Customer privacy victory sends fighters of click fraud back to the drawing board

Mobile communications company Vodacom has fought off a legal challenge to have customer information released.

The Supreme Court of Appeal (SCA) found that even though another company wanted the information because of alleged cases of fraud, Vodacom was correct in its interpretation of recent legislation protecting digital privacy.  

Giftwrap Trading sells corporate gifts and clothing online. It uses Google to advertise on the web. Online advertising fees in this instance are calculated by the number of visits from such ads. These can be banner ads on sites you are browsing, for example, that lead to the company’s website. A company pays a publisher for a certain number of “clickthroughs”, each one costing, say, R10.

Ideally, some of those clickthroughs will lead to purchasing the company’s products. The company then recoups its budget, even though it lost money to clicks that did not lead to purchases. 

Giftwrap, like many, found itself the target of “click fraud”. This is where a competitor hires people to click on a victim’s ads until it has wasted the victim’s marketing budget. This limits proper access to the ad and thus potential revenue of the victim company. Giftwrap attempted to combat this with expert help. It obtained IP addresses of devices used in the click fraud, as well as the service providers. 

Applying to the high court in Pretoria, Giftwrap wanted a disclosure of customer information from these providers, including Vodacom, MTN and Telkom. Only Vodacom opposed the disclosure because it felt that, even if it agreed with Giftwrap, under SA electronic data legislation, Vodacom could not disclose. It would violate various aspects of customer privacy.

High court judge Selemeng Mokose agreed with Vodacom. Rejecting this outcome, Giftwrap appealed to the Supreme Court of Appeal. Appeal judge Christiaan van der Merwe assessed the case law Giftwrap relied on for its claim, as well as electronic data legislation.

First, he noted that in the case law relied on by Giftwrap, the relevant communications legislation was not pointed out to that court. Van der Merwe held that this legislation “precluded the disclosure of customer information”. To the extent the case law made no mention of this, the case “was wrongly decided”. (It is noteworthy that this case was handed down by his colleague, current acting appeal judge David Unterhalter.) Because of this, the case was of no assistance to Giftwrap’s arguments. 

Second, the same legislation says digital customer information obtained by, for example, service providers, cannot be disclosed. However, there are exceptions. Giftwrap relied on the specific provision where information is required as evidence in court. Another provision allows for someone like the director of public prosecution in the course of an investigation to have that information disclosed.

The issue was that Giftwrap did not fit the criteria that allowed it to obtain such information for “investigation”, only for evidence in a current court.

No such legal action is currently on, since Giftwrap wants that evidence before instituting action. “Giftwrap requires the customer information to identify the perpetrators of click fraud in order to take legal action against them,” Van der Merwe writes. “It goes without saying that disclosure of the customer information in respect of the listed IP addresses would not necessarily lead to legal action against a person so identified. It follows that in reality Giftwrap requires the customer information as part of an investigation with a view to taking appropriate legal action.”

But, Van der Merwe pointed out, “investigation” is reserved only for a competent authority, such as the National Prosecuting Authority (NPA), not a company like Giftwrap.

The specific provision in the legislation that allows the NPA to get information for an investigation is explicit about this allowance. However, the provision that Giftwrap fits makes no mention of an “investigation”.  Such an “absence”, says Van der Merwe, “indicates that disclosure for the purpose of an investigation is not allowed in the legislation for a party like Giftwrap”.

This does not leave Giftwrap empty-handed, the court noted. The information can still be preserved until Giftwrap institutes legal proceedings, where it can then claim under the provision it attempted to initially use. Giftwrap can also lodge a criminal complaint and thus engage the NPA.

The appeal was dismissed and no costs were awarded.