- The Washington Times - Monday, July 17, 2000

The Federal Trade Commission wasted no time filing suit against Toysmart.com Inc. once it found out the company planned to sell its customer list.

A sale of the information about consumers would have violated Toysmart's own privacy policy, so the FTC sued the company on July 10 to block the sale of the consumer data.

A day later Walt Disney Co., which owns 60 percent of Toysmart, offered to buy the list. A bankruptcy judge has yet to rule on the proposed sale.

It was the first time the FTC challenged a failing firm's sale of information that is subject to a privacy policy. It may not be the last, and Jodie Bernstein, director of the FTC's bureau of consumer protection, is on the prowl for other unscrupulous on-line companies.

Question: How many Toy-Smart.coms are out there trying to sell information about consumers who register on their sites and provide personally identifiable information?

Answer: I don't know the answer to that. There have been accounts of three or four others, and we will be looking at them. We keep that confidential as to who we are looking at.

Q: Is the concern that if one dot-com company sells a consumer list, the door would burst wide open and others will try the same thing?

A: That would be a concern because people might think there would be no constraint on their ability to do that, and that would be a concern of this agency because those consumers would have been assured that that would not be the case.

Q: Walt Disney Co. has offered to buy Toysmart's customer list. Is that acceptable to the FTC and do you think every dispute will be settled that easily?

A: Walt Disney is not a party to the lawsuit … they had a 60 percent interest in the company. Because Disney has stated publicly that the practice Toysmart engaged in was not consistent with their own business practices, they really felt that they wanted to help resolve the suit. So they have offered to buy the list … but [Toysmart] is in involuntary bankruptcy, so there would be some issues before the bankruptcy court as to whether [Disney] will be permitted to buy the list and under what circumstances.

As far as we're concerned … [Disney's purchase of the list] could have been part of the settlement if they had agreed that they would not use it in a way that was of concern. However, because of the bankruptcy, it may not be as easy to obtain it.

Q: Is the FTC pursuing action against other companies trying to sell customer lists?

A: I really can't answer that because they are confidential investigations … 'Can't confirm or deny' is the rule we operate under.

Q: The industry wants a self-regulatory approach to ensure consumer privacy. The FTC in May recommended Congress give it legislative authority to protect consumer privacy. What do you think of the FTC critics who say the laws in place will work fine to ensure privacy, but it will take time for the laws to take effect and it's too early to give the FTC more authority?

A: The FTC has studied this issue for five years and reported to Congress on three occasions as to how effective self-regulation has been. Twice in the past the commission has said we want to give self-regulation a chance to work.

This time, after doing an extensive survey and finding disappointing results … the commission decided to recommend to Congress that now it's time to at least enact framework legislation.

The compelling reason is that parties who are not part of the self-regulatory process and don't follow it and for those who may have violated [privacy policies], there needs to be an enforcement mechanism … the self-regulatory programs we've seen in the past … work effectively, but they have always had legislation backing them up, particularly for enforcement purposes.

This is consistent with that, and we think the Internet is not that different, so it can sustain the same amount of legislative scrutiny without dampening this wonderful new medium.

Q: Rep. Spencer Bachus, Alabama Republican, plans to introduce a bill to forbid bankrupt companies from sharing information they had pledged to keep private. Sen. Patrick Leahy, Vermont Democrat, and Sen. Robert Torricelli, New Jersey Democrat, introduced legislation [last Thursday] to bar the sale of personal information kept by a defunct company if the sale would have violated its privacy policy. Is that a strong enough safety net? What's the FTC's initial reaction to the bills?

A: We haven't had a chance to review either of those proposals in detail …

I think there was a particular problem in connection with the application of bankruptcy laws to this particular situation, and that's why it triggered those very specific [bills] … In an ordinary situation, that promise the company made [to keep consumer data private] would be honored. If a buyer buys it, it would be honored. But if you're in bankruptcy, it might not be honored because the creditors have a claim or lien on all assets of the company … and they might say if that list has some value, we're going to sell it to the top bidder.

Q: What if companies bought and sold the consumer lists, then did like on-line clothing retailer Fashionmall.com did last month when it bought London-based Boo.com's mailing list and e-mailed everyone on the list and asked whether or not they could use the information. Is that practice acceptable?

A: Under existing laws, it certainly would be.

Q: Don't off-line companies like magazines do this all the time buy customer lists? What's the difference between that practice and an on-line company selling a list?

A: The main difference is that Toysmart made a commitment to its potential customers. Perhaps the people who were providing the personal information would not have done so [if they knew the information wouldn't be kept private].

In the off-line world there is not such a commitment. Since this issue has arisen online, people are raising just that question as to whether there should be some constraint on [off-line] lists as well.



LOAD COMMENTS ()

 

Click to Read More

Click to Hide