Statement of Commissioner Mozelle W. Thompson This case is important because it directly considers the obligation of an online business to its customers and the responsibility of the business for its customers' personal information. This case is also very timely in light of predictions that pressures for internet profitability may lead many dot coms to sell data. See, e.g., The Internet Privacy Migraine, May 16, 2000, Forrester Research. Toysmart.com ("Toysmart"), an online toy retailer, developed a valuable database of children's personal information based, among other things, on the express representation that it would never disclose such information to third parties. Unfortunately, Toysmart's performance in the marketplace resulted in bankruptcy, prompting Toysmart to sell its principal remaining asset - - its customer information database. In building this asset, however, Toysmart made a covenant with its customers; the company's lack of success does not extinguish this important obligation which forms the very basis for the existence of the asset. I have voted to approve the settlement in this matter resolving the Commission's charges that Toysmart violated Section 5 of the Federal Trade Commission Act because I believe the terms of the settlement are consistent with Toysmart's privacy policy.(1) More specifically, the settlement permits Toysmart to sell its information only to a "qualified buyer," defined as an entity engaged in the family commerce market who expressly agrees to be Toysmart's successor-in-interest as to that information. Accordingly, Toysmart may transfer its data only to someone who specifically "stands" in the shoes of Toysmart. Despite the consistency between the settlement and Toysmart's privacy policy, my decision to approve the settlement is not without reservation. Like my colleagues Commissioner Anthony and Commissioner Swindle, I think that consumers would benefit from notice and choice before a company transfers their information to a corporate successor. Indeed, many of the consumers who disclosed their families' personal information to Toysmart might not have been willing to turn over the same information to the particular corporate entity that ultimately succeeds Toysmart. This is true even where Toysmart's corporate successor must pursue the same line of business as its predecessor. I urge any successor to provide Toysmart customers with notice and an opportunity to "opt out" as a matter of good will and good business practice. In this case I believe that the specific terms of the settlement provide Toysmart's customers with the rights to which they agreed when they disclosed their information. I do, however, reserve the right to revisit this question should anyone, including the Bankruptcy Court, seek to alter these important settlement provisions. 1. Toysmart also violated the Children's Online Privacy Protection Act ("COPPA") by collecting personal information directly from children under the age of 13 without providing parental notice or obtaining verifiable parental consent. The settlement effectively resolves this charge by requiring Toysmart to delete all the information it collected in violation of the COPPA. |