On September 15, Barnes & Noble (“B&N”) acquired several of Borders’ intellectual property assets, including a database of customer information, as part of Borders’ bankruptcy auction.  The sale of those assets hit a potential roadblock on Thursday, though, when a New York bankruptcy judge refused to approve the transaction, saying that he needed more time to think about the potential privacy concerns. This decision came on the heels of a Report issued by a court-appointed ombudsman who recommended certain privacy restrictions to be taken with respect to the customer information.

The Report recommended, among other restrictions, that B&N obtain the affirmative consent of affected consumers before transferring the personal data and that it treat consumer information pursuant to Borders’ privacy policy in effect at the time of its collection. Borders’ first privacy policy, published in 2006, provided that it will “only disclose [customer] email address or other personal information to third parties if you expressly consent to such disclosure.” (emphasis in original text)

The Report also cited to letters the ombudsman received from 25 State Attorney Generals and the FTC expressing concern over the transfer of personal information in connection with the sale. The FTC’s letter recommended than any transfer of personal information take place only with the consent of Borders’ customers or with significant restrictions on the transfer and use of the information. Those recommended restrictions included: (i) Borders agreeing not to sell the customer information as a standalone asset; (ii) the buyer’s line of business be substantially similar to that of the old owner; (iii) the buyer expressly agreeing to be bound by the terms of Borders’ privacy policy; and (iii) the buyer agreeing to obtain affirmative consent from consumers for any material changes to the policy. The FTC further stated that any transfer of customer information could contravene Borders’ express promise not to disclose such information and could constitute a deceptive or unfair practice.

B&N responded to the Report by filing a statement with the bankruptcy court. In the statement, B&N denied knowing that the ombudsman was planning to make recommendations or that he had corresponded with the FTC and the Attorney Generals. B&N characterized the Report’s restrictions as “overreaching and unnecessary” and said that implementation of the restrictions “would materially reduce the value of the customer list.” While B&N did agreed with some of the restrictions, it rejected others, particularly that Borders obtain opt-in consent for the transfer of personal data and that B&N treat consumer information pursuant to the Borders’ privacy policy in effect at the time of its collection. According to B&N, it would be completely unrealistic to expect customers to affirmatively respond to a request from Borders since Borders “has gone out of business.” Further, to treat consumer data pursuant to Borders’ privacy policies at the time of its collection would be, according to B&N, “administratively difficult, if not impossible, and would likely have the perverse effect of harming consumers through confusion and lack of a straightforward method for them to understand how their information is being used.” B&N said the transaction is “at risk.”

This is certainly not the first time that would-be buyers of information-based assets have faced FTC or judicial scrutiny and concerns about the privacy implications of such a transfer. For example, last year, a former publisher of a magazine and dating website for gay youth had declared bankruptcy, which resulted in the dispute over ownership of various business assets, including the subscriber database. The FTC warned that any transfer or use of the database could potentially result in a violation of the FTC Act. The New Jersey Bankruptcy Court eventually ordered the buyer to destroy the subscriber database.

Similarly, in 2000, the FTC brought an action against Toysmart, in which the Commission sued an online toy retailer which had filed for bankruptcy and sought to auction the personal information it collected from customers. The Commission eventually entered into a settlement with Toysmart allowing the transfer so long as the buyer adhered to certain restrictions, many of which were similar to the ones recommended in the FTC’s letter to Borders.

In today’s information age, consumer information is essential to business efficiency and can be a very valuable asset for those companies who are forced to liquidate their assets to mitigate debt (as evidenced by the $13.9 million dollar price tag B&N agreed to pay for the IP assets). While databases containing consumer information can be valuable, transferring such databases can be a risky process, subject to judicial and regulatory scrutiny. This case teaches us that companies looking to perform these transfers need to be mindful of the privacy implications involved in the process. Reed Smith can help companies that are contemplating such transactions, whether in a bankruptcy proceeding or a negotiated transaction, with evaluating the transferability of those assets and identifying and analyzing associated risks — before the government or another third party does.