The staff of the Federal Trade Commission’s Bureau of Consumer Protection recently sent a letter to the court handling ConnectEdu’s bankruptcy proceedings and sale of assets, which may include their customer’s personal information. ConnectEdu’s privacy policy stated that personally identifiable information would not be made available to distribute to third parties without the individual’s express consent and direction, and that ConnectEdu would not “give, sell, or provide access to your personal information to any company, individual, or organization for its use in marketing or commercial solicitation or for any other purpose, except as is necessary for the operation of this [website].” Finally, the policy also stated that, “In the event of sale or intended sale of the [c]ompany…, ConnectEDU will give users reasonable notice and an opportunity to remove personally identifiable data from the service. In any event, any purchaser of ConnectEDU’s assets will abide by the terms of this Privacy Policy in the form effective of as of any transfer.”

The letter emphasizes that if the sale of assets includes personal information, such a sale must comply with Section 363(b)(1)(A) of the Bankruptcy Code, which specifically prohibits the sale of personally identifiable information about an individual covered by a privacy policy to a third party unless such a sale is consistent with the policy. As such, the FTC stated its belief that any sale of ConnectEdu’s customer’s personal information would be inconsistent with the privacy representations in ConnectEdu’s policy and potentially violate the FTC Act and Bankruptcy Code unless such individuals were provided notice and an opportunity to delete the information. The FTC further stated that its concerns may be diminished if a privacy ombudsman were appointed to protect the privacy interests of ConnectEdu’s customers.

TIP: This letter suggests that the FTC is concerned about consumer privacy in bankruptcy proceedings. If considering purchasing a company’s assets, take into consideration that target’s privacy obligations. These include affirmative promises made about how personal information will be treated as part of a sale of the target company.