When privacy promises head to bankruptcy court

So a company is going great guns and collects massive amounts of personal information from consumers with the express promise it won’t share it with third parties.  Stuff happens and the company finds itself in Bankruptcy Court.  If you followed the FTC action in Toysmart or read the letters regarding Borders and XY Magazine, you’re already wondering what effect bankruptcy will have on those promises.  A letter from Jessica Rich, Director of the FTC’s Bureau of Consumer Protection, to a U.S. Bankruptcy Judge in New York underscores the importance of consumers’ privacy interests.

Educational technology company ConnectEDU has a website with career planning tools for students, parents, and counselors.  More than 20 million students have registered – along with 5,000 education institutions and 140,000 employers.  Students have built personal listings to showcase their academic interests, used the resume builder, and networked with potential mentors and bosses.

In the process, ConnectEDU has collected a mountain of data from users:  names, home and email addresses, dates of birth, phone numbers, the works.  Add to that the student records from high schoosl and community colleges that contracted with ConnectEDU.

In amassing all that information, the company made certain promises to users:  “[T]he personally identifiable data you submit to ConnectEDU (or that ConnectEDU obtains from your school) is not made available or distributed to third parties, except with your express consent and at your direction.”  Furthermore, “the Company will not give, sell or provide access to your personal information to any company, individual or organization for its used in marketing or commercial solicitation or for any other purpose, except as is necessary for the operation of the site.”

What if the company is sold at some point in the future?  ConnectEDU thought about that, too, and told people “In the event of sale or intended sale of the Company, ConnectEDU will give users reasonable notice and an opportunity to remove personally identifiable data from the service.”  Well, that about covers it.

Or does it?  Last month, ConnectEDU filed for Chapter 11 bankruptcy protection and now the company is proposing to sell pretty much all its assets, potentially including personal information about individuals.  Jessica Rich's letter to the Bankruptcy Court expresses concern that a sale that includes personal information could violate the FTC Act and Section 363(b)(1)(A) of the Bankruptcy Code.  What’s that provision say?  That a debtor can’t sell personally identifiable information about an individual covered by a privacy policy prohibiting the transfer of that information to a third party, unless the sale is consistent with that policy.

The letter explains the Bureau of Consumer Protection’s position:  “We believe that any sale of the personal information of ConnectEDU’s customers would be inconsistent with ConnectEDU’s privacy policy, unless ConnectEDU provides those customers with notice and the opportunity to delete that information.”

The letter continues, “It is our understanding that bankruptcy filings contemplate that any potential acquirer will fully comply with the ConnectEDU Privacy Policy.”  That may partially address some qualms, “but still would not cure the potential deception in the privacy policy.”  What would diminish those concerns?  If ConnectEDU:  1) tells users about the sale of their personal information and gives them a chance to remove it; or 2) destroys the data.  Another option would be to use a provision in the Bankruptcy Code that authorizes the Court to appoint a privacy ombudsman to ensure consumers’ interests are protected.

Privacy mavens and bankruptcy gurus:  Read the letter to find out more.

 

0 Comments

| Comment Policy

Leave A Comment

Don't use this blog to report fraud or deceptive practices. To file a complaint with the Federal Trade Commission, please use the FTC Complaint Assistant.

PRIVACY ACT STATEMENT: It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act and the Federal Information Security Management Act authorize this information collection for purposes of managing online comments. Comments and user names are part of our public records system, and user names are also part of our computer user records system. We may routinely use these records as described in our Privacy Act system notices. For more information on how we handle information that we collect, please read our privacy policy.