It was revealed two months ago that toy company VTech was hacked. The criminals broke in and stole information including the birth dates and addresses of millions of children and their parents. It was quickly found out that VTech had employed abysmal security practices and made no notable efforts to keep their clients’ information safe. Lesson learned, one would suppose.
Unfortunately not so. Troy Hunt discovered last week that VTech made some changes – to their terms of service. The change, which happened in December, stated that parents were responsible for the security of their childrens’ data even though that had already been handed to VTech. Rather than accept responsibility for their egregious previous failure, VTech chose to absolve themselves with words of text.
The following words were added to the terms and conditions for VTech’s Learning Lodge website: “You acknowledge and agree that any information you send or receive during your use of the site may not be secure and may be intercepted or later acquired by unauthorized parties… Recognizing such, you understand and agree that…neither VTech nor [its partners] or employees will be liable to you for any…damages of any kind.”
The BBC got a comment from UK’s Information Commissioner’s Office that VTech indeed was responsible for such information. “The law is clear that it is organisations handling people’s personal data that are responsible for keeping that data secure,” said a spokeswoman. This should also be the case for the rest of the EU. Local laws will apply to Asian countries.
Having to deal with pages and pages of small-printed legal text on contracts and emails that end in statements disclaiming responsibility for the email content are very disappointing aspects of modern society. Not only do people quickly learn to ignore such text as the noise that it is, it gives service providers the false sense of security that they may not be held accountable. For the sense of everyone’s sanity, please stop doing this! Keep your disclaimers brief and to the point. Take a look at this old Google page about how to actually tell someone about relevant terms and conditions.
In other news, Amazon has told its customers that its Lumberyard game development tools are not to be used for life-critical or safety-critical systems… unless the zombie apocalypse is going on, in which case this particular condition is nullified! See clause 57.10.