Case LSS Doc 412 Filed 10/28/16 Page 1 of 25 UNITED STATES BANKRUPTCY COURT FOR THE DISTRICT OF DELAWARE : : : : : Debtors.

Transcription

1 Case LSS Doc 412 Filed 10/28/16 Page 1 of 25 UNITED STATES BANKRUPTCY COURT FOR THE DISTRICT OF DELAWARE In re: GOLFSMITH INTERNATIONAL HOLDINGS INC. et al., Debtors. : : : : : Chapter 11 Case No (LSS) (Jointly Administered) REPORT OF THE CONSUMER PRIVACY OMBUDSMAN Cassandra M. Porter, CIPP/US Telephone: (973) cporter@lowenstein.com Consumer Privacy Ombudsman Mary J. Hildebrand, CIPP/E/US Lowenstein Sandler LLP 65 Livingston Avenue Roseland, New Jersey Telephone: (973) mhildebrand@lowenstein.com Counsel to the Consumer Privacy Ombudsman Lowenstein Sandler LLP

2 Case LSS Doc 412 Filed 10/28/16 Page 2 of 25 TABLE OF CONTENTS I. Recommendations...1 II. Scope and Bases of Ombudsman Investigation...5 III. Background...7 A. The Chapter 11 Cases....7 B. About Golfsmith International....8 C. Overview of the Debtors Operations....8 D. Debtors Sale Process....9 E. Debtors Canadian Affiliates IV. Debtors Privacy Policies and Personal Information Collection Activities...11 V. Applicable Law...15 A. Relevant Bankruptcy Code Provisions B. Toysmart.com; Importance of Protecting Consumer Privacy Rights in Bankruptcy C. Other Applicable Federal Law D. State Law Considerations VI. Section 332 Analysis...21 VII. Conclusion...23 Lowenstein Sandler LLP i

3 Case LSS Doc 412 Filed 10/28/16 Page 3 of 25 Cassandra M. Porter, the duly-appointed consumer privacy ombudsman of the estates of Golfsmith International Holdings, Inc. ( Golfsmith International ) and its affiliated debtors 1 (collectively, the Debtors ), respectfully submits this report (the Report ) to assist the Court in its consideration of the facts, circumstances and conditions of the proposed sale and transfer of personally identifiable information ( PII ) 2 of the Debtors customers ( Customer PII ) to Dick s Sporting Goods, Inc. and its affiliates (the Buyer ) pursuant to the Asset Purchase Agreement Dated By and Among Dick s Sporting Goods, Inc., the Agent Referred to Herein, Golfsmith International Holdings, Inc., and the Other Parties Signatory Hereto (the Purchase Agreement ) [D.I. 404], and states: I. RECOMMENDATIONS 1. After a review of the facts and circumstances, and as more fully discussed in this Report, the Ombudsman recommends ( Recommendations ) that the Court approve the proposed sale and transfer of Customer PII to the Buyer, subject to the following conditions: 2. The Debtors demonstrate, and the Court finds, that the Buyer is a Qualified Buyer. A Qualified Buyer means an entity that: (a) (b) agrees to operate Debtors business as a going concern to the extent set forth in the Purchase Agreement and its exhibits, including the Agency Agreement 3 ; expressly agrees to be bound by, and succeed to, the Debtor s existing privacy policy ( Privacy Policy ); and 1 The Debtors, along with the last four digits of each Debtor s federal tax identification number, as applicable, are: Golfsmith International Holdings, Inc. (4847); GMAC Holdings, LLC (3331); Golf Town USA Holdco Limited (5562); Golf Town USA Holdings Inc. (7038); Golf Town USA, LLC (0259); Golfsmith 2 GP, L.L.C. (2218); Golfsmith Europe, L.L.C. (2408); Golfsmith Incentive Services, L.L.C. (2730); Golfsmith International, Inc. (7337); Golfsmith International, L.P. (4257); Golfsmith Licensing, L.L.C. (5499); Golfsmith NU, L.L.C. (2404); and Golfsmith USA, L.L.C. (2405). 2 As defined in 11 U.S.C. 101(41A). 3 The term Agency Agreement shall mean the Agency Agreement by and among Golfsmith International Inc., Golfsmith International Holdings, Inc., and Hilco Merchant Resources, LLC, Tiger Capital Group, LLC, Gordon Brothers Retail Partners, LLC; and Dick s Sporting Goods, Inc. [D.I. 404]. Lowenstein Sandler LLP

4 Case LSS Doc 412 Filed 10/28/16 Page 4 of 25 (c) agrees to be responsible for any violation of the Privacy Policy after the Closing Date (as defined in the Purchase Agreement). 3. The Buyer agrees to notify the Debtors customers ( Customers ) of the sale by providing clear and conspicuous notice ( Notice ) of the following: (i) Dick s Sporting Goods, Inc. is the Buyer; (ii) as a result of the sale, Buyer purchased Customer PII; (iii) the Buyer is the successor-in-interest under the Privacy Policy; and (iv) Customers have the opportunity to optout from receiving communications from the Buyer, and having their Customer PII transferred to the Buyer ( Opt-Out Request ). The Notice(s) must be provided using the methods, and within the respective periods, set forth in paragraphs 4 (a)-(d) below, and include a hyperlink and a tollfree number for Customers to effectuate an Opt-Out Request. Each Notice shall state that Opt- Out Requests must be received by the Buyer (or its designee) no later than thirty (30) days after the respective posting, placement, or sending (by or postal mail) thereof (the Opt-Out Deadline ). 4. The Buyer shall: (a) (b) (c) (d) Clearly and conspicuously post the Notice on Debtors website ( within forty-eight (48) hours after the Closing Date (or such other time as mutually agreed in writing by the Ombudsman and the Buyer), which Notice shall remain posted for a period of thirty (30) days thereafter; Place the Notice in a clear and conspicuous location at, or near, the point of sale in all Stores within forty-eight (48) hours after the Closing Date (or such other time as mutually agreed in writing by the Ombudsman and the Buyer), which Notice shall remain posted for a period of thirty (30) days thereafter; the Notice, within thirty (30) days of the Closing Date, to Customers whose addresses are included in the Customer PII; and Send the Notice, within thirty (30) days of the Closing Date, to Customers who do not have an address in the Customer PII but do have a physical mailing address, by postage paid regular mail. 5. The Buyer shall cause each of the notifications described in paragraph 4 above to Lowenstein Sandler LLP 2

5 Case LSS Doc 412 Filed 10/28/16 Page 5 of 25 be completed by third-party service provider(s) to be determined by mutual written agreement by the Ombudsman and Buyer. 6. The Buyer shall file a certification confirming its compliance with the conditions set forth in paragraphs 2, 3, and 4 with the Court. In the alternative, the Court may direct the Ombudsman to file a report confirming such compliance. 7. The Buyer agrees that Customer PII will not be transferred to the Buyer until after the expiration of the last Opt-Out Deadline and the filing of the certification set forth in paragraph 6; provided however, this paragraph 7 does not modify the Buyer s rights under the Agency Agreement with respect to certain limited uses of Customer PII. 8. Upon expiration of the last Opt-Out Deadline, filing of the certification set forth in paragraph 6 above, and transfer of the Customer PII, the Buyer may seek to convert Customers to the Buyer s privacy policy, to the extent required by applicable law, by: (a) (b) providing Customers with prior notice (in substantially the same manner and within the timeframe(s) customarily implemented under the Buyer s existing privacy policy 4 for user notification of material changes thereto), and directing them to the Buyer s privacy policy; and providing each Customer with the opportunity to opt-out of coverage by the Buyer s privacy policy, which policy shall bind only those individuals who do not opt-out. 9. The Buyer agrees to safeguard all Customer PII in a manner consistent with industry standard data security protections and applicable information security laws and best practices. 10. The Buyer agrees to destroy all Customer PII for which it determines it has no reasonable business need in a manner consistent with industry standard data security protections and applicable information security laws and best practices. 4 A copy of Buyer s existing privacy policy, which was last updated on December 18, 2015, is available on Buyer s website at: (last viewed Oct. 28, 2016). Lowenstein Sandler LLP 3

6 Case LSS Doc 412 Filed 10/28/16 Page 6 of Within ninety (90) days of the Closing Date, the Debtors shall delete and destroy, or cause to be deleted and destroyed: (a) (b) all Customer PII not transferred to the Buyer (or other purchaser, as the case may be); and all Customer PII resident on any and all computer hardware, servers, devices and related equipment used by Debtors in the ordinary course of business, whether or not such assets are being acquired by the Buyer or a third party. This process shall be completed in a manner consistent with industry standard data security protections and applicable information security laws and best practices. However, the Debtors should take no action with respect to any Customer PII that is the subject of a litigation hold until the expiration of such hold. 12. The Debtors shall file a certification with the Court confirming such destruction. In the alternative, the Court may direct the Ombudsman to file a report confirming such destruction. 13. If, for any reason, Customer PII is sold to an entity that does not meet the requirements of a Qualified Buyer, then the Court should require that: (a) (b) (c) The purchaser must, at a minimum, agree to abide by Debtors existing Privacy Policy; Debtors and the purchaser must provide notice to any consumer whose PII it holds of the proposed transfer; and As part of the notification, Debtors and the purchaser must provide Customers with the opportunity to opt-in to the transfer, or their information will not be transferred. 14. The proposed conditions to the sale and transfer of Customer PII are consistent with applicable precedent in this area of the law, including Federal Trade Commission rulings Lowenstein Sandler LLP 4

7 Case LSS Doc 412 Filed 10/28/16 Page 7 of 25 and prior Consumer Privacy Ombudsman recommendations in other bankruptcy cases Subject to the foregoing conditions, the Ombudsman respectfully recommends that the Court approve the sale and transfer of Customer PII to the Buyers. II. SCOPE AND BASES OF OMBUDSMAN INVESTIGATION 16. In performing her duties and preparing this Report, the Ombudsman has, among other things, reviewed: (a) Debtors privacy policy in effect on the Petition Date (the Privacy Policy ). 6 A copy of the Privacy Policy is attached hereto as Exhibit A. (b) Debtors privacy policy in effect from at least December 22, 1999 to October 3, 2011 (the Earlier Privacy Policy ). A copy of the Earlier Privacy Policy is attached hereto as Exhibit B. (c) Debtors information security procedures, including the Document Retention and Security Policy that was last updated as of July 17, 2015 (the Document Retention Policy ). A copy of the Document Retention Policy is attached hereto as Exhibit C. (d) Debtors Terms of Use in effect on the Petition Date ( TOU ). 7 A copy of the TOU is attached hereto as Exhibit D. (e) Content of the Debtors Website where Customer PII could be obtained by Debtors and/or provided by Customers in the ordinary course of Debtors business, including (i) Customer accounts; (ii) purchase of goods and/or services; (iii) credit card program; (iv) 5 See, e.g., In re Aeropostale, Inc., Case No (SHL) (Bankr. S.D.N.Y. 2016) [D.I. 758]; In re Hancock Fabrics Inc., Case No (BLS) (Bankr. D. Del. 2016) [D.I. 948]; In re Adinath Corp., Case No (LMI) (Bankr. S.D. Fl. 2015) [D.I. 427]; In re Radioshack Corp., Case No (BLS) (Bankr. D. Del. 2015) [D.I. 2148]; In re Deb Stores Holdings, LLC, Case No (KG) (Bankr. D. Del. 2014) [D.I. 272]; In re delia*s, Inc., Case No (RDD) (Bankr. S.D.N.Y. 2014) [D.I. 557]; In re CWC Liquidation Inc. f/k/a Coldwater Creek, Inc., Case No (BLS) (Bankr. D. Del. 2014) [D.I. 339, 425]; In re Crumbs Bake Shop, Inc., Case No (MBK) (Bankr. D.N.J. 2014) [D.I. 174]; In re Kid Brands, Inc., Case No (DHS) (Bankr. D.N.J. 2014) [D.I. 280]; In re Dots, LLC, Case No (DHS) (Bankr. D.N.J. 2014) [D.I. 624]; In re Loehmann s Holdings Inc., Case No (MG) (Bankr. S.D.N.Y. 2013) [D.I. 196]; In re Real Mex Restaurants, Inc., (Case No (BLS) (Bankr. D. Del. 2011) [D.I. 877]; In re Borders Group, Inc., Case No (MG) (Bankr. S.D.N.Y. 2011) [D.I. 1830]. 6 The Privacy Policy was last updated on dated October 3, A copy is available at the Debtors website at (last viewed Oct. 27, 2016). 7 A copy is available on the Debtors Website at (last viewed Oct. 27, 2016). Lowenstein Sandler LLP 5

8 Case LSS Doc 412 Filed 10/28/16 Page 8 of 25 gift card program; (v) contests, sweepstakes, giveaways and other interactive transactions, including the receipt of special offers from Golfsmith via ; (vi) mobile text alert program; (vii) e- mail notification program; and (viii) golf equipment trade-in program. (f) (g) (h) (i) (j) (k) (l) (m) (n) Debtors direct to consumer catalog business and call centers with respect to procedures for collection of Customer PII, and/or provision by Customers of Customer PII. Debtors retail operations with respect to procedures for collection of Customer PII, and/or provision by Customers of Customer PII. Debtors Customer database which included all Customer PII collected and/or received by Debtors through e-commerce, catalog sales (including call centers) and retail operations, together with all customer data collected and/or received by certain non-debtor Canadian affiliates (the Canadian Data ). 8 Debtors proposed approach to segregate the Canadian Data from the Customer PII (i.e., based on the source of such data being Debtors or Golf Town), in order to facilitate the sale and transfer of the Canadian Data in accordance with Ontario Superior Court of Justice s Approval and Vesting Order dated September 30, 2016 ( CCAA Sale Order ). Debtors proposed approach to removing Customer PII and other data from equipment. A list of third party service providers engaged by Debtors who received and/or processed Customer PII on behalf of the Debtors. Debtors disclosures on its website. Content of the Debtors website where PII could be obtained including (i) a customer account program; (ii) ability for customers to receive special offers from Golfsmith via ; (iii) ability to obtain a Golfsmith credit card; and (iv) Debtors collection procedures, disclosures on its website and its database. Pleadings filed in the Chapter 11 Cases (as defined below), including the Sale Motion and the Motion of the Debtors for Interim and Final Authority to (I) Maintain and Administer 8 In conjunction with the filing of the Chapter 11 Cases by Debtors, certain non-debtor Canadian affiliates (collectively Golf Town ) commenced a proceeding under the Companies Creditors Arrangement Act (the CCAA ) in the Ontario Superior Court of Justice (Commercial List) in Canada. See First Day Declaration at 1. Golf Town operates retail stores in Canada. Lowenstein Sandler LLP 6

9 Case LSS Doc 412 Filed 10/28/16 Page 9 of 25 Prepetition Customer Programs, Promotions, and Practices, and (II) Pay and Honor Related Prepetition Obligations [D.I. 10]. (o) Documents about the Debtors business and operations provided to prospective purchasers. 17. Moreover, the Ombudsman interviewed and had discussions with: (a) (b) (c) Debtors outside counsel; Kelley Anderson, a Debtors employee for the past three years and knowledgeable of the Debtors information privacy practices, including the collection, use, and disclosure of Customer PII, management of the Debtors database, and the Debtors use of third party service providers in relation thereto; and Buyer s outside counsel and in-house counsel concerning Buyer s intended use of the Debtors customer information. 18. The Ombudsman researched applicable United States Federal, State, and local laws and regulations regarding the privacy of consumer information, and, as necessary, reviewed the outcome of comparable situations in this and other jurisdictions. III. BACKGROUND A. The Chapter 11 Cases. 19. On September 14, 2016 (the Petition Date ), the Debtors each filed a voluntary petition for relief (the Chapter 11 Cases ) under chapter 11 of the Bankruptcy Code. A detailed description of the Debtors, including their business operations and events leading to the filing of these Chapter 11 Cases is set forth in the Declaration of Brian Cejka in Support of the Debtors Chapter 11 Petitions and First Day Relief [D.I. 3] (the First Day Declaration ). 20. On September 23, 2016, the Office of the United States Trustee (the U.S. Trustee ) appointed the Official Committee of Unsecured Creditors to the Debtors. See D.I The United States Trustee appointed Cassandra M. Porter to serve as the Ombudsman in these Chapter 11 Cases, effective as of October 7, 2016 [D.I. 224]. Lowenstein Sandler LLP 7

10 Case LSS Doc 412 Filed 10/28/16 Page 10 of 25 B. About Golfsmith International. 22. Based in Austin, Texas, Golfsmith International identifies itself as the largest specialty golf retailer in the world 9 and offers customers an extensive selection of golf equipment and related services, such as club-fittings. 23. According to the Debtors, the Golfsmith brand started as a provider of custommade golf clubs and a repair service in See First Day Declaration at 18. In 1972, the company opened its first retail location. Id. Three years thereafter, the company circulated its first catalog selling third-party products. Id. Through the late 1990s, the company operated primarily as a catalog business. Id. at 19. In 1997, the company opened its first website. Id. C. Overview of the Debtors Operations. 24. As of the Petition Date, the Debtors operate as an integrated, multi-channel retailer 10 with retail stores, traditional catalog sales, and an e-commerce business. Id. at Retail Stores. The Debtors have 109 retail stores located in Alabama, Arizona, California, Colorado, Connecticut, Delaware, Florida, Georgia, Illinois, Indiana, Kansas, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nevada, New Jersey, New York, North Carolina, Oklahoma, Ohio, Oregon, Pennsylvania, South Carolina, Tennessee, Texas, and Wisconsin. 26. Customers have access to a number of services, including club-fitting, club repair, swing analysis, at the Debtors retail locations. In addition, Customers also have access to a variety of golf-related products for purchase. Id. at See Golfsmith.com, About Us, (last viewed Oct. 11, 2016). 10 Id. Lowenstein Sandler LLP 8

11 Case LSS Doc 412 Filed 10/28/16 Page 11 of Direct to Consumer/Catalog Business. The Debtors are one of the industry s leading golf specialty retailers. Id. at 24. The Debtors offer two principal catalogs ( Catalogs ) to consumers: the Golfsmith Consumer Catalog and the Golfsmith Clubmaking Catalog. Id. The Catalogs are distributed electronically and by mail. Id. 28. E-commerce and Website. Prior to the Petition Date, the Debtors operated their own e-commerce and website, According to the Debtors, in 2015, the website received and processed over 400,000 orders for golf-related products and services, with an average of approximately 29 million unique site visits on an annual basis. Id. at 25. D. The Debtors Sale Process. 29. On the Petition Date, the Debtors filed the Motion of Debtors for Entry of Order (I)(A) Approving Bidding Procedures for the Sale of Substantially All of Debtors Assets, (B) Scheduling an Auction for and Hearing to Approve Sale of Debtors Assets, (C) Approving Form and Manner of Notice of Sale, Auction, and Sale Hearing, (D) Approving Assumption and Assignment Procedures, and (E) Granting Related Relief; and (II)(A) Approving Sale of Substantially All of Debtors Assets Free and Clear of Liens, Claims, Interests, and Encumbrances, (B) Approving Assumption and Assignment of Executory Contracts and Unexpired Leases, and (C) Granting Related Relief [D.I. 20] (the Sale Motion ) seeking, among other relief, authority to sell substantially all of their assets. 30. On September 28, 2016, the United States Trustee s office filed an objection to the Sale Motion, asserting in part, that appointment of a consumer privacy ombudsman is necessary in these Chapter 11 Cases. See D.I On October 6, 2016, the Order Approving Bidding Procedures for the Sale of Substantially All of Debtors Assets, (B) Scheduling an Auction for an Hearing to Approve Sale Lowenstein Sandler LLP 9

12 Case LSS Doc 412 Filed 10/28/16 Page 12 of 25 of Debtors Assets, (C) Approving Form and Manner of Notice of Sale, Auction, and Sale Hearing, (D) Approving Assumption and Assignment Procedures, and (E) Granting Related Relief [D.I. 196] (the Bid Procedures Order ) was entered on the Court s docket. Accordingly, the Court approved the portion of the Sale Motion pertaining to bid procedures and scheduled an Auction (as defined in the Bid Procedures Order) to take place on October 19, As contemplated by the Bid Procedures Order, parties interested in purchasing the Debtors assets submitted bids by October 17, The Debtors provided the Ombudsman with a copy of bids and advised that the Auction would go forward on October 19, The Auction took place over several days; at its conclusion, the Debtors selected the Buyer s bid as the highest and best. 34. In connection with the sale, the Debtors are seeking authority to enter into Purchase Agreement with the Buyer. A hearing to approve this relief is scheduled for October 31, As reflected in the Purchase Agreement, the Buyer seeks to purchase all [of the Debtors ] customer contact information (including personally identifiable information such as name, address, phone numbers), together with all customer transaction history, customer loyalty program data and participant information, customer opt-out or opt-in lists, current customer models, and other customer-based analysis or reports (the Customer Information ). See Purchase Agreement at 1.1 (definitions of Acquired Intellectual Property and Intellectual Property). The Customer PII is included in the Customer Information. 36. However, the Buyer is not seeking to purchase any credit card information or social security number information that may be in the Debtors possession. Id. Lowenstein Sandler LLP 10

13 Case LSS Doc 412 Filed 10/28/16 Page 13 of 25 E. About Debtors Canadian Affiliates, Golf Town. 37. In July 2012, Golfsmith International and Golf Town merged. As a result of the merger, GSI Holdings LP was formed to serve as the global parent company for both entities. See First Day Declaration at Golf Town operates 55 retail locations in Canada. Id. at According to the Debtors, Golf Town s website ( is operated in conjunction with their own website, Moreover, the Debtors maintain Golf Town s customer records in the same database containing their Customers records. This database is maintained at the Debtors Texas facility. 40. On September 30, 2016, the Ontario Superior Court of Justice (Commercial List) in Canada entered the CCAA Sale Order authorizing the sale of Golf Town to the purchaser identified therein (the Golf Town Purchaser ). 41. After reviewing the CCAA Sale Order, the Ombudsman inquired as to how the Debtors intended to separate their Customers records from Golf Town s records. According to the Debtors, they are able to split these records into two separate databases. The Debtors confirmed that division of the database also entails identification and allocation of consumers who specifically opted in receive s and other communication from Golf Town, the Debtors, or both, and their associated records. 42. Based on the Debtors representations, the Ombudsman is satisfied that Customer PII will not be provided to the Golf Town Purchaser in connection with the transfer contemplated under the CCAA Sale Order. IV. DEBTORS PRIVACY POLICIES AND PERSONAL INFORMATION COLLECTION ACTIVITIES 43. Through this investigation, the Ombudsman learned that Golfsmith International Lowenstein Sandler LLP 11

14 Case LSS Doc 412 Filed 10/28/16 Page 14 of 25 collects information (including certain PII) from Customers through its website, retail stores, catalog business, and related call centers. For example, the Debtors will collect data in connection with sign-ups on Debtors Website and in stores; purchases made through their website, catalog, store, and/or call center; gift card program; warranty program; and company branded credit card. The PII collected includes a Customer s name, birthday, gender, address, physical/mailing address. The Debtors engage third party service providers to accept and process credit card transactions for Customers, and the associated information is not in Debtors possession. 44. As per the Ombudsman s understanding, the Debtors do not collect Customers social media credentials. The Debtors also do not collect Customers credit card numbers or social security numbers. 45. As of October 14, 2016, the Debtors identified 9,941,999 total unique records in the Golfsmith International Customer database. 46. According to the Debtors, all Customer Information, including Customer PII, is stored in one database located at the Debtors offices in Austin Texas. On a regular basis, the Debtors data (e.g., store purchases, website inquiries) is collected by third-party vendors ( Vendor(s) ). 11 The respective Vendor(s) authenticate the data, remove duplicate data points, store the data, and transmit the refined data back to the Debtors. The Debtors access this information through data tables organized by specific purpose and/or function. 47. The Debtors use the data to, inter alia, analyze level of performance; segment 11 In addition to approval of the sale and the transfer of Customer PII, the Debtors are also seeking authority to assume and assign (or reject, as appropriate) certain pre-petition contracts. These contracts include agreements with third parties who handle certain privacy- and security- related tasks for the Debtors, including with respect to Customer PII. The Ombudsman understands that the Buyer is reviewing these agreements. However, if the Buyer rejects a pertinent contract, the Ombudsman expects that all of the Customer Information, including Customer PII, held by such a contract counterparty will be destroyed in a manner consistent with industry standard data security protections and applicable information security laws and best practices. Lowenstein Sandler LLP 12

15 Case LSS Doc 412 Filed 10/28/16 Page 15 of 25 performance (based on attributes such as loyalty, credit card, and activity segments); create marketing materials; determine to whom marketing and promotions materials will be sent, and the method of transmittal (e.g., , direct mail, SMS); evaluate the effectiveness of promotional campaigns, and various sweepstakes, contests, and giveaways; and/or determine which customers may be contacted for in-store events. 48. Privacy Policy. The Privacy Policy discloses that PII about users may be obtained from various sources including through the Website, the catalog phone center, retail superstores, and communications to the Debtors. 49. The Privacy Policy also states, with respect to sharing customer information with third parties, the Debtors may share a Customer s name and postal mailing address with the Debtors trusted third party service providers. However, Customers are given the option to not have their information shared with such third parties by notifying the Debtors via or telephone to a customer service representative. 50. Customer Phone Numbers. The Privacy Policy further describes that telephone numbers provided by Customers will be used in connection with orders. However, the Debtors do not make any phone numbers in our customer database available to other companies or organizations. See Privacy Policy at Personal Information. 51. Customer Addresses. The Privacy Policy also states that: [Except for certain limited exceptions set forth in the Privacy Policy] Golfsmith will not sell, share, or otherwise distribute your address. Any address supplied directly to Golfsmith with respect to online orders, catalog requests, and requests for other information will remain in the sole possession of Golfsmith. Id., at Policy. This same language appears in earlier versions of the Privacy Policy. See Lowenstein Sandler LLP 13

16 Case LSS Doc 412 Filed 10/28/16 Page 16 of 25 Earlier Privacy Policy The Earlier Privacy Policy discloses that the Debtors collected and/or received PII from Customers when this policy was effective including addresses, postal addresses and phone numbers. Moreover, the Earlier Privacy Policy stated that, Golfsmith will not sell your address. Any address supplied to Golfsmith with respect to online orders, catalog requests, and requests for other information will remain in the sole possession of Golfsmith. 53. The Privacy Policy (and the Earlier Privacy Policy) contains explicit restrictions on the Debtors ability to sell or transfer Customer PII to a third party. Accordingly, in connection with the recommendations set forth herein, the Ombudsman is providing the Court with information, pursuant to section 332(b) of the Bankruptcy Code, to assist the Court in (a) considering the facts, circumstances, and condition of a proposed sale and transfer of Customer PII to the Buyer, and (b) evaluating whether this sale and transfer violates applicable nonbankruptcy law. 54. Document Retention Policy. The Debtors maintain records electronically, with a limited number of records in paper format. The Document Retention Policy is an internal document that provides guidance to employees and agents regarding the archival, retention, recovery and security protocols to be observed in connection with all Debtors records. Specifically with respect to Customer data security: All credit card data, printed on paper or received by fax, was to be kept secure until the transaction completed, at which time the data was to be immediately shredded and/or destroyed. Customer/employee 13 data, such as credit card, social security number, were to be kept secure at all times and never transmitted externally (or internally) via See also, copy of privacy policy available as of December 3, 2002 at (last viewed Oct. 26, 2016). 13 The Debtors employee s data is excluded from the sale and transfer of Customer PII addressed in this Report. Lowenstein Sandler LLP 14

17 Case LSS Doc 412 Filed 10/28/16 Page 17 of 25 Sales information and/or related materials are not be distributed/transmitted externally without the express written consent from a member of senior management. No one within Golfsmith or their vendors, contractors and business partners was allowed to have access to Customer Information, including credit card and social security numbers (as applicable), without prior written consent from a member of senior management. See Document Retention Policy at pages 3-5. Moreover, documents are to be shredded one (1) month after the retention date identified in the Document Retention Policy. Id. V. APPLICABLE LAW 55. This Report analyzes applicable law in the following categories: relevant Bankruptcy Code provisions, applicable Federal and State law, and relevant regulations. A. Relevant Bankruptcy Code provisions. 56. Bankruptcy Code sections 101(41A), 332, and 363, as a group, define and govern a debtor s use, sale, or lease of PII. 57. The Bankruptcy Code defines PII to mean any information provided by an individual to a debtor in connection with obtaining a product or a service from the debtor primarily for personal, family, or household purposes that includes an individual s first and last name, geographic address, electronic address (including an address), a telephone number, a social security account number, and/or an individual s credit card account number. See 11 U.S.C. 101(41A)(A)(i)-(v). PII will also include a birth date, the number of a birth or adoption, or a place of birth and/or any other information concerning an identified individual that, if disclosed, will result in contacting or identifying such individual physically or electronically if identified with one of the items listed in (A)(i)-(vi). See 11 U.S.C. 101(41A)(B). 58. Generally, section 363(b)(1) prohibits a debtor from selling or leasing PII in its Lowenstein Sandler LLP 15

18 Case LSS Doc 412 Filed 10/28/16 Page 18 of 25 possession if at the time of the commencement of a bankruptcy case, if the respective debtor s privacy policy prohibits the transfer of PII to unaffiliated entities. See 11 U.S.C. 363(b)(1). However, after appointment of a consumer privacy ombudsman, a court may approve a sale or lease of PII upon conclusion of a hearing where the court considers the facts, circumstances, and conditions of such sale or such lease and finds that, no such showing was made that such sale or lease would violate applicable nonbankrutpcy law. See 11 U.S.C. 363(b)(1)(B). 59. Under section 332(b), if a debtor proposes to sell PII under section 363(b)(1)(B) of the Bankruptcy Code, a consumer privacy ombudsman shall provide to the court information to assist the court in its consideration of the facts, circumstances, and conditions of the proposed sale of PII. See 11 U.S.C. 332(a). A consumer privacy ombudsman s presentation to the court may include a review of: See 11 U.S.C. 332(b). (1) the debtor's privacy policy; (2) the potential losses or gains of privacy to consumers if such sale or such lease is approved by the court; (3) the potential costs or benefits to consumers if such sale or such lease is approved by the court; and (4) the potential alternatives that would mitigate potential privacy losses or potential costs to consumers. B. Toysmart.com; Importance of Protecting Consumer Privacy Rights in Bankruptcy. 60. The genesis of the Bankruptcy Code s consumer privacy ombudsman provisions relate to the Toysmart.com bankruptcy matter. Although the facts of the Toysmart.com matter are well-known, they are worth repeating given their relevance to the circumstances presented here. 61. In the 1990s, Toysmart.com LLC ( Toysmart ) sold toys through its e-commerce website. In connection with its business, Toysmart collected customer information, including Lowenstein Sandler LLP 16

19 Case LSS Doc 412 Filed 10/28/16 Page 19 of 25 customer names, shopping preferences, and family profile information. Toysmart s privacy policy promised never to share its customer s information with a third party. 62. In June 2000, Toysmart s creditors filed an involuntary petition against the company. A few weeks later, Toysmart agreed to seek relief under chapter 11 of the Bankruptcy Code. 14 In connection with a proposed plan of liquidation, Toysmart sought to sell customer PII. However, because Toysmart s pre-petition privacy policy promised never to share customer information with a third party, the Federal Trade Commission ( FTC ) filed an action to enjoin the sale under Section 5 of the FTC Act (as defined below). 15 The matter subsequently settled by a settlement and stipulation entered into by the FTC and Toysmart (the Toysmart Stipulation ). 63. Today, the Toysmart Stipulation serves as a benchmark for determining whether the transfer of a PII asset is compliant with the relevant privacy policy. When making such a determination, the FTC will consider the Toysmart Stipulation factors in its analysis, including: whether customer data is being sold to an entity engaged in the same general line of business as the debtor; whether customer data is being sold as part of a larger group of assets; whether the buyer agrees to treat the customer data in accordance with the terms of the debtor s privacy policy in effect at the time the data was collected by the debtor; and whether customers will be given an opportunity to consent to any material change in the governing privacy policy. 16 C. Other Applicable Federal Law. 64. The Ombudsman also reviewed various non-bankruptcy laws 17,18 in connection 14 See In re Toysmart.com LLC, Case No (Bankr. D. Mass.). 15 See FTC v. Toysmart.com, LLC, Compl., Case No. CV RGS (D. Mass. July 10, 2000), (last viewed Oct. 26, 2016). 16 See, e.g., Letter from David Vladeck, Director of Bureau of Consumer Protection, to Peter Larson & Martin E. Shmagin (July 1, 2010), (last viewed Oct. 26, 2016) (identifying certain permissible criteria for transfer of PII to a new owner). 17 The Ombudsman reviewed the Children s Online Privacy Protection Act of 1998 ( COPPA ) in connection with Lowenstein Sandler LLP 17

20 Case LSS Doc 412 Filed 10/28/16 Page 20 of 25 with her analysis of the Debtors sale and transfer of Customer PII to the Buyers, including Section 5 of the Federal Trade Commission Act (the FTC Act ). 65. The FTC has general authority to issue regulations to implement protections against unfair and deceptive acts and practices. 15 U.S.C. 57A. Section 5 of the Federal Trade Commission Act, 15 U.S.C. 45(a)(1) (the FTC Act ), directs the FTC to prevent persons and corporations from using unfair or deceptive acts or practices in or affecting commerce. 66. The FTC Act defines unfair acts or practices as conduct that: (a) causes substantial consumer injury; (b) is not outweighed by countervailing benefits to consumers or competition; and (c) results in an injury that consumers could not reasonably have avoided. 19 The concept of deceptive acts or practices focuses on whether a misrepresentation or omission is likely to mislead consumers acting reasonably under the circumstances to their detriment. 20 In this instance, the conduct must be: (a) conveyed through either express or implied claims; (b) likely to mislead reasonable consumers; and (c) material. 67. As reflected in the Toysmart (and other matters), the FTC interprets Section 5 of the FTC Act as a prohibition on an entity s collection, use, or disclosure of PII in a manner that is contrary to any promise(s) made to consumers in its privacy policy, including a promise not to its review of the facts and circumstances presented in the Chapter 11 Cases. See 15 U.S.C et seq. COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, or disclosure of PII from, and/or about, children under the age of 13 obtained from the Internet. 15 U.S.C et seq. Based upon her review, the Ombudsman found no information suggesting that the Debtors collected PII from children under the age of 13 on its website or at its Stores. Therefore, COPPA is not applicable here. 18 The Ombudsman also considered The Gramm-Leach-Bliley Act ( GLBA ). See 15 U.S.C et seq. GLBA regulates the privacy of personally identifiable, non-public information disclosed to non-affiliated third parties by financial institutions. The Debtors clearly are not a financial institution, which makes GLBA inapplicable here U.S.C. 45(n); see FTC Policy Statement on Unfairness dated Dec. 17, 1980 (appended to International Harvester Co., 104 F.T.C. 949, 1070 (1984)) available at (last viewed Oct. 26, 2016). 20 See FTC Policy Statement on Deception, appended to Cliffdale Associates, Inc., 103 F.T.C. 110, 174 (1984) available at (last viewed Oct. 25, 2016). Lowenstein Sandler LLP 18

21 Case LSS Doc 412 Filed 10/28/16 Page 21 of 25 share such information with third parties. 68. For example, in response to Facebook Inc. s proposed acquisition of WhatsApp Inc., the FTC noted that a company s failure to keep a promise about privacy constitutes a deceptive practice under Section 5 of the FTC Act. 21 Further, the FTC cautioned that if a company decides to change how it collects, uses and shares data, it should offer consumers an opportunity to opt out of the changes. 69. In the instant matters, Section 5 of the FTC Act would likely prohibit the Debtors from transferring Customer PII to the Buyer. This is because such a transfer is contrary to the Debtors representations in its Privacy Policy (and Earlier Privacy Policy). As a result, such an act could be deemed a deceptive trade practice. 70. The Recommendations proposed herein follow the guidelines established in the Toysmart and subsequent matters. Accordingly, by instituting the Recommendations, the Court will ensure that sale and transfer of Customer PII does not violate applicable nonbankrutpcy law. D. Applicable State Law. 71. Mini FTC Acts. The Debtors operate retail stores across the United States and presumably have customers located in all 50 states and the District of Columbia. Virtually all states and the District of Columbia have adopted their own form of consumer protection statute similar to the FTC Act (which may be referred to as a Mini FTC Act ). 22 Since the Customer 21 Letter from Jessica L. Rich, Director of the Federal Trade Commission Bureau of Consumer Protection, to Erin Egan, Chief Privacy Officer, Facebook, and to Ann Hoge, General Counsel, WhatsApp Inc. dated April 10, 2014, available at (last viewed Oct. 26, 2016). 22 For background, see Albert Norman Shelden State Consumer Protection Laws and Unfair Competition (last viewed Oct. 26, 2016); see, e.g., Alabama, Ala. Code et seq.; California, Cal. Bus. & Prof. Code et seq.; Colorado, Col. Revised Statute (e); Connecticut, Conn. Gen. Stat et seq.; Delaware, Del. Code Ann. tit. 6, 2511 et seq.; Florida, Fla. Stat et seq.; Illinois, 815 Ill. Comp. Stat. Ann. 505/1 et seq.; Indiana, Deceptive Consumer Sales Act, Indiana Code sec (a) and (b)(1); Maryland, Md. Code Ann., Com. Law et seq.; Massachusetts, Mass. Gen. Laws c. 93A, 2(a) and the regulations promulgated Lowenstein Sandler LLP 19

22 Case LSS Doc 412 Filed 10/28/16 Page 22 of 25 Information likely includes PII from consumer located throughout the United States, the Debtors are required to comply with all applicable state consumer protection acts. Although there is some variation among the various state laws; most, if not all, prohibit deceptive representations to consumers. As such, in addition to complying with the FTC Act, the Debtors must also comply with applicable state laws when selling PII. In the instant matters, the analysis of the Debtors proposed sale and transfer of PII under state law would be substantially similar to the analysis of the FTC Act discussed above. 72. Data Disposal Laws. PII is often collected and stored in various formats. For example, although the Debtors collect most Customer data electronically, they also maintain certain paper files related to Customer credit card applications. At least 31 states and territories have enacted laws that require entities to destroy, dispose of, or otherwise make PII unreadable or undecipherable. 23 Moreover, the Federal Trade Commission has issued guidance for employers and others on the appropriate methods of disposing of consumer information In the instant matters, the Buyer has agreed to follow applicable laws with respect to the deletion of data for any Customer who Opts-Out of the transfer. Specifically, the Buyer will use industry standard practices and means to delete data for any Customer who Opts-Out. Moreover, the Debtors have agreed to use industry standard practices and means to destroy thereunder, 940 CMR 3.00 et seq. and 6.00 et seq.; Michigan, Mich. Comp. Laws et seq.; Nevada, Nev. Rev. Stat (5); New York, N.Y. Gen. Bus. Law 349 et seq.; North Carolina, N.C. Gen. Stat ; Ohio, Ohio Rev. Code Ann et seq.; Oregon, Or. Rev. Stat et seq.; Pennsylvania, 73 P.S , et seq.; South Carolina, S.C. Unfair Trade Practices Act, (A), (a), Section (b); Tennessee, T.C.A et seq.; Wisconsin, Wis. Stat See National Conference of State Legislatures, Data Disposals Laws (last updated Jan. 12, 2016), (last viewed Oct. 27, 2016). 24 See Federal Trade Commission Disposing of Consumer Report Information? Rule Tells How (last viewed Oct. 27, 2016). Lowenstein Sandler LLP 20

23 Case LSS Doc 412 Filed 10/28/16 Page 23 of 25 records and otherwise dispose of records and information not transferred to the Buyer. VI. SECTION 332 ANALYSIS 74. Section 332(b) of the Bankruptcy Code provides that the Ombudsman shall provide to the court information to assist the court in its consideration of the facts, circumstances, and conditions of the proposed sale or lease of PII under section 363(b)(1)(B). See 11 U.S.C. 332(b). Among other things, the Ombudsman may present the following information to the Court: the Debtors privacy policy; the potential losses or gains of privacy to consumers if such sale or such lease is approved by the court; the potential costs or benefits to consumers if such sale or such lease is approved by the court; and alternative solutions that might mitigate the privacy impact. Id., 332(b)(1)-(4). 75. Privacy Policy. As reflected above, the Privacy Policy (and the Earlier Privacy Policy) unequivocally state that the Debtors will not transfer Customer s PII. However, Bankruptcy Code section 363(b)(1)(B) provides that this Court may approve a sale in contravention of the Privacy Policy if (a) consent is obtained from each Customer, or (b) this Court finds that applicable non-bankruptcy law will not be violated. The Ombudsman respectfully states that the transfer of Customer PII to the Buyer may be approved if the Court finds that the Buyer is Qualified Purchaser who agrees to abide by the Recommendations provided herein. 76. Privacy Impact on Consumers if the Sale is Approved. The Recommendations set forth in this Report are designed to provide meaningful notice to Customers of the sale of Customer PII to the Buyer. 77. Pursuant to the Opt-Out process outlined in the Recommendations, the Buyer agrees to be bound by the Privacy Policy with respect to Customers. The Buyer also agrees to Lowenstein Sandler LLP 21

24 Case LSS Doc 412 Filed 10/28/16 Page 24 of 25 use Customer PII only in a manner consistent with the Privacy Policy. At such time as the transfer of Customer PII to the Buyer is completed pursuant to the Recommendations set forth herein, the Buyer may initiate a separate process to convert such Customers to its privacy policy. 78. These protections, coupled with other Recommendations contained in this Report, are intended to minimize the impact on Customers if the sale and transfer of Customer Information, including Customer PII, is approved by this Court. 79. Potential Costs or Benefits to Consumers. The Ombudsman understands that the Customer PII will be transferred to the Buyer with the intention it will be used by another retailer in a similar business (namely sales of golf equipment and related goods). Accordingly, it is unlikely that this occurrence will create a negative cost to Customers. In fact, Customers may be disappointed that Debtors are closing and may be pleased to receive information about the Buyer s company. 80. Alternative Solutions. Because of the negotiated terms of the proposed sale and transfer of Customer PII to the Buyer reflected herein, the Ombudsman does not foresee that Customers will experience losses or costs if the sale and transaction are approved by the Court. Accordingly, so long as the Recommendations set forth herein are followed, the Ombudsman does not believe that an alternative to the sale and transfer proposed by the Debtors is necessary or appropriate. Lowenstein Sandler LLP 22

25 Case LSS Doc 412 Filed 10/28/16 Page 25 of 25 VII. CONCLUSION 81. Subject to the forgoing restrictions, the Ombudsman would respectfully recommend that the Court approve the referenced transfer of Customer PII. Dated: October 28, 2016 /s/ Cassandra M. Porter Cassandra M. Porter, CIPP/US Consumer Privacy Ombudsman Lowenstein Sandler LLP 23

26 Case LSS Doc Filed 10/28/16 Page 1 of 4

27 Case LSS Doc Filed 10/28/16 Page 2 of 4

28 Case LSS Doc Filed 10/28/16 Page 3 of 4

29 Case LSS Doc Filed 10/28/16 Page 4 of 4

30 Case LSS Doc Filed 10/28/16 Page 1 of 3

31 Case LSS Doc Filed 10/28/16 Page 2 of 3

32 Case LSS Doc Filed 10/28/16 Page 3 of 3

33 Case LSS Doc Filed 10/28/16 Page 1 of 5

34 Case LSS Doc Filed 10/28/16 Page 2 of 5

35 Case LSS Doc Filed 10/28/16 Page 3 of 5

36 Case LSS Doc Filed 10/28/16 Page 4 of 5

37 Case LSS Doc Filed 10/28/16 Page 5 of 5

38 Case LSS Doc Filed 10/28/16 Page 1 of 7

39 Case LSS Doc Filed 10/28/16 Page 2 of 7

40 Case LSS Doc Filed 10/28/16 Page 3 of 7

41 Case LSS Doc Filed 10/28/16 Page 4 of 7

42 Case LSS Doc Filed 10/28/16 Page 5 of 7

43 Case LSS Doc Filed 10/28/16 Page 6 of 7

44 Case LSS Doc Filed 10/28/16 Page 7 of 7