On April 10, 2015, RadioShack, and certain affiliated debtor entities, proposed a bankruptcy sale of certain assets, including Personally Identifiable Information (“PII”). Deposition testimony in the case revealed that, over the years, RadioShack had accumulated PII for 117 million customers!  The proposed sale sought to sell the PII for 67 million customers that contained, among other things, the complete customer name and physical address files. Approximately 36 different states, through their respective Attorneys General, opposed the sale of RadioShack’s PII.  Their chief objection to the proposed sale was that all versions of RadioShack’s privacy policy contained provisions that consumer PII would not be sold.

The issue has been resolved.  On May 20, 2015, RadioShack notified the Bankruptcy Court that an agreement was reached following a mediation between RadioShack, the states’ Attorneys General, and the proposed purchaser of the PII.  Pursuant to that agreement, RadioShack agreed to limit the sale of the PII so that it would not sell, among other things, customer telephone numbers and customer e-mail addresses that were active more than two years prior to the petition date.  Customers with active e-mail addresses within the two-year period prior to the petition dates would receive an opportunity to opt-out of having their PII transferred. The purchaser also agreed to provide an opt-out opportunity at a website for RadioShack as well as to be bound by the existing RadioShack privacy policy with regard to customers listed in the purchased PII.

RadioShack is not the first time that proposed bankruptcy sales of PII have been stalled for failure to comply with a debtor’s privacy policy. As discussed in our prior blog post, Bankruptcy Sales of Personally Identifiable Information: Does it Satisfy the Privacy Policy?  the FTC has objected to the proposed sales of PII in the bankruptcy proceedings of ConnectEDU, XY Magazine, and the Borders Group. The FTC also sent a letter objection opposing the sale in RadioShack, although it did not participate in the mediation. The takeaway from RadioShack remains the same as in those cases: when it comes to privacy policies, companies need to “say what they do, and do what they say.” Otherwise, they could face an uphill battle in attempting to sell their PII through a bankruptcy proceeding.