Businesses, bankruptcy, and privacy promises

Share This Page

When a major retailer declares bankruptcy, it can be a devastating day. But what about the mounds of customer information the company has compiled over the years? When a company closes its doors, what effect does bankruptcy have on a business’ privacy promises?

As part of the FTC’s ongoing efforts to protect consumer privacy, BCP Director David Vladeck sent a letter to the consumer privacy ombudsman appointed by the court overseeing the bankruptcy of book and video retailer Borders. The concern? Over the years, Borders had collected personal information — including purchase history and email addresses — from over 20 million customers. According to the letter, through various iterations of its privacy policy, Borders had promised customers it wouldn’t share that information without consent.

Director Vladeck wrote, “The representations Borders made to its customers about the privacy of their information, including email addresses and purchase history, would likely be considered very important to many customers. In particular, information about the types of books and videos customers have purchased would be considered personal to many customers. Consumers who bought such items would likely be very concerned if their information were to be transferred without restriction to an unknown purchaser for unknown uses.”

“We understand that Borders’ customer information constitutes a potentially valuable estate asset,” the letter continued. “We are concerned, however, that any sale or transfer of the personal information of Borders’ customers would contravene Borders’ express promise not to disclose such information and could constitute a deceptive or unfair practice.”

Director Vladeck continued, “it would be appropriate for Borders to obtain express consent from its customers, specifying the potential purchaser, before it transfers the data. The consent process would allow customers to make their own determination as to whether a transfer of their information would be acceptable to them. For consumers who did not consent, their data would be purged.”

But what if the bankruptcy court “declines to require consent to the transfer in light of other considerations”? The letter points to the settlement regarding the bankruptcy of toy retailer Toysmart as an appropriate model. “As in Toysmart, our concerns about the transfer of customer information inconsistent with privacy promises would be greatly diminished if all the following conditions were met:

  • Borders agrees not to sell the customer information as a standalone asset;
  • The buyer is engaged in substantially the same lines of business as Borders;
  • The buyer expressly agrees to be bound by and adhere to the terms of Borders’ privacy policy; and
  • The buyer agrees to obtain affirmative consent from consumers for any material changes to the policy that affect information collected under the Borders’ policy.”

Read the full letter here.

Add new comment

Comment Policy

Privacy Act Statement

It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act authorizes this information collection for purposes of managing online comments. Comments and user names are part of the Federal Trade Commission’s (FTC) public records system (PDF), and user names also are part of the FTC’s computer user records system (PDF). We may routinely use these records as described in the FTC’s Privacy Act system notices. For more information on how the FTC handles information that we collect, please read our privacy policy.