Due to the COVID-19 pandemic, some businesses are considering potential liquidation or restructuring through bankruptcy. Companies in this situation should keep privacy concerns in mind, because the handling of personal data in bankruptcy proceedings poses some unique challenges.

The issue of whether or not personally identifiable information (PII) can be sold (and under what terms) is a common way privacy issues come into play during liquidation and reorganization proceedings. As further discussed below, there are many factors to consider to ensure that data does not lose its value as part of the bankruptcy process.

|

The Bankruptcy Code, GDPR and CCPA

When a company files for bankruptcy, it must obtain court approval to sell its assets outside of the ordinary course of business. A company may use, sell, or lease property of the estate, including customers' data, unless its privacy policy prohibits "the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor," according to U.S. Bankruptcy Code Section 363(b)(1). If the company's privacy policy prohibits this transfer, a consumer privacy ombudsman (CPO) must be appointed to review the facts of the sale and the applicable non-bankruptcy law.