Every year American companies gather billions of pieces of data on consumers. But what happens to that data if the company goes into bankruptcy. That is the fundamental question that was raised by RadioShack in its bankruptcy proceeding in Delaware. How RadioShack navigated that issue may serve as a possible warning for companies.
During its life, electronics retailer RadioShack accumulated substantial amounts of data regarding its customers’ personal information and shopping habits. When the chain filed for bankruptcy protection earlier this year it listed among its assets more than 65 million customer names and physical addresses and 13 million email addresses. As part of the bankruptcy process, RadioShack then conducted an auction for this data, and awarded the sale to Standard General LP, which also purchased most of the defunct retailer’s intellectual property, including its name, along with certain store leases.
The issue is that RadioShack’s privacy policy stated that it would not sell any personally identifiable information collected from its customers. As a result, 38 states’ attorneys general or consumer protection bodies objected to RadioShack’s deal to sell its data to Standard General. In formal objections filed on March 20, 2015, the states asserted that the sale violate the company’s privacy policy and state consumer protection laws concerning notice to customers regarding the use of their data.
The FTC Bureau of Consumer Protection raised similar concerns in a letter to the bankruptcy court appointed consumer ombudsman. In its letter, the FTC suggested that if the data was to be sold, it should not be sold as a standalone asset but rather should be sold only with other assets of the company to another entity in substantially the same line of business as RadioShack. The Commission also suggested that the buyer must agree to be bound by the RadioShack privacy policies. The FTC further stated that the buyer should be required to obtain affirmative consent before using the data it purchases.
On May 20, 2015, the Delaware bankruptcy court judge Brendan L. Shannon approved a deal reached with the state attorneys general. Under this deal, Standard General will acquire the email addresses supplied to RadioShack by customers who sought product information in the past two years, but those customers will be allowed to opt out of the transfer. Standard General will not be able to share any of that information with Sprint, with whom it has a deal to co-brand the remaining RadioShack stores. Approximately 50 million customer files will be destroyed, including credit card information, Social Security numbers, birth dates, physical addresses, and phone numbers.
Even though the states attorneys general asserted that the deal was a victory for consumer privacy, companies that collect data, along with their investors and creditors, should view the RadioShack deal with a certain amount of caution. Many companies, such as Facebook and Google, have built billion-dollar businesses focused on the acquisition and use of customer information. Should one of these companies one day need to sell that data, or a portion thereof, (either through a bankruptcy or a corporate reorganization), they may find it hard to do. Clearly, this will need to be an issue that companies consider when crafting their privacy policies.
The case is In re RadioShack Corp., 15-10197, U.S. Bankruptcy Court, District of Delaware (Wilmington).
Take Away: Companies need to be forward thinking in crafting their privacy policies to deal with how data may be handled in the future. As data becomes increasingly valuable for marketers, companies should seek to establish flexible policies that taken into account future contingencies.