Evan Schuman's StorefrontBacktalk

But what happens if the merchant goes bankrupt or is otherwise acquired? When online toy seller Toysmart went belly up, it had made no provision for the disposition of personal information as an asset. The FTC sued Toysmart in 2000 for sharing personal information as a bankruptcy asset, alleging that this constituted an unfair and deceptive trade practice. Even a decade ago, the FTC was concerned about the disposition of personal information as an asset in bankruptcy.

As a result, lawyers writing privacy policies have included provisions like that in the Borders’ privacy policy.

The Borders policy says explicitly that the retailer and its subsidiaries and affiliates “believe that your personal information—including your purchase history, phone number(s), E-mail and residential addresses, and credit-card data—belongs to you. We collect this type of information to serve you better when you provide it to us, but we do not rent or sell your information to third parties.”

After starting with that laudable goal, Borders (like many retailers) goes on to say that it can collect and share information with third parties to “improve your experience” and provides that users can “opt out” of certain uses. Borders also tells its customers that, in the event of an “acquisition or divestiture” customers’ personal information may be an asset transferred, stating explicitly, “In the event that Borders or all of its assets are acquired in such a transaction, customer information would be one of the transferred assets.”

So Borders is cool, right? It has effectively told its customers that, hey, if we go belly up your data is up for grabs—right? Almost, but not quite.

A privacy policy is the starting point, but not the ending point for the data relationship between a retailer and a customer. The real question should be, “is the transfer of this asset fair and reasonable?”

The federal bankruptcy law, 11 USC 363 (b)(1) provides that if a bankrupt company has a privacy policy “prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor and if such policy is in effect on the date of the commencement of the [bankruptcy] case, then the trustee may not sell or lease personally identifiable information to any person” unless the sale is consistent with the privacy policy or if the court appoints a consumer privacy ombudsman who allows the sale or transfer under certain conditions.

So here is the $64,000 question: Does the Borders policy “prohibit the transfer of personally identifiable information?” Yes. And no.