Opinion No. (2006) ( 2006 )

Dear Director Richard:

This office has received your request for an official Attorney General Opinion in which you ask, in effect, the following questions:

1. Previous Attorney General Opinions have found that state contracts may not contain clauses that limit a private vendor's liability to the State. Does the prohibition on limitation of liability clauses apply only to contracts for goods, only to contracts for services, or to all state contracts?

2. Does the prohibition on limitation of liability clauses apply only to clauses that limit direct damages, or are state agencies also prohibited from entering into contracts that limit a private vendor's liability for indirect, incidental, special, punitive or consequential damages?

3. Are state agencies also prohibited from entering into contracts that limit a private vendor's liability for loss of profits, revenue, data or data use?

4. May a state agency enter into a contract whereby a private vendor accepts unlimited liability for damages caused by the vendor's negligent or intentionally wrongful acts only if the State agrees that the vendor will have sole control of the defense of any claims?

5. Does the prohibition on limitation of liability clauses apply to license agreements (also known as "shrink wrap licenses") enclosed with off-the-shelf computer software products? (This question relates to boxed, off-the-shelf software products that come with packaged warranties.)

6. May a state agency enter into a contract limiting a private vendor's liability for damages resulting from advice and/or assistance the private vendor provided to the agency in implementing software applications?

7. May a state agency enter into a contract that clearly limits a vendor's liability if the contract also includes the language, "To the extent that the limitation of liability contained herein is construed by a court of competent jurisdiction to be a limitation of liability in violation of Oklahoma law, such limitation of liability shall be void"?

8. May a state agency enter into a contract containing language in the clause proposed in Attachment "A" to this question?

9. May a state agency enter into a contract containing language in the clauses proposed in Attachment "B" to this question?

BACKGROUND Before addressing your questions specifically, we think it advisable to review the issues which led to your request. Your questions stem from previous Attorney General Opinions concluding that state contracts may not contain clauses which: limit private vendors' liability and hold them harmless for their own negligence or intentionally wrongful acts (A.G. Opins. 01-2, 78-256); indemnify a non-state party (A.G. Opin. 96-7); and waive the State's legal rights and defenses in advance of an action (A.G. Opin. 78-256). A "hold harmless" clause, for example, is one "whereby one party assumes the liability inherent in the undertaking, thereby relieving the other party of responsibility" — i.e., the State agrees to assume whatever liability would otherwise be borne by the vendor. 17A AM. JUR. 2D Contracts § 280 (West, WESTLAW through 2005). An "indemnity" clause "holds the indemnitee [vendor] harmless from liability by requiring the indemnitor [the State] to bear the cost of any damages for which the indemnitee is held liable." Id. An "exculpatory" clause is "[a] contractual provision relieving a party from any liability resulting from a negligent or wrongful act." Black's Law Dictionary 588 (7th ed. 1999). All such contract clauses, however they are labeled, have essentially the same general effect — to impose an actual or contingent obligation on the State for the benefit of the vendor.

You indicate that some vendors, particularly information technology vendors, object to contracts assigning them "unlimited liability." As we understand it, vendors' liability is not unlimited; rather, state contracts provide that each party, the State and the vendor, is responsible for its own intentionally wrongful acts or negligence.¹ "There is no impropriety in a contractual provision or stipulation making the contractor liable for the consequences of the contractor's own negligence." 64 Am. Jur. 2d Public Works and Contracts § 130 (2001).

In contrast, the contract provisions you have provided require the State to bear the risk of the vendors' intentionally wrongful acts or negligence in addition to the State's own. The obligations thereby assumed by the State may be substantial if injured third parties assert claims against the State, because the limitation of liability clauses would foreclose the State from being awarded damages in a breach of contract suit against the vendor whose acts or omissions actually caused the injury.² Attorney General Opinion 01-2 determined that such a contract provision creates a "debt or obligation" prohibited by Article X, Section 23 of the Oklahoma Constitution unless funds have been appropriated to cover the resulting obligation at the time the contract is executed. Id. at 12. The Opinion noted that such clauses were prohibited since the obligation created is contingent upon a future event which may or may not occur and therefore indeterminate as to both amount and the time payable, making appropriation impracticable. Id.

In response to Opinion 01-2, the Legislature in 2002 introduced State Question 703, which proposed to amend Article V, Section 53 of the Constitution to allow the Legislature to "enact laws to permit state entities to limit the contractual liability of persons contracting to provide information technology goods or services to the state, but in no event shall liability be limited to less than the amount of the contract." H.J. Res. 1051, 48th Leg., 2d Sess. (Okla. 2002). When State Question 703 was submitted to a vote of the people in the November 5, 2002 general election, it was defeated, with 55.74% of voters against the proposal. See Okla. State Election Bd., Gen. Election Nov. 5, 2002, Summary Results, available at http://www.state.ok.us/elections/02gen.html.

The contract issues you raise are not peculiar to Oklahoma. Other states have determined that limitation of liability, hold harmless, and indemnification clauses favoring vendors are void under the states' Constitutions, statutes, or public policy unless means for paying any contingent liabilities are provided for at the time of executing the contract.

Attorney General Opinion 01-2 was based on the principles articulated by the Oklahoma Supreme Court in Wyatt-Doyle Butler Engineers, Inc. v. City of Eufaula, 13 P.3d 474 (Okla. 2000), where the court regarded contingent liabilities as debts or obligations prohibited under the Oklahoma Constitution ArticleX, Section 26 (Article X, Section 26 is similar to Article X, Section 23 but applies to political subdivisions rather than the State.) A.G. Opin. 01-2, at 10-12. Wyatt-Doyle involved an indemnification clause in which a city agreed to pay funds owed by a public trust if the trust defaulted on its obligation.Wyatt-Doyle, 13 P.3d at 475. The court found the clause void, saying it created a contingent liability prohibited by OKLA. CONST. art. X, § 26. Id. at 479. The kind of contract clause inWyatt-Doyle is different from the limitation of liability clauses about which you ask, in that the latter do not require the State to become a surety and pay the balance of a debt owed to a third party. These clauses do, nonetheless, create a contingent obligation. Other states with similar constitutional provisions have come to the same conclusion.

In a provision similar to Oklahoma's Article X, Section 26, Texas's Constitution prohibits a city or county from creating a debt unless at the time it is created a tax and sinking fund are instituted to pay for it. Tex. Const. art. XI, § 7.³ The Texas Supreme Court said such a debt was created pursuant to that constitutional provision when a county agreed to indemnify private railway companies for their liability for damages incurred from the public's use of a causeway and drawbridge built jointly by the county and the railway companies. Tex. NewOrleans R.R. Co. v. Galveston County, 169 S.W.2d 713, 715 (Tex. 1943). The court noted that when the parties made the agreement they could not determine when such liability might arise or what its extent would be, and thus a debt was created. Id. at 715. Because the county had not, at the time it made the agreement, provided for levying and collecting a sufficient tax or created a sinking fund to pay the debt, the indemnity agreement was invalid. Id.; see also Brown v. Jefferson County,406 S.W.2d 185, 189-90 (Tex. 1966) (finding that although a "hold harmless" provision created an indeterminate future liability, the county could agree to it if it levied the tax and established the sinking fund required by the Constitution).

In summarizing these and other cases, Texas's Attorney General stated, "[A] county's agreement to indemnify a third party for damages arising from the third party's acts creates a debt within [the Constitution]." Tex. Op. Att'y Gen. GA-1076 (2004),2004 WL 763182, at * 3; see also Idaho Op. Att'y Gen. 79-13 (1979),1979 WL 29534, at *3 (construing a similar constitutional provision and stating that a contract in which a public entity assumes liability for its own fault or negligence is permissible, but warning that any contract provision that imposes on the state an assumption of existing or contingent liability on behalf of a third party may violate the Constitution); N.M. Op. Att'y Gen. 00-04 (2000), 2000 WL 1833589, at *4 (finding that an indemnification provision created a debt under the state Constitution, which "preclude[s] a government from entering into an agreement subjecting it to contingent liability, the amount of which is uncertain at the time of the agreement"); N.D. Op. Att'y Gen. 2002-L-21 (2002), 2002 WL 562587, at *2 (deciding that although a particular state entity had authority to indemnify a contractor or third party, it must include a non-appropriation clause as well as identify the funds it would use to fulfill its obligations if a claim arose under the indemnity provision).

Even without such a constitutional provision, states have prohibited limitation of liability clauses in state contracts for reasons of public policy. For example, Maryland's Attorney General was informed that "requiring contractors to assume unlimited liability on State contracts will both drive up the cost to the State of doing business (. . . by requiring prospective vendors to increase the cost of their proposals so as to compensate for the potential unlimited liability) and reduce the pool of potential contractors, by eliminating those who refuse to assume unlimited liability." Md. Op. Att'y Gen. 97-029 (1997), 1997 WL 819842, at *2. These same points were made in the Opinion request which resulted in Okla. A.G. Opin. 01-2. See A.G. Opin. 01-2, at 8. Responding to these issues, Maryland's Attorney General replied, "[A] provision requiring the State to bear indeterminate risk for another's negligence is beyond the authority of a contract officer unless insurance or another source of funds was available to underwrite the risk, or the agreement itself expressly conditioned the obligation on the availability of appropriations." Md. Op. Att'y Gen. 97-029,1997 WL 819842, at *4.

In this and other opinions, Maryland's Attorney General relied not on any constitutional or statutory provisions, but on public policy grounds. See, e.g., Md. Op. Att'y Gen. 86-064 (1986),1986 WL 287651, at *3 (finding that a proposed indemnity clause in a contract for the State Department of Agriculture to purchase a vaccine was "flatly inconsistent" with the state's public policy because it "expose[d] the [State] to potentially unlimited liability under circumstances in which no funds are appropriated to fund that potential liability, the risk is uninsured, and the indemnity clause itself does not condition the [State's] obligation on future appropriations having been made available.")

At least one state, Louisiana, has codified this public policy against the state assuming liability for others' actions:

A. It is hereby declared that any provision contained in a public contract . . . which requires a public entity to assume liability for damages arising out of injuries or property damage to the contracting parties or to third parties caused by the negligence of anyone other than the public body, its employees, or agents, is contrary to the public policy of the state of Louisiana. Any and all such provisions in any and all public contracts issued on or after October 1, 1988, are null and void.

LA. REV. STAT. ANN. § 38:2195 (West 2005).

State entities are entrusted with public funds and spending those funds must serve the public interest. Article X, Sections 23 and 26 were enacted "as a protection of the people from the excesses of governmental entities." Wyatt-Doyle,13 P.3d, at 477. The Oklahoma Supreme Court recognized this public policy in examining the competitive bidding requirements which accompany the award of most state contracts, finding as follows:

The provisions of statutes, charters and ordinances requiring competitive bidding in the letting of . . . contracts are for the purpose of inviting competition, to guard against favoritism, improvidence, extravagance, fraud and corruption, and to secure the best work or supplies at the lowest price practicable, and they are enacted for the benefit of property holders and taxpayers, and not for the benefit or enrichment of bidders, and should be so construed and administered as to accomplish such purpose fairly and reasonably with sole reference to the public interest.

Rollings Const., Inc., v. Tulsa Metro. Water Auth.,745 P.2d 1176, 1177-78 (Okla. 1987) (emphasis added) (citation omitted).

Oklahoma's Constitution reserves to the people the power to act in a legislative capacity and set public policy by referendum. "[T]he people reserve to themselves the power to propose laws and amendments to the Constitution and to enact or reject the same at the polls independent of the Legislature, and also reserve power at their own option to approve or reject at the polls any act of the Legislature." OKLA. CONST. art. V, § 1. In the 2002 referendum concerning public contracts, Oklahoma's electorate indicated that limiting vendors' liability is not in the public interest. See Okla. State Election Bd., Gen. Election Nov. 5, 2002, Summary Results, available at http://www.state.ok.us/elections/02gen.html. A limitation of liability provision which releases a vendor from responsibility for damages caused by its own negligence or intentionally wrongful acts puts the vendor's interest above that of the public. Such a clause is, therefore, not only constitutionally suspect but void as against public policy.

This office recognizes that the provisions of Article X, Sections 23 and 26, create problems when contracting with vendors who ask the State to assume their potential liability, especially when a vendor is the sole source for a particular good or service, or when the state's operations are so dependent on a particular vendor's product that the State effectively loses its bargaining power. There is no easy answer to this issue, but we believe there is at least one possibility, albeit with its own problems, that would satisfy the constitutional debt provisions and public policy considerations. That approach is to ensure that no obligation is created under the constitutional provisions by eliminating the uncertainty associated with contingent liabilities.

Attorney General Opinion 01-2 determined that a contract provision limiting a vendor's liability created a contingent obligation because the proposed indemnity was "indefinite in term and uncertain in amount." Id. at 12 (quoting A.G. Opin. 96-7, at 18). Therefore, if the State could make certain the time and amount of payment and encumber funds sufficient to pay the amount when the contract was executed, no "obligation" in the constitutional sense would be created. This approach has been advocated by Ohio's Attorney General in several opinions addressing debt creation under that state's Constitution. See,e.g., Ohio Ops. Att'y Gen. 96-060 (1996), 1996 WL 708356; 99-049 (1999), 1999 WL 756681; 2003-035 (2003), 2003 WL 22720012; 2005-007 (2005) 2005 WL 526809.

Based on state case law, Ohio's Attorney General determined that a hold harmless or indemnification clause in a state contract could comply with the state's constitutional debt and appropriation provisions⁴ as long as it met the following criteria: (1) "the clause may obligate the state only for the duration of the [fiscal year] in which the contract is executed" and cannot "bind the state for any length of time beyond that [period]"; (2) "the clause must specify a maximum dollar amount for which the state is obligated"; and (3) the amount specified must be appropriated to the contracting state agency and encumbered as available for payment prior to the contract's execution. Ohio Op. Att'y Gen. 96-060 (1996), 1996 WL 708356, at *9 (interpreting State v. Medbery, 7 Ohio St. 522 (1857)). The Attorney General cautioned that even if these three criteria were met, however, "a state agency also should consider whether agreeing to include such clauses in its contracts is prudent or advisable as a matter of public fiscal policy." Id. at *11.

This approach, although perhaps difficult to implement, would satisfy the legal requirements of Okla. Const. art. X, § 23 (for state agencies) and Section 26 (for municipalities and other political subdivisions of the state). A state entity and a vendor could negotiate and incorporate into a contract the amount of contingent liability the State would bear for a certain contract period, with the vendor being liable for any damages exceeding the agreed-upon amount. The state entity would then ensure that sufficient funds were appropriated and encumbered to cover the amount before the contract was executed. The extent to which the State should protect itself in a procurement contract against risk associated with a vendor's intentionally wrongful acts or negligence is a policy question for the procuring agency and perhaps the State Purchasing Director, not a question of law this office can answer. 74 Ohio St. 2001, § 18b[74-18b](A)(5).

We affirm the conclusions of Attorney General Opinions 78-256, 96-7, and 01-2. With those Opinions and the requirements of OKLA. CONST. art. X, §§ 23 and 26 in mind, we turn to your specific questions. The answers given assume that any contract containing a limitation of liability clause must incorporate some means to fund the potential liability, as mentioned previously.

1. Does the prohibition on limitation of liability clauses apply only to contracts for goods, only to contracts for services, or to all state contracts?

The prohibition applies to all state contracts. The constitutional provisions apply regardless of the subject matter of a contract and include contracts for both goods and services.

2. Does the prohibition on limitation of liability clauses apply only to clauses that limit direct damages, or are state agencies also prohibited from entering into contracts that limit a private vendor's liability for indirect, incidental, special, punitive, or consequential damages?

The prohibition applies to clauses that limit any damages, regardless of type, that the State could collect from a vendor in a contract action.⁵

3. Are state agencies also prohibited from entering into contracts that limit a private vendor's liability for loss of profits, revenue, data, or data use?

Yes, if the loss of profits, revenue, data, or data use results from the vendor's, rather than the state's, negligence or intentionally wrongful acts.

4. May a state agency enter into a contract whereby a private vendor accepts unlimited liability for damages caused by the vendor's negligent or intentionally wrongful acts only if the State agrees that the vendor will have sole control of the defense of any claims?

You indicate that some vendors submit contract clauses which state that the vendor will pay the cost of the state's defense if a third party sues the State alleging damages arising from a state contract with the vendor; in return for this promise, the vendor demands sole control over defending the case. Such a contract clause attempts to waive the State's legal rights and defenses before a lawsuit ever arises. No purchasing officer has the authority to agree to such a clause; State law provides that this authority belongs only to the Attorney General. Title 74, Section 18b(A)(3) reads as follows:

A. The duties of the Attorney General as the chief law officer of the state shall be:

. . . .

3. To initiate or appear in any action in which the interests of the state or the people of the state are at issue, . . . and prosecute and defend in any court or before any commission, board or officers any cause or proceeding, civil or criminal, in which the state may be a party or interested; and when so appearing in any such cause or proceeding, the Attorney General may, if the Attorney General deems it advisable and to the best interest of the state, take and assume control of the prosecution or defense of the state's interest therein[.]

Id.

The Attorney General is the only person who could agree with a vendor to allow it to have sole control over the state's defense, and then only once a lawsuit had actually arisen. "In the absence of explicit legislative or constitutional expression to the contrary, the attorney general possesses complete dominion over every litigation in which he properly appears in the interest of the state whether or not there is a relator or some other nominal party." State ex rel. Nesbitt v. Dist. Court, 440 P.2d 700, 707 (Okla. 1967), overruled on other grounds by Beidleman v.Belford, 525 P.2d 649 (Okla. 1974); see also A.G. Opin. 78-256 at 597-98 (concluding that such a clause is "unenforceable as being illegal in that the State Board of Public Affairs is not the proper state agency to make such a decision and cannot do so under the guise of negotiating and performing a contract with a private entity"). Because both the Oklahoma Supreme Court and the Legislature have granted to the Attorney General control over litigation in which the State has an interest, no other person can cede control of a lawsuit to a vendor or waive in advance the state's defenses. Therefore, such a contract clause is prohibited.

5. Does the prohibition on limitation of liability clauses apply to license agreements (also known as "shrinkwrap licenses") enclosed with off-the-shelf computer software products? (This question relates to boxed, off-the-shelf software products that come with packaged warranties.)

Mass software licenses such as shrinkwrap, clickwrap, and browsewrap⁶ (collectively, quickwraps) are unlike conventional contracts in that: (1) the buyer indicates acceptance by some act other than a signature on a writing; (2) they are not negotiated, but are a "take it or leave it" type of agreement; and (3) they are intended for use by a large group of end-users "for which negotiated licenses would be financially, administratively or otherwise infeasible." Terry J. Ilardi, MassLicensing — Part 1: Shrinkwraps, Clickwraps and Browsewraps, 831 PLI/PAT. 251, 255 (2005). Typically, quickwrap licenses contain limitation of liability clauses with language similar to that cited in your questions. You ask specifically about such clauses contained in shrinkwrap licenses.⁷

With shrinkwrap agreements, the packaged software is technically an offer which a buyer is free to accept or reject ("pay now, terms later"). The buyer triggers the agreement by opening the package and indicates acceptance of the license terms contained therein by failing to return the software within a specified period of time. Id. at 256. Thus, the contract is formed not when an order is placed or the software is purchased, but after the buyer has had a chance to inspect both the software and the terms accompanying it. ProCD, Inc. v. Zeidenberg,86 F.3d 1447, 1452-53 (7th Cir. 1996). While a few courts have found shrinkwrap agreements to be unenforceable, most courts have held them to be valid.⁸

For courts that have found shrinkwrap agreements enforceable, such agreements do not raise any new legal issues, but are merely another form of transaction, common in the sale of consumer goods, that requires payment before the buyer knows all the terms of the agreement. See, e.g., ProCD, 86 F.3d at 1451 (comparing purchasing boxed software to buying consumer goods whose warranties are viewable only after the sale). In ProCD, the court analyzed the shrinkwrap agreement as a sale of goods under Article 2 of the UCC (enacted in Oklahoma as 12A O.S. 2001 Supp. 2005, §§ 2-101-2-725). Id. at 1452. Section 2-204(1) of the UCC (12A O.S. 2001, § 2-204[12A-2-204](1)) states that agreement may be shown by the conduct of the parties. The court found the defendant was bound by the license agreement because his failure to return the software for a refund indicated acceptance of the license terms contained within the box. Id.

In the question you raise, under the reasoning of ProCD and similar cases, a limitation of liability clause contained in a shrinkwrap agreement is part of the contract if the State keeps the software. A buyer may still, however, reject certain terms in such an agreement and propose different terms, either before the purchase (by obtaining a copy of the shrinkwrap agreement before placing an order) or before the post-sale acceptance-or-refund period expires. The Oklahoma version of the UCC allows a party, like the State, to attempt to modify the terms of a sale of goods, including a shrinkwrap agreement. Title 12A, Section 2-207 provides as follows:

(1) A definite and seasonable expression of acceptance or a written confirmation which is sent within a reasonable time operates as an acceptance even though it states terms additional to or different from those offered or agreed upon, unless acceptance is expressly made conditional on assent to the additional or different terms.

(2) The additional terms are to be construed as proposals for addition to the contract. Between merchants such terms become part of the contract unless:

(a) the offer expressly limits acceptance to the term of the offer;

(b) they materially alter it; or

(c) notification of objection to them has already been given or is given within a reasonable time after notice of them is received.

(3) Conduct by both parties which recognizes the existence of a contract is sufficient to establish a contract for sale although the writings of the parties do not otherwise establish a contract. In such case the terms of the particular contract consist of those terms on which the writings of the parties agree, together with any supplementary terms incorporated under any other provisions of this act.

Id. (emphasis added).

A "merchant" is a person who either deals in goods of the kind being offered or someone who "by his occupation holds himself out as having knowledge or skill peculiar to the practices or goods involved in the transaction." 12A O.S. Supp. 2005, § 2-104[12A-2-104](1). "`Between merchants' means in any transaction with respect to which both parties are chargeable with the knowledge or skill of merchants." Id. § 2-104(3). Under these definitions, a state purchasing officer or other employee involved in a shrinkwrap license transaction who is knowledgeable about the offered goods would qualify as a merchant. See, e.g., Miss. Op. Att'y Gen. 98-0288 (1998), 1998 WL 304154, at *3 (finding that that State Department of Information Technology Services, as well as other state entities and employees with sufficient knowledge or skill, qualified as merchants under the state version of the UCC).

If the State initiates a purchase order for boxed software indicating terms such as quantity, price, etc. and the vendor ships the software with a license agreement which includes a limitation of liability clause not previously agreed upon, courts disagree whether the license is a proposal to add additional or different terms to the contract under Section 2-207. See, e.g.,M.A. Mortenson Co. v. Timberline Software Corp., 998 P.2d 305,311-12 (Wash. 2000), but contra, 316-17 (Sanders and Alexander, JJ., dissenting). In any case, the State may negotiate the limitation of liability clause in a shrinkwrap license (either before or after purchase) and seek to make it conform to the constitutional requirements cited above by conditioning the State's acceptance upon the vendor's agreement to alter the limitation of liability clause.

6. May a state agency enter into a contract limiting a private vendor's liability for damages resulting from advice and/or assistance the private vendor provided to the agency in implementing software applications?

See the answer to Question 1. The constitutional requirements apply to contracts for both goods and services. Rendering advice and/or assistance in implementing software applications pursuant to a contract constitutes providing services.

7. May a state agency enter into a contract that clearly limits a vendor's liability if the contract also includes the language, "To the extent that the limitation of liability contained herein is construed by a court of competent jurisdiction to be a limitation of liability in violation of Oklahoma law, such limitation of liability shall be void"?

See the answer to Question 1. Regarding the quoted language, it essentially says the limitation of liability clause is valid unless or until a court finds otherwise, and is similar to a clause that says liability is limited "to the extent allowed by Oklahoma law." This statement is not prohibited in state contracts, but is superfluous. If the State cannot under the Constitution agree to a particular limitation of liability clause, the clause is void and the quoted language has no legal effect. If, on the other hand, the clause specifies a maximum dollar amount and time period for which the State is obligated and funds are appropriated and encumbered for the contingent obligation, the clause is valid and enforceable. Inserting "to the extent allowed by law" or similar language does not change this result. See, e.g., Ohio Op. Att'y Gen. 2005-007 (2005),2005 WL 526809, at *6; Miss. Op. Att'y Gen. 2002-0488 (2002),2002 WL 31663364, at *1.

8. May a state agency enter into a contract containing language in the clause proposed in Attachment "A" to this question?

9. May a state agency enter into a contract containing language in the clauses proposed in Attachment "B" to this question?

This office does not generally construe contracts in Attorney General Opinions, but will address a public entity's authority to agree to a particular contract term if the question can be answered as a matter of law. 74 Ohio St. 2001, § 18b[74-18b](A)(5). You have submitted with your questions two attachments containing proposed contract language. Attachment "A" states as follows:

Unlimited liability will apply only to direct damages incurred by the State for death, physical injury or damage to real or tangible personal property of the State, except to the extent caused by the negligence or willful misconduct of the State, its employees, agents, contractors, representatives or third parties. In no event will VENDOR be liable for indirect, incidental, special, consequential damages, or damages resulting from lost data or lost profits, or costs of procuring substitute goods, software or services, however arising, even if it has been advised of the possibility of such damages. For all other direct damages, VENDOR'S liability for such damages arising out of, relating to or in any way connected with the relationship of the parties, the agreement, or the provision or non-provision of software or services (whether in contract, tort, or otherwise) shall in no event exceed the amount received by VENDOR from the State under this agreement, and if such damages result from specific services, such liability shall be limited to two times the fees paid for the service giving rise to the liability from which the claim arose.

Letter from John S. Richard, Director, Department of Central Services, to W.A. Drew Edmondson, Attorney General of Oklahoma (Jan. 24, 2006) (on file with the Oklahoma Attorney General's Office) (emphasis added). This clause disclaims vendor liability for any damages other than direct damages, and limits direct damages to the amount of the contract or, in certain circumstances, to twice the contract amount. Regarding damages other than direct damages, see the answer to Question 2. As for limiting the vendor's liability to the contract amount, or twice that amount, a state purchasing officer is not authorized to agree to this clause if it creates an obligation for which no appropriation has been made, as addressed above.

You also attached a second sample limitation of liability clause labeled "Attachment B." It reads as follows:

a) NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR DATA USE. VENDOR'S MAXIMUM LIABILITY FOR ANY DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT OR YOUR ORDER, IN CONTRACT OR TORT, SHALL BE LIMITED TO THE AMOUNT OF THE FEES YOU PAID VENDOR UNDER THIS AGREEMENT, AND IF SUCH DAMAGES RESULT FROM YOUR USE OF PROGRAMS OR SERVICES, SUCH LIABILITY SHALL BE LIMITED TO THE FEES YOU PAID VENDOR FOR THE DEFICIENT PROGRAM OR SERVICES GIVING RISE TO THE LIABILITY.

b) Notwithstanding the limitation on direct damages stated in a) above, VENDOR shall indemnify Customer for claims of bodily injury and/or tangible personal property damage resulting from negligent or intentionally wrongful actions or omissions of an [sic] VENDOR employee in the performance of obligations under this agreement to the extent such actions or omissions were not caused by Customer or any third party; provided, however, that (i) Customer notifies VENDOR within thirty (30) days of Customer's receipt of a claim; (ii) VENDOR has sole control of the defense and all related settlement negotiations, to the extent permitted by law (provided, however, without Customer's written consent, VENDOR may not admit that Customer has any liability, obligate Customer to pay any non-reimburseable sum or make any admission of a wrongdoing by Customer in conjunction with the defense or as a result of the settlement of the claim); and (ii) [sic] Customer provides VENDOR with the assistance, information and authority reasonably necessary to perform the above; reasonable out-of-pocket expenses incurred by Customer in providing such assistance will be reimbursed by VENDOR.

As used in this section b), the term "tangible personal property" shall not include software, documentation, data or data files. VENDOR'S liability shall not apply to damages incurred from use of any software.

c) This agreement applies only to the license of commercially available VENDOR software and standard technical support for such software. This agreement does not apply to any VENDOR consulting services that you may order. In the event you wish to order VENDOR consulting services, that order will be under a separate written agreement containing the terms of such order, including the terms for any limitations of liability.

To the extent that the limitation of liability contained herein is construed by a court of competent jurisdiction to be a limitation of liability in violation of Oklahoma law, such limitation of liability shall be void.

Id. This clause poses several issues, some of which have already been addressed above in the answers to Questions 2 (excluding all but direct damages), 3 (excluding damages for loss of profits, revenue, data, or data use), 4 (granting the vendor sole control over defense of claims), and 7 (including an inoffensive, but legally ineffective, clause).

Some language at first glance appears unobjectionable, such as, "VENDOR shall indemnify Customer for claims of bodily injury and/or tangible personal property damage resulting from negligent or intentionally wrongful actions or omissions of an [sic] VENDOR employee." Id. ¶ b). "Tangible personal property," however, is then defined to exclude "software, documentation, data or data files," the very things that the vendor apparently intends to provide to the State in this contract. Id. Thus, the vendor is not liable if its employee negligently or intentionally destroys, corrupts, or fails to properly maintain software, documentation, data or data files, which could potentially cost the State as much as a claim for bodily injury or injury to tangible personal property arising from conduct of the vendor's employee. This clause is a tacit limitation of liability in favor of the vendor and should be treated as if it were clearly labeled as such.

It is, therefore, the official Opinion of the Attorney Generalthat:

1. In accordance with the principles articulated in Wyatt-Doyle Butler Engineers v. City of Eufaula, 13 P.3d 474 (Okla. 2000), Article X, Section 26 (and by extension, Article X, Section 23) of the Oklahoma Constitution prohibits limitation of liability clauses in all state contracts, whether for goods or services, unless at the time the contract is executed funds have been appropriated and encumbered to pay for any contingent liability which might arise.⁹ Further, a limitation of liability clause which creates an unfunded contingent liability is void as against public policy.

2. Absent an appropriation as described in Answer 1, limitation of liability clauses that limit any damages, regardless of type, that the State could collect from a vendor in a contract action are prohibited.

3. Absent an appropriation as described in Answer 1, limitation of liability clauses that limit a vendor's damages for loss of profits, revenue, data, or data use are prohibited.

4. The Attorney General is the only person who can agree to grant a vendor sole control over the state's defense of any claim arising from a contract with the vendor. State ex rel. Nesbitt v. Dist. Court, 440 P.2d 700, 707 (Okla. 1967); 74 Ohio St. 2001, § 18b[74-18b](A)(3). See also A.G. Opin. 78-256, at 597-98. Therefore, a contract clause granting a vendor control over the state's defense in a lawsuit before a claim ever arises is prohibited.

5. Absent an appropriation as described in Answer 1, limitation of liability clauses contained in shrinkwrap agreements for packaged off-the-shelf software which limit a vendor's damages as in Answers 2 and 3 above, are prohibited.

6. Absent an appropriation as described in Answer 1, limitation of liability clauses in contracts for a vendor to provide advice and/or assistance in implementing software applications are prohibited.

7. Although contract language which states a vendor's liability is limited to the extent allowed by law is not prohibited, such language has no legal effect if the State cannot under the Constitution agree to a particular limitation of liability clause.

8. Regarding the proposed language in your Attachment "A," reproduced in full in the text above, see Answers 1 and 2.

9. Regarding the proposed language in your "Attachment B," reproduced in full in the text above, see Answers 1, 2, 3, 4, and 7.

W.A. DREW EDMONDSON Attorney General of Oklahoma

DEBRA SCHWARTZ Assistant Attorney General

¹ Oklahoma's Governmental Tort Claims Act ("GTCA") provides that governmental entities, officers, and employees shall only be liable in tort to the extent specified in the GTCA. 51 Ohio St. 2001, § 153[51-153]. Thus, the State has no authority to assume liability by contract for its own wrongful or negligent acts beyond that allowed under the GTCA.

² Under some such clauses, the State essentially would assume a risk of exposure to potential damages originating in tortious conduct beyond that contemplated by the GTCA, 51 Ohio St. 2001 Supp. 2005, §§ 151-200. In the GTCA the State adopted the doctrine of sovereign immunity for itself, its political subdivisions and all of their employees acting within the scope of their employment. 51 Ohio St. 2001, § 152.1[51-152.1](A). Some limitation of liability clauses would require the State in effect to extend its immunity to the vendor and its employees, who are not personnel the Legislature intended to protect under the GTCA. Such clauses thus essentially attempt to waive, by contract, the sovereign immunity of the State. Nevertheless, the GTCA does not directly apply to the proposed clauses because the state's liability, though directly traceable to tortious acts by the vendor and its employees, would arise as a matter of contractual obligation. A person injured by the tortious act or omission would sue the State in tort, but the State would in turn sue the vendor in contract.

³ Like Oklahoma, Texas has a similar constitutional provision which applies to state entities. See TEX. CONST. art. III, § 49.

⁴ Ohio Op. Att'y Gen. 96-060 also addressed whether such contract clauses violated the state Constitution's prohibition on lending the credit of the state to a private entity, a provision similar to OKLA. CONST. art. X, § 15. Id. at *9. The Attorney General determined that as long as the state received consideration equal to the value of its assumption of the contractor's liability there was no violation. Our Opinion does not address this issue.

⁵ "Direct" (or general) damages are "[d]amages that the law presumes follow from the type of wrong complained of." BLACK'S LAW DICTIONARY 394 (7th ed. 1999). "Consequential" damages are "[l]osses that do not flow directly and immediately from an injurious act, but that result indirectly from the act." Id. "Incidental" damages are "[l]osses reasonably associated with or related to actual damages." Id. at 395. "Punitive" damages are "[d]amages awarded in addition to actual damages when the defendant acted with recklessness, malice, or deceit . . . and . . . are generally not recoverable for breach of contract." Id. at 396. "Special" damages are "[d]amages that are alleged to have been sustained in the circumstances of a particular wrong." Id. We found no definition for "indirect" damages.

⁶ "Shrinkwrap" refers to a license contained within a physical package; "clickwrap" refers to licenses in which a computer user must assent to certain conditions before being allowed to download or install software; "browsewrap" refers to licenses which are available only by clicking on an Internet link. Ilardi, 831 PLI/Pat. at 256-57.

⁷ In referring to shrinkwraps, this Opinion uses the terms "license," "contract," and "agreement" interchangeably and does not consider any legal differences in the terms which may matter under the copyright doctrine of first sale. ProCD, Inc. v.Zeidenberg, 86 F.3d 1447, 1450 (7th Cir. 1996).

⁸ The law in this area is still unsettled, with courts using varied rationales to find shrinkwrap agreements either enforceable or unenforceable. See Kevin W. Grierson, Annotation, Enforceability of "Clickwrap" or "Shrinkwrap"Agreements Common in Computer Software, Hardware, and InternetTransactions, 106 A.L.R. 5th 309, 319 (2003).

⁹ A vendor remains liable for any damages exceeding the amount the State has by contract agreed to assume.