Almost all of us face this situation daily: We enter into an agreement with a company to disclose personal information, for example a home address and books purchased, and the company agrees to limit its use of such information. What happens to this personal information though when that company goes bankrupt? Does the agreement bind the buyer of the bankrupt company?
This precise question is currently playing out in the bankruptcy of Borders, the national bookseller which entered Ch. 11 in February. The bankruptcy court appointed a Consumer Privacy Ombudsman, whose report stated any use of Borders consumer information would require consent.
In issuing his report, the Consumer Privacy Ombudsman sought a written description of the Federal Trade Commission’s concerns regarding the sale of the consumer personal information Borders possessed. David Vladeck, Bureau of Consumer Protection Director at the FTC, responded in a letter laying down the framework for how the consumer personal information possessed by Borders should be sold to and used by a buyer. The framework generally followed that of the Toysmart settlement. The FTC stated its concerns about the transfer of customer information inconsistent with privacy promises would be “greatly diminished” if:
- Borders were to sell the rights as part of a larger group of assets to a buyer engaged in the same line of business as Borders,
- The buyer were to agree to be bound by the terms of Borders’ privacy policy, and
- The buyer were to obtain affirmative consent from consumers before enacting any significant changes to the policy.
The ultimate buyer of the consumer privacy information was in the same line of business and claimed the customer information was not sold as a standalone asset because trademarks and online content were also included in the sale. However, the buyer also claimed that the ombudsman’s consent requirement would render the value of the customer information worthless.
The bankruptcy court approved the sale of the customer information allowing the buyer to keep and use all the information. The court did not explicitly follow the Ombudsman’s report. The court required the buyer to send an email to affected consumers giving them 15 days to opt out of the transfer and prevent their information from being handed over. The buyer sent out the email on September 30. The Ombudsman took issue with the email, claiming it “omitted material information” by not disclosing the extent of the privacy information to be transferred and failing to state that the opt-out opportunity was required by the Court. Further, the FTC issued a reminder to consumers about the deadline to opt out.
While consumers faced an October 15 deadline to opt-out, this case and the fall out will surely extend far beyond that. With companies collecting more personal information on its customers while facing uncertain financial futures, bankruptcy courts are likely to see more cases involving the sale of consumer information.
- Ronald Lee and McCormick Conforti
