II. The Federal Trade Commission And Privacy Policies
III. Fair Information Practice Principles
Currently, no statute requires the placement of privacy policies on Internet Web sites other than the Children’s Online Privacy Protection Act of 1998 (“COPPA”), which is only applicable to Web sites collecting information from children who are younger than 13 years old.[FOOTNOTE 7] In addition, there is no legislation that regulates the content of posted privacy policies for Internet companies. However, the FTC has established fair information practice principles that act as a guideline for evaluating Web site privacy policies.[FOOTNOTE 8] Fair information practice principles were additionally used as a framework in drafting COPPA, and they are currently being recommended as guidelines for drafting legislation to regulate web sites not governed by COPPA.[FOOTNOTE 9] In 2000, the FTC submitted a report to Congress concerning the results of a survey performed on heavily trafficked web sites and advocating legislation based on the following fair information practice principles:
1. Notice — Web sites should be required to provide customers with clear and conspicuous notice of their information practice, including what information they collect, how they collect it, how they use it, and how they provide Choice, Access, and Security to consumers.
2. Choice — Web sites should offer consumers choices as to how their personal identifying information is used beyond the use for which the information was provided.
3. Access — Web sites should be required to offer consumers reasonable access to the information a Web site has collected about them, including a reasonable opportunity to review the information and to correct inaccuracies or delete information.
4. Security — Web sites should take reasonable steps to protect the security of the information the collect for consumers.[FOOTNOTE 10]
Although fair information practice principles have not been disseminated to all Internet companies via legislation, the principles have influenced the industry in a variety of ways. TRUSTe, a non-profit privacy seal organization, uses the fair information practice principles as a standard for approving Internet company privacy policies. In addition, the FTC uses fair information practice principles as a framework for developing privacy policies in settlements when the Commission has filed complaints against Internet companies for engaging in deceptive business practices.
While Toysmart.com was able to resolve the FTC’s claims, the issue of selling a customer list as part of the sale of assets is not fully resolved. In the settlement, certain Commissioners recommended that Toysmart.com give notice and choice to its customers before transferring their information to a corporate successor as a matter of good will and good business practice.[FOOTNOTE 17] In addition, Commissioner Swindle dissented and argued that the FTC should not have allowed the sale.[FOOTNOTE 18]
In addition to the FTC, state attorneys general have been particularly active on the privacy issue, relying on state unfair or deceptive business practices and other consumer protection laws. In addition to objecting to the Toysmart.com sale, the Texas Attorney General took a lead role in objecting to the sale of customer information in the recent Living.com bankruptcy in Texas. Living.com had been an e-tailer of home furnishings. Under a settlement with the Texas Attorney General, Living.com agreed to destroy its customer personal financial information but was permitted to transfer non-financial information only if customers did not opt-out after receiving a notice via e-mail of a proposed transfer.[FOOTNOTE 19]
When you register with CraftShop.com, you will be asked for information that you consider private. Unless you specifically give us permission, CraftShop.com will never disclose any of the information you share with us. Ever. We will hold your secure online shopping information in the strictest confidence. We will never release it to any person or any company for any purpose. We do not sell, rent, or lend any part of our mailing list.
Following the FTC’s actions against Toysmart.com, however, Craftshop.com announced to prospective purchasers that the customer list was no longer for sale.
IV. Avoiding FTC And Attorneys General Action
V. The Bankruptcy Reform Act And Other Legislation
The Toysmart.com case prompted at least two bills to be introduced in the prior, 106th Congress that would have precluded customer lists from being sold in bankruptcy, in addition to one that had already been introduced. As discussed in detail below, the Senate version of the Bankruptcy Reform Act of 2001 also includes specific privacy — related provisions.
By excluding personally identifiable information from the definition of “property of the estate” under all or certain circumstances, the two Senate bills from the 106th Congress could have created unanticipated problems. For example, if the customer information were not property of the estate at all, would the automatic stay apply to attempts by a secured creditor or others to obtain such a database? Moreover, could a Chapter 11 debtor-in-possession even use the customer information as part of its existing business or as part of a reorganized debtor post — confirmation? Addressing the use of customer data through amendment of Section 541(b) raises these and other significant questions, suggesting that a more direct solution to privacy concerns in bankruptcy should be considered.
The Senate-passed version of the Bankruptcy Reform Act of 2001, S. 420, contains specific provisions designed to address personally identifiable information, but does so by amending Section 363(b)(1), instead of Section 541(b) of the Bankruptcy Code. Section 231 of the bill provides as follows:
SEC. 231. PROTECTION OF NONPUBLIC PERSONAL INFORMATION.
(a) IN GENERAL — Section 363(b)(1) of title 11, United States Code, is amended by striking the period at the end and inserting the following:
‘, except that if the debtor has disclosed a policy to an individual prohibiting the transfer of personally identifiable information about the individual to unaffiliated third persons, and the policy remains in effect at the time of the bankruptcy filing, the trustee may not sell or lease such personally identifiable information to any person,
(A) the sale is consistent with such prohibition; or
(B) the court, after notice and hearing and due consideration of the facts, circumstances, and conditions of the sale or lease, approves the sale or lease.’
(b) DEFINITION — Section 101 of title 11, United States Code, is amended by inserting after paragraph (41) the following:
(41A) ‘personally identifiable information’, if provided by the individual to the debtor in connection with obtaining a product or service from the debtor primarily for personal, family, or household purposes –
(A) means –
(i) the individual’s first name (or initials) and last name, whether given at birth or adoption or legally changed;
(ii) the physical address for the individual’s home;
(iii) the individual’s e-mail address;
(iv) the individual’s home telephone number;
(v) the individual’s social security number; or
(vi) the individual’s credit card account number; and
(B) means, when identified in connection with one or more of the items of information listed in subparagraph (A) –
(i) an individual’s birth date, birth certificate number, or place of birth; or
(ii) any other information concerning an identified individual that, if disclosed, will result in the physical or electronic contacting or identification of that person;.
In Section 232 of the Senate-passed bill, the position of a Consumer Privacy Ombudsman is created. This section provides as follows:
SEC. 232. CONSUMER PRIVACY OMBUDSMAN.
(a) IN GENERAL –
(1) APPOINTMENT ON REQUEST — If the trustee intends to sell or lease personally identifiable information in a manner which requires a hearing described in section 363(b)(1)(B), the trustee shall request, and the court shall appoint, an individual to serve as ombudsman during the case not later than — –
(A) on or before the expiration of 30 days after the date of the order for relief; or
(B) 5 days prior to any hearing described in section 363(b)(1)(B) of title 11, United States Code, as amended by this Act.
(3) NOTICE TO OMBUDSMAN — The ombudsman shall receive notice of, and shall have a right to appear and be heard, at any hearing described in section 363b(1)(B) of title 11, United States Code, as amended by this Act.
(4) CONFIDENTIALITY — The ombudsman shall maintain any personally identifiable information obtained by the ombudsman under this title as confidential information.
(b) APPOINTMENT — If the court orders the appointment of an ombudsman under this section, the United States Trustee shall appoint 1 disinterested person, other than the United States trustee, to serve as the ombudsman.
(c) COMPENSATION OF CONSUMER PRIVACY OMBUDSMAN — Section 330(a)(1) of title 11, United States Code, is amended in the matter preceding subparagraph (A), by inserting �an ombudsman appointed under section 332,’ before �an examiner’.
VI. What About Creditors?
� Copyright 2001 Robert L. Eisenbach III. All rights reserved.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
LexisNexis® and Bloomberg Law are third party online distributors of the broad collection of current and archived versions of ALM's legal news publications. LexisNexis® and Bloomberg Law customers are able to access and use ALM's content, including content from the National Law Journal, The American Lawyer, Legaltech News, The New York Law Journal, and Corporate Counsel, as well as other sources of legal information.
For questions call 1-877-256-2472 or contact us at [email protected]