May 24, 2014
FTC to the Bankruptcy Court: Do it Right or Appoint a CPO
In a May 22 letter from Jessica Rich, Director of the FTC's Bureau of Consumer Protection to the United States Bankruptcy Court for the Southern District of New York, the FTC drew a line in the sand in the ConnectEDU bankruptcy case. ConnectEDU was a venture funded tech start-up that provided data-driven services to help college students evaluate career options and paths.
The letter (the FTC also filed a formal objection with the Court) pointed out that ConnectEDU collected information from students under a privacy policy promising that “In the event of sale or intended sale of the Company, ConnectEDU will give users reasonable notice and an opportunity to remove personally identifiable data from the service.” The letter insisted that the Court either condition the sale on the company complying with that provision of the privacy policy or appoint a Consumer Privacy Ombudsman prior to the sale. Procedural oddities aside (the sale hearing itself was scheduled for May 23 on an emergency basis, leaving little time for appointment of a CPO), the letter is interesting because of the implications inherent in the FTC's dual request. Either the sale terms must change to make the sale itself consistent with the privacy policy OR the court should appoint a CPO. This implies an acceptance by the FTC that the court, with the CPO's guidance, might allow a sale that does not give users advance notice and an opportunity to remove personally identifiable information from the service prior to the transfer.
The hearing date was moved to May 27 prior to the hearing, so it remains to be seen what action will occur in the case, but given the FTC's objection, it seems likely the US Trustee's Office will appoint a CPO.
The hearing date was moved to May 27 prior to the hearing, so it remains to be seen what action will occur in the case, but given the FTC's objection, it seems likely the US Trustee's Office will appoint a CPO.
Labels: consumer privacy, CPO
¶ 6:25 AM
