Statement of Commissioner Mozelle W. Thompson
This case is important because it directly considers the obligation of an online business to its customers and the responsibility of the business for its customers' personal information. This case is also very timely in light of predictions that pressures for internet profitability may lead many dot coms to sell data. See, e.g., The Internet Privacy Migraine, May 16, 2000, Forrester Research.
Toysmart.com ("Toysmart"), an online toy retailer, developed a valuable database of children's personal information based, among other things, on the express representation that it would never disclose such information to third parties. Unfortunately, Toysmart's performance in the marketplace resulted in bankruptcy, prompting Toysmart to sell its principal remaining asset - - its customer information database. In building this asset, however, Toysmart made a covenant with its customers; the company's lack of success does not extinguish this important obligation which forms the very basis for the existence of the asset.
I urge any successor to provide Toysmart customers with notice and an opportunity to "opt out" as a matter of good will and good business practice. In this case I believe that the specific terms of the settlement provide Toysmart's customers with the rights to which they agreed when they disclosed their information. I do, however, reserve the right to revisit this question should anyone, including the Bankruptcy Court, seek to alter these important settlement provisions.
1. Toysmart also violated the Children's Online Privacy Protection Act ("COPPA") by collecting personal information directly from children under the age of 13 without providing parental notice or obtaining verifiable parental consent. The settlement effectively resolves this charge by requiring Toysmart to delete all the information it collected in violation of the COPPA.