Businesses, bankruptcy, and privacy promises

When a major retailer declares bankruptcy, it can be a devastating day. But what about the mounds of customer information the company has compiled over the years? When a company closes its doors, what effect does bankruptcy have on a business’ privacy promises?

As part of the FTC’s ongoing efforts to protect consumer privacy, BCP Director David Vladeck sent a letter to the consumer privacy ombudsman appointed by the court overseeing the bankruptcy of book and video retailer Borders. The concern? Over the years, Borders had collected personal information — including purchase history and email addresses — from over 20 million customers. According to the letter, through various iterations of its privacy policy, Borders had promised customers it wouldn’t share that information without consent.

Director Vladeck wrote, “The representations Borders made to its customers about the privacy of their information, including email addresses and purchase history, would likely be considered very important to many customers. In particular, information about the types of books and videos customers have purchased would be considered personal to many customers. Consumers who bought such items would likely be very concerned if their information were to be transferred without restriction to an unknown purchaser for unknown uses.”

“We understand that Borders’ customer information constitutes a potentially valuable estate asset,” the letter continued. “We are concerned, however, that any sale or transfer of the personal information of Borders’ customers would contravene Borders’ express promise not to disclose such information and could constitute a deceptive or unfair practice.”

Director Vladeck continued, “it would be appropriate for Borders to obtain express consent from its customers, specifying the potential purchaser, before it transfers the data. The consent process would allow customers to make their own determination as to whether a transfer of their information would be acceptable to them. For consumers who did not consent, their data would be purged.”

But what if the bankruptcy court “declines to require consent to the transfer in light of other considerations”? The letter points to the settlement regarding the bankruptcy of toy retailer Toysmart as an appropriate model. “As in Toysmart, our concerns about the transfer of customer information inconsistent with privacy promises would be greatly diminished if all the following conditions were met:

  • Borders agrees not to sell the customer information as a standalone asset;
  • The buyer is engaged in substantially the same lines of business as Borders;
  • The buyer expressly agrees to be bound by and adhere to the terms of Borders’ privacy policy; and
  • The buyer agrees to obtain affirmative consent from consumers for any material changes to the policy that affect information collected under the Borders’ policy.”

Read the full letter here.
 

0 Comments

| Commenting Policy

Leave A Comment

Don't use this blog to report fraud or deceptive practices. To file a complaint with the Federal Trade Commission, please use the FTC Complaint Assistant.

PRIVACY ACT STATEMENT: It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act and the Federal Information Security Management Act authorize this information collection for purposes of managing online comments. Comments and user names are part of our public records system, and user names are also part of our computer user records system. We may routinely use these records as described in our Privacy Act system notices. For more information on how we handle information that we collect, please read our privacy policy.