Journal Issue
Column Name
As technology continually and rapidly changes the landscape of the law and society,
the focus inevitably becomes protecting the wealth of information transmitted
and maintained electronically. Web sites are not only an essential part of business
and information transmission, but they also constitute an industry in their
own right. As a result, capturing value in bankruptcy through sales of Web sites
has become more common, as have attendant issues unique to the sales of Web
sites. One of the first attempts to sell a Web site occurred in the Toysmart.com
bankruptcy, where the debtor attempted to sell personal information obtained
from customers as an asset of its estate despite its privacy policy.1
More recent incidents such as the theft of computers containing, for example,
personal information of government personnel, insurance applicants and consumers
of a popular online travel Web site, underscore the need for security measures
to protect individuals' identifying information.
The Bankruptcy Abuse Prevention and Consumer Protection Act (BAPCPA) attempts
to meet these concerns with its mandate for a Consumer Privacy Ombudsman (CPO)
under certain circumstances of a sale of a debtor's assets. Section 332 of the
Code, as amended by BAPCPA, requires that when a sale is proposed pursuant to
§363 (b)(1)(B) and a hearing is required thereunder, "the court shall
order the U.S. Trustee to appoint, not later than five days before the commencement
of the hearing, one disinterested person (other than the U.S. Trustee) to serve
as the consumer privacy ombudsman in the case and shall require that notice
of such hearing be timely given to such ombudsman." 11 U.S.C. §332(a).
The CPO is charged with the task of providing information to the court to assist
it in considering the proposed sale or lease of "personally identifiable
information" (PII).2 11 U.S.C. §332(b).
The CPO requirement arises only where the proposed sale or lease involves PII.
Section 363(b) (1)(B) continues to authorize the sale or lease of property outside
the ordinary course of business "except...if the debtor in connection with
offering a product or a service discloses to an individual a policy prohibiting
the transfer of personally identifiable information about individuals to persons
that are not affiliated with the debtor and if such policy is in effect on the
date of the commencement of the case, then the trustee may not sell or lease
personally identifiable information to any person unless (a) such sale or such
lease is consistent with such policy, or (b) after appointment of a consumer
privacy ombudsman in accordance with §332, and after notice and a hearing,
the court approves such sale or such lease...." 11 U.S.C. §363(b)(1)(B).
The Code is less specific with regard to what information the CPO should provide
the court, but states that it "may include presentation of (1) the debtor's
privacy policy, (2) the potential losses or gains of privacy to consumers if
such sale or such lease is approved by the court, (3) the potential costs or
benefits to consumers if such sale or such lease is approved by the court and
(4) the potential alternatives that would mitigate potential privacy losses
or potential costs to consumers." 11 U.S.C. §332(b). Amended §330
allows the CPO to be compensated. 11 U.S.C. §330. It is not entirely clear
under BAPCPA precisely when a CPO must be hired, other than that it cannot be
later than five days prior to a sale hearing.
Implementing §332
The first occasion to test §332's CPO requirement occurred in June 2006
and highlighted both the potential benefits and potential burdens of this provision.
In In re Engaging and Empowering Citizenship Inc.3 (E2C),
the U.S. Trustee sought and received an order appointing a CPO pursuant to §332.
In the E2C case, the court-appointed examiner sought to sell assets that included
three Internet portals (AmberAlert.com, Pets911.com and Earth911.com), their
related interfaces and their corresponding customer lists. At that point in
the case, the E2C business had run out of money and a prompt sale was the only
chance of preventing administrative insolvency in the case. Access to these
Web sites required individuals to provide, inter alia, their names, telephone
numbers and e-mail addresses. E2C's privacy policy prohibited the sale, trade
and provision of personal contact information to third parties.
The U.S. Bankruptcy Court for the District of Arizona granted the U.S. Trustee's
request, but noted its concerns over the potential time delay and costs. The
U.S. Trustee appointed Donald Gaffney, an established practitioner with
extensive experience in bankruptcy law, 10 days prior to the scheduled sale
hearing. Gaffney filed a preliminary report nearly 40 pages long and an even
more extensive final report. Ultimately, the sale hearing was continued for
one week, providing the CPO 16 days from his appointment to complete the investigation,
analysis and drafting of the CPO's report.
The E2C's CPO report provides a thorough examination of the CPO's intended
role under BAPCPA amendments, a comprehensive analysis of the debtor's privacy
policies, relevant state and federal law, the proposed sale, and applicable
concerns and recommendations to the court. Despite the obvious extensive time
invested in the CPO's investigation and report, Gaffney agreed not to seek a
fee for his services. Thus, the cost to the debtor's estate was de minimus.
Ultimately, the order entered by the court approving the sale included recommendations
from the CPO such as adopting the debtor's existing privacy policies, notifying
users of the sale and providing an election to be removed from the database,
and requiring the buyer to take additional security measures to protect customer
information.
Practical Implications of the CPO
An issue at the forefront of §332 that remains to be addressed in the
CPO process is how the estate will bear the cost of the CPO's services. The
E2C case involved a modest estate where the assets attracted a $500,000 stalking-horse
bid and ultimately sold for $1.15 million.4 That no costs were incurred
for the CPO's services is almost certainly an anomaly. It is easily conceivable
that in smaller bankruptcy cases where there may be only one potential bidder,
the cost of retaining the CPO could near the sale price. The Code does not delineate
how to deal with the cost-effectiveness issue. Court-imposed limitations on
CPO fees may discourage the most qualified individuals from serving, and passing
this cost on to the buyer may discourage competitive bidding.
The law and the practice of law must necessarily evolve
as technology does...
Another consideration is the timing imposed by §332: A CPO shall be appointed
not later than five days prior to the sale hearing. In the often fast-paced
sale of assets under §363, and especially in complex cases, it is difficult
to see how much a CPO can reasonably accomplish in such a short timeframe.
A third concern for a CPO is the potential risk of liability. Section 332 states
that a CPO "shall not disclose any personally identifiable information
obtained by the ombudsman under this title." 11 U.S.C. §332(c). The
Code does not differentiate between willful or negligent disclosure and doesn't
specifically provide a remedy for a violation of subsection (c), but also doesn't
specifically insulate the CPO from liability for any particular type of disclosure.
Like the cost issue, such uncertainties also stand to discourage sophisticated
individuals from accepting an appointment as CPO.
Conclusion
The CPO and its related statutory provisions illustrate the ever-present challenge
of balancing somewhat esoteric privacy issues in an electronic world against
the commercial reality of bankruptcy. The law and the practice of law must necessarily
evolve as technology does, though the full benefits and burdens of the §§332
and 363(b)(1)(B) are yet to make themselves known.
Footnotes
1 FTC v. Toysmart.com, 2000 WL 34016434 (D. Mass 2000). See, also,
Salazar, "FTC Takes Action," Nat'l. L.J. Oct. 9, 2000, for further
discussion on the Toysmart.com case.
2 Section 101(41A) of the Code provides a broad definition of PII that includes
consumers' names, physical addresses, e-mail addresses and telephone numbers,
and "any other information" that, if disclosed, will result in contacting
or identifying a consumer either physically or electronically. 11 U.S.C. §101(41A).
3 Case No. 2-05-28175-CGC (D. Ariz.).
4 The E2C case raised a number of relatively cutting-edge sale issues, besides
the CPO issue, that are outside the scope of this article, including (1) credit
bid rights of a creditor that held a relatively modest lien on some of the hardware
that was positioned for sale, (2) the power and business judgment of an examiner
to sell assets under §363 and (3) the propriety and amount of a break-up
fee for the stalking-horse bidder where assets are sold for a relatively small
amount (the stalking horse ultimately received a $50,000 break-up fee, or 10
percent of his bid—a relatively high percentage for break-up fees).
Journal Date