Legal Alerts/3 Jun 2014

Legal Alert – Privacy Concerns for Companies Going Through Bankruptcy

It is typical for companies to state in their privacy policies that the personal data they gather from their users will not be disclosed to third parties except in certain limited circumstances. While there is no doubt that most companies making such promises intend to honor them, a privacy pitfall the companies may not anticipate is the sale of user data to third parties during bankruptcy proceedings.

On May 22, 2014, the director of the Bureau of Consumer Protection of the Federal Trade Commission, a U.S. regulator, sent a letter to a bankruptcy judge overseeing the reorganization of ConnectEDU, an education technology company. The letter expressed concern about the potential sale of the company’s assets, which could include transferring to another company the personally identifiable user data that ConnectEDU had collected during the 12 years of its operations. The letter stated that selling user data in these circumstances could violate the U.S. Bankruptcy Code and amount to an “unfair or deceptive act or practice” under the Federal Trade Commission Act (“FTCA”).

ConnectEDU’s privacy policy, in addition to including the typical protection against unauthorized disclosure of personal data to third parties, also stated:

In the event of sale or intended sale of the Company, ConnectEDU will give users reasonable notice and an opportunity to remove personally identifiable data from the service. In any event, any purchaser of ConnectEDU’s assets will abide by the terms of this Privacy Policy in the form effective as of any transfer.

The FTC letter stressed that, under Section 363(b)(1)(A) of the Bankruptcy Code, personal user data must not be sold to a third party unless the sale is consistent with the privacy policy. The letter concluded that even if the third-party buyer provided the same privacy protections as ConnectEDU, the sale of personal data by ConnectEDU would not be consistent with its privacy policy unless its users received notice of any proposed sale and were given an opportunity to delete their personal information. Otherwise, the sale might constitute a deceptive practice under the FTCA because the company would fail to adhere to a promise it had made in its privacy policy.

Companies that collect personal data from their users or customers should therefore be aware of the challenges of privacy protection that bankruptcy proceedings pose. If companies wind up in bankruptcy, they should ensure that they are able to abide by their representations regarding user privacy in case a potential sale of personal data is involved.

Share on LinkedInTweet about this on TwitterShare on Facebook