Keeping Up with Technology Section 332 and the Consumer Privacy Ombudsman

Keeping Up with Technology Section 332 and the Consumer Privacy Ombudsman

Journal Issue: 
Column Name: 
Journal Article: 
As technology continually and rapidly changes the landscape of the law and society, the focus inevitably becomes protecting the wealth of information transmitted and maintained electronically. Web sites are not only an essential part of business and information transmission, but they also constitute an industry in their own right. As a result, capturing value in bankruptcy through sales of Web sites has become more common, as have attendant issues unique to the sales of Web sites. One of the first attempts to sell a Web site occurred in the bankruptcy, where the debtor attempted to sell personal information obtained from customers as an asset of its estate despite its privacy policy.1 More recent incidents such as the theft of computers containing, for example, personal information of government personnel, insurance applicants and consumers of a popular online travel Web site, underscore the need for security measures to protect individuals' identifying information.

The Bankruptcy Abuse Prevention and Consumer Protection Act (BAPCPA) attempts to meet these concerns with its mandate for a Consumer Privacy Ombudsman (CPO) under certain circumstances of a sale of a debtor's assets. Section 332 of the Code, as amended by BAPCPA, requires that when a sale is proposed pursuant to §363 (b)(1)(B) and a hearing is required thereunder, "the court shall order the U.S. Trustee to appoint, not later than five days before the commencement of the hearing, one disinterested person (other than the U.S. Trustee) to serve as the consumer privacy ombudsman in the case and shall require that notice of such hearing be timely given to such ombudsman." 11 U.S.C. §332(a). The CPO is charged with the task of providing information to the court to assist it in considering the proposed sale or lease of "personally identifiable information" (PII).2 11 U.S.C. §332(b).

The CPO requirement arises only where the proposed sale or lease involves PII. Section 363(b) (1)(B) continues to authorize the sale or lease of property outside the ordinary course of business "except...if the debtor in connection with offering a product or a service discloses to an individual a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor and if such policy is in effect on the date of the commencement of the case, then the trustee may not sell or lease personally identifiable information to any person unless (a) such sale or such lease is consistent with such policy, or (b) after appointment of a consumer privacy ombudsman in accordance with §332, and after notice and a hearing, the court approves such sale or such lease...." 11 U.S.C. §363(b)(1)(B).

The Code is less specific with regard to what information the CPO should provide the court, but states that it "may include presentation of (1) the debtor's privacy policy, (2) the potential losses or gains of privacy to consumers if such sale or such lease is approved by the court, (3) the potential costs or benefits to consumers if such sale or such lease is approved by the court and (4) the potential alternatives that would mitigate potential privacy losses or potential costs to consumers." 11 U.S.C. §332(b). Amended §330 allows the CPO to be compensated. 11 U.S.C. §330. It is not entirely clear under BAPCPA precisely when a CPO must be hired, other than that it cannot be later than five days prior to a sale hearing.

Implementing §332

The first occasion to test §332's CPO requirement occurred in June 2006 and highlighted both the potential benefits and potential burdens of this provision. In In re Engaging and Empowering Citizenship Inc.3 (E2C), the U.S. Trustee sought and received an order appointing a CPO pursuant to §332. In the E2C case, the court-appointed examiner sought to sell assets that included three Internet portals (, and, their related interfaces and their corresponding customer lists. At that point in the case, the E2C business had run out of money and a prompt sale was the only chance of preventing administrative insolvency in the case. Access to these Web sites required individuals to provide, inter alia, their names, telephone numbers and e-mail addresses. E2C's privacy policy prohibited the sale, trade and provision of personal contact information to third parties.

The U.S. Bankruptcy Court for the District of Arizona granted the U.S. Trustee's request, but noted its concerns over the potential time delay and costs. The U.S. Trustee appointed Donald Gaffney, an established practitioner with extensive experience in bankruptcy law, 10 days prior to the scheduled sale hearing. Gaffney filed a preliminary report nearly 40 pages long and an even more extensive final report. Ultimately, the sale hearing was continued for one week, providing the CPO 16 days from his appointment to complete the investigation, analysis and drafting of the CPO's report.

The E2C's CPO report provides a thorough examination of the CPO's intended role under BAPCPA amendments, a comprehensive analysis of the debtor's privacy policies, relevant state and federal law, the proposed sale, and applicable concerns and recommendations to the court. Despite the obvious extensive time invested in the CPO's investigation and report, Gaffney agreed not to seek a fee for his services. Thus, the cost to the debtor's estate was de minimus.

Ultimately, the order entered by the court approving the sale included recommendations from the CPO such as adopting the debtor's existing privacy policies, notifying users of the sale and providing an election to be removed from the database, and requiring the buyer to take additional security measures to protect customer information.

Practical Implications of the CPO

An issue at the forefront of §332 that remains to be addressed in the CPO process is how the estate will bear the cost of the CPO's services. The E2C case involved a modest estate where the assets attracted a $500,000 stalking-horse bid and ultimately sold for $1.15 million.4 That no costs were incurred for the CPO's services is almost certainly an anomaly. It is easily conceivable that in smaller bankruptcy cases where there may be only one potential bidder, the cost of retaining the CPO could near the sale price. The Code does not delineate how to deal with the cost-effectiveness issue. Court-imposed limitations on CPO fees may discourage the most qualified individuals from serving, and passing this cost on to the buyer may discourage competitive bidding.

The law and the practice of law must necessarily evolve as technology does...

Another consideration is the timing imposed by §332: A CPO shall be appointed not later than five days prior to the sale hearing. In the often fast-paced sale of assets under §363, and especially in complex cases, it is difficult to see how much a CPO can reasonably accomplish in such a short timeframe.

A third concern for a CPO is the potential risk of liability. Section 332 states that a CPO "shall not disclose any personally identifiable information obtained by the ombudsman under this title." 11 U.S.C. §332(c). The Code does not differentiate between willful or negligent disclosure and doesn't specifically provide a remedy for a violation of subsection (c), but also doesn't specifically insulate the CPO from liability for any particular type of disclosure. Like the cost issue, such uncertainties also stand to discourage sophisticated individuals from accepting an appointment as CPO.


The CPO and its related statutory provisions illustrate the ever-present challenge of balancing somewhat esoteric privacy issues in an electronic world against the commercial reality of bankruptcy. The law and the practice of law must necessarily evolve as technology does, though the full benefits and burdens of the §§332 and 363(b)(1)(B) are yet to make themselves known.



1 FTC v., 2000 WL 34016434 (D. Mass 2000). See, also, Salazar, "FTC Takes Action," Nat'l. L.J. Oct. 9, 2000, for further discussion on the case.

2 Section 101(41A) of the Code provides a broad definition of PII that includes consumers' names, physical addresses, e-mail addresses and telephone numbers, and "any other information" that, if disclosed, will result in contacting or identifying a consumer either physically or electronically. 11 U.S.C. §101(41A).

3 Case No. 2-05-28175-CGC (D. Ariz.).

4 The E2C case raised a number of relatively cutting-edge sale issues, besides the CPO issue, that are outside the scope of this article, including (1) credit bid rights of a creditor that held a relatively modest lien on some of the hardware that was positioned for sale, (2) the power and business judgment of an examiner to sell assets under §363 and (3) the propriety and amount of a break-up fee for the stalking-horse bidder where assets are sold for a relatively small amount (the stalking horse ultimately received a $50,000 break-up fee, or 10 percent of his bid—a relatively high percentage for break-up fees).

Bankruptcy Code: 
Journal Date: 
Friday, September 1, 2006