Customer data in bankruptcy: when a consumer privacy ombudsman is appointed

When is a consumer privacy ombudsman appointed?#

A consumer privacy ombudsman is appointed when a debtor in a US bankruptcy case proposes to sell or lease personally identifiable information in a way its privacy policy did not permit. Under 11 U.S.C. section 363(b)(1), if the debtor disclosed a policy prohibiting transfer of that information to unaffiliated persons, and the policy was in effect when the case began, the sale can proceed only if it is consistent with the policy or the court approves it after an ombudsman is appointed and a hearing is held.

When that hearing is required, section 332(a) has the court order the United States trustee to appoint one disinterested person, other than the US trustee, as ombudsman no later than 7 days before the hearing. The court then gives due consideration to the facts, circumstances and conditions of the sale, and may approve it only if no showing is made that it would violate applicable nonbankruptcy law.

The trigger is a promise. Many consumer-facing companies told customers their information would not be sold, rented or shared with unaffiliated companies. When a buyer of the business wants the customer list, order history or account records, that promise collides with the estate's duty to get the best value for its assets.

The Code's own definition, in section 101(41A), covers items such as a first and last name, home address, email address, a telephone number for contacting the person at home, a Social Security number and a credit card account number, when the individual provided them to obtain a product or service primarily for personal, family or household purposes. A company that sold mostly to other businesses should ask counsel early whether its records fall inside that definition at all.

What does the ombudsman actually review?#

The ombudsman reviews how the proposed sale would affect the customers whose information would be transferred, and reports to the court before the sale is decided. Section 332(b) lets the ombudsman appear and be heard and present the debtor's privacy policy, the potential losses or gains of privacy to consumers, the potential costs or benefits to consumers, and potential alternatives that would mitigate privacy losses or costs. Section 332(c) bars the ombudsman from disclosing personally identifiable information obtained in the case.

In practice the ombudsman wants documents, not summaries: every version of the privacy policy with the dates each was in force, a description of each data set and how it was collected, the buyer's identity and line of business, and what the buyer plans to do with the information. Recommendations in past cases have tended to be conditions rather than a plain yes or no, such as the ones below.

• 1The buyer operates in substantially the same line of business and uses the data for similar purposes.
• 2The buyer agrees to be bound by the privacy policy customers relied on, as a successor to the debtor.
• 3The buyer obtains customers' affirmative consent before making material changes to how their data is used.
• 4Categories the buyer does not need, such as Social Security numbers, birth dates or payment card numbers, are excluded.
• 5Records that are not sold are destroyed under a documented plan when the case closes.

What have past cases shown about customer data in bankruptcy?#

Past cases show that promises made to customers follow the data into insolvency, and that conditions usually narrow what transfers rather than block every sale. The consumer privacy provisions themselves were added by the Bankruptcy Abuse Prevention and Consumer Protection Act of 2005, after disputes such as Toysmart.

The cases below are public examples, not predictions. Each turned on its own privacy policy, data and buyer, and later courts are not bound to follow the same conditions.

Which wind-down paths involve an ombudsman?#

Only bankruptcy cases involve a consumer privacy ombudsman; other wind-down paths leave the privacy policy question to the parties and their counsel. That does not make the question smaller, because transferring data against a published promise can draw attention from the Federal Trade Commission or state attorneys general whatever the procedure.

The table shows how the question usually arises in each path. Use it to frame a first conversation with counsel, not as a conclusion.

How is licensing de-identified records different from selling a customer list?#

Licensing de-identified records differs from selling a customer list because the buyer receives a record of the work, not a way to reach the people. A customer list exists to identify and contact individuals; de-identified support tickets, job histories or order exceptions are prepared so that no individual can reasonably be identified.

That difference matters for the ombudsman analysis. If the licensed records no longer contain personally identifiable information, the privacy policy question may not arise for that package. Whether the de-identification holds is a legal judgment for counsel and, if contested, for the court. The Spirit Airlines reporting shows the pattern: internal records offered, passenger profiles and loyalty records left out.

Two points do not change. A license of estate property outside the ordinary course of business usually needs notice and court approval, like a sale. And the motion should describe the de-identification method plainly, because creditors, the US Trustee or an ombudsman already appointed for other assets may ask about it.

What should a trustee or wind-down officer do first?#

A trustee or wind-down officer should first preserve two things before systems and subscriptions are switched off: the records themselves and the evidence of what customers were promised. Without both, neither a sale nor a license can be described accurately to the court.

The order matters. Exports taken in a hurry after a vendor's termination notice often lose metadata such as collection dates and source systems, which are exactly what an ombudsman or a buyer will ask to see.

• 1Collect every version of the privacy policy and terms of service, with the dates each was posted, from website archives, content management history and counsel's files.
• 2Map each data set to the policy versions in force when its records were collected.
• 3Separate consumer records from business customer, employee and vendor records, since each follows different rules.
• 4Keep systems running, or export them under a documented chain of custody, until the sale or license process is settled.
• 5Decide which assets to offer, such as the customer list, de-identified operating records or both, and describe each in the motion.
• 6Raise the ombudsman question with counsel before the motion is filed, not after an objection.

Illustrative: a home services company in Chapter 11#

Illustrative: a fictional residential HVAC and plumbing company files for Chapter 11 and plans to sell its operating branches. Its records include a homeowner list with names, addresses and phone numbers, years of job histories in its field service software, and call recordings. Its website privacy policy said customer information would not be shared with unaffiliated companies except service providers.

The branch buyer wants the homeowner list and service histories so it can keep serving those households. Counsel advises that the transfer does not fit the policy as written, and the court directs the US trustee to appoint an ombudsman, who recommends that the buyer be bound by the existing policy, notify customers of the change of ownership and leave stored card data behind.

Separately, the chief restructuring officer proposes to license de-identified job records to an AI developer: equipment types, symptoms, diagnoses and repairs, with no names, addresses or recordings. The motion describes the preparation method and the license limits, the ombudsman's report addresses both transactions, and the judge approves each with conditions.

How SourceX works with trustees and wind-down officers#

SourceX works with trustees, wind-down officers and restructuring professionals on the licensing side of an estate's records, alongside the estate's own counsel. Work starts with a fit check that uses metadata only: which systems exist, how many years of records they hold and when subscriptions end. No files are shared during that assessment.

For any package that proceeds, the SourceX five-step transaction runs Supply, Rights, Preparation, Approval and Delivery, and the SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and release authorization. In a bankruptcy case, release authorization points to the court order and the conditions it sets.