2.2 Toysmart case exercises - student module  (Page 3/19)

Fierce opposition emerged when Toysmart placed ads in the Wall Street Journal and the Boston Globe to sell this data base. Customer interest groups pointed out that Toysmart had promised not to share customer information with third parties. Toysmart also prominently displayed the TRUSTe seal which testified further to the company's obligations to respect customer privacy and security. Selling this data to third parties would break Toysmart promises, violate TRUSTe policies, and undermine consumer confidence in the security and privacy of online transactions. Toysmart's obligations to its customers came into direct conflict with its financial obligations to its investors and creditors.

TRUSTe reported Toysmart's intention to sell its data base to the FTC (Federal Trade Commission) who on July 10, 2000 filed a complaint "seeking injunctive and declaratory relief to prevent the sale of confidential, personal customer information" (FTC article) Toysmart's promise never to share customer PII with third parties provided the legal foundation for this complaint. According to the FTC, Toysmart "violated Section 5 of the FTC Act by misrepresenting to customers that personal information would never be shared with third parties, then disclosing, selling, or offering that information for sale." Finally, because it collected data from children under 13 who entered various contests offered on its website, Toysmart was also cited for violating the Children's Online Privacy Protection Act or COPPA.

The FTC reached a settlement with Toysmart. The bankrupt dot-com must "file an order in the bankruptcy court prohibiting the sale of its customer data as a 'stand-alone asset'. In other words, the rights bundled in the liquidation and sale of Toysmart did not include the liberty of buyers to dispose of the asset in whatever way they saw fit. According to the negotiated settlement, buyers were bound by the commitments and promises of the original owners. Toysmart creditors "can sell electronic assets only if the purchasing company abided by the same privacy policy." In essence, the FTC asked Toysmart creditors to honor the spirit, if not the letter, of Toysmart's original promise to its customers not to sell their PII to third parties. Creditors now had to guarantee that (1) the buyer had the same basic values as Toysmart (for example, a commitment to selling quality, educational toys), (2) the buyer use the data in the same way that Toysmart had promised to use it when collecting it, and (3) the buyer would not transfer the information to third parties without customer consent. In this way, the settlement proposed to protect Toysmart customer privacy interests while allowing creditors to recover their losses through the sale of the bankrupt company's "crown jewel", its customer data base.

On August 17, 2000, the Federal Bankruptcy Court declined to accept the Toysmart-FTC settlement. Instead, they argued that Toysmart and the FTC should wait to see if any parties willing to buy the data base would come forward. The Bankruptcy Court felt that potential buyers would be scared off by the FTC suit and the pre-existing obligations created by Toysmart promises and TRUSTe standards. Should a buyer come forth, then they would evaluate the buyer's offer in terms of the FTC-Toysmart settlement designed to honor the privacy and security commitments made to Toysmart customers.