All parties have approved a settlement in the Toysmart.com customer privacy case, with the failed Waltham, Mass., online toy seller agreeing to destroy its customer list and its parent, Walt Disney Co., agreeing to pay $50,000 to creditors.
The negotiated settlement was filed Wednesday with a federal bankruptcy court in Boston. It includes approvals from Federal Trade Commission attorneys and 44 state attorneys general who had intervened to prevent the names, addresses and shopping preferences of 250,000 Toysmart customers from being sold to a third party.
U.S. Bankruptcy Court Judge Carol J. Kenner is expected to rule on the motion within three weeks. Attorneys said she will likely approve.
The settlement is unusual in that Toysmart’s majority owner, Disney online subsidiary Buena Vista Internet Group, is paying for customer data that it will never receive, much less use. What Disney is buying, in essence, is an end to a publicity firestorm stoked by concerned consumer and privacy advocates.
The states and the FTC touted the settlement. They said the fact that the data will be destroyed without being transferred strongly protects consumer privacy rights.
With many dot-com companies struggling financially and filing for bankruptcy, more proposed sales of valuable customer data are expected to reach the courts.
“It’s a terrific outcome,” said Pamela Kogut, an assistant attorney general for Massachusetts who handled the case. “It’s important for online companies to understand that if they try to take steps inconsistent with consumer privacy rights, states will intervene.”
Laura Mazzarella, attorney for the FTC’s bureau of consumer protection, said, “Companies need to think ahead to how they will handle customer data under changed financial circumstances. Just because companies file for bankruptcy, they still need to consider the promises they’ve made to consumers.”
Toysmart disclosed Wednesday that it had received an offer from an unnamed company to buy the data for more than $100,000.
But a committee of Toysmart’s creditors, who’ve filed claims saying they’re owed about $25 million, agreed to settle for $50,000 to avoid the threat of lawsuits. The FTC, which had already sued in district court to block the data sale to any third party, pledged to revive the suit, with more than 40 attorneys general prepared to follow suit.
“At a certain point you look at a $50,000 offer that ends the issue as the best deal,” said Christopher Panos, attorney for the creditors’ committee. “The market for the list is probably as good as it’s ever going to be; past a certain point, the information gets stale. And you’re looking at the potential of a long court fight to get not much more money.”
Buena Vista originally made its $50,000 offer last summer. But creditors were holding out for a higher offer, and privacy advocates also objected. They were hoping for a precedent-setting court ruling that banned the sale of customer data altogether, which a deal selling to a parent company doesn’t necessarily provide.
Judge Kenner in August postponed a ruling, saying there was no need to hear the case until a buyer acceptable to the creditors stepped forward.
Warren Agin, a Boston attorney who is chair of the American Bar Association’s subcommittee on electronic transactions in bankruptcy, said a case involving the sale of customer data from another failed dot-com company is likely to arise soon.
Aside from the growing list of failing dot-coms, Agin noted that the states and the FTC failed to see eye-to-eye on the best remedy in the Toysmart case. The FT
C would have settled for the data to be sold to another online toy seller that maintained the privacy protections promised by Toysmart. But the attorneys general thought such a sale would have violated Toysmart’s pledge never to sell data to any third party.
“The law governing enforcement of privacy in this area is still not understood,” Agin said. “Is a privacy pledge a contract between the company and the consumer? It doesn’t have all the elements of a contract. Is violating such a pledge an ‘unfair and deceptive’ business practice (that violates consumer protection laws)? That moves into a gray area, too.
“Toysmart said it wouldn’t disclose customer data to ‘any third party,’ but it gave customer addresses routinely to United Parcel Service” to ship its merchandise, Agin continued. “Now no one would argue that was a privacy violation. But at what point do expected transactions step on the rights of consumers? There’s nothing in either privacy law or bankruptcy law that provides a clear answer.”
While Judge Kenner’s acceptance of the privacy deal is expected soon, the settling of Toysmart’s debts remains to be determined. The judge has scheduled a hearing for Feb. 20 to discuss a financial settlement plan filed last month.
Gavin McCormick is managing editor at boston.internet.com.