In what may become viewed as the de facto standard for selling customer information in bankruptcies, a Delaware bankruptcy court approved, on May 20, 2015, a multi-party agreement that would substantially limit RadioShack’s ability to sell 117 million customer records. The agreement was entered into by RadioShack Corp., General Wireless Inc., and 17 state attorney generals as part of the former’s ongoing bankruptcy proceeding. Despite its original intention to sell all of its customer records, RadioShack entered into the agreement in response to filings made by 36 state attorney generals and the Federal Trade Commission (FTC) (although the FTC was not a signatory). Instead of selling the entire cache of data, which includes credit and debit information, transaction history, telephone numbers, mailing addresses, and email addresses, RadioShack will destroy the majority of the data and sell only a subset of customer email addresses to General Wireless Inc. That subset of customer data will also be subject to various restrictions.
Following a RadioShack filing in the bankruptcy proceeding stating its intention to sell customer records, the Texas Attorney General filed a limited objection with the court arguing that the sale of the customer data would violate a number of provisions in RadioShack’s privacy policies, most notably a provision stating that consumer personally identifiable information will not be sold. The Texas Attorney General therefore argued that pursuant to 11 U.S.C.§ 363(b)(1)(B)(ii) such a sale would be impermissible because it would violate the Texas Deceptive Trade Practices Act, which prohibits “false, misleading, or deceptive acts or practices in the conduct of any trade or commerce,” and other states’ consumer protection laws. Section 363(b)(1)(B)(ii) requires a bankruptcy court to find that no applicable non-bankruptcy law will be violated by the sale of personal information when the proposed sale is inconsistent with the debtor’s privacy policy.
Tennessee, Pennsylvania, and Oregon also filed formal objections with the court, similar to that of the Texas Attorney General, and regulators from 32 other states filed letters supporting these motions.
The FTC’s Director of the Bureau of Consumer Protection, Jessica Rich, also filed a letter with the court-appointed ombudsman on May 16, 2015. Citing concerns similar to the Texas Attorney General’s, Rich wrote:
The representations RadioShack made to its customers about the privacy of their information, including name, address, telephone number, email address, and purchase history, would likely be considered very important to many customers . . . Consumers who provided their personal information to RadioShack would likely be very concerned if it were to be transferred without restriction to an unknown purchaser for unknown uses.
Rich therefore expressed the FTC’s concern that “a sale or transfer of the personal information of RadioShack’s customers would contravene RadioShack’s express promise not to sell or rent such information and could constitute a deceptive or unfair practice under Section 5 of the FTC Act [15 U.S.C. § 45].”
Rich analogized RadioShack’s proposal to the facts of a previous case brought by the Commission, FTC v. Toysmart, in which it sued a bankrupt online toy store seeking to auction personal information collected from customers. According to the FTC, the sale would have violated Toysmart’s privacy policy, thereby constituting a deceptive practice. While pointing to similar concerns with RadioShack’s proposed sale, Rich admitted that “bankruptcy presents special circumstances, including the interest in allowing a company to get back on its feet – or alternatively, to marshal remaining assets for its creditors,” and noted that the FTC had ultimately entered into a settlement agreement with Toysmart to allow it to transfer its customer information subject to several limitations.
Drawing on the principles of the Toysmart agreement, Rich stated that the FTC’s concerns about a sale of personal information in contravention of a privacy policy as part of a bankruptcy “would be greatly diminished” under the following arrangement:
- The customer information is not sold as a standalone asset;
- The buyer is engaged in substantially the same lines of business as RadioShack;
- The buyer expressly agrees to be bound by and adhere to the terms of RadioShack’s privacy policies as to the personal information acquired from RadioShack; and
- The buyer agrees to obtain affirmative consent from consumers for any material changes to the policy that affect information collected under the RadioShack policies.
In addition, Rich also recommended that RadioShack obtain affirmative consent from its customers before transferring the data. Those customers who did not consent could choose to have their information purged.
The agreement reached on May 20 ultimately reflected the Toysmart principles. Specifically, it allows RadioShack to sell email addresses that have been active within the last two years, but greatly limits the other types of data that can be included in the sale. Data subjects will also have the right to opt out within a certain time frame before their information is transferred to General Wireless. General Wireless also agreed not to sell or share any of the customer email addresses with any other entity and to be bound by the existing RadioShack privacy policy.
As big data analytics become an increasingly essential component of most companies’ marketing strategies, issues associated with the sale of customer data are bound to become more common. Although this is not the first time state regulators and the FTC have raised concerns about transactions such as these, the level of coordination and swift action on the part of these regulators shows they mean business when it comes to protecting consumer privacy, even in the context of major bankruptcies. Companies should therefore be sure to consider the guidance offered by the FTC and contained in the May 20 agreement when developing or revising their privacy policies with an eye towards potential sales in connection with bankruptcies or other future transactions.
*Zach Miller, Summer Associate with A&B, contributed to this post*