By Matthew King

On November 21, 2005, a class action lawsuit was filed against Sony arising from the inclusion of “spyware” on their music CDs. This spyware prevented users from duplicating the CDs more than a few times, allegedly protecting Sony’s rights to limit unauthorized duplication of the CDs.

However, Sony failed to disclose to the consumers that this spyware would be installed on the user’s computer. In fact, even if the user declined to accept the licensing agreement that popped up when the CD was inserted, the spyware was still installed on the computer.

What was even worse, however, was that the removal program (offered by Sony following public outcry that the spyware was improper) installed a control to allow the uninstalled spyware to work remotely. This same control allowed anyone who knew about the control to run malicious or dangerous software code on the user’s computer. Sony settled the lawsuit in December 2005.

But what can a wronged consumer do when this type of harm occurs? The traditional tort of trespass to chattel does offer some relief. In Sotelo v. DirectRevenue, LLC,1 the court reasons that spyware installation (absent the user’s consent) might breach this common law tort. Further, in CompuServe Inc. v. Cyber Promotions, Inc., the court granted a temporary restraining order against a mass e-mailer on trespass-to-chattel grounds.2

In Washington, however, no case law exists addressing spyware and tort law. In light of the difficulties associated with tort principles in the Internet context, the Legislature enacted RCW Chapter 19.270. This law declares it unlawful to install spyware on a user’s computer without that user’s knowledge. The law also applies to other deceptive activities including collecting personal data from a computer through surreptitious means.3

If such an activity occurs, the statute limits actions to the attorney general, providers of software and an owner of a Web site or trademark who is “adversely affected” by a violation of the chapter to enjoin the damages and recover either actual damages or $100,000 per violation, whichever is greater.4 In addition, damages can be trebled if the defendant engaged in a pattern and practice of violating the chapter and the court may award reasonable attorneys fees and costs.5 However, damages cannot exceed $2 million.6

While this may seem to limit the ability of a consumer to recover for the installation of spyware, remember that violation of a statute is evidence of negligence. Therefore, a negligence claim may lie against a spyware installer.

1 384 F.Supp.2d 1219 (N.D. Ill. 2005).

2 962 F.Supp. 1015, 1022 (S.D. Ohio 1997).

3 RCW ¤¤ 19.270.020, .030, .040.

4 RCW ¤ 19.270.060.

5 RCW ¤ 19.270.060(2).