FTC Writes to RadioShack Consumer Privacy Ombudsman;
Outlines Manner of Potential Sale of Data
Elise Frejka of Frejka PLLC has been appointed the Consumer Privacy Ombudsman by the RadioShack Bankruptcy Trustee. Jessica Rich, the Director of the Federal Trade Commission’s Bureau of Consumer Protection wrote to Ms. Frejka to express the FTC’s concern over the potential/likely transfer of this consumer data especially in light of RadioShack promises that
We will not sell or rent your personally identifiable information to anyone at any time.
Rich’s letter is instructive since it outlines the FTC’s concerns in this area while also outlining a potential resolution.
We understand that RadioShack’s customer information constitutes a potentially valuable asset. We are concerned, however, that a sale or transfer of the personal information of RadioShack’s customers would contravene RadioShack’s express promise not to sell or rent such information and could constitute a deceptive or unfair practice under Section 5 of the FTC Act.
The Commission has brought many cases alleging that the failure to adhere to promises about information privacy constitutes a deceptive practice under the FTC Act. (Note 1) These cases include FTC v. Toysmart, in which the Commission sued an online toy retailer which had filed for bankruptcy and sought to auction the personal information it collected from its customers. (Note 2) The Commission alleged that the sale of personal information constituted a deceptive practice because the company had represented in its privacy policy that such information would never be shared with third parties. (Note 3)
We have similar concerns about the potential deceptive nature of the transfer of customer information in this case. We recognize, however, that bankruptcy presents special circumstances, including the interest in allowing a company to get back on its feet – or alternatively, to marshal remaining assets for its creditors – consistent with any promises made to customers. Toysmart is instructive on this point. There, the Commission entered into a settlement with the company allowing the transfer of customer information under certain limited circumstances: 1) the buyer had to agree not to sell customer information as a standalone asset, but instead to sell it as part of a larger group of assets, including trademarks and online content; 2) the buyer had to be an entity that concentrated its business in the family commerce market, involving the areas of education, toys, learning, home and/or instruction (i.e., the same line of business that Toysmart had been in); 3) the buyer had to agree to treat the personal information in accordance with the terms of Toysmart’s privacy policy; and 4) the buyer had to agree to seek affirmative consent before making any changes to the policy that affected information gathered under the Toysmart policy. These conditions served to protect consumer interests by ensuring that the data would be used consistent with Toysmart’s promises by an entity that was essentially operating as a new owner of the business, as opposed to a “third party” who was merely the highest bidder in a winner-take-all auction that may not have a reputational interest in handling the information in the same manner.
We believe the Toysmart precedent is an appropriate model to apply here to third parties. In this case, consumers provided personal information to RadioShack with the expectation that RadioShack might use it, for example, to make new offers of interest to consumers, but not to sell or rent it. As in Toysmart, our concerns about the transfer of customer information inconsistent with privacy promises would be greatly diminished if the following conditions were met:
-
The customer information is not sold as a standalone asset;
-
The buyer is engaged in substantially the same lines of business as RadioShack;
-
The buyer expressly agrees to be bound by and adhere to the terms of RadioShack’s privacy policies as to the personal information acquired from RadioShack; and
-
The buyer agrees to obtain affirmative consent from consumers for any material changes to the policy that affect information collected under the RadioShack policies.
The FTC concluded by noting that, alternatively, Radioshack could simply obtain affirmative consent from its consumers, which would ” allow customers to make their own determination as to whether a transfer of their information would be acceptable to them. For consumers who do not consent, their data would be purged.R
Note 1: See, e.g., In the Matter of Snapchat, Inc., No. C-4501 (F.T.C. 2014) (consent order), available at http://www.ftc.gov/enforcement/cases-proceedings/132-3078/snapchat-inc-matter; Facebook, Inc., No. C-4365 (F.T.C. 2012) (consent order), available at http://www.ftc.gov/os/caselist/0923184/index.shtm; FTC v. ControlScan, Inc., No. 1:10-cv-00532-JEC (N.D. Ga. 2010) (Stipulated Final Judgment and Order for Permanent Injunction and Other Equitable Relief), available at http://www.ftc.gov/os/caselist/0723165/index.shtm; In the Matter of Google, Inc., No. C-4336 (F.T.C. 2011) (consent order), available at http://www.ftc.gov/os/caselist/1023136/index.shtm; In the Matter of Chitika, Inc., No. C-4324 (F.T.C. 2011) (consent order), available at http://www.ftc.gov/os/caselist/1023087/110617chitikacmpt.pdf
Note 2: First Amended Complaint for Permanent Injunction and Other Equitable Relief, No. 00-11341-RGS (D. Mass. July 21, 2000), available at http://www.ftc.gov/os/2000/07/toysmartcomplaint.htm.
Note 3: Since the Toysmart case, the Bureau has sent letters similar to this one, advocating on behalf of consumers whose personal information was subject to potential transfer or sale in bankruptcy proceedings. See Letter from Jessica L. Rich, Director, FTC’s Bureau of Consumer Protection to The Honorable Shelley C. Chapman, United States Bankruptcy Judge, Bankruptcy Court for the Southern District of New York. (May 23, 2014), available at https://www.ftc.gov/public-statements/2014/05/commission-letter-jessica-l-rich-director-bureau-consumerprotection-filed (letter to bankruptcy court judge expressing concern that potential sale of student personal information may violate Bankruptcy Code and Section 5 of the FTC Act); Letter from David C. Vladeck, Director, FTC’s Bureau of Consumer Protection to Michael St. Patrick Baxter, Esq., et al. (Sept. 14, 2011), available at http://www.ftc.gov/sites/default/files/documents/public_statements/protection-personal-customer-information-heldborders-group/110914bordersletter.pdf (letter to bankruptcy court-appointed Consumer Privacy Ombudsman noting potential Section 5 concerns associated with selling personal information in a manner inconsistent with privacy policy representations); Letter from David C. Vladeck, Director, FTC’s Bureau of Consumer Protection to Peter Larson, et al. (July 1, 2010), available at http://www.ftc.gov/os/closings/100712xy.pdf (setting forth concerns about the transfer of personal information about subscribers to gay male youth-oriented XY Magazine to a new owner of the business),
Cyber Report 