The consumer privacy ombudsman: selling customer data in bankruptcy

When a company in bankruptcy wants to sell customer personal information that its privacy policy promised not to share, the court has to appoint a consumer privacy ombudsman first. Under 11 U.S.C. § 363(b)(1), the trustee may not sell that information unless the sale is consistent with the policy, or the court approves it after an ombudsman is appointed and after notice and a hearing. Section 332 says the US trustee appoints the ombudsman no later than 7 days before that hearing.

How the rule works

Situation	What happens
The privacy policy in effect at filing allows the transfer	The sale can proceed under the normal sale rules
The policy prohibits transfers to unaffiliated persons	No sale unless consistent with the policy, or approved after a hearing with an ombudsman
An ombudsman is needed	The court orders the US trustee to appoint one, at least 7 days before the hearing

What the ombudsman tells the court

Section 332(b) lists what the ombudsman may present at the hearing:

• the debtor’s privacy policy;
• the potential losses or gains of privacy to consumers if the sale is approved;
• the potential costs or benefits to consumers;
• possible alternatives that would mitigate privacy losses or costs.

The ombudsman may not disclose personally identifiable information it obtains in the case.

What the FTC has asked for

In Toysmart (2000), the FTC’s settlement allowed the customer list to be sold only with the whole website, to a qualified buyer in a related market that agreed to follow Toysmart’s privacy statement, and required the data to be destroyed if no approved sale happened within a year. In RadioShack (2015), the FTC asked the court to keep customer data from being sold on its own, to sell only to a buyer in substantially the same line of business, to bind the buyer to the original privacy policies, and to require consent for materially different uses.

Why it matters for company records

A bankrupt company’s records, including email, chat, tickets and CRM data, are estate assets. Licensing de-identified copies to an AI developer is a transaction the trustee or court has to approve, and customer data inside those records may bring section 363(b)(1) into play. Raise it with counsel early; see company assets and data in bankruptcy.