What to do with customer data when your company closes

A closing company still has to keep the promises in its privacy policy about customer data. In practice that leaves three options: delete what you no longer need, keep what law or contracts require, and transfer data only in ways your policy allows. The FTC’s long-standing position, set out in the RadioShack and Toysmart bankruptcies, is that a buyer of customer data should be in the same line of business and bound by the policy the customers agreed to.

Your options for customer data

Option	When it fits	Watch out for
Delete	You no longer need it and no retention rule applies	Dispose of it properly; FTC guidance is to keep only what you need
Keep	Tax, warranty, legal hold or contract duties	Name who keeps it and secure it
Return	B2B customers whose contracts require it	Contract deadlines and formats
Transfer with the business	A buyer takes over the line of business	Privacy policy terms; California’s merger and acquisition rule
License de-identified copies	Operational records, with counsel’s approval	Policy promises, contracts and how de-identification is done

What regulators have said

• FTC, RadioShack (2015): RadioShack had promised not to sell customer information. The FTC asked the bankruptcy court to make sure any sale kept the data bundled with other assets, went to a buyer in substantially the same line of business, bound the buyer to the original privacy policies, and required affirmative consent for materially different uses.
• Bankruptcy Code: if a privacy policy in effect at filing prohibits transferring personal information to unaffiliated parties, a trustee may not sell it unless the sale is consistent with the policy or the court approves it after a hearing, with a consumer privacy ombudsman (11 U.S.C. § 363(b)(1)). See the consumer privacy ombudsman.
• California (CCPA): transferring personal information as an asset in a merger, acquisition, bankruptcy or similar transaction where the third party takes control of the business is not a “sale”, but if the acquirer materially changes how it uses the data, it must give consumers prior notice (Cal. Civ. Code 1798.140(ad)(2)(C)).

A short plan

1. Find the privacy policy that was in force when you collected the data, and any earlier versions.
2. List where customer data lives: CRM, support desk, billing, email, backups.
3. Decide per system: delete, keep, return, transfer or license, and write the decision down.
4. Have counsel review any transfer or licence before it happens.