As business bankruptcies continue to occur, the assets sold by debtors in bankruptcy often include data concerning their customers, much of which is personally identifiable information. When contemplating such a transaction, it is important to review the debtor's privacy policy. That fact was underscored recently by the FTC's scrutiny of a debtor's proposed transfer of customer information in bankruptcy and the bankruptcy court's ultimate rejection of portions of the settlement agreement relating to the debtor's transfer of the information.

XY Magazine: A Case Study

The now-defunct XY magazine and its companion website, XY.com, targeted a young gay male subscriber base. The final issue of the magazine was published in 2007, and the website closed in 2009. During the time they were in operation, both the magazine and the website collected a substantial amount of personal information from subscribers while touting a restrictive privacy policy. For example, the signup confirmation page on XY.com urged subscribers to "note our amazing privacy policy. We never give your info to anybody." Similar statements appeared elsewhere on the website, and XY also made representations regarding the anonymity of its subscribers in connection with distributing the magazine.

When XY entered bankruptcy in 2010, the bankruptcy trustee proposed to transfer subscribers' personal information to a third party. This proposed transfer drew the attention of the FTC's Bureau of Consumer Protection, which sent a letter to proposed transferees advising them that any sale, transfer or use of the information "raises serious privacy issues" and could violate the Federal Trade Commission Act's prohibition against unfair or deceptive acts or practices. According to the FTC, because of XY's "simple, explicit, and clear" privacy policy under which "[s]ubscribers and members were told that their personal information would not be sold, shared, or given away to 'anybody,'" the sale or transfer of the data could constitute an unfair or deceptive trade practice by the debtor. The FTC also noted that a third-party transferee's receipt of the data with knowledge of the privacy policy violation could violate the Federal Trade Commission Act.

Ultimately, the bankruptcy court rejected portions of the settlement agreement that would transfer subscribers' personally identifiable information and ordered that all such information be destroyed (with the exception of a very limited set of data relating to unfulfilled orders for back issues of the magazine). Presumably, the court reached this decision based on section 363(b)(1) of the Bankruptcy Code, which limits a bankruptcy trustee's ability to transfer personally identifiable information in a manner that is inconsistent with a debtor's privacy policy. In particular, if a debtor discloses a privacy policy in connection with offering a product or service that prohibits the transfer of personally identifiable information to persons who are not affiliated with the debtor and the privacy policy is in effect on the date the bankruptcy case commences, the bankruptcy trustee may not sell or lease the information unless one of the following is true: (a) the transaction is consistent with the privacy policy (e.g., there is a carve-out that allows the information to be sold); or (b) the court—following the appointment of a consumer privacy ombudsman, proper notice and a hearing—approves the transaction, finding that no showing was made that the sale or lease would violate applicable nonbankruptcy law.

Interestingly, the FTC concluded that the transfer of XY's subscriber data could constitute an unfair or deceptive trade practice under the Federal Trade Commission Act, and the bankruptcy court stopped the transfer, even though the prospective transferees represented to the court that they wanted possession of the data in order to resume operating the magazine and/or website. As the FTC explained, the continued use of XY subscribers' personal information, even by the existing owner, would not necessarily be consistent with the purpose for which the information was provided given the closure of the magazine and website, as well as the subsequent passage of time. The FTC did suggest, however, that the transfer of personal information to a new owner of a business might be permissible under certain circumstances if the new owner agreed to use the information only in accordance with the original privacy policy and consistent with the original purpose for which the data was provided. A similar notion has been applied by at least one bankruptcy court. In In re Velocity Express Corporation (Bankr. D. Del. Nov. 3, 2009), the court allowed the transfer of assets that included personally identifiable information without appointing a consumer privacy ombudsman because the purchaser agreed to adhere to any privacy policies applicable to the debtor.

Lessons Learned

The XY bankruptcy proceedings offer some important practical lessons with respect to privacy policies and personally identifiable information. First, it is important to draft privacy policies with an eye toward the future. Privacy policies should, for example, expressly allow for the transfer of personal information in appropriate circumstances, such as in connection with the sale of other assets of the business or where the original privacy policy will govern the activities of the transferee. It is also important to consider whether the assets to be sold or acquired—in connection with bankruptcy proceedings or otherwise—include personal information and, if so, to review any applicable privacy policies and take their restrictions into account.

This attention to detail will allow a potential seller or buyer to reduce the risk of violating the Federal Trade Commission Act by transferring personal information in a manner that would constitute an unfair or deceptive trade practice. Furthermore, in the bankruptcy context, these precautions will allow a potential buyer or seller to avoid wasting time and money pursuing transfers of personal information that are unlikely to be allowed by the court under section 363(b)(1) of the Bankruptcy Code.