Last week, I attended a 'Breakfast Seminar' on The Legal Risks of Web 2.0 for your business, at Pinsent Masons in Birmingham.

By "Web 2.0", the presenters meant second generation user services like Blogs, Wikis, Flickr, MySpace etc, (rather than the XML/Semantic Web angle.)

Web 2.0 services are characterised by user-generated content. User-generated content is harder to control, and so presents more legal risks. Speakers Hartshorn and Ives focused on corporate blogging:

Blogging

The big concerns are Defamation, and Copyright Infringement.

What is Defamation?

Any statement that: is published, identifies a person, and damages that person's reputation - can be defamatory and give grounds to a libel case.

Employer liability

Liability for employee's defamatory comment on a corporate blog lies with the employer. Ingenta is liable for what I write here. (By the way.. did I mention that customer who was a complete.. OK, don't panic, Charlie ;) ) The conclusion: employers need to take defence measures to minimise the risk of liability.

What defence measures?

The presenters advise:

1. Don't Moderatate

Surprisingly, it may be sensible not to moderate a blog; ie, not to have a human eyeballing comments from the public, before they are published. This is because the Defamation Act 1996, protects the mere 'provider of access to a communication system'.

More recent E-Commerce Regulations 2002 distinguish between a "service provider" (eg, an ISP) and a "publisher" of content. If you moderate, you're a publisher, and you're liable, if you don't, you're a mere conduit and may not be.

2. Have a way for people to report bad postings.

In order to rely on protection by the Defamation Act, you need to show firstly that you are not the publisher, as above, but also that you 'took reasonable care'. This seems confusing and contradictory at first, so here's an example of how it was interpreted:

In 1999 Lawrence Godfrey wrote to Demon Internet requesting they remove a defamatory statement in a newsgroup. The ISP ignored him (what a surprise, an ISP with poor customer service.. never!) Godfrey sued under the new act, Demon were found not to have taken 'reasonable care' and were forced to pay £200,000. The conclusion: have a process in place for people to report bad postings, and act on them ASAP.

3. Have a Terms & Conditions and a Disclaimer

Eg, have them linked from the footer. The T&C should include behaviour that is forbidden, such as posting defamatory or otherwise unlawful content, as well as stating the rights of the blog editor to reproduce, or modify content.

4. Tailored Warnings

Repeat the statements from the T&C if there's an obvious reason, and place, to do so. YouTube repeat copyright warnings during the upload process.


What about personal blogs?

The employer is unlikely to be liable, unless there is some specific connection between the personal blog contents and the company, but it is a grey area. Waterstone's dismissed Joe Gorden for bringing the company into disrepute when he blogged about "Bastardstone's", but Gorden successfully appealed the sacking. Similarly, Orange suspended but then reinstated Inigo Wilson, even though his offensive Leftie Lexicon was unrelated to the company. So what's the conclusion here? I'm not sure. Perhaps: be wary.


Anything other than blogging?

Other bewarities with Web 2.0 include AJAX and Disability regulations (screen readers), copyright problems with RSS and Podcasting, and child protection issues. But I think I'll leave those for another blogger.


Disclaimer: You should neither rely nor act upon my comments in this blog post. Corporate Web 2.0-ers should consult their lawyers. ;)