The head of the Federal Trade Commission’s (“FTC”) Consumer Protection Bureau, David Vladeck, recently questioned the planned sale of email addresses and other information for about 48 million consumers by Borders Group, Inc. (“Borders”) as part of that entity’s bankruptcy proceeding.3 In a public letter, Mr. Vladeck noted that the data held by Borders included records of merchandise purchased (video and books) that could be perceived as personal by many customers. The bankruptcy court ultimately allowed the data sale to proceed, while imposing privacy restrictions that are less extensive than those preferred by the FTC.

According to the FTC’s letter, at least some of the data offered for sale in the bankruptcy proceeding had been collected prior to 2008 under privacy policies stating that data would not be transferred without “express consent.” A later privacy policy alerted customers that data could be transferred if Borders decided to sell, buy, merge, or otherwise reorganize the business, but Mr. Vladeck took the position that the statement would not cover the company’s dissolution and piecemeal sale. Mr. Vladeck therefore suggested that the sale of Borders’ customer data could be unfair or deceptive.

The FTC has repeatedly scrutinized planned sales of data assets following the dissolution of a business. Previously, the FTC alleged that a bankrupt online retailer, Toysmart.com, engaged in deceptive practices by offering its customer list for sale after its privacy policy stated that personal information would “never” be shared with third parties.4 Similarly, Mr. Vladeck warned in 2010 that the transfer of subscriber data from a discontinued magazine could be deceptive or unfair in light of the magazine’s previous privacy representations that data would not be shared.5 Mr. Vladeck further stated that the receipt of such data by a third party, in knowing violation of the privacy policy, could also be unfair.6

In his letter regarding the Borders bankruptcy, Mr. Vladeck took the position that it would be appropriate for Borders to specify the prospective purchaser and seek its customers’ express consent prior to transferring any data. However, citing the Toysmart settlement, Mr. Vladeck also noted that the concerns associated with data transfer would be diminished if: (1) the data were not sold as a standalone asset, (2) the new data owner were engaged in a business substantially similar to that of Borders, (3) the new owner agreed to abide by the terms of the Borders privacy policy and (4) the new owner agreed to obtain consumers’ affirmative consent to any material changes to the policy.

Barnes & Noble arranged to purchase Borders’ customer data along with other intellectual property assets through the bankruptcy proceeding, thereby satisfying the first two principles set out by Mr. Vladeck. However, the bankruptcy court declined to require customers’ express consent either to the transfer or to any material differences between the two companies’ privacy policies. Instead, the companies must provide notification of the planned sale to Borders customers via email, notices on the two companies’ homepages, and a newspaper ad. Customers will have 15 days from the notice to opt out of having their data transferred to Barnes & Noble.