FM's privacy policies inconsistent, insufficient

[tehsux0r]

Originally Posted by hobbes

If you can't tell the difference between these two kinds of service, then you will never understand the need for TOS/Privacy Polices of FM and others.

Wow. Nice tone.

Originally Posted by hobbes

I'm done with this thread, but it's been fun.

He'll be back. They always come back.

[hobbes]

Originally Posted by tehsux0r

Wow. Nice tone.

Apologies for the tone. But, the poster was comparing chalk with cheese.

He'll be back. They always come back.

No I won't.

[mariner]

Originally Posted by tehsux0r

I sent an e-mail to the privacy address yesterday giving my forum user-name, and all I've had back so far is a brief reply to the effect that it's a long thread full of analysis by people not qualified in law.

Wait. That was literally the reply?

[tehsux0r]

Originally Posted by mariner

Wait. That was literally the reply?

I thought it was an unbiased paraphrasing of a slightly longer paragraph:

The forum thread you pointed to is long and contains lots of posts by
people who aren't lawyers, aren't familiar with Australia law, and are
trying to interpret a legal document. We worked closely with lawyers to
ensure the document is valid and contains the correct legal wording.

Can you tell me exactly which parts/sentences you personally are
concerned by.


I replied thus:

Hi

I told you my forum user name so that you could easily find my statements in the thread rather than having to read it all. That said, I think somebody in the Fastmail offices *should* be reading these threads from start to finish, if for no other reason than to gauge customer sentiment on these issues - there are serious concerns here, and four pages is hardly War and Peace.

I'm also not sure what point you're making by pointing out that those posting aren't lawyers or familiar with Australian law. Are you implying that customers shouldn't try understand contracts, but should just agree to them without scrutiny? Are you saying that customers who are not lawyers specialising in your jurisdiction don't deserve to understand what they're agreeing to? Are you saying that you simply don't care whether customers can understand their rights under the TOS without a law degree?

I don't see any evidence that anybody *other* than a lawyer was significantly involved in drafting this document, and that's the problem! See this post:

http://www.emaildiscussions.com/show...1&postcount=42

There's another, older thread dealing with this issue too:

http://www.emaildiscussions.com/show...6&postcount=35

This is my first post in the thread concerned. Please see mariner's and downset's statements in the same thread for further context and clarification, as we all agree on what is wrong with the TOS and privacy policy.

regards,

[tehsux0r]

Originally Posted by hobbes

Apologies for the tone. But, the poster was comparing chalk with cheese.

In all seriousness, though, the relative chalkiness and cheesiness of the two is changing every year. E-mail is now mainstream, and despite its theoretical insecurity, people are using it for serious and confidential purposes.

I think it's got past the point where we can justifiably take the laissez-faire attitude of ten or fifteen years ago; much like the postal system centuries back, it's reached a point where it needs to be protected to some degree simply because it's so heavily relied upon. Like it or not, computers, the Internet, and e-mail are no longer toys for the rich and curious; they're commonplace and we need to start assuming the ignorance of the average user in order to establish sensible practices.

[tehsux0r]

I don't know how you guys feel about this, but I feel I should post the other FM correspondence on this issue to keep you all updated, especially as it seems mariner hasn't had any luck getting a reply yet.

This is the text of my reply to today's message from FM privacy - their text is doubly indented, and my responses are singly indented. As the other correspondent didn't seem to want to read these threads in full, a lot of this is repetition and restatement, so apologies in advance.

The terms of service is a legal document. When people signup an account, there's a legal contract being entered into between us and the customer. Because of that, the document has to be carefully worded so that it is legally valid and binding. Unfortunately in some cases that does mean that certain legal language has to be used. Should a problem ever occur, the result would be a court having to interpret the TOS as a legal contract, which means that we do have to be very careful with it.

I do understand the need for care, but that's not what we're talking about. There is a highly unequal relationship between FM and an IMAP customer: as an individual, I can do FM no lasting damage by withdrawing my subscription. FM, on the other hand, can do me severe and irreparable harm by exercising certain clauses in this contract. The need for care in legal wording doesn't justify conferring unlimited power on one party to take arbitrary and irreversible destructive actions without any rationale.

Jeremy has already responded to the thread as a FastMail official, explaining why the wording was what it was, because it has special meaning in the law. After that, some people seem to have ignored that, and have again questioned it, even though Jeremy explained the reason for it being that way was very specific and what it meant.

I'm afraid this isn't true. Jeremy responded only partially and superficially to the concerns raised, his explanations raised more questions than they answered, and he seemed to assume that the thread was purely about the recent TOS changes (even though it predates them). These are the genuine concerns of a group of real people who value their data and privacy, and it seems that no-one at FM has fully read either the original post on each thread or the (relatively concise) discussion that follows. Virtually all the posters who expressed concern (who appear to be paid customers) found Jeremy's response inadequate, and this is why the discussion, and the requests for further response, have continued.

We would all appreciate it if Jeremy came back to the thread not as an official, but as a director prepared to look at the words and actions of his company from a customer's perspective.

So I'm pointing out again that the wording was written that way explicitly by lawyers for a good reason. A bunch of people who aren't lawyers, aren't familiar with Australian law, and are attempting to re-interpret wording themselves, not understanding that certain words have specific reasons in legal terminology because it is a legal document, is actually not really a very helpful discussion, when again as I say, Jeremy has already explained why it's that way and what it means.

There can be no lack of understanding by any of us that wordings have specific legal meaning - it's been restated several times. The problem is that nobody (Jeremy included) has provided legal context or explanation to show that these wordings do not, in fact, confer the arbitrary, unlimited power that they seem to. No-one has even denied it!

Consumers have to interpret from scratch using common sense; this is what makes them consumers and not lawyers or corporations. If they're unable to glean any sense of even basic rights and responsibilities from the contract presented to them then it is, by definition, not a useful consumer contract. To insist otherwise is tantamount to cherry-picking customers from two categories: those prepared to willingly give uninformed consent, and those giving informed consent because they are (or have ready access to cheap and good) lawyers. I have never insisted that the contracts I agree to be free from restatements of applicable law that might clarify their meaning; FM and its lawyers chose to draft things in this minimal way, and by your own admission the result is at best incomprehensible by non-lawyers.

The tone taken in the responses to this issue seems largely dismissive and irritable - if this is how FM and its management feel about privacy-conscious customers, it's no wonder that no attempt has been made to capitalise on us by advertising FM as a sympathetic provider. What a shame - there are quite a few of us, and we're much less irritating when we're listened to and treated with a little respect rather than patronised. Your customers are neither unreasonable know-it-alls for wanting to know their actual rights nor unworthy of a response just because they dare to examine their contracts without being Australian lawyers. You might see our discussion as "not very helpful", but it's helpful to us - we're operating in a vacuum. What's truly unhelpful is to draft such an apparently protectionist contract, offer no clarification of its actual meaning under applicable law, and then trivialise and ignore the concerns of a group of thoughtful customers.

The recent TOS changes were actually very minor,

If the recent changes highlighted the deficiencies in the existing contract, that's bad luck, but it was bound to happen sooner or later. Nobody has yet explained to us how adding the word "allowed" to a statement about disclosure is a minor change, or denied that it (and the phrase "to protects the interests of...others") allows FM to disclose any information to anyone for any reason. Jeremy's post doesn't explain how being "legally required" to obey a police request is incompatible with the wording "required by law", nor why using the blanket word "allowed" (rather than "or by law-enforcement requests" or similar) is the only solution.

and most of the wording raised in the thread has been the same for the last 10 years, which we're not going to change. People do have a choice whether to signup an account or not, and have to accept the TOS as they are or not.

The users concerned are existing customers, not new signups. I've been with Fastmail for over four years, and over that time I've been forced (as has everyone) to raise my standards when it comes to data security and integrity, especially given the tide of explotative small print and weasel words in the world of commerce. I've always thought of FM as a trustworthy provider, and the technology and service have always been great, but the TOS has stood still, and now gives the appearance to a layperson of having gone backwards.

The attitude I've seen in response to my concerns has been quite surprising, and has actually *reduced* my trust in the values of the Fastmail organisation. This is something I never expected!

regards,

[mariner]

Originally Posted by tehsux0r

I don't know how you guys feel about this, but I feel I should post the other FM correspondence on this issue to keep you all updated

Thanks for posting this. Your replies express my sentiments exactly.

[mariner]

As tehsux0r's correspondent at FM felt that this thread is long, I thought a brief, hopefully easy-to-read, recap of the concerns it mentions might be helpful. If I have missed any, please say so!

1. The terms are so broad that FM can release anything to anyone for almost any reason (such as, “a good faith belief that such action is necessary to ... (4) act to protect the interests of its members or others”).
   
2. Since the customer has agreed to these terms, Australian privacy laws are unlikely to mitigate this. (That is, the law says you can't let yourself into my house — but if I have given you written permission to do so, that law doesn't apply.)
   
3. In any event, Australian law doesn't apply to the facility where FM's primary servers are located, because it is in New York. Customers should be informed as to the implications of this for their privacy.
   
4. In-house accessing of customer data (which is called for in a variety of circumstances) should be addressed separately from disclosure of this data to third parties (which should almost never occur).
   
5. Even if a customer trusts FM's current staff at a personal level, a professional may yet have a fiduciary responsibility to require his privacy rights to be protected, rather than abrogated, by contract. Moreover, FastMail's contract should be written so as to protect users' privacy even in the event of a change in ownership.
   
6. Customers should be informed of any changes to the TOS as regards privacy (or otherwise, for that matter), and the specific changes should be indicated.
   
7. FastMail should describe the privacy its customers' can expect in terms understandable to an ordinarily educated layman.
   
8. As other providers' terms suggest, it is perfectly possible for FM to have a written policy of 1) only releasing data when compelled to by applicable local law, and 2) informing the affected customers immediately, unless this is forbidden by applicable local law.
   

Finally: I have looked over others' contributions, and at this point there are a dozen customers just in this thread who would like one or more of these concerns addressed — and then there's the 2,500+ views the thread has received.

[tehsux0r]

Originally Posted by mariner

Thanks for posting this. Your replies express my sentiments exactly.

Thanks. That makes the time I spent composing it feel worthwhile.

Originally Posted by mariner

<snipped summary>
Finally: I have looked over others' contributions to the thread, and at this point there are a dozen customers who would like one or more of these concerns addressed.

Thanks - that's very concise.

To qualify your last comment: there are a dozen posters to this thread who would like one or more of these concerns addressed. This does not include the majority of FM users who don't use the forums at all, the forum users who are unaware of this thread, and those aware of it who haven't posted.

The speed with which these two threads have gathered such a solid consensus on the problem suggests that these issues may be of interest to a significant proportion of FM's customer base.

[ChewyMints]

You can also post complaints direct to:

privacy@fastmail.fm

It is possible to view the old privacy policy at:
It is a snapshot of the page as it appeared on 2 Feb 2010 12:40:06 GMT
http://webcache.googleusercontent.co...fm&hl=en&gl=uk

Search query to above:
http://www.google.co.uk/search?hl=en...=&oq=&gs_rfai=

Australian privacy law at:
http://www.privacy.gov.au/law

FM's blog post cause me to be suspicious, especially as it gave no links to the pages it had posted changed policies on. It also seems to have posted it's new policy on a new url, which prevents automated page change monitors from alerting anyone of the changes, such as: http://www.watchthatpage.com

FM also does not give it's Privacy and TOS policy much profile on it's website and it is quite hard to locate them, this alone detracts from the trust that can be inferred from sites that makes such important policies easy to see, access and monitor.

I would also suggest to FM, that it should always keep past copies of previous policies, so customers can compare the changes.

[ChewyMints]

Privacy policy OLD version: (extract)

---
2. How we use and disclose your information

We will only disclose or use personally identifiable information where

* Law enforcement agencies have either provided us with the required legal documentation or court order, or the disclosure or use is reasonably necessary for the enforcement of criminal law; or
* You have given us your consent.

Non-paying users only:

We may disclose non personally identifiable demographic information to third party advertisers for the purpose of displaying relevant advertising.
-----

New version:

----
How we use and disclose your information

We will only disclose or use personally identifiable information where:

*

Law enforcement agencies have either provided us with the required legal documentation or court order, or the disclosure or use is reasonably necessary for the enforcement of criminal law; or
*

To protect and defend the rights or property of the Service Provider; or
*

To enforce the terms of service; or
*

To act to protect the interests of its members or others; or
*

To facilitate a change of control of the Service Provider or the acquisition of the Service Provider's business by a third party, and to enable that third party to continue to provide the FastMail.FM services to you.
*

You have given us your consent.
http://www.fastmail.fm/help/overview_privacy.html
---

[mariner]

I have high hopes regarding Opera. Their formal stance on user privacy appears to be everything that FastMail's is not. Of course, there's no saying whether Opera will alter the FastMail TOS to match their policy in other matters. I think we should certainly encourage them to. Here's the disclosure policy:

We protect your data from disclosure, with the exception of matters where designated by law or court order.

And that's it! The policy on Opera’s access also consists of one sentence. Here's the operative part:

It is the policy of Opera Software to process personal data for purposes that are objectively justified by Opera Software's service …

The rest of it explains why words in a contract should matter (emphasis added):

… and to perform the processing in accordance with fundamental respect for the right to privacy, including the need to protect personal integrity and private life and to ensure that personal data are of adequate quality.

Again, we’ll see how much of this gets reflected in the FastMail TOS. But, off the bat, I’d say those are some fine principles to build a relationship on.

[Sherry]

Looks like you can now see what they have done (said) in the new TOS and Privacy Policy for us. I posted about it in the "Fastmail Acquired by Opera!" thread so thought I'd put a link to that post in this thread.

New TOS and Privacy Policy

Sherry

[mariner]

Originally Posted by Sherry

Looks like you can now see what they have done (said) in the new TOS and Privacy Policy for us.

I don’t think the privacy language you’ve cited differs from the language we’ve been discussing in the thread. Have I missed something?

[Sherry]

Hmm, perhaps you are right and it's only the TOS that has changed? I looked for some quotes in this thread on the Privacy complaints but so much in here was about the TOS it was taking to long to carefully read every post and figure who's talking about what. Anyway, if the Privacy policy hasn't changed then thanks for pointing that out.

Sherry