Indemnification clauses and liability regarding use of information?

Question

I've seen a lot of clauses like this,

You will indemnify and hold Evil Corp, its directors, officers, employees, agents, consultant, contractors, partners, vendors and service providers (including, without limitation, hosting and telecommunications providers) harmless, including costs and attorneys’ fees, from any claim or demand made by any third party due to or arising out of your access to the public Network, use of Evil Corp products or services made available on the public Network, your violation of this Agreement, or your infringement or any third party using your account, of any intellectual property right.

And also this,

You agree to indemnify and hold the Evil Corp, harmless from and against any loss, liability, claim, demand, damages, costs and expenses, including reasonable attorney's fees, arising out of or in connection with (i) your use of and access to the Service; (ii) your violation of any term of these Terms; (iii) your violation of any third party right, including without limitation any copyright, property, or privacy right or any third party agreement; or (iv) any of Your Content or information in your Account or any other information you post or share on or through the Service. As used in this section, "you" shall include anyone accessing the Service using your password.

How do both of these stack up with regard to data protection and sale? If you don't explicitly grant the company the right to sell your data that they acquired through your use on their network, did you otherwise indemnify them in the event they do it?

What about losing the data because of gross negligence?

Answer 1

How do both of these stack up with regard to data protection and sale? If you don't explicitly grant the company the right to sell your data that they acquired through your use on their network, did you otherwise indemnify them in the event they do it?

What about losing the data because of gross negligence?

The key language is "due to or arising out of your access to the public Network" and "your use of and access to the Service" respectively.

If the Company is using your data, that isn't really "due to or arising out of your access to the public Network" or "your use of and access to the Services", so much as it is their actions is doing something with data about you.

While there is a possible reading that them selling your data which causes then to be sued (e.g. by a government regulator) could be interpreted as a triggering the indemnification obligation, many privacy laws have anti-waiver provisions and form contracts that have an ambiguity like this one are normally interpreted against the drafter.

They would only have liability to you for losing your data if they made some sort of promise that created an obligation on their part to not lose your data, which Evil Corp. probably didn't do. Indeed, there is probably another paragraph in the contract or ToS that expressly disclaims all liability for lost data.