The American Legal System (Sentencia)

Lucia Laprida v. UCU USA Inc.
Court of Appels of Washington
October 22, 2018

OPINION BY: ARCAUS

The facts in this case are as follows: Lucia Laprida, a student at UCU, decided to join a program promoted by her university through its subsidiary in the United States called UCUSI. This program offered the possibility of connecting to a central computer known as "Secure Server", which offered the possibility of studying to use their iPads from abroad, and store information about their investigations in the "Secure Server" bank. Lucia was doing her thesis by this means, but everything was accidentally deleted by a UCUSI employee.

Lucia sued UCUSI, but also Steve's Sales, who was the manufacturer of the server, and finally, sued Beoing, since, the Central Storage Memory Bank (the "bank") was provided by this. The trial judge dismissed the claim to Beoing. In turn, UCUSI cross claimed against Boeing.

First, I will describe the arguments and evidence made by the parties, and in the end I will give my opinion on all points alleged by the plaintiff and the defendants.

The plaintiff alleges contractual liability against UCUSI, saying that it clearly breached an express warranty, because the defendant offered the possibility of storing data on a server called "Secure Server", which is a warranty because it highlights in its name the essential element of security and generates a lot of confidence to those who use this service. This induced the defendant to entrust her most important work to the server. It is clear that it is not essential that a server is fully secure, in fact, in the markets you can find servers for homes called "NAS", which have no security, so if a server stands out in its name the word "security", the applicant concludes that it is an express warranty.

On the other hand, Lucia say that there is an implied warranty that was violated. On this occasion it states that by explicitly offering "prepare research papers by storing all research material", it is understood that, implicitly, a server that stores extremely important information must have sufficient security to avoid loss of information. Lucia argues that, if you store a physical good in a warehouse, the expectation is that the good will not disappear and return to her hands, and if it does not, they must pay the damages, and similarly it would be the same with an intangible asset, such as information, if stored in a certain place, the expectation is to recover it or charge the damages.

In addition, as stated in Chysky case, when a consumer implicitly or explicitly discloses the purpose for which he obtains the goods, and there is a trust in the seller, there is an implicit or explicit guarantee that "the products shall be reasonably fit for such purpose." In this case, it is easy to visualize what the purpose was, since not only the plaintiff warns it, but explicitly the defendant promotes that use, therefore, the requirement in this case is even greater.

It is indisputable that the defendant knew the importance of the information stored in their servers, since they were created for that purpose, and UCUSI conducted a huge advertising campaign for students to access the program.

In Randy case, the reasons why the advertiser of a product inviting consumers to use it were extensively commented on, cannot avoid being held responsible if their statements caused damages.

Also, the applicant emphasizes that it complies with the rules established in the Codling test: she used the product in the appropriate manner and for the purpose for which it was promoted, that is, kept the information of its research on that server. Nor did he notice any defect in the operation, and when it stopped working it was too late to do anything about it. In addition, it is such a complex technological product that, it is beyond the consumer's reach to understand why or how the article works and, therefore, even further away from its scope to detect when there may be a defect (Colding).

Lucia also alleges negligence on the part of UCUSI since everything is derived from an employee of the same, who negligently erases all the information. When it comes to a service with this kind of information, a minimum error can cause great damages, therefore, precautions must be taken, principle that is extracted from MacPherson: who "invites another to make use of an appliance is bound to the exercise of reasonable care." According to Lucia, a poster is not enough to prevent a disaster, real measures must be taken that physically prevent an accident from happening, and even warn new employees that under no circumstances should they go to unauthorized places, something that was not done.

Finally, the applicant states that UCUSI acknowledged its error after having changed the Bank model to a safer one. This means that it was defective, in that case, a defect in the design, since it did not have the necessary security. In the Lancaster case, it is emphasized that a subsequent modification is proof that they did not act prudently when deciding on its final design. Leaving in evidence, according to Lucia, another negligence on the part of UCUSI.

On the other hand, UCUSI defended itself in the following terms: In the first place, it denies the existence of an express warranty of security, that name was given to the server "Secure Server" since it prevents information theft and any other hacking technique or cracking, and not for the possible loss of information. Protection against the latter is found in the Central Storage Memory Bank and not in the server as a whole. Therefore, the name serves for general confidence, but only in terms of possible leaks of information.

He also denies that there is an implicit warranty, he says that the only explicit warranty was the advertised, in summary, access to information in all parts of the world, and that warranty was fully executed. Do not confuse the purpose, which is to instantly access information from anywhere in the world, with the alleged purpose claimed by the applicant. The server was not created with the intention of being a center of backup or protection of important information, the purpose was clearly not that. The product was advertised for the "UC For Me" program whose mission was that students could study in other parts of the world from their iPads, and to study, it is necessary to have a place in which to order information, but not a place in which protect that information.

The importance of the information although it is known by UCUSI, alleges that, since the aim was not to protect, who has the ultimate responsibility of looking for a safe place of information is Lucia. Nobody with reasonable diligence leaves the most important information of his life in the hands of a single company, it is always possible that failures or problems occur that prevent temporary or definitive access to the information, failures that have even happened to large companies such as Google, Wikipedia, Microsoft, etc.

UCUSI continues its argument saying that it is not likely that a person only keeps that important information on the cloud, without having it also in its internal memory of the device, or in any other device. Lucia was not diligent making a backup of her information, backups are highly recommended and, above all, necessary in this type of information, all companies and people with knowledge in the area warn that the only way that the information is totally sure of possible data losses and possible corruptions, is through a backup.

Following this line of thought, UCUSI alleges that it did not comply with the Codling test, since it did not use the product properly. As stated, the purpose was to be able to access information remotely, not to protect the data. Therefore, if Lucia had used in a normal way, making backups periodically and using the servers only to access the information through the internet (while her backup was safe at home), many damages would have been prevented. As stated in Goldberg, everyone is aware of the dangers that certain things entail, in this case, how dangerous it is to not have such important information backups.

Regarding the accident committed by the employee, UCUSI argues that it took the necessary precautions training all the personnel and, prohibiting access to unauthorized places to untrained workers. If a person ignores the warnings installed in UCUSI, it is not due to lack of diligence of the company, since it is not expected that a company has an army to protect the entry of untrained personnel. For the fault and negligence, it is necessary that common, reasonable measures have not been taken and that every average man would take, and it is not reasonable to install an army to defend a database. This was solely the fault of that employee.

Finally, UCUSI defends itself by saying that the change of the product is due to business decisions aimed at improving the quality of the services, not for that reason it is admitted that they were negligent. The valid question here, is if the previous model was correctly chosen, and the answer is yes, it is reasonable to choose a model with the sole purpose of being accessible from all parts of the world, for this, the maximum protection was not necessary.

Lucia regarding the lawsuit against Steve's Sales Corp for breach of the express security warranty, for the name given to the server, argues that there is liability because, although there is no privity, in the Greenberg case it is established that this rule must be revised, and finally in Randy case, the traditional privity was dispensed with when there is an express warranty. In the same case, it is emphasized that, in a world with so much publicity, when the express warranty is false, the consumer is harmed by his confidence in those warranties.

In addition, it alleges that although Steve's Sales Corp may be held responsible for the falsity of its warranty, and Boeing Airplane Company for the security defect of its product, it would be only after a long litigation process, it is late, useless and extremely expensive, at the same time that it is complicated by all the interruptions that could happen, such as insolvency, disclaimers, etc.

In turn, it is based on Goldberg arguing that, if an article when used for the normal purpose is likely to generate a danger (in this case, the damage would be the loss of information), if it is not designed properly, the manufacturer and the seller are responsible in case of non-compliance with the implicit warranty of the law.

On the other hand, it also argues that the purpose of extending the scope of the warranty is to impose the burden on the manufacturer that put its product on the market, and that consumers have fewer tools to detect the defects of products of that complexity, however, other companies like the three defendants, do have that capacity. The article in the hands of the consumer is mysterious and too sophisticated.

According to Lucia, is part of the negligence of Steve's Sales Corp not to ensure that their products have the necessary security, since the purpose for which UCUSI would use it was known. Not only did he provide a misleading name to the server, but he is also responsible for not warning that the product would not serve that purpose. This is proved with the subsequent behavior of Steve's Sales, they began to develop a safer model after the failure.

Finally, both Lucia and UCUSI blame Boeing, the argument of both is that Boeing had manufactured a defective product without the necessary security. Lucia emphasizes once again that they immediately began developing a safer Model B with Steve's Sales, which shows the lack of security.

In response, Steve's Sales Corp alleges that Goldberg requires normal use by the consumer, and that the product may cause a hazard. However, who used negligently was UCUSI and not the consumer or Steve's Sales, so, the only responsible is UCUSI because of his negligence.

On the other hand, Steve's Sales argues that, as established in the Greenberg case, Judge Froessel ruled that, the modification and extension of liability was only for that specific case and for those specific facts, and however much he may want expand the responsibility, that should be left to the legislature. On the other hand, it is unfair to hold a diligent retailer responsible, who has not committed negligence or error of any kind, for a supposed defect of a product manufactured by Boeing.

For its part, Boeing Airplane Company bases its defense on the fact that its product, the Model B, was sold as a cheap product, without much protection and with inferior safety qualities to the Model A that it also offered, the latter being more expensive, because of the better protection and a better quality in terms of safety. All this information was known by UCUSI and by Steve's Sales Corp, who decided, despite the lack of security, to buy that product.

The product did not have a design flaw, simply the diligence of whoever had it in their hands should be greater to avoid damage, and that is obvious. If a person buys a lower quality product to save money, his expectation cannot be that the product is of a higher quality. Even the product did not fail due to a defect, a lack of warning or its poor quality, it was a total oversight on the part of UCUSI, which did not prevent untrained personnel from having contact with such a complex product.

It is undeniable, according to Beoing, that the lack of protection was warned UCUSI, and that he also wanted the product despite their concerns. Whoever wants a cheaper product and is willing to take a risk, which is not imminent, is the one who should take responsibility. It clarifies that the risk is not imminent since it did not occur due to the normal use of the thing; on the contrary, there was a person without knowledge who came into contact with the product, that is, it was a negligent use, and not a normal use.

In addition, Boeing alleges that the developing of a new product is not synonymous that the previous one had a failure. It is well known that the world of technology advances day by day, it is a sector that is constantly developing new systems, designs and increasingly advanced products. If a technology company does not update its components, all its products will be obsolete and many customers will be lost. In addition, after the negligence of UCUSI, Boeing products got a bad image, and the only way to change that is by offering a better service to customers, and assure them that Boeing cares about the safety and welfare of the customers.

A technology company lives in constant updating, and for that reason it should not be held responsible. The old design used was never offered as a high-quality product. If the customer uses the cheap product for something so important and does not take the necessary care, it is not Boeing's responsibility.

First of all, as a judge, I must specify many points. First, I believe that the express warranty made by of UCUSI is existent. If a service with the name of "Secure Server" is offered, it should be safe, and if it is safe only against the theft of information, against hacking or cracking, it should be warned that it is only safe against it and not against any other type of inconvenient. It is evident that a name generates confidence in the consumer, and if all those advertising strategies that give express warranties turn out to be false, the consumer who trusts in those express warranties is affected, as mentioned in the Randy case.

All these huge advertising campaigns are usually made to make the consumer trust the product, for this reason, it should be given the clearest and most accurate information possible, and not be excused later saying that it was only safe in an area and not in the another, this is totally unknown to the consumer.

In addition, it would be good to emphasize that, if UCUSI knows of the weaknesses of its server, and also decided that its purpose was not data protection, it would have been honest and fair that UCUSI take more diligent behavior by letting consumers know that the only way to avoid losing information before any inconvenience, is making backups every certain time. Warning about this, signaling that your server did not have the necessary tools to recover information that can be lost, is extremely important if it was not intended to be a database intended for protection. In this case we could talk about a defect due to a lack of warning, not from Steve's Sales or Boeing, but from UCUSI.

It is clear that the announcement of this type of thing is important, since the common user does not have the tools to detect by itself only when a server is reliable and safe, and only lets himself be carried away by the advertising of a company that he trusts. For the average consumer, this type of technology surpasses their understanding, does not know how it works or why it works, much less if it has sufficient security measures. However, I will later analyze Lucia's guilt.

On the other hand, I agree that the end of the product is not clear, on the one hand, it is called "Secure Server" but, on the other, it is promoted as a service to access information in all parts of the world. Even if we say that the purpose is only to access the information and not to protect it, it is well known that there should always be a minimum of security for the clients when the importance of the information is high.

Different would be the case of a server designed to store information not so priority, perhaps in this type of servers it is reasonable to choose a cheaper bank model without much protection. This principle derives from Chysky case, a product intended for a purpose must have sufficient and reasonable elements to fulfill that purpose.

UCUSI alleged that Lucia had to make backups, with which I agree. It does not seem reasonable to me that a person does not have a copy of such an important work. Either his thesis was not so important, or she was not diligent enough to make sure that her thesis was safe and copied in different places. It is evident that, with a medium diligence and care, any person would have avoided all this damage, especially with information as important as a thesis. Who has not been worried about losing their thesis or information of equal value? We have all made backups of that important information. Maybe not all of us do backups of absolutely all our information, but it is certain that we all worry about the information on which our future, our work and, in general, our whole life depends.

There is a special point that I want to highlight; when someone stores information in the cloud, it does not automatically erase the information in the device in which it was originally, so, I infer that, the only way that the information could be only in the cloud and not on the device of the applicant, Lucia he had to manually delete the information from his device, leaving only his most important information in the cloud. Which shows deeply his disregard for the thesis.

Much of the fault is on the part of UCUSI to not have the necessary diligence to prevent an untrained employee from entering manipulated prohibited elements, and that there is no person controlling the server. All this negligence, although it is attributable to UCUSI, it is not possible to point out that the loss of the thesis is entirely his fault. A minimum diligence of both, UCUSI and Lucia would have avoided all problems. As much as it is argued that UCUSI is a secure company that provides trust, this does not mean that the applicant should stop being diligent with their information.

Going into more technical details, it is well known that every server has at least two groups of storage units, a group for all information, so that people can access it, and a second group of storage units in which is a backup of all that information. That is to say, it is also the obligation of UCUSI to make backup of all the information, he himself alleges that he knows the risks of not making backups. Anyway, I understand that, if they did not intend to make a database for protection, perhaps it could be accepted that to save money it would be omitted to have another large storage unit for backups, since it is cheaper than is the users themselves take care of the information and use the service as a simple means to access information remotely anywhere in the world.

Again, I conclude that there was not enough care of either of the two parties, UCUSI did not make clear the purpose of the server and, Lucia did not behave like a careful person. There is a clear comparative negligence.

As for the subsequent modification made by the three defendants, each case is very different. On the one hand, UCUSI realized the error and problems involved in buying a cheaper model, knowing all the inconveniences that could cause and decided later change to the safest. If from the beginning you could have paid the most expensive model, and it was within your possibilities to grant more protection, it is not credible that the change is a simple strategy to improve your services, clearly admitting that it was not the right product.

Regarding the modification by Steve's Sales and Boeing, first I would like to analyze whether the existence of privity is necessary or not. In many cases it has been left aside, from Greenberg, where it insinuates that this theory should be left aside because it is unfair, going through Randy in which this theory is completely eliminated, the Goldberg case also speaks about strict tort liability, and they are not given so much importance to privity, even in Lancaster case where strict tort liability is finally applied also without giving much importance to privity. All these cases are more current than Chysky case, which has been far behind in time and has been modified by all those already named. Therefore, I conclude that it is possible to make an exception in privity in this case.

Returning to the modification, both are technology companies, both need a constant update of all their devices, that is a reality. It is certainly a very big coincidence that just after the problem they decided to develop a safer Model B. However, here I believe there is a confusion of terms. If UCUSI buys a cheaper product which is not suitable, does not mean that the product is defective, it should be noted that a defective product is one that has problems in its construction, design or warnings as it is indicated in Lancaster. Different is the case of a product not suitable for the task that UCUSI would develop.

UCUSI clearly knew the quality of the product and its functions, for which, we can deduce that they understood that this product was perhaps not the most appropriate, which does not imply that the product was defective. I do not think that the problem was a defect in the product, but rather a bad choice on the part of UCUSI, combined with an oversight, so it is not possible to say that Steve's Sales and Boeing are responsible, neither against UCUSI, nor in front of Lucia in this aspect.

Regarding the express warranty that Lucia alleges against Steve's Sales, I refer to the a forementioned, if the name of "Secure Server" is given, I believe it is an express warranty. If it was Steve's Sales who gave the name to the server, it must be responsible for that warranty, and not UCUSI, however, as UCUSI continued using that name to promote its product, it also has a part of responsibility for this express warranty, because it knew It was not as safe as the name indicated. Therefore, there is a shared responsibility of Steve's Sales and UCUSI against Lucia.

Regarding the implied warranty that Lucía alleges against Steve's Sales, I must say that the company warned UCUSI of the qualities of the products and gave two options, one with outstanding security and the other with weaker security, to choose. It is not possible to say that Steve's was negligent in offering a product with less security, even if he knows the purpose for which it will be used, it proved that the product worked correctly and fulfilled its objectives, and without a doubt it would have continued working if it were not for the UCUSI's negligence, which did not use the product correctly and normally. On the other hand, we have previously warned that the modification in this specific case did not imply an acceptance of a defect in the product.

If we apply the Codling Test, the defect should appear when the product was used properly, however, the server was not manipulated in UCUSI by a trained person when the information was deleted, on the other hand, UCUSI knew the weaknesses of the Bank that bought and used, for which reason it cannot allege that it did not know the frailty of the server. Finally, if Lucia had been careful enough, she would not have received any kind of damage.

Then, as a final conclusion, there is shared and compensation of negligence on the part of UCUSI and Lucia regarding the loss of information due to their fault for not using the server correctly and for not making backups. There is a shared liability between UCUSI and Steve's Sales against Lucia for the express warranty after naming the server as "Secure Server" and using it for promotion. Finally, any possible liability of Boeing in any of the cases is discarded.

The judgment appealed from should be modified according with this opinion.