internet privacy terms-of-service
Is it against the law to automate user personal information in the cloud
<p>Suppose that a customer wants an online or cloud service to automate registering accounts on a 3rd party website, and the cloud service is transmitting personal data such as shipping/billing information from the customer across the cloud service to the 3rd party website. The customer gives consent to the cloud service to use their information. Where would this stand in the eyes of the law?</p>

<p>Depends on the jurisdiction.</p>
<p>In GDPR terms, you might be the data controller, and the third party websites would be <em>your</em> data processors. Your customers would see <em>you</em> as their point of contact for any GDPR requests or complaints regarding those third party sites. Yet you have no agreement with the third party websites on what they do with the data. Some issues:</p>
<ul>
<li>Is your website &quot;targeting&quot; a global audience or are you at least trying to stay in your jurisdiction?</li>
<li>Are your target websites in the same jurisdiction as you and your customers?</li>
<li>Have you checked that they are applying due diligence?</li>
<li>If billing information includes credit cards, is your handling compliant with industry standards? (I wouldn't touch that one without a ten-foot pole and a dozen reputable consultants.)</li>
<li><strong>Can a consent be written to legally waive all this?</strong></li>
</ul>
<p>While I'm not a lawyer (and also see the site disclaimer), I did get a number of lectures from lawyers who told me to err on the side of caution and to consult the legal staff <em>before</em> starting a project like this.</p>

<p>If each of the people whose information is being used to register an account has consented to this use of their information, then I can see no unlawful act here. It could be looked at as simply a tool for the people to complete such registrations, which they surely have a right to do.</p>
<p>If the inmforamtion is made up or is being used without the authorization of the people whose info it is, then this <strong>might</strong> be fraud depending on the facts. Particularly depending on whether there was intent to gain a materiel advantage or inflict a material loss.</p>
<p>Thr might also be a violation of a data protection law such as the GDPR or the CCPA, <strong>if</strong> one applies to the transaction.</p>
<p>In any of those cases there could be a violation of the websites terms of service (TOS), depending on just how those terms were worded. But even if there was a violation of the TOS, for a successful suit there would need to be proof of some damage to the site operator, and I don't see what that would be in the circumstances described.  But the facts might reveal some such damage.</p>
