« August 2011 | Main | October 2011 »

September 29, 2011

Borders’s Sale of Personal Information Approved by Bankruptcy Court

The Wall Street Journal reported this week that Judge Martin Glenn of the U.S. Bankruptcy Court in Manhattan approved on September 26th the $13.9 million sale of Borders’s intellectual property to Barnes & Noble. Intellectual property assets include personal information (PI) that Borders collected from 48 million customers. This PI includes customer’s email addresses, but also records of books and videos they have purchased.

The issue of the privacy rights of Border’s customers was debated during the process. At a September 22 hearing, Judge Glenn had hesitated to approve the sale over concerns about customer’s privacy. The two sides, working with the Consumer Privacy Ombudsman (CPO) appointed by the court overseeing the Borders bankruptcy, agreed to email Border’s customers within a day of the sale's closing to ask them if they wish to opt out of Barnes & Noble’s email list. Records about specific titles bought in the past at Border’s won't be included in the sale.

The CPO had contacted the Federal Trade Commission (FTC) requesting it to provide a written description of its concerns regarding the possible sale of the PI collected by Borders during bankruptcy proceeding.

Bureau of Consumer Protection Director David Vladeck answered in a letter to the CPO on September 14, which was submitted to the court.

Borders and Its Privacy Policies

Selling PI during bankruptcy is regulated by section 363(b) of the Bankruptcy Code, 11 U.S.C. § 363(b), which provides that:  (our emphasis)

(b) (1) The trustee, after notice and a hearing, may use, sell, or lease, other than in the ordinary course of business, property of the estate, except that if the debtor in connection with offering a product or a service discloses to an individual a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor and if such policy is in effect on the date of the commencement of the case, then the trustee may not sell or lease personally identifiable information to any person unless —

(A) such sale or such lease is consistent with such policy; or

(B) after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale or such lease —

(i) giving due consideration to the facts, circumstances, and conditions of such sale or such lease; and

(ii) finding that no showing was made that such sale or such lease would violate applicable nonbankruptcy law.

Border’s 2006 and 2007 privacy policies had promised customers that the retailer would only disclose to third parties a customer’s email address or other PI if the customer “expressly consents to such disclosure.” The 2008 privacy policy, however, stated that:

Circumstances may arise where for strategic or other business reasons, Borders decides to sell, buy, merge or otherwise reorganize its own or other businesses. Such a transaction may involve the disclosure of personal or other information to prospective or actual purchasers, or receiving it from sellers. It is Borders’ practice to seek appropriate protection for information in these types of transactions. In the event that Borders or all of its assets are acquired in such a transaction, customer information would be one of the transferred assets.”

However, Mr. Vladeck wrote that the FTC “views this provision as applying to business transactions that would allow Borders to continue operating as a going concern and not to the dissolution of the company and piecemeal sale of assets in bankruptcy” and that “[e]ven if the provision were to apply in the event of a sale or divestiture of assets through bankruptcy, Borders represented that it would “seek appropriate protection” for such information.”

Privacy Policies and Unfair Practice

Mr. Vladeck wrote that the FTC was concerned that any sale or transfer of the PI of Borders’ customers “would contravene Borders’ express promise not to disclose such information and could constitute a deceptive or unfair practice.”

Mr. Vladeck ‘s letter noted that the FTC brought cases in the past where it alleged that the failure to adhere to a privacy policy is a deceptive practice under the FTC Act. In one of these cases, FTC v. Toysmart, an online retailer had filed for bankruptcy and then tried to sell its customer’s PI. The FTC alleged that the sharing of PI in connection with an offer for sale violated section 5 of the FTC Act, as the retailer had represented in its privacy policy that such information would never be shared with third parties.

Mr. Vladeck wrote that the “Toysmart settlement is an appropriate model to apply” in the Border’s case. The FTC entered a settlement with Toysmart allowing the transfer of customer information under certain limited circumstances:

1) the buyer had to agree not to sell customer information as a standalone asset, but instead to sell it as part of a larger group of assets, including trademarks and online content;

 2) the buyer had to be an entity that concentrated its business in the family commerce market, involving the areas of education, toys, learning, home and/or instruction;

3) the buyer had to agree to treat the personal information in accordance with the terms of Toysmart’s privacy policy; and

 4) the buyer had to agree to seek affirmative consent before making any changes to the policy that affected information gathered under the Toysmart policy.

Mr. Vladeck concluded his letter by offering these guidelines:

-          Borders agrees not to sell the customer information as a standalone asset;

-          The buyer is engaged in substantially the same lines of business as Borders;

-          The buyer expressly agrees to be bound by and adhere to the terms of Borders’ privacy policy; and

-          The buyer agrees to obtain affirmative consent from consumers for any material changes to the policy that affect information collected under the Borders’ policy.”

It seems that Mr. Vladeck’ s letter had a significant impact on the ruling.  Curiously, only a small percentage of customers understand the value their PI may have for a company, even though PI may be sold as assets.

September 27, 2011

Federal Trade Commission is Seeking the Public’s Comments on COPPA Rule

The Federal Trade Commission (FTC) is seeking comments from the general public on proposed amendments to the Children’s Online Privacy Protection Rule (COPPA Rule or the Rule).

The Children’s Online Privacy Protection Act (COPPA) was passed in 1998. It required the FTC to issue regulations regarding the collection of children’s personal information by operators of websites or online services directed to children under 13, and to enforce these regulations. The COPPA Rule was issued in November 1999, and became effective on April 21, 2000.

The COPPA Rule required the FTC, no later than April 21, 2005, to do a review of the Rule and to report the results of this review to Congress. The FTC sought public comments in 2005 on the Rule, and also sought additional comments on the COPPA Rule’s sliding scale approach to obtaining parental consent, which takes into account how children’s collected information  will be used. The FTC announced in April 2006 its decision to retain the COPPA Rule without changes.

In March 2010, the FTC asked the public to comment on whether changes to technology warrant changes to the COPPA Rule. The FTC also held a public roundtable during the comment period to discuss COPPA’s definitions of “Internet,” “website,” and “online service” as they apply to new devices and technologies.

After reviewing these public comments, the FTC is now proposing to amend the COPPA Rule. It proposes to modify some of the Rule’s definitions, and to update the requirements for parental consent, confidentiality and security, and safe harbor provisions. The FTC also proposes to add a new provision addressing data retention and deletion.

Parental Consent (16 CFR 312.5):

(p. 59 and following)

The FTC proposes to eliminate the “email plus” method for parental consent. This method allows operators to obtain verifiable parental consent through an email from the parent, but the email must be coupled with an additional step, such as postal address or telephone number from the parent, and confirming the parent’s consent by letter or telephone.

The FTC found that electronic scans and video conferencing technologies are functionally equivalent to the written and oral methods of parental consent originally recognized by the FTC in 1999. Therefore, the FTC proposes to recognize these two methods as a way to obtain verifiable parental consent.  The FTC also proposes to allow operators to collect a form of government-issued identification (driver’s license, truncated social security number) from the parent, as a way to verify the parent’s identity, provided that the parent’s identification is deleted “promptly” once the verification is done (p. 63).

Confidentiality, Security, and Integrity of Personal Information Collected From Children (16 CFR 312.8):

(p. 76 and following)

The Commission proposes to amend § 312.8 to strengthen the provision for maintaining the confidentiality, security, and integrity of personal information. The FTC thus proposes adding a requirement that “operators take reasonable measures to ensure that any service provider or third party to whom they release children’s personal information has in place reasonable procedures to protect the confidentiality, security, and integrity of such personal information.” Indeed, COPPA requires operators to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children, but does not explain what would be the data security obligations of third parties.

The FTC Commission proposes to amend § 312.8 to add:

 

The operator must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. The operator must take reasonable measures to ensure that any service provider or any third party to whom it releases children’s personal information has in place reasonable procedures to protect the confidentiality, security, and integrity of such personal information.”

 

Safe Harbors (current 16 CFR 312.10, proposed 16 CFR 312.11):

(p. 80 and following)

COPPA established a “safe harbor” for participants in FTC-approved COPPA self-regulatory programs: compliance with these programs serve as a “safe harbor” against an FTC’s enforcement action. Such programs are, for example, the Children’s Advertising Review Unit of the Council of Better Business Bureaus, or TRUSTe.

The FTC proposes to amend paragraph (b)(2) of the safe harbor provisions of the Rule to read:

An effective, mandatory mechanism for the independent assessment of subject operators’ compliance with the self regulatory program guidelines . At a minimum, this mechanism must include a comprehensive review by the safe harbor program, to be conducted not less than annually, of each subject operator’s information policies, practices, and representations. The assessment mechanism required under this paragraph can be provided by an independent enforcement program, such as a seal program.”

Data Retention and Deletion Requirements (proposed 16 CFR 312.10):

(p. 78 and following)

The FTC proposes to add new data retention and deletion provisions. Operators would retain children’s personal information for only as long as is reasonably necessary to fulfill the purpose for which the information was collected. Also, operators would have to delete this information by taking reasonable measures to protect against unauthorized access to, or use of, the information in connection with its deletion.

The new data retention and deletion provision (§ 312.10) would read:

“An operator of a website or online service shall retain personal information collected online from a child for only as long as is reasonably necessary to fulfill the purpose for which the information was collected. The operator must delete such information using reasonable measures to protect against unauthorized access to, or use of, the information in connection with its deletion.”

Written comments must be received on or before November 28, 2011.