There are many legal considerations for counsel to keep in mind when thinking about buying or selling the assets of a business that has an online presence, including subscriber lists, user profiles or other personally identifiable information (PII). Most importantly, counsel must be aware of the seller's privacy policy, as the Federal Trade Commission (FTC) has strict regulations where PII is involved, including special considerations in cases of bankruptcy.

Seller's privacy policies and transferring PII

Personal information is generally collected from subscribers, customers and other individuals under the terms of privacy policies. These policies make certain promises about how the company will protect the information and to what extent it will share the information with others. Privacy policies govern the treatment of the information not only in the context of day-to-day operations but also in the context of a sale of the assets of the business. The FTC has taken the position that transferring PII in violation of an applicable privacy policy, even when the sale is part of a more comprehensive sale of the assets of a business, can constitute an unfair or deceptive trade practice under the Federal Trade Commission Act (FTCA). Such transfers may also violate applicable state consumer protection laws.

Of course, special rules apply when a transfer of PII occurs in the case of a bankruptcy. The U.S. Bankruptcy Code expressly limits a bankruptcy trustee's ability to transfer PII in a manner that is inconsistent with the debtor's privacy policy. Section 363(b)(1) of the Bankruptcy Code provides that if a debtor discloses a privacy policy in connection with offering a product or service that prohibits the transfer of PII to unaffiliated persons, and if the privacy policy is in effect on the date the bankruptcy case commences, the bankruptcy trustee may not sell or lease the information unless one of the following conditions is met:

1. The transaction is consistent with the privacy policy (e.g., there is a carve-out that allows the information to be sold)
2. The court—following the appointment of a consumer privacy ombudsman, proper notice and a hearing—approves the transaction, finding that no showing was made that the transfer would violate applicable law.

The FTC requires compliance with a seller's privacy policy even when a prospective buyer will be using the information for the same purpose as the seller. In such transactions, the FTC will typically conclude that the transfer constitutes an unfair or deceptive trade practice under the FTCA. Accordingly, the bankruptcy court may stop the transfer, even if the prospective transferees represent to the court that they want possession of the data in order to resume operating the existing company. In the end, the FTC may only allow such a transfer of PII to a new owner if the new owner agrees to use the information only in accordance with the original privacy policy and consistent with the original purpose for which the information was provided.

Draft privacy policies with the future in mind

Counsel should always draft privacy policies with an eye toward the future. For many businesses, under current law, the most significant restrictions on their ability to transfer personal information collected from customers and subscribers are those contained in the privacy policy under which the information was collected. While collecting information under a restrictive privacy policy may make subscribers and customers feel more comfortable, it also makes it more difficult to sell the information and related parts of the business down the road. Unless there is a compelling reason to provide a more restrictive privacy policy, companies should collect PII should under a policy that allows transfers to third parties. Even when a more restrictive privacy policy is appropriate, the policy should expressly allow for the transfer of personal information in appropriate circumstances, such as in connection with the sale of other assets of the business or where the original privacy policy will govern the activities of the transferee.

Avoiding the pitfalls

In order to avoid costly legal challenges and to facilitate the transfer of business assets that include PII, businesses should pay careful attention to privacy policies. Ultimately, it pays to think ahead when drafting privacy policies and to be diligent when reviewing them for a proposed purchase or sale of assets that include personal information—particularly in the bankruptcy context.