FTC Writes to RadioShack Consumer Privacy Ombudsman;
Outlines Manner of Potential Sale of Data
Elise Frejka of Frejka PLLC has been appointed the Consumer Privacy Ombudsman by the RadioShack Bankruptcy Trustee. Jessica Rich, the Director of the Federal Trade Commission’s Bureau of Consumer Protection wrote to Ms. Frejka to express the FTC’s concern over the potential/likely transfer of this consumer data especially in light of RadioShack promises that
We will not sell or rent your personally identifiable information to anyone at any time.
Rich’s letter is instructive since it outlines the FTC’s concerns in this area while also outlining a potential resolution.
We understand that RadioShack’s customer information constitutes a potentially valuable asset. We are concerned, however, that a sale or transfer of the personal information of RadioShack’s customers would contravene RadioShack’s express promise not to sell or rent such information and could constitute a deceptive or unfair practice under Section 5 of the FTC Act.
We believe the Toysmart precedent is an appropriate model to apply here to third parties. In this case, consumers provided personal information to RadioShack with the expectation that RadioShack might use it, for example, to make new offers of interest to consumers, but not to sell or rent it. As in Toysmart, our concerns about the transfer of customer information inconsistent with privacy promises would be greatly diminished if the following conditions were met:
The customer information is not sold as a standalone asset;
The buyer is engaged in substantially the same lines of business as RadioShack;
The buyer expressly agrees to be bound by and adhere to the terms of RadioShack’s privacy policies as to the personal information acquired from RadioShack; and
The buyer agrees to obtain affirmative consent from consumers for any material changes to the policy that affect information collected under the RadioShack policies.
The FTC concluded by noting that, alternatively, Radioshack could simply obtain affirmative consent from its consumers, which would ” allow customers to make their own determination as to whether a transfer of their information would be acceptable to them. For consumers who do not consent, their data would be purged.R
Note 1: See, e.g., In the Matter of Snapchat, Inc., No. C-4501 (F.T.C. 2014) (consent order), available at http://www.ftc.gov/enforcement/cases-proceedings/132-3078/snapchat-inc-matter; Facebook, Inc., No. C-4365 (F.T.C. 2012) (consent order), available at http://www.ftc.gov/os/caselist/0923184/index.shtm; FTC v. ControlScan, Inc., No. 1:10-cv-00532-JEC (N.D. Ga. 2010) (Stipulated Final Judgment and Order for Permanent Injunction and Other Equitable Relief), available at http://www.ftc.gov/os/caselist/0723165/index.shtm; In the Matter of Google, Inc., No. C-4336 (F.T.C. 2011) (consent order), available at http://www.ftc.gov/os/caselist/1023136/index.shtm; In the Matter of Chitika, Inc., No. C-4324 (F.T.C. 2011) (consent order), available at http://www.ftc.gov/os/caselist/1023087/110617chitikacmpt.pdf
Note 2: First Amended Complaint for Permanent Injunction and Other Equitable Relief, No. 00-11341-RGS (D. Mass. July 21, 2000), available at http://www.ftc.gov/os/2000/07/toysmartcomplaint.htm.