EU situation should be looked at by everyone [LWN.net]

EU situation should be looked at by everyone

Posted Dec 13, 2023 10:24 UTC (Wed) by Wol (subscriber, #4433)
In reply to: EU situation should be looked at by everyone by khim
Parent article: Bottomley: Solving the Looming Developer Liability Problem

> I mean: does a car dealer have a liability if car have defect? Only if said dealer tinkered with it and made it unsafe, right? Why then someone who sells you Debian or PostgreSQL should be held responsible if that's not their fault?

This is not right. In fact, it's so bad it's not even wrong. IT'S TOTAL GARBAGE.

Europe's entire consumer protection legislation edifice is BUILT on the premise that the guy who SELLS the product IS LIABLE.

I've just bought myself a car. A brand new Volkswagen to be precise. And let's assume the engine fell out on the way home and the car was destroyed. THIS IS NOTHING TO DO WITH VOLKSWAGEN. The law places ALL responsibility on the dealer. (We'll forget that I have a legal liability to have insurance, and that will absorb a chunk of it.) It is the DEALER'S problem - he may - should - have backup contracts / liability sharing / what-have-you with Volkswagen, but that's down to him. As the consumer, I go to the dealer, and HE HAS TO FIX IT.

I've actually used that, with that big retailer who "is never knowingly undersold". A three month old phone broke, and I took it back. The crucial point here is I bought it end-of-line in a sale ... They said to me "We can't replace it, we have a deal with the manufacturer so we can't repair it, you can have a refund". Leaving me £20 out-of-pocket if I replaced it like-for-like. I just replied "It's got a warranty. Repair or Replace. Otherwise you're charging me for a warranty repair."

It still ended up costing me £20, but that's because I got an upgraded replacement, and that was the difference between like-for-like and what I walked off with.

Which is why people like pizza should have nothing to worry about.If he's uploading to some random forge, there is no "placing on the market" to trigger liability. To the best of my knowledge, forges have nothing to worry about either, because they provide a market place, they aren't placing anything on the market either. (And I think that might actually be explicit in the legislation.) And even if pizza's doing stuff for money, all he needs is for the contract to say either (a) that pizza will undertake best efforts and his employer will warrant to fix things if they break (probably by employing pizza again), or (b) pizza will include the cost of insurance in the invoice. And if the employer doesn't like it, well he's always (with Open Source) got a third choice - do it himself!

Cheers,
Wol

to post comments

EU situation should be looked at by everyone

Posted Dec 13, 2023 11:03 UTC (Wed) by khim (subscriber, #9252) [Link] (5 responses)

> As the consumer, I go to the dealer, and HE HAS TO FIX IT.

Sure, but we are not talking about that. We are talking about the next step: what happens after.

All car dealers that I have ever saw contacted manufacturer if that's their defect. Sure, if someone stole some screws while car was with dealer and manufacturer is not to blame and car dealer goes to court.

But if car dealer can prove that he haven't touched anything and goods were defective when they left the factory then it's on manufacturer, 100%.

The law applies the exact same tules to software. Why it's so hard to understand and accept?

> Which is why people like pizza should have nothing to worry about.If he's uploading to some random forge, there is no "placing on the market" to trigger liability. To the best of my knowledge, forges have nothing to worry about either, because they provide a market place, they aren't placing anything on the market either.

Sorry, but this couldn't be right. One of them have to be responsible. Like in retail: supermarket may be selling under their own name and then would be responsible, or may provide space for others to put their booth and then these others would be responsible, but someone have to be liable, or else why have the whole charade of a law if no one is responsible for anything?

> And if the employer doesn't like it, well he's always (with Open Source) got a third choice - do it himself!

And that is why the law is shaped like it's shaped. It's completely inconceivable that one guy which you can find on freelancer.org and which knows how to combine LAMP with 100 lines of his own code should be responsible for the whole thing. Someone big enough must be responsible, or else the whole scheme wouldn't work. Even if some idiotic lawmaker would try that said guy simply have no means to review and support millions lines of code in LAMP.

And yes, if that would mean that open source would disappear entirely and would be replaced by Microsoft and Oracle $$ offerings then lawmakers would accept that: in that world would always have someone who can be, reasonably, made liable for software.

EU situation should be looked at by everyone

Posted Dec 13, 2023 11:15 UTC (Wed) by farnz (subscriber, #17727) [Link] (2 responses)

Legislatively, the liability stops with the car dealer. If the manufacturer says "nope, not going to fix it, your problem", that's the car dealer's problem to deal with.

In practice, as a result, car dealers refuse to sign contracts with manufacturers that permit manufacturers to say that - they instead require manufacturers to sign up to contracts that allow the dealer to pass liability backwards down the chain to the manufacturer.

But, for example, if the car dealer you bought your car from goes bankrupt, you have no legal claim against the manufacturer, only against the car dealer's remains. Manufacturers will usually intervene in this case, for the benefit of the brand, but they are under no legal obligation to do so.

The CRA, while not perfect, is an attempt to try and fit similar rules to software - it's just that because of the nature of software, it's a lot easier for vendors to sell you just one piece of the final product (a simple piece like a start-up script), and require you to assemble the rest of the software from other places, and the CRA wants to block off that sort of shenanigans. But this is new rules for software.

EU situation should be looked at by everyone

Posted Dec 13, 2023 11:38 UTC (Wed) by khim (subscriber, #9252) [Link] (1 responses)

> Legislatively, the liability stops with the car dealer. If the manufacturer says "nope, not going to fix it, your problem", that's the car dealer's problem to deal with.

You are talking about defect fixing. I'm talking about liability. And, of course, in case of accident your car maker may be found liable and that doesn't depend just on what contract between dealer and car maker says.

Manufacturer can disclaim some liability, sure, but not everything.

> But, for example, if the car dealer you bought your car from goes bankrupt, you have no legal claim against the manufacturer, only against the car dealer's remains. Manufacturers will usually intervene in this case, for the benefit of the brand, but they are under no legal obligation to do so.

Lol. That loophole was closed years ago. I still remember times when law worked like that in Russia. Big companies just never sold anything, they created tiny dealers which sold good and then went disappeared after 3 or 6 months. And then your warranty was pretty much pointless and you companies could save money. That's a no-brainer scheme, really.

Of course these loopholes were patched up and today law doesn't work like that. Whether manufacturer would be help liable or not is determined by a large body of law, but if car design defect leads to deaths it's almost always judged to be manufacturer's fault.

Why defect in MySQL or Apache Web Server shouldn't be treated in the same way?

EU situation should be looked at by everyone

Posted Dec 13, 2023 12:07 UTC (Wed) by farnz (subscriber, #17727) [Link]

In the UK, it still works like that - the manufacturer can disclaim all liability and pass it onto the dealer. The dealer is the entity that cannot disclaim liability. A US lawyer talking about liability in the US is kinda irrelevant here - we're not (yet?) a state of the USA.

We closed the loophole differently; the liability for manufacturing defects is created at the time the sale happens, and is thus part of the company that you have to handle while you close the company down; if you've not done so, then the directors of the company that was closed down have committed a criminal offence, and can both be forced to pay out the liabilities personally (possibly making them bankrupt), and banned from ever running a UK company again. This makes the trick you describe effectively impossible - you need to find genuine directors for your new company (otherwise it's just a trading name of the manufacturer), and you will not be able to do so if you're burning through them every 3 months or so, and discarding them with huge liabilities that they agreed to.

Further, to close a company down requires you to transfer all of its assets and liabilities out - if you transfer assets out without transferring out liabilities, then the company becomes insolvent, and the asset transfers can be undone to make the company solvent again (since it's illegal to engage in any transfer that makes the company insolvent). The only way to leave liabilities behind is to go bankrupt, but in UK law, that requires you to prove that the company could not continue trading - and also opens up opportunities for the bankruptcy court to "pierce the corporate veil" and say that the company is merely a front for another entity, who thus is liable for everything the company did as-if they did it themselves. In the case of the scheme you describe, the company would be deemed (in bankruptcy) to be a front for the manufacturer, and thus the manufacturer becomes liable because they created the company purely to avoid liability.

And if you remember when it worked like this in Russia, then Russia had this problem a long time after the mechanisms I loosely describe above came into being in England & Wales; these mechanisms built up in the 18th and 19th centuries, and were fully in place by the beginning of the 20th century.

EU situation should be looked at by everyone

Posted Dec 13, 2023 13:18 UTC (Wed) by Wol (subscriber, #4433) [Link]

> Sorry, but this couldn't be right. One of them have to be responsible. Like in retail: supermarket may be selling under their own name and then would be responsible, or may provide space for others to put their booth and then these others would be responsible, but someone have to be liable, or else why have the whole charade of a law if no one is responsible for anything?

Sorry, but this is the "it's not my fault" fallacy. It's what frauds and conmen like to do - "it's your fault for falling for a scam". What if it's NOBODY'S fault? Certainly the moral position is quite clear - if you are actively benefiting, then you have to warranty what you're doing. And for the most part, the law agrees. If you're benefiting from actions that injure someone else, then you're responsible.

That's why it's "follow the contract". That's why when I purchase a car from a dealer it's the DEALER who is liable for EVERYTHING. That's why the DEALER will have a CONTRACT with Volkswagen to indemnify the dealer for faults in Volkswagen's products.

I dunno about the law where you live, but that's why, when we have a recall for faults, it's the DEALER who fixes everything. It may well be Volkswagen that actually pays for it, but that's between the dealer and Volkswagen - nothing to do with me! And that's why manufacturers don't like recalls - because it's the CONTRACT between them and the dealer that says they pay for it. How else would UK law get a German manufacturer to fix defects in cars (not in this case, but in others) made in the Far East? They push all the responsibility on the guy SELLING the PRODUCT, and expect them to cover their backs with contracts. And if those contracts are straw, then that's the dealer's tough luck.

As for your example of manufacturers setting up little dealerships and letting them go under - well we have "evasion" regulations. If the purpose of setting up the dealership is to let it go bust and evade liability, English law certainly will "pierce the veil" and say "this dealership is a fraud. For the purposes of the law it never existed and its supplier is on the hook instead". Actually invoking that may be tricky, but that's what the law says, that's how the law deals with it. The law doesn't say "the manufacturer is responsible", it says "the manufacturer is fraudulently dodging responsibility". J Random Hacker quite clearly isn't setting up legal shell distributors with the intention of evading responsibility, fraud clearly isn't on the table ... the customer is getting EXACTLY what he (didn't) paid for. (Likewise with J Random Forge - there's nothing that could remotely be described as fraudulent.)

Cheers,
Wol

EU situation should be looked at by everyone

Posted Dec 13, 2023 13:24 UTC (Wed) by Wol (subscriber, #4433) [Link]

> All car dealers that I have ever saw contacted manufacturer if that's their defect. Sure, if someone stole some screws while car was with dealer and manufacturer is not to blame and car dealer goes to court.

> But if car dealer can prove that he haven't touched anything and goods were defective when they left the factory then it's on manufacturer, 100%.

But that's down to the dealer's contract with the manufacturer. NOTHING TO DO WITH ME. If the manufacturer can't/refuses to honour their contract with the dealer, NOTHING TO DO WITH ME.

The car isn't fit for purpose. The dealer legally MUST refund me. If they can't get the money back from the manufacturer, NOT MY PROBLEM.

(Okay, in practice, I might have considerable difficulty in enforcing this - if the manufacturer refuses to bail out the dealer, the dealer may go bust and I lose my money, but that's not the law, that's the law in practice, a very different thing.) And in that case, the receiver SHOULD sue the manufacturer on my behalf, but is that ever going to happen?

Cheers,
Wol

EU situation should be looked at by everyone

Posted Dec 13, 2023 11:38 UTC (Wed) by mb (subscriber, #50428) [Link]

>I've just bought myself a car. A brand new Volkswagen to be precise. And let's assume the engine fell out on the way home and the car was destroyed. THIS IS NOTHING TO DO WITH VOLKSWAGEN.

Well, that depends on whether it's a case for "Gewährleistung" or "Produkthaftung".
In the case of "Produkthaftung", which basically means persons have been injured or *other* things have been destroyed, the dealer is only liable in a couple of special cases. (Basically, only if the dealer can't point at manufacturer)