Customer data and the consumer privacy ombudsman

Privacy is the issue that turns a routine asset sale into a contested one. Congress added specific protections for consumer data in bankruptcy in 2005, after high-profile disputes over selling customer lists. If your company's data includes information about consumers, this is the part of the process to get right.

General information, not legal advice. Privacy law changes quickly and varies by state.

The rule: Section 363(b)(1)

Section 363(b)(1) says that if the debtor, in connection with offering a product or service, disclosed a privacy policy to individuals that prohibits transferring personally identifiable information to unaffiliated persons, and that policy is in effect on the date the case starts, the trustee may not sell or lease that PII unless:

• (A) the sale is consistent with the policy, or
• (B) after a consumer privacy ombudsman is appointed under § 332, and after notice and a hearing, the court approves the sale, giving due consideration to the facts and circumstances, and finding no showing that the sale would violate applicable nonbankruptcy law.

What counts as "personally identifiable information"

Section 101(41A) defines PII narrowly. It covers information like an individual's name, address, email, phone, Social Security number or payment card number, provided by an individual in connection with obtaining a consumer product or service primarily for personal, family or household purposes, plus certain information linked to those identifiers.

Two practical consequences:

1. Business-to-business data (contact details of a customer's employees, for instance) may fall outside the statutory definition, though state privacy laws and contracts may still restrict it.
2. Employee data isn't covered by § 101(41A), but other law and your own policies may apply.

Counsel should decide how the definition applies to your actual data.

When the ombudsman is appointed

If § 363(b)(1)(B) is the route, the court orders the appointment, and the U.S. Trustee appoints a disinterested person as ombudsman not later than 7 days before the hearing (§ 332(a)). The ombudsman may appear at the hearing and gives the court information about:

• the debtor's privacy policy,
• the potential losses or gains of privacy to consumers if the sale is approved,
• the potential costs or benefits to consumers, and
• possible alternatives that would mitigate privacy losses.

Ombudsmen often recommend conditions: limiting the buyer to the same uses, honoring opt-outs, notice to consumers, or excluding sensitive categories. The ombudsman's fees are generally paid by the estate as an administrative expense, so plan for them.

How de-identification changes the analysis

AI developers usually want the record of how work gets done: the workflow, the decision, the fix. They don't need the identity of the customer. If the dataset is properly de-identified, or if consumer PII is excluded entirely, counsel may be able to show that the sale doesn't transfer PII at all, which can make the ombudsman process unnecessary.

That conclusion depends on the method. Simple find-and-replace often isn't enough: free text in emails and tickets can contain names, addresses, order numbers and other details. A defensible approach combines:

• automated detection and replacement of identifiers,
• scanning of free text,
• human review of samples,
• excluding whole categories (payment data, health information, minors' data),
• and contractual promises from the buyer not to attempt re-identification.

No method makes re-identification risk zero, and you shouldn't claim it does. See de-identifying company data in bankruptcy.

Beyond the Bankruptcy Code

Section 363(b)(1)(B) asks whether the sale would violate "applicable nonbankruptcy law." That brings in:

• The FTC Act, which prohibits deceptive practices, including breaking privacy promises. The FTC has weighed in on bankruptcy sales of customer data before.
• State consumer privacy laws, several of which regulate "sales" of personal information and give consumers opt-out rights.
• Sector rules such as HIPAA for health information and GLBA for certain financial data.

A practical sequence

1. Pull the privacy policy in effect on the petition date, and earlier versions if data was collected under them.
2. Map which systems contain consumer PII.
3. Decide: exclude, de-identify, or sell subject to the ombudsman process.
4. Document the decision in the motion and the supporting declaration.
5. If an ombudsman is appointed, engage early and share the de-identification method.

What to tell the court

A motion that addresses privacy head-on, with a clear description of what is and isn't included, is far more likely to be approved without a fight than one that leaves the U.S. Trustee to ask. We prepare a factual privacy memo for counsel's analysis as part of every engagement.

What the ombudsman actually reviews

When an ombudsman is appointed under § 332, the job is to give the court information about the privacy implications of the proposed sale. In practice, the review usually covers:

• The privacy policy in effect when the information was collected, and any changes over time.
• What data is transferring, in what form, and whether it is truly de-identified or merely pseudonymized.
• The buyer's commitments: whether it agrees to the same restrictions as the debtor, to use limits, and to deletion obligations.
• Applicable non-bankruptcy law, such as state privacy statutes, sector rules for health or financial data, and consumer protection standards.
• Alternatives, such as limiting the sale to certain categories, requiring consent, or excluding sensitive records.

The ombudsman's report doesn't bind the court, but it carries real weight. An ombudsman who has seen the de-identification method and the buyer's restrictions is far more likely to report favorably than one who sees a vague description.

Preparing a package for the ombudsman

Build a short packet before the appointment, so the review starts with facts instead of questions:

1. A data map: systems, record counts, date ranges, and the categories of personal information in each.
2. The de-identification method, with a before-and-after example. Our de-identification guide explains what usually gets removed.
3. Copies of every version of the privacy policy, with dates.
4. The proposed buyer restrictions: no re-identification, no contact with individuals, use limits, security and deletion terms.
5. A proposed order that incorporates those restrictions.

Ombudsman fees are paid by the estate, so a well-prepared packet saves money as well as time.

For where this sits in the overall approval process, see court approval and Section 363 and the Section 363 sale guide.

Frequently asked questions

When is a consumer privacy ombudsman required?

Under § 363(b)(1), when the debtor's privacy policy prohibits transferring personally identifiable information and the sale would transfer it, the court can approve only if the sale is consistent with the policy or after appointing an ombudsman and finding the sale appropriate.

Can de-identification avoid the ombudsman?

Often it narrows or removes the issue, because no personally identifiable information is transferred. Whether it does in your case depends on the method and the court's view, so counsel should address it directly in the motion.

Who pays the ombudsman?

The estate, as an administrative expense, subject to court approval. That's a reason to prepare thoroughly and keep the scope focused.

Does this apply to business customers?

The Code's definition focuses on individuals, but business contracts can impose their own confidentiality limits. Those are handled through exclusions and de-identification as well.

This guide is general information, not legal, tax or financial advice, and reading it does not create an attorney-client relationship. Bankruptcy outcomes depend on the facts, the court and the parties; nothing here promises price, timing or court approval. Talk to your bankruptcy counsel about your case.