://europa.eu.int/information_society/ topics/ecomm/doc/ useful_information/libraiy/communic_reports/spam/ spam_com_2004_28_en.pdf.
19. In addition, it must be considered that a minority of Member States do not have a consumer protection authority and enforcement is left to consumers' associations or consumers themselves.
20. See www.cnil.fr/index.php?1608 and the report by the Commission Nationale de l'Informatique et des Libertés ('CNIL'), 'Results of the initiative taken by the CNIL in relation to unsolicited electronic communications', February 2003, p 11, www.cnil.fr/fileadmin/documents/uk/CNIL-spamreport-022003- VA.pdf.
21. See the report by the Belgian Commission de la Protection de la Vie Privée ('CPVP'), pp 5-6, www.privacy.fgov.be/publications/spam_4-7-03_fr. pdf.
22. FTC Act, 15 U.S.C. 57a(a)(1)(B).
23. For an approach using private nuisance to combat spam, see Mossoff, 'Spam - Oy, It's such a nuisance', Michigan State University - DCL College of Law, Public Law Research Paper No 01-20. This essay contends that ISPs and others businesses should sue spammers for private nuisance.
24. For a critical view in general on the punishment by high penalties, see Rasch, 'Spam punishment doesn't fit the crime', The Register, 11 December 2004, www.theregister.co.uk/2004/12/27/spam_punishment_too_harsh. In contrast, see the most recent fines by the Dutch watchdog OPTA, http://asia.news.yahoo.com/ 041230/ap/d879m9dg1.html.
25. In addition, monetary damages are only recoverable by a state if it shows that the defendant knew or should have reasonably known of the act or omission that constituted a violation of the CAN-SPAM Act.
26. 'FTC announces First Can-Spam Act Cases', www.ftc.gov/opa/200404/ 040429CANSPAM.htm.
27. In addition, several ISPs are suing spammers who use their networks to send unsolicited commercial email. A visit to AOL's legal webpage shows that it has filed over 20 lawsuits for what it deems 'junk email', http://legal.web.aol. com/decisions/dljunk/aolarchive.html.
28. EarthLink has sued over 100 spammers and last year won a verdict for $24 million against Kahn Smith, aka the 'Genghis spammer' - see Rubner, 'Anti-Spam Bill: Public Policy or Public Relations?', Atlanta Business Chronicle. United Parcel Service of America (UPS') is currently conducting discovery regarding several individuals who allegedly used the company's email system to send sexually explicit spam to UPS customers. Microsoft has announced that it also will file an $18.8 million lawsuit against the trio of companies recently sued by New York, claiming that the spammers targeted Microsoft's hotmail service. Microsoft similarly filed 15 other suits in the US and the UK against spammers that it claims flooded its MSN internet service with over 2 billion unsolicited messages, www.criminology.fsu.edu/book/ Microsoft%20Sues%2015%20Organizations%20in%20Broad%20Attack%20on%20spam%20Email. htm. These lawsuits are in addition to those filed by various ISPs against spammers under the CAN-SPAM Act.
29. See Microsoft press release, www.microsoft.com/presspass/press/ 2004/oct04/10-28CANSPAMFollowUpPR.asp.
30. See also the press release of 10 March 2004, www.microsoft.com/presspass/ press/2004/mar04/03-10CANSPAMpr.asp.
31. FTC, 'A CAN-SPAM Informant Reward System: A FTC Report to Congress', September 2004, www.ftc.gov/reports/rewardsys/040916rewardsysrpt.pdf.
32. FTC Report, ibid, p 2.
33. FTC Report, supra n 28, p 22 et seq.
34. FTC Report, supra n 28, p 3. The report further explains that because cybersleuths do not have the power to issue or enforce subpoenas, in most instances they cannot legally obtain and supply to the FTC admissible evidence of a spammer's identity, whereabouts or level of illegal activity. Many of the critical pieces of information necessary to prove these issues are in the possession of third parties (banks, payment processors, ISPs and others) that will not or cannot provide them to private citizens like cybersleuths who have no subpoena power. Insiders, however, are often privy to this kind of evidence and would not need compulsory process to obtain it.
35. FTC Report, supra n 28, p 3.
36. FTC Report, supra n 28, p 4.
37. FTC Report, supra n 28, p 4.
38. 'Memorandum of Understanding on mutual enforcement assistance in commercial email matters among the following agencies of the United States, the United Kingdom, and Australia: The United States FTC, The United Kingdom's Office Of Fair Trading, The United Kingdom's Information Commissioner, Her Majesty's Secretary Of State For Trade And Industry In The United Kingdom, The Australian Competition And Consumer Commission, And the Australian Communications Authority', www.ftc.gov/os/2004/07/040630spammoutext.Pdf.
39. 'US, UK, Australia join to fight international spam', 2 July 2004, www.computerworld.com/softwaretopics/software/groupware/story/0,10801,94292,00. html;
40. Heise, 'Abkommen über spam unter der Ägide der ITU?', www.heise.de/newsticker/meldung/print/48937.
41. For the Australian legislation on spam, the Spam Act 2003 and the Spam (Consequential Amendments) Act 2003, http://scaleplus.law.gov.au/html/comact/11/ 6735/top.htm.
42. See Haydon, 'Multi-lateral and Bi-lateral Cooperation: the Australian approach', contribution from the ACA to the ITU WSIS meeting on countering spam, www.itu.int/osg/spu/spam/contributions/John%20 Haydon_ACA_Multilateral%20and%20Bilateral%20Cooperation.pdf.
43. 'UK hosts anti-spam summit'. The Register, 11 October 2004, www.theregister.co.uk/2004/10/11/oft_anti-spam_summit/.
44. Memorandum of Understanding between the Korea Information Security Agency and the Australian Communications Authority and the National Office for the Information Economy of Australia concerning co-operation in the regulation of spam, www.aca.gov.au/consumer_info/frequently_asked_questions/spam_MOU.rtf.
45. For the full text and signatories, see www.acma.gov.au/acmainterwr/ consumer_info/spam/spam%20-%20multilateral%20mou%20seoul.melbourne%20- %20final%20web%20version.rtf.
46. Council Regulation (EC) No 44/2001 of 22 December 2000 on juris-diction and the recognition and enforcement of judgements in civil and commercial matters, OJ L012, 16 January 2001, p 1, http://europa.eu.int/eur-lex/pri/en/oj/ dat/2001/l_012/l_01220010116en00010023.pdf.
47. Co-operation procedure concerning the transmission of complaint information and intelligence relevant to the enforcement of Article 13 of the privacy and electronic communication directive 2002/58/EC, or any other applicable national law pertaining to the use of unsolicited electronic communications, 1 December 2004, www.opta.nl/download/Cooperation%20protocol%20- %20CNSA%20final%20version%20-%2020041201.pdf.
48. See Council of the European Union, Presidency Paper, 24 November 2004, p 2, http://register.consilium.eu.int/pdf/en/04/st15/st15148.en04.pdf.
49. See Case C-21/76 Bier v Mines de Potasse d'Alsace S.A (ECJ, 30 November 1976).
50. See www.alipman.com/snowbirdguide/chap16.html.
51. Graham, 'Stopping Spam', 2003, p 4, www.paulgraham.com/stopspam.
52. html. See also 'Mail out of order', The Guardian, 27 February 2003. www.guardian.co.uk/online/story/0,3605,903312,00.html.
53. Trzaskowski, 'Cross-Border Law Enforcement in the Information Society', 2003, p 5, www.legalriskmanagement.com/PUBLICATIONS/2003%20-%20JULEBOC.pdf.
54. Trzaskowski, ibid, p 8.
55. Virtual Conference on Regulatory Co-operation on Spam, www.itu.int/ ITU-D/treg/Events/Seminars/Virtual-events/spam/index.htral.
56. See especially the discussion paper by Prince, 'Countering Spam, How to craft an effective Anti Spam Law', www.itu.int/osg/spu/spam/contributions/ Background%20Paper_How%20to%20craft%20and%2 0effective%20anti-spam%20law.pdf. For information regarding the meeting outcome and future work on countering spam, see www.itu.int/spam.
57. Available at www.itu.int/osg/spu/spam/law.html.
58. See Telecommunication Standardization Advisory Group, www.itu.int/ITU-T/tsag/index.asp.
59. For an overview of OECD work on spam see, www.oecd.org/department/0,2688, en_2649_22555297_1_1_1_1_1,00.html.
60. 'OECD Launches Anti-Spam Toolkit and Invites Public Contributions', 21 September 2004, www.oecd.org/document/50/0,2340, en_2649_22555297_33732274_1_1_1_1_1,00.html.
61. See www.apecsec.org.sg/content/apec/apec_groups/som_special_task_groups/ electronic_commerce.html.
62. 'FTC and International Agencies Announce "Operation Secure Your Server'", 29 January 2004. For the press release, see www.ftc.gov/opa/2004/ 01/opsecure.htm. For detailed information, see the website for the project, www.ftc.gov/secureyourserver.
63. See www.ftc.gov/bcp/conline/edcams/spam/secureyourserver/partners. htm.
64. For detailed information on this organisation, see www.icpen.org.
65. See www.econsumer.gov.
66. For a full text of the plan, see www.ftc.gov/os/2004/10/ 041012londonactionplan.pdf.
67. See news.zdnet.co.uk/internet/security/0,39020375,39207233,00.htm.
68. See the ITU WSIS Thematic Meeting on Countering Spam Website on International Co-operation, www.itu.int/osg/spu/spam/intcoop.html.
69. 'AOL sees decline in spam', 27 December 2004, zdnet, http://newx.zdnet. com/2100-1009_22-5504603.html.
70. Keizer, 'CAN-SPAM Can't Slam Spam', Information Week, 4 January 4 2005, www.informationweek.com/story/showArticte.jhtml?articlelD= 56900503.
71. Keizer, ibid.
72. However, there at least have been some reactions, for example the 'Spam King' Wallace has agreed to stop sending related pop-up advertisements until a federal lawsuit is resolved in the US - see '"Spam King" Agrees to Halt Spyware Until Lawsuit Ends', E-Commerce Times, 5 January 2005, www.ecommercetimes.com/story/39408.html