Supposing this is a freelancer & client in the EU and that a website was reasonably secured when developed.
Imagine there are no written contracts and a year after delivery this client's website suffers an attack and its sensitive data is stolen.
-
If the site was "reasonably secured", how did the breach happen? – user6726 Jan 23 at 2:23
-
by an attack vector not considered by the freelancer when developing, because the client unknowingly shared their password or other tokens of verification, because of an attack that was not well-known at the time, because it was a security flaw discovered in the meantime, because the freelancer didn't protect against all and every possible attack even though it did against some, etc. – Fernando Bessa Jan 23 at 2:34
-
3@user6726 "Reasonably secured" is not perfectly secured. Many, perhaps mopst, breaches are of sites reasonably secured -- until a way in is found. – David Siegel Jan 23 at 3:01
-
1The point is to clarify the level of potential negligence of the coder. Those details ought to be in the question. – user6726 Jan 23 at 5:23
Add a comment
|
If the freelance developer used normal and reasonable security precautions, then the dev fulfilled the contract. Moreover, the client accepted it. I doubt the dev has any liability on the facts stated in the Q. Details matter, of course.
answered Jan 23 at 3:04
It depends on the contract
Normally, an independent contractor is liable for their own torts. So, if the breach occurred because of the freelancer’s negligence, an aggrieved third party could sue the principal, the freelancer or both. The common law position is that they are jointly and severally liable (i.e. each is responsible for their own and the other’s breach), however, many jurisdictions have passed proportionality statutes that limit exposure to the proportion that each contributed. Also, some jurisdictions have professional liability limitation schemes that limit maximum exposure if the professional complies with the requirements.
The contract can change this position as between the principal and the freelancer - it can’t, of course, bind third parties but given that an aggrieved party is likely a user of the principal, the contract between them will be relevant as well. So, for example, the principal could indemnify the freelancer against third-party claims (or vice-versa).
If the freelancer breached the contract (e.g. there was a warranty, explicit or implied, that the website would have a certain level of security and it doesn’t) then the principal can recover its losses from the freelancer. The freelancer’s liability would be reduced by any contributory negligence by the principal, potentially to zero.
This is what professional indemnity insurance is for - then it’s the freelancer’s insurer’s problem.
-
-
-
-
@o.m. therefore common law is in scope, because the question has not excluded the possibility that the contract is governed by the law of Ireland or Cyprus. – phoog Jan 23 at 13:43
-
@phoog, I didn't downvote, I just want to point out that the most significant common-law member of the EU just left. There could be a line in the answer like "this actually applies to less than 2% of the EU, by population." – o.m. Jan 23 at 14:08
You note the absence of a written contract. Most contracts don't have to be written to be valid, (Contracts on some issues have to be written or even notarized to become valid, details differ between the EU member states.) But without a written contract, I find it implausible that the developer would have guaranteed any sort of fitness for purpose one year after deployment, without maintenance, unless a lot of money changed hands.
Most open-source and commercial software includes boilerplate language disclaiming liabilities, but that's often aimed at global audiences.
A client who operates software for more than a year without regular security checks and updates/upgrades would act unprofessional (again in my opinion, details might differ between jurisdictions). The GDPR requires adequate technical and organisational measures be the client to safeguard data. This might cause liability.
