Suppose that a customer wants an online or cloud service provider to port all their users from their old system to the provider's new system. Most of them won't know this is happening.

It seems like creating a user in a system is bypassing the acceptance of user agreements, privacy policies, and TOS.

Is it legal to create an account for a user in a system with or without their consent (whatever that means)?

  • 1
    Ask your company's legal department. Aug 11 '19 at 17:11
  • @BlueDogRanch Hahahah I see what you did there!
    – richard
    Aug 11 '19 at 17:14
  • 2
    Does migrating to the new system require different user agreements and privacy policies than the old one? The agreements/policies/TOS are between the user and an organization, not between the user and a particular software system.
    – Peteris
    Aug 11 '19 at 17:24
  • @richard I see you haven't read the sidebar; due to the nature of the law, Law SE is not the same as SE sites. Aug 11 '19 at 17:33
  • 2
    As edited, this is a question about what the law is, and not a request for legal advice. It should not, now, be closed as off-topic. Aug 11 '19 at 18:48

There are three different roles involved: end users, the company, and the provider. There already is some legal relationship between the end users and the company.

Your question seems to boil down to: can the company create a legal relationship between the provider and the end users?

  • The company cannot enter any agreements on behalf of the end users, unless the end users have provided the necessary rights.
  • It may be possible for the company to transfer its end user relationship to the provider, with the new provider remaining bound by existing agreements.
  • The company may be able to unilaterally change its terms of service offered to the end users, but not all such changes are valid.

But in practice, nothing like this will be happening: there won't be any legal relationship between the end users and the provider, only between the company and the provider. The company might then appear as a reseller. The company can only engage that provider if their agreement with the end user allows this.

A practical example: The company provides an email service. It wants to stop self-hosting the email and outsource the service to some provider.

  • Scenario A: The current terms of service state that the emails will be stored on servers in Switzerland, but the new provider would be in Australia. Engaging the provider would violate the terms of service in the current form, but the ToS can likely be changed with some advance notice that allows users to delete their account if they don't agree with the changes.

  • Scenario B: The company's current agreement with end users makes certain privacy guarantees. The company ensures that these guarantees hold even when outsourcing to that provider. For example, they might have a contract with the provider that controls how the provider can process the end user data.

By the way, that scenario B would be a GDPR-compliant approach: the company acts as a data controller, and can take on data processors if they sign a data processing agreement that binds the processor to only use that end user data as explicitly instructed by the controller. That way, any use of the data remains under the authority of the controller. Things only get problematic when the provider wants to use the data for their own purposes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.