Professor Urges Passage of Federal Law to Protect Private Customer Information When Companies Go Bankrupt

Companies go bankrupt all the time, and when they do, assets can be sold so that creditors can receive payment on what they are owed. If a manufacturer has to sell inventory or fixtures as part of a Chapter 7 or 11 proceeding, it usually has little to no effect on third parties. However, for some businesses, the private information they’ve collected from customers over the years is one of their most valuable assets. One recent bankruptcy has led some legislators and law professors to call for a measure that protects consumers in these situations. 

Genetic testing giant 23andMe filed for Chapter 11 bankruptcy in March. The company received a lot of attention by offering people the chance to get a genetic profile by sending in a saliva sample. Now, the question arises as to the disposition of both the samples and profiles in a bankruptcy-related sale. Significantly, the genetic information processed by 23andMe does not fall under HIPAA protection, presenting unique privacy challenges for its customers. 

Currently, there are limited regulations that directly address the sale of customer data during bankruptcy. In most cases, this data could potentially be acquired by other companies, changing hands without the customer’s explicit consent. Such transactions heighten the risk of misuse, exploitation or exposure of confidential genetic information.

Recognizing the potential pitfalls, some privacy advocates are calling for legislation that ensures customer information remains confidential and cannot be freely sold during bankruptcy liquidation. Proposed measures could impose restrictions on transferring personal data, introduce stricter privacy safeguards, or require explicit customer consent for any transfer of their data. Law Professor Sara Gerke of the University of Illinois says that Congress might need to pass a wide-ranging privacy protection law similar to the European Union’s General Data Privacy Regulation. 

Implementing legislation to safeguard consumer data during bankruptcy would have significant implications for large and small businesses seeking debt relief. For smaller businesses, rigorous data protection requirements could increase operational costs, affecting their ability to compete or emerge from bankruptcy efficiently. They would need to adopt enhanced data management systems and security protocols, requiring both time and investment.

For larger corporations, one consideration would be ensuring compliance across international operations. Companies like 23andMe, which handle copious amounts of data, would need to exercise more comprehensive data governance and potentially face limitations in asset liquidations.

Balancing business interests and consumer protections presents challenges. As companies in various industries collect more personal data from customers, they need to be aware of the possibility that someday they might be subject to tougher rules governing the disposition of private data should they file for bankruptcy.   

Jeff Field & Associates assists Georgia businesses with bankruptcy proceedings. For an appointment, please call 404-381-1278 or contact us online. We have locations in Douglasville, Gainesville, Bogart, Lawrenceville, Marietta and Decatur.