Open source liability is coming

The part you quoted continues with:

> Their business is bankrupt, their files are in a hacker’s hands, or their own customers are suing them.

Those are not consumers. That's B2B and comes with significantly lesser protections (if any) in EU law due to the EU’s view of B2B relationships being less asymmetrical w/r/t power and businesses being better at assessing the risks.

The implications are clear because this is not some new thing the EU conjured out of thin air but rather an expansion of which products will fall under the PLD, so we know how this has shaken out historically.

The long and short of it is that with physical merchandise, manufacturers have long been liable if their products caused damage (e.g., batteries of electric scooters catching fire). Still, when it came to software, companies often just shrugged and said, “We provided it as is, so tough luck.” The EU now says that's simply not good enough, and software companies should be held to the same liability standards as merchandise manufacturers.

Software lobbyists, of course, don't like this, so to stop that, they've decided to spread FUD about FOSS.

That's it, that's the story.

0: https://www.bigtechwiki.com/index.php/Developers_Alliance

The long and short of it is that this talks about expanding product liability laws in the EU. Currently, software doesn't fall within the PLD, and software developers can shrug and say their software was provided as is if damages occur (e.g., loss of data, data leak, etc.), whereas manufacturers of merchandise are on the hook if their product causes damage (e.g., fire)

The EU says this isn't good enough and wants to include software in the PLD. This would only pertain to commercially exploited software (e.g., sold, provided with maintenance contracts, etc.), excluding tiny software developers.

The only relation this has to FOSS is that software developers that use FOSS in their product would need to, you know, make sure they know what they are including in their software (something they should do anyway).

This has zero effect on Joe Schmoe and their GitHub repo, but this lobbyist likes you to think otherwise to help him stop this change in EU regulation.

That's it.

0: https://www.bigtechwiki.com/index.php/Developers_Alliance

That was the time the fda got far more rights to sanction and sue medical manufactures and I think we are in a better world for that.

The new law explicitly says what liability it wants to add:

* death or personal injury, including medically recognised psychological harm;

Whether software (including apps) was covered under the existing PLD has always been controversial.i For instance, there is controversy as to whether software should qualify as a product in the sense of the directive, ii or whether it is part of either the services or of the intangible goods category, iii which falls outside the scope of the existing PLD. iv

i) D. Wuyts, The product liability directive – more than two decades of defective products in Europe, 2014, and BEUC position paper on the Review of Product Liability Rules, 2017.

ii) See Article 2 of the existing PLD. A product has to be distinguished from a service and must be understood as 'all movables even if incorporated into another movable or into an immovable'.

iii) See pages 53-54 of the Commission staff working document on the approximation of the laws, regulations and administrative provisions of the Member States concerning liability for defective products, 2018: 'The definition of "product" as per article 2 of the Directive is related to the concept of "movable". This has been interpreted as meaning that only tangible goods shall be considered products [...] the non-tangible nature of some new technological developments (software, applications, Internet of Things, Artificial Intelligence systems) makes it difficult to classify them as products rather than services'.

iv) K. Alheit, The applicability of the EU Product Liability Directive to software, 2001. EPRS | European Parliamentary Research Service 6

* property damage, while removing the threshold of €500 and the possibility for Member States to impose a financial ceiling of €70 million; and

* loss or corruption of data that is not used exclusively for professional purposes

You don't even have to do it flawless, you still have the same defences available as in other product liabilities:

* the defect did not exist when they placed the product on the market;

* or the state of technical knowledge at the time of placing the product on the market made it impossible to discover the defect (i.e., the 'development risk defence').

We all buy medical devices and the companies are fully liable for them and they contain software, so it is quite possible to build software without getting sued.

see:

https://www.europarl.europa.eu/RegData/etudes/BRIE/2023/7393...

edit: formatting