Disposal Of Customer Lists On Insolvency
The customer database can be an online business' most valuable asset. On insolvency the liquidator may wish to realise the asset by sale to a third party. However there is a conflict between this objective and EU data protection legislation which Data Protection.operates to prevent data transfers without adequate privacy protection. The UK Data Protection Commissioner is frequently consulted on this topic and has indicated that she is drawing up guidelines on the sale of personal databases by insolvent businesses.
In June 2000 the liquidators of boo.com sold its database of customers to a US company. This sale was unlawful under the Data Protection Act 1998 as boo.com did not have permission from its customers to share their data with third parties and the United States did not satisfy the adequate level of protection standard for data exports to non-EEA countries. The purchaser has now been required to contact each of the customers to ask their permission to continue to use the data.
Another recent US decision highlights the need to consider privacy policies carefully at an early stage. In the United States, Toysmart Inc. an online toy retailer attempted to sell all its assets including its customer database on insolvency. Such a sale would violate its privacy policy, which stated that personal data would never be shared with a third party. This privacy policy did not allow for any exceptions. The Federal Trade Commission filed a complaint to prevent sale of the database as in the circumstances the privacy policy represented a deceptive practice. The settlement reached between the Federal Trade Commission and Toysmart Inc. prohibited the sale of the database except in very limited circumstances. However the US Bankruptcy Court for the District of Massachusetts rejected the settlement because Toysmart Inc. had failed to notify its customers in advance and give them the option to decide whether their data could be transferred to the buyer.
Recently Amazon.com, the online bookseller, changed its privacy policy announcing that it could no longer guarantee that it would not disclose customer information to third parties. Amazon now says that customer information is a business asset that can be sold if it goes out of business. Two privacy groups have ended their partnership with Amazon in protest at their changed privacy standards.
The information and opinions contained in this publication are provided by national law firm Hammond Suddards Edge. They should not be applied to any particular set of facts without seeking appropriate legal or other professional advice.
