Evan Schuman's StorefrontBacktalk

So here is the $64,000 question: Does the Borders policy “prohibit the transfer of personally identifiable information?” Yes. And no. The main policy essentially says, we won’t sell this data—typical stuff. But the bankruptcy part says that the data is an asset, and we can do what we want with it. So if Borders’ customer data is sold to the highest bidder, would that be “consistent with the privacy policy” that allows the data to be disposed of? Technically, yes; but as a practical matter, no.

Take the case of the online magazine xy.com, which catered to gay and lesbian teens. Certainly its subscriber base contained sensitive information that the magazine told its customers would never be shared. When the magazine went bankrupt and its assets transferred to a new owner (even one who intended to continue publishing the magazine), this could not be done unless and until approved by a bankruptcy privacy ombudsman.

Imagine if the online magazine—and its assets, including subscriber information—were sold to anti-gay-rights organizations or organizations that wanted to “out” the subscribers or even organizations that wanted to target subscribers for mailings about curing their homosexual tendencies. I suggest that any transfer of personal information be consistent not only with the letter of the policy but with the purpose for which the data was given in the first place.

A number of years ago, a non-profit group called the Cult Awareness Network (CAN) provided help and support for families of members of what they considered cults. They had a mailing list of former cult members, resources to help family members and a lot of sensitive information.

The Church of Scientology sued CAN for other reasons and won the lawsuit, forcing the tiny non-profit into bankruptcy. CAN’s only assets were its Web site and mailing list, both of which were acquired by the Church.

Thus, the combination of civil litigation and bankruptcy law could make what consumers believe to be personal information accessible by entities that they would never want to have it.

Retailers collecting personal information should take care to protect it even after their demise. Simply saying “your personal information becomes an asset if we declare bankruptcy” is not a privacy policy. It places almost no limitation on the use of the data. Anyone who acquires the company or its assets acquires the personal data. And that’s not what your customers signed up for.

If you disagree with me, I’ll see you in court, buddy. If you agree with me, however, I would love to hear from you.