Case LMI Doc 427 Filed 07/29/15 Page 1 of 53

Transcription

1 Case LMI Doc 427 Filed 07/29/15 Page 1 of 53 UNITED STATES BANKRUPTCY COURT SOUTHERN DISTRICT OF FLORIDA MIAMI DIVISION IN RE: CHAPTER 11 ADINATH CORP. SIMPLY FASHION STORES, LTD. Debtor(s). / CASE NO.: LMI CASE NO.: LMI (Jointly Administered) REPORT OF CONSUMER PRIVACY OMBUDSMAN James P. S. Leshaw Leshaw Law, P.A. 240 Crandon Boulevard, Suite 248 Key Biscayne, FL Telephone: (305) Jim@LeshawLaw.Com

2 Case LMI Doc 427 Filed 07/29/15 Page 2 of 53 TABLE OF CONTENTS RECOMMENDATIONS...1 If Successful Bidder is a "Qualified Buyer...2 If Successful Bidder is Not a "Qualified Buyer...3 BACKGROUND...5 Review of the Debtor s Privacy Policy and Practices...6 PII Collected by the Debtor...7 The Privacy Policies...8 The Dots Data and Privacy Policy...9 Analysis Section 363(b) of the Bankruptcy Code Applicable Non-Bankruptcy Law Federal Law Applicable Non-Bankruptcy Law State Law Consideration of the Facts, Circumstances and Considerations of Sale The Debtor s Privacy Policy Potential Impact on Consumers Alternatives to Mitigate Potential Privacy Losses or Costs to Consumers CONCLUSION i

3 Case LMI Doc 427 Filed 07/29/15 Page 3 of 53 UNITED STATES BANKRUPTCY COURT SOUTHERN DISTRICT OF FLORIDA MIAMI DIVISION IN RE: CHAPTER 11 ADINATH CORP. SIMPLY FASHION STORES, LTD. Debtor(s). / CASE NO.: LMI CASE NO.: LMI (Jointly Administered) REPORT OF CONSUMER PRIVACY OMBUDSMAN James P. S. Leshaw, the duly appointed consumer privacy ombudsman in the above captioned cases ( Ombudsman ), files this report pursuant to section 332(b) and 363(b)(1)(B) of the Bankruptcy Code, 11 U.S.C. 332(b) and 363(b)(1)(B), to assist the Bankruptcy Court in its consideration of the facts and circumstances of the proposed sale of personally identifiable information ( PII ) of customers of Simply Fashion Stores, Ltd. (the Debtor ) pursuant to the Bankruptcy Court s July 24, 2015 Order (I) Approving Bidding And Auction Procedures For Sale Of Intellectual Property, And (II) Setting Sale Hearing Date And Objection Deadlines ( Bid Procedures Order ). RECOMMENDATIONS 1. Based on the Ombudsman s review of the facts and circumstances, and as more fully discussed in this Report, the Ombudsman recommends that the Bankruptcy Court approve the proposed sale and transfer (the Sale ) of the Debtor s customer lists including names, physical addresses, telephone numbers and SMS data (the "Customer Data ), subject to the following recommendations.

4 Case LMI Doc 427 Filed 07/29/15 Page 4 of 53 A. If Successful Bidder is a "Qualified Buyer" 2. If the Bankruptcy Court determined that the Successful Bidder is a Qualified Buyer, 1 the Customer Data may be sold to the Successful Bidder provided that: The scope of the Customer Data to be transferred to the Successful Bidder as part of the Sale is limited to the following data fields: customer contact information including addresses, physical addresses, telephone numbers, SMS data and similar information. The Successful Bidder agrees to (i) become the successor-in-interest under the Web site privacy policy in effect on the Petition Date or on terms that are at least as protective of consumer privacy; (ii) adhere to all material terms of the Privacy Policy; and (iii) be liable for any violation of the Privacy Policy after the closing of the Sale ("Closing ). The Successful Bidder agrees to notify customers of the Sale by: Posting a clear and conspicuous notice on the main page of the simplyfashions.com website for a period of three (3) months from the Closing advising consumers that: (i) the Successful Bidder purchased the Customer Data; (ii) the Successful Bidder is the successor-in-interest under the Privacy Policy; and (iii) consumers have the opportunity to opt-out from receiving communications from the Successful Bidder and be removed from the customer database. Such notice should include a hyperlink and a toll-free number for consumers to effectuate any opt-out request. In its initial customer contact, which shall be within sixty (60) days of the Closing, ing the subset of customers whose addresses are being acquired by the Successful Bidder. Such should clearly and conspicuously advise such customers that: (i) the Successful Bidder purchased the Customer Data; (ii) the Customer Data has been sold and transferred to the Successful Bidder; (iii) the Successful Bidder is the successor-in-interest under the Privacy Policy; and (iv) consumers have the opportunity to opt-out from receiving communications from the Successful Bidder and be removed from the customer database. The notification should contain a hyperlink and toll-free number for customers to effectuate any opt-out. Except for Customer Data that is subject to litigation holds (if any), which Customer Data should be retained by the Debtor through the conclusion of such litigation and thereafter 1 A Qualified Buyer means an entity that: (i) concentrates in the same business and market as Debtor; (ii) expressly agrees to be Debtor s successor-in-interest as to the customer information; (iii) agrees to be responsible for any violation of that policy following the date of purchase; and (iv) agrees not to disclose, sell, or transfer customers PII to any third party in a manner inconsistent with Debtor s Privacy Policy or applicable law.

5 Case LMI Doc 427 Filed 07/29/15 Page 5 of 53 destroyed, the Debtor should (i) destroy or cause to be destroyed within ninety (90) days of the Closing, in a manner consistent with industry standard data security protections and applicable information security laws and best practices, all Customer Data not transferred to the Successful Bidder, and (ii) file a certificate of destruction with the Bankruptcy Court confirming such destruction. The Successful Bidder agrees that, prior to making any material change to the Privacy Policy, including changes to the use or disclosure of PII, the Successful Bidder will, to the extent required by applicable law: (i) provide consumers with notice of the proposed change; (ii) direct consumers to the Successful Bidder's privacy policy; and (iii) provide each consumer with the opportunity to opt-out of the revised privacy policy. The Successful Bidder agrees to safeguard all PII in a manner consistent with industry standard data security protections and applicable information security laws and best practices. The Successful Bidder agrees to destroy all PII for which it determines it has no reasonable business need. The Debtor represents on the record at the hearing on approval of a Sale that the Customer Data does not include any data from the former Dots LLC database. The Successful Bidder agrees to file a notice with the Bankruptcy Court within ninety (90) days after Closing, (i) stating that it is in compliance with the foregoing provisions, and (ii) certifying that it will comply with any ongoing obligations in accordance with these recommendations. B. If Successful Bidder is Not a "Qualified Buyer" 3. If, for any reason, the Bankruptcy Court does not determine that the Successful Bidder is a Qualified Buyer, then the PII should not be sold and transferred to the Successful Bidder unless: The Debtor and the Successful Bidder comply with each of the requirements set forth above as applicable to a sale of the Customer Data to a Qualified Bidder. Before any Customer Data is transferred or otherwise made available to the Successful Bidder, the Debtor notifies customers of the Sale by: Posting a clear and conspicuous notice on the main page of the simplyfashions.com website as soon as is reasonably practicable through the Closing advising consumers that: (i) the Successful Bidder purchased the Customer Data; (ii) the Successful Bidder is the successor-in-interest under the Privacy Policy; and (iii) consumers have the opportunity to opt-out from receiving communications from the Successful Bidder and be 3

6 Case LMI Doc 427 Filed 07/29/15 Page 6 of 53 removed from the customer database before the Customer Data is transferred or otherwise made available to the Successful Bidder. Such notice should include a hyperlink and a toll-free number for consumers to effectuate any opt-out request. ing, as soon as is reasonably possible, the subset of customers whose addresses are proposed to be acquired by the Successful Bidder. Such should clearly and conspicuously advise such customers that: (i) the Successful Bidder purchased the Customer Data; (ii) the Customer Data will be sold and transferred to the Successful Bidder unless the consumer opts-out within fifteen (15) days of the sending of the notification; (iii) the Successful Bidder is the successor-in-interest under the Privacy Policy; and (iv) consumers have the opportunity to opt-out from receiving communications from the Successful Bidder and be removed from the customer database. The notification should contain a hyperlink and tollfree number for customers to effectuate any opt-out. The Debtor agrees to file a notice with the Bankruptcy Court within thirty (30) days after Closing, (i) stating that it is in compliance with the foregoing provisions, and (ii) certifying that it will comply with any ongoing obligations in accordance with these recommendations. 4. In formulating the recommendations contained in this Report, the Ombudsman has worked with representatives of the Debtor, and has reviewed recommendations made in bankruptcy cases with similarly prohibitive privacy policies in which the FTC or attorneys general of various states have taken an active role in negotiating an agreed-upon protocol for the transfer of the debtor s PII. The Ombudsman believes these recommendations adequately address the transfer of the Customer Data in a manner that protects consumers' PII while facilitating the Sale for the benefit of the Debtor's estate and creditors. 5. These recommendations are generally consistent with those made by consumer privacy ombudsmen in other bankruptcy cases who have encountered similar facts a proposed sale of PII that is, or may be, contrary to the terms of the debtor's existing privacy policy. 2 In broad terms, 2 The primary difference between the recommendations contained in this Report and those found in other reports reviewed by the Ombudsman is the recommendation in this Report that, if the Successful Bidder is not a Qualified Buyer, the Debtor be required to give 15 days notice of the potential transfer of PII and an opportunity to opt out before the transfer is actually made. This provision is consistent with the Debtor s Privacy Policy, which permits update of the Debtor s Privacy Policy by posting a notice on the main page of the Debtor s website. In contrast, most 4

7 Case LMI Doc 427 Filed 07/29/15 Page 7 of 53 consumer privacy ombudsmen have recommended, and Bankruptcy Courts have approved, the sale of PII in contravention of a debtor's existing privacy policy; provided that: (i) the sale is made to a Qualified Buyer, (ii) the purchaser is the successor-in-interest to the debtor's privacy policy; and (iii) consumers are afforded notice of the proposed sale and given an opportunity to opt-out of the proposed transfer of PII. As such, the Ombudsman believes the above recommendations are consistent with applicable precedent, including FTC rulings and prior consumer privacy ombudsman recommendations in other bankruptcy cases. The Ombudsman also notes that he was informed by Debtor s counsel that notice of the Sale was served on the FTC and the attorneys general of each state in which the Debtor did business and, as of the filing of this Report, to the best of the knowledge, information and belief of the Ombudsman, neither the FTC for any attorney general has objected to the Sale of the Customer Data or contacted the Debtor to discuss the Sale of the Customer Data. BACKGROUND 6. Until filing its bankruptcy petition on April 16, 2015 ( Petition Date ), the Debtor was primarily a brick and mortar retailer of junior, plus and super plus women s fashion catering to African American women between the ages of 25 and 55. It operated 247 stores in 25 states and employed 1,332 employees. In accordance with orders of the Bankruptcy Court, the Debtor concluded its going out of business sales on June 30, On July 10, 2015, the Debtor filed a motion pursuant to which it sought approval of bidding and auction procedures for the sale of intellectual property, setting sale dates and authorizing the sale of intellectual property ( Bid Procedures Motion ) 4 pursuant to a draft asset purchase agreement attached as an exhibit to the Bid Procedures Motion. The Debtor filed a revised form of consumer privacy ombudsman reports reviewed by the Ombudsman required that consumers affirmatively opt-in to a transfer of their PII before the PII is transferred to a purchaser that is not a Qualified Buyer. 3 Sale Motion (defined below) at 4, 7. 4 D.E. No

8 Case LMI Doc 427 Filed 07/29/15 Page 8 of 53 asset purchase agreement on July 20, 2015 ( Asset Purchase Agreement ). 5 In substance, the Bid Procedures Motion requested the Bankruptcy Court to approve procedures for the sale by the Debtor of, among other things, all rights, title and interest in the data relating to customers of the [Debtor] that relate to the Trademarks that are part of the Acquired Assets, including customer phone numbers, addresses and customer list(s) (e.g., including names and mailing addresses). According to the Bid Procedures Motion, the sale is to be to one or more buyers to be identified (the Successful Bidder ). At the time of filing of this Report, the Successful Bidder has not yet been identified. 8. The Debtor requested that the US Trustee appoint a consumer privacy ombudsman by Motion dated July 13, By separate orders issued July 24, 2015, the Bankruptcy Court (a) directed that the US Trustee appoint a consumer privacy ombudsman 7 and (b) approved the Bidding Procedures attached as an exhibit to the Bid Procedures Motion, determined that the Sales of any personally identifiable information (as that term is defined in section 101(41A) of the Bankruptcy Code) will be subject to the findings and recommendations (collectively, the Findings and Recommendations ) contained in any oral or written report submitted by the consumer privacy ombudsman, and the Debtors and other interested parties reserve the right to contest such Findings and Recommendations The US Trustee filed its Notice of Appointment of Consumer Privacy Ombudsman accompanied by the Verified Acceptance of Appointment as Consumer Privacy Ombudsman of James P. S. Leshaw on July 24, Review of the Debtor s Privacy Policy and Practices 11. In preparing this Report and performing his duties, the Ombudsman has reviewed and relied upon, among other things: 5 D.E. No D.E. No D.E. No D.E. No. 396 at 4. 9 D.E. No

9 Case LMI Doc 427 Filed 07/29/15 Page 9 of 53 a. The website policy in effect on the Debtor s website on the Petition Date ( (the Privacy Policy ) and the predecessor website policy (the Predecessor Privacy Policy ), which was in effect until approximately March, 2014 (available at Copies of the Privacy Policy and the Predecessor Privacy Policy are attached respectively as Exhibits A and B to this Report; b. Order Pursuant to Sections 105 and 363 of the Bankruptcy Code (I)Authorizing the Sale of Certain Intellectual Property Free and Clear of Liens, Claims, Encumbrances and Other Interests, and (II) Granting Related Relief, entered in case no DHS in the United States Bankruptcy Court for the District of New Jersey (D.E. No. 649) (the Dots Order ), which authorized the sale of certain PII of Dots, LLC to New Dots, LLC. A copy of the Dots Order is attached as Exhibit C to this Report; c. Privacy Policy of Dots, LLC, attached as Exhibit 2 to the Dots Order. d. Report of consumer privacy ombudsman appointed in the Dots case, dated May 9, 2014 (D.E. No. 624 in Dots bankruptcy case); e. The Asset Purchase Agreement; f. Telephone interviews with (i) counsel to the Debtor, (ii) Jack Hazan of Hilco IP Services, LLC d/b/a Hilco Streambank, the Debtor s intellectual property consultants and (iii) Judy Reiley, a former employee of the Debtor who is currently working as an independent contractor for the Debtor; g. Selected pleadings and orders filed or issued in connection with the Debtor s bankruptcy case, including pleadings and orders cited to in this Report; h. Research and review of reports of consumer privacy ombudsmen filed in other bankruptcy cases involving sales of PII; and i. Commentary regarding applicable United States federal and state privacy laws and regulations. PII Collected by the Debtor 12. The Ombudsman was informed by representatives of Hilco that the Customer Data includes data collected from more than 150,000 customers, including more than 180,000 addresses and more than 115,000 phone numbers. 13. The Ombudsman was informed by representatives of Hilco that the Customer Data includes only names, physical addresses, telephone numbers and SMS data, and that the Debtor does not retain any payment information (credit card numbers, debit card numbers, checking account information, etc.), dates of birth, social security numbers or other confidential information. 14. The Customer Data was gathered through three principal means: (a) at point of sale 7

10 Case LMI Doc 427 Filed 07/29/15 Page 10 of 53 (registers) in brick and mortar stores when customers voluntarily gave their names, addresses, addresses or phone numbers so they could be included in promotions and marketing; (b) by voluntarily providing names, addresses, addresses or phone numbers through a link on the Simply Fashions website; and (c) through the Debtor s SMS program, which permitted customers to send a text message to Simply Fashions to receive the Debtor s marketing materials. PII to be Sold by the Debtors 15. According to the Asset Purchase Agreement, PII to be sold includes all rights, title and interest in the data relating to customers of the [Debtor] that relate to the Trademarks that are part of the Acquired Assets, including customer phone numbers, addresses and customer list(s) (e.g., including names and mailing addresses). 10 The Ombudsman has been informed that the Customer Data to be sold does not include any transactional data (e.g., the dates of transactions, dollar amount of transactions, SKUs, customer sizes or preferences, etc.), payment information, dates of birth, social security numbers or other confidential information. A. The Debtor s Privacy Policies The Privacy Policies 16. The Debtor had two privacy policies that are substantially identical and do not differ in any material respect. Accordingly, this Section will discuss only the Debtor s Privacy Policy which was in effect on the Petition Date. 17. The Privacy Policy purports to govern all PII gathered by the Debtor, including by electronic means, at point of sale in physical stores and on social media: 11 This Privacy Policy governs the manner in which Simply Fashion collects, uses, maintains and discloses information collected from users (each, a User ) of the website ( Site ) and at In Store Point Of Sale ( POS ) registers or any other means, 10 D.E. No. 408 at 1.1(c). 11 All references in this Section of the Report are to the Privacy Policy in effect on the Petition Date, a copy of which is attached as Exhibit A to this Report. 8

11 Case LMI Doc 427 Filed 07/29/15 Page 11 of 53 including Facebook, Twitter and other social media. This privacy policy applies to the Site, In Store communication and all products and services offered by Simply Fashion. 18. The Privacy Policy states that the Debtor will not sell, trade or rent customer PII: Sharing your personal information: We do not sell, trade, or rent Users personal identification information to others. We may share generic aggregated demographic information not linked to any personal identification information regarding visitors and users with our business partners, trusted affiliates and advertisers for the purposes outlined above. 19. The Privacy Policy states that addresses will be used only to respond to customer inquiries unless a customer opts into the Simply Fashions website in which case the customer may receive various types of marketing s. The Privacy Policy also gives customers the right to opt out of future s: The address Users provide will only be used to respond to their inquiries, and/or other requests or questions. If User decides to opt-in to our mailing list, they will receive s that may include company news, updates, related product or specials information, etc. If at any time the User would like to unsubscribe from receiving future s, we include detailed unsubscribe instructions at the bottom of each The Privacy Policy give the Debtor an absolute right to update the Privacy Policy with no notice to customers other than by posting a notification on its website: Changes to this privacy policy: Simply Fashion has the discretion to update this privacy policy at any time. When we do, we will post a notification on the main page of our Site. We encourage Users to frequently check this page for any changes to stay informed about how we are helping to protect the personal information we collect. You acknowledge and agree that it is your responsibility to review this privacy policy periodically and become aware of modifications. Your acceptance of these terms: By using this Site and/or supplying your information you signify your acceptance of this policy. If you do not agree to this policy, please do not use our Site or provide your information in any other manner. Your continued use of the Site following the posting of changes to this policy will be deemed your acceptance of those changes. B. The Dots Data and Privacy Policy 21. The Ombudsman had been informed that the Customer Data might include data 9

12 Case LMI Doc 427 Filed 07/29/15 Page 12 of 53 purchased from the bankruptcy estate of Dots, LLC. Representatives of the Debtor informed the Ombudsman that the Dots business (including PII) was purchased by an insider of the Debtor rather than by the Debtor, that the Dots data is not property of the Debtor s bankruptcy estate, that the Dots data was never merged with the Debtor s Customer Data and that the Dots data is not part of the Customer Data or the Sale. Accordingly, although the Ombudsman reviewed the order approving the sale of the Dots data, the Dots privacy policy and the report of the consumer privacy ombudsman filed in the Dots bankruptcy case, the Ombudsman does not believe the Dots privacy policy is relevant to the subject of this Report. Analysis A. Section 363(b) of the Bankruptcy Code 22. Section 363(b)(1) of the Bankruptcy Code governs a debtor s use, sale or lease of PII. If the debtor has a privacy policy in effect on the date of the filing of its bankruptcy petition and that privacy policy prohibits the transfer of personally identifiable information [12] about individuals to persons that are not affiliated with the debtor, the debtor may not sell or lease PII unless such sale or lease is consistent with such policy 13 or the court approves the sale or lease after appointment of a 12 Section 101(41A) of the Bankruptcy Code defines personally identifiable information as (A) if provided by an individual to the debtor in connection with obtaining a product or a service from the debtor primarily for personal, family, or household purposes (i) the first name (or initial) and last name of such individual, whether given at birth or time of adoption, or resulting from a lawful change of name; (ii) the geographical address of a physical place of residence of such individual; (iii) an electronic address (including an address) of such individual; (iv) a telephone number dedicated to contacting such individual at such physical place of residence; (v) a social security account number issued to such individual; or (vi) the account number of a credit card issued to such individual; or (B) if identified in connection with 1 or more of the items of information specified in subparagraph (A) (i) a birth date, the number of a certificate of birth or adoption, or a place of birth; or (ii) any other information concerning an identified individual that, if disclosed, will result in contacting or identifying such individual physically or electronically. 13 A tension exists between the language of section 363(b)(1) of the Bankruptcy Code and established principles of data protection or privacy law with respect to the effective date of privacy policies. The Bankruptcy Code identifies as the relevant privacy policy the one in effect on the date of the commencement of the [bankruptcy] case, 13 while privacy law has been interpreted such that the relevant privacy policy is the one in place on the date that the information is 10

13 Case LMI Doc 427 Filed 07/29/15 Page 13 of 53 consumer privacy ombudsman in accordance with section 363(b)(1)(B) of the Bankruptcy Code The Debtor s Privacy Policy explicitly prohibits the sale of the Customer Data. 15 Accordingly, to sell its PII, the Debtor must comply with the provisions of Section 363(b)(1)(B). Section 363(b)(1)(B) permits the sale of PII in violation of a published privacy policy if: (B) after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale or such lease (i) giving due consideration to the facts, circumstances, and conditions of such sale or such lease; and (ii) finding that no showing was made that such sale or such lease would violate applicable nonbankruptcy law. B. Applicable Non-Bankruptcy Law Federal Law 24. The privacy of consumers PII is regulated by the Federal Trade Commission ( FTC ) under the FTC Act, 16 the Children s Online Privacy Protection Act of 1998 ( COPPA ), 17 and the Gramm-Leach-Bliley Act ( GLBA ) The FTC has authority to issue regulations to protect against deceptive and unfair acts and practices. 19 Section 5 of the FTC Act makes unfair or deceptive practices in commerce unlawful. 20 Section 5 is violated when an express or implied claim is likely to affect a consumer s choice of or conduct regarding a product and is likely to mislead reasonable consumers under the collected. See In the Matter of Gateway Learning Corp., Decision and Order (FTC 2004) available at This issue is largely academic where, as here, the Privacy Policy and the Predecessor Privacy Policy are substantially identical U.S.C. 363(b)(1). 15 See Report at USC 45 (2006). 17 By its terms, COPPPA is applicably only to PII of children under 13 years old. Based on information supplied to the Ombudsman, the Debtor is not aware that any of the Customer Data relates to children under 13 years old as the Debtor neither retained customer birthdates nor sold children-sized clothing. Accordingly, this Report will not focus on COPPPA. 18 By its terms, GLBA is applicably only to PII collected by financial institutions. The Debtor is not a financial institution. Accordingly, this Report will not focus on GLBA U.S.C. 57A U.S.C

14 Case LMI Doc 427 Filed 07/29/15 Page 14 of 53 circumstances. 21 In addition, an act or practice may be considered unfair if it causes, or is likely to cause, substantial injury to consumers that is not outweighed by countervailing benefits to consumers or competition and is not reasonably avoidable by consumers. 22 The FTC has explicitly applied section 5 s prohibitions against deceptive acts and practices to corporate privacy statements made on the Internet and elsewhere in multiple consent orders The FTC and bankruptcy courts have recognized that there is a need to balance a consumer s privacy right with the interests of the creditors and estate of a bankrupt debtor. Specifically, in the Toysmart bankruptcy case, 24 the FTC consented to a sale of PII in violation of the debtor s published privacy policy so long as (a) the sale was part of a larger sale of assets that 21 FTC Policy Statement on Deception, appended to Cliffdale Associates, Inc., 103 FTC 110, 174 (1984), available at 22 See generally FTC Policy Statement on Unfairness, appended to International Harvester Co., 104 FTC 949, 1070 (1984) available at 23 See, e.g., United States v. ChoicePoint, Inc., Stipulated Final Judgment and Order (N.D. Ga. 2006) available at (last viewed May 24, 2009); In the Matter of Vision I Properties d/b/a CartManager International, Agreement Containing Consent Order (FTC 2004) available at (last viewed May 24, 2009); In the Matter of Petco Animal Supplies, Inc., Decision and Order (FTC 2005) available at (last viewed May 24, 2009); In the Matter of Gateway Learning Corp., Decision and Order (FTC 2004) available at (last viewed May 24, 2009); In the Matter of Tower Records, Decision and Order (FTC 2004) available at (last viewed May 24, 2009); In the Matter of Guess?, Inc. and Guess.com, Inc., Decision and Order (FTC 2003) available at (last viewed May 24, 2009); In the Matter of Educational Research Center of America, Inc. and Student Marketing Group, Inc., Decision and Order (FTC 2002) available at (last viewed November 13, 2006); In the Matter of the National Research Center for College and University Admissions, Inc., Decision and Order, (FTC 2003) available at (last viewed May 24, 2009); In the Matter of Microsoft Corporation, Decision and Order (FTC 2002) available at (last viewed May 24, 2009); In the Matter of Eli Lilly and Company, Decision and Order (FTC 2002) available at (last viewed May 24, 2009); FTC v. Reverseauction.com, Inc., Decision and Order (FTC 2000) available at (last viewed May 24, 2009); In the Matter of Liberty Financial Co., Decision and Order (FTC 1999) available at (last viewed May 24, 2009); In the Matter of Geocities, Decision and Order (FTC 1999) available at (last viewed May 24, 2009). 24 In re Toysmart.com, LLC, Case No CJK (Bankr. D. Ma 2000) 12

15 Case LMI Doc 427 Filed 07/29/15 Page 15 of 53 included a sale of the debtor s goodwill; (b) the sale was to a Qualified Buyer; (c) the purchaser agreed to be bound by the debtor s privacy policy; (d) the purchaser agreed to be responsible for any violation of the debtor s privacy policy; and (d) prior to making any material change to the debtor s privacy policy, the purchaser obtain affirmative (opt-in) consumer consent. 25 The Toysmart stipulation, a copy of which is attached as Exhibit D to this Report, has become the benchmark for sale of PII in bankruptcy cases and led to enactment of the consumer privacy ombudsman provisions of the Bankruptcy Code. 26 C. Applicable Non-Bankruptcy Law State Law 27. Each state has enacted consumer privacy laws. Those laws are largely consistent with the FTC Act. The Customer Data contains PII for consumers in at least 25 states. If the Sale complies with the FTC transfer requirements and the Recommendations contained in this Report, applicable state laws would also likely be satisfied. Consideration of the Facts, Circumstances and Considerations of Sale 28. Section 332(b) of the Bankruptcy Code requires that the Ombudsman provide information to assist the court in its consideration of the facts, circumstances, and conditions of the proposed sale or lease of personally identifiable information under section 363(b)(1(B) including a. the Debtor s privacy policy; b. the potential losses or gains of privacy to consumers if such sale or such lease is approved by the court; c. the potential costs or benefits to consumers if such sale or such lease is approved by the court; and d. the potential alternatives that would mitigate potential privacy losses or potential costs to consumers. The Debtor s Privacy Policy 25 Notably, the privacy policy at issue in the Toysmart case did not contain a provision such as is contained in the Debtor s Privacy Policy permitting the debtor to update its privacy policy. 26 Avoiding the Privacy Trap Understanding BAPCPA s Consumer Privacy Ombudsman Provisions, available at 13

16 Case LMI Doc 427 Filed 07/29/15 Page 16 of The Debtor s Privacy Policy states that the Debtor will not sell the Customer Data. A bankruptcy court may, however, approve a sale of PII even if the sale violates the applicable privacy policy if the dictates of Sections 332(b) and 363(b)(1)(B) of the Bankruptcy Code are followed and the bankruptcy court finds that applicable non-bankruptcy law has not been violated. 30. Here, the Debtor s Privacy Policy contains an explicit provision authorizing the Debtor to update its privacy policy at any time by posting a notification on the main page of its website. Potential Impact on Consumers 31. The impact on consumers (both in terms of privacy loss and cost) of a sale of the PII will be negligible, particularly if the Sale is to an entity that operates a business in a line similar to the Simply Fashion business and that agrees to abide by the Debtor s Privacy Policy, including providing consumers with an easy opt-out mechanism. Alternatives to Mitigate Potential Privacy Losses or Costs to Consumers 32. The Ombudsman has considered a number of potential alternatives to mitigate potential privacy losses or costs to consumers. Among the factors considered in formulating his recommendations in this Report were (a) the sensitivity of the data collected, (b) the costs and benefits to consumers and the Debtor in requiring affirmative consent to the Sale, (c) the value of PII to the Successful Bidder and (d) the relatively weak nature of the Debtor s privacy policy, which permits update of the Privacy Policy by posting a notice on the main page of the Debtor s website. 33. Most of the data to be sold includes data that is not particularly sensitive in nature and, for the most part, is publicly available (names, addresses, addresses and telephone numbers). The data to be sold does not include more confidential or proprietary information such as credit card numbers, debit card numbers, bank account information, birthdays or Social Security numbers. 34. The cost to the Debtor of requiring affirmative consent to the sale would likely render much of the Customer Data valueless due to the likely very high rate of nonresponse and the cost of 14

17 Case LMI Doc 427 Filed 07/29/15 Page 17 of 53 attempting to obtain affirmative consent. Similarly, the cost to consumers of not requiring affirmative (opt-in) consent is minimal, particularly if the Successful Bidder provides an opt out hyperlink and a toll-free number to permit consumers to easily and seamlessly opt out of receiving notifications. 35. The Debtor s privacy policy is relatively weak in that it permits update at any time by posting a notice on the Debtor s main website page. Accordingly, absent the Debtor s bankruptcy filing, if the Debtor s privacy policy had been updated to permit a sale of PII and consumers were given an opportunity to opt out, the sale of PII would arguably not have violated the Debtor s privacy policy. CONCLUSION 36. The Ombudsman believes that the recommendations in this Report reach a fair balance between the privacy rights of consumers in the interests of the Debtor, its creditors and its estate in maximizing the value of its assets. Dated: July 29, 2015 Respectfully Submitted, James P. S. Leshaw James P. S. Leshaw Consumer Privacy Ombudsman 15

18 Case LMI Doc 427 Filed 07/29/15 Page 18 of 53 TABLE OF EXHIBITS Exhibit A Exhibit B Exhibit C Exhibit D The website policy in effect on the Debtor s website on the Petition Date ( The predecessor website policy (the Predecessor Privacy Policy ), which was in effect until approximately March, 2014 (available at Order Pursuant to Sections 105 and 363 of the Bankruptcy Code (I)Authorizing the Sale of Certain Intellectual Property Free and Clear of Liens, Claims, Encumbrances and Other Interests, and (II) Granting Related Relief, entered in case no DHS in the United States Bankruptcy Court for the District of New Jersey (D.E. No. 649) (the Dots Order ), which authorized the sale of certain PII of Dots, LLC to New Dots, LLC Stipulation and Order Establishing Conditions of Sale of Customer Information, In re Toysmart.com, LLC, Case No CJK (Bankr. D. Ma 2000)

19 Case LMI Doc 427 Filed 07/29/15 Page 19 of 53 EXHIBIT A

20 Case LMI Doc 427 Filed 07/29/15 Page 20 of 53

21 Case LMI Doc 427 Filed 07/29/15 Page 21 of 53

22 Case LMI Doc 427 Filed 07/29/15 Page 22 of 53 EXHIBIT B

23 Case LMI Doc 427 Filed 07/29/15 Page 23 of 53 Simply Fashion Info and Alerts SMS Terms and Conditions The short code is used by Simply Fashion to promote their info and alerts SMS campaign You may opt-in by submitting the keyword SIMPLY to Contact us at You will receive no more than 07 messages per month You may opt-out at anytime by sending STOP to short code For additional information, text HELP to short code Supported carriers are AT&T, U.S. Cellular, Verizon Wireless, Sprint, Virgin Mobile, Cricket, Boost and T-Mobile Message and Data Rates May Apply Powered by Tatango, Inc. Privacy Policy This Privacy Policy governs the manner in which Simply Fashion collects, uses, maintains and discloses information collected from users (each, a User ) of the website ( Site ) and at In Store Point Of Sale ( POS ) registers or any other means, including Facebook, Twitter and other social media. This privacy policy applies to the Site, In Store communication and all products and services offered by Simply Fashion. Personal identification information We may collect personal identification information from Users in a variety of ways, including, but not limited to, when Users visit our site, subscribe to the newsletter, fill out a form, and in connection with other activities, services, features or resources we make available on our Site, as well as at the POS and in communication with Users over the phone and in person. Users may be asked for, as appropriate, address, phone number. Users may, however, visit our Site anonymously. We will collect personal identification information from Users only if they voluntarily submit such information to us either on our Site, In Person, or over the phone. Users can always refuse to supply personally identification information, except that it may prevent them from engaging in certain Site related activities. Non-personal identification information We may collect non-personal identification information about Users whenever they interact with our Site. Non-personal identification information may include the browser name, the type of computer and technical information about Users means of connection to our Site, such as the operating system and the Internet service providers utilized and other similar information. How we use collected information

24 Case LMI Doc 427 Filed 07/29/15 Page 24 of 53 Simply Fashion collects and uses Users personal information for the following purposes: - To improve our Site experience: We continually strive to improve our website offerings based on the information and feedback we receive from you. - To improve customer service: Your information helps us to more effectively respond to your customer service requests and support needs. - To administer a content, promotion, survey or other Site feature - To send Users information they agreed to receive about topics we think will be of interest to them. - To send periodic s or text messages - To promote specials, contest, deals and promotions The address Users provide will only be used to respond to their inquiries, and/or other requests or questions. If User decides to opt-in to our mailing list, they will receive s that may include company news, updates, related product or specials information, etc. If at any time the User would like to unsubscribe from receiving future s, we include detailed unsubscribe instructions at the bottom of each . How we protect your information We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of your personal information, username, password, transaction information and data stored on our Site. Sensitive and private data exchange between the Site, POS and its Users happens over a SSL secured communication channel and is encrypted and protected with digital signatures. Sharing your personal information We do not sell, trade, or rent Users personal identification information to others. We may share generic aggregated demographic information not linked to any personal identification information regarding visitors and users with our business partners, trusted affiliates and advertisers for the purposes outlined above. Changes to this privacy policy Simply Fashion has the discretion to update this privacy policy at any time. When we do, we will post a notification on the main page of our Site. We encourage Users to frequently check this page for any changes to stay informed about how we are helping to protect the personal information we collect. You acknowledge and agree that it is your responsibility to review this privacy policy periodically and become aware of modifications. Your acceptance of these terms By using this Site and/or supplying your information you signify your acceptance of this policy. If you do not agree to this policy, please do not use our Site or provide your information in any

25 Case LMI Doc 427 Filed 07/29/15 Page 25 of 53 other manner. Your continued use of the Site following the posting of changes to this policy will be deemed your acceptance of those changes. Contacting us If you have any questions about this Privacy Policy, the practices of this site, or your dealings with this site, please contact us at: Simply Fashion PO Box 188 Birmingham, AL This document was last updated on March 14, 2012

26 Case LMI Doc 427 Filed 07/29/15 Page 26 of 53 EXHIBIT C

27 Case DHS Case LMI Doc 649 Filed Doc 05/22/ Filed Entered 07/29/15 05/22/14 Page 16:46:13 27 of 53 Desc Main Document Page 1 of 16 UNITED STATES BANKRUPTCY COURT DISTRICT OF NEW JERSEY Caption in compliance with D.N.J. LBR (c) 5/22/2014 LOWENSTEIN SANDLER LLP Kenneth A. Rosen, Esq. John K. Sherwood, Esq. Andrew Behlmann, Esq. 65 Livingston Avenue Roseland, New Jersey Tel: (973) Fax: (973) Counsel to the Debtors and Debtors-in-Possession In re: DOTS, LLC, et al. 1, Debtors. Chapter 11 Case No (DHS) (Jointly Administered) ORDER PURSUANT TO SECTIONS 105 AND 363 OF THE BANKRUPTCY CODE (I) AUTHORIZING THE SALE OF CERTAIN INTELLECTUAL PROPERTY FREE AND CLEAR OF LIENS, CLAIMS, ENCUMBRANCES AND OTHER INTERESTS, AND (II) GRANTING RELATED RELIEF (16), is hereby ORDERED. The relief set forth on the following pages, numbered one (1) through sixteen DATED: 5/22/ The Debtors in these Chapter 11 cases are Dots, LLC, IPC/Dots LLC, and Dots Gift LLC. The last four digits of Dots, LLC s and IPC/Dots LLC s tax identification numbers are (3957) and (8282), respectively.

28 Case DHS Case LMI Doc 649 Filed Doc 05/22/ Filed Entered 07/29/15 05/22/14 Page 16:46:13 28 of 53 Desc Main Document Page 2 of 16 Page 2 of 16 Debtors: Dots, LLC, et al. Case No.: (DHS) Caption: Order Pursuant to Sections 105 and 363 of the Bankruptcy Code (I) Authorizing the Sale of Certain Intellectual Property Free and Clear of Liens, Claims, Encumbrances, and Other Interests, and (II) Granting Related Relief Upon consideration of the motion (the Motion ) of the above-captioned debtors and debtors and possession (the Debtors ) for entry of an order, pursuant to pursuant to 105(a), 332 and 363 of title 11 of the United States Code, 11 U.S.C. 101 et seq. (the Bankruptcy Code ), and Rules 2002, 6004 and 9014 of the Federal Rules of Bankruptcy Procedure (the Bankruptcy Rules ) approving the bidding procedures for the Debtors intellectual property assets, authorizing expense reimbursement to one or more stalking horse bidders, setting the dates for the Auction 2 and the Approval Hearing, and directing the United States Trustee to appoint a CPO, filed on April 8, 2014 (Docket No. 523); and the Court having entered an Order approving the Bidding Procedures portion of the relief requested in the Motion as set forth in the Order Approving IP Sale Bidding Procedures entered on April 21, 2014 (Docket No. 561) (the BPO ); and the Debtors having held the Auction on May 9, 2014; and New Dots LLC (the Purchaser ) having been declared the highest and best offer for the Acquired Assets at the conclusion of the Auction on the terms and conditions set forth in the Asset Purchase Agreement dated May 20, 2014, annexed hereto as Exhibit 1 (the Purchase Agreement ) in accordance with the requirements of the BPO; and it appearing that the relief requested in the Motion is in the best interests of the Debtors estates, their creditors, and other parties-in-interests; and upon the arguments made at the hearing on the sale of the Acquired Assets held on May 20, 2014 (the Sale Hearing ); and due and adequate notice of the Motion having been given under the circumstances; and upon the entire record in these Chapter 11 Cases; and after due deliberation thereon, and good and sufficient cause appearing therefor, it is hereby 2 Capitalized terms not defined herein shall have the meanings provided to them in the Purchase Agreement annexed hereto as Exhibit / v.3 Approved by Judge Donald H. Steckroth May 22, 2014

29 Case DHS Case LMI Doc 649 Filed Doc 05/22/ Filed Entered 07/29/15 05/22/14 Page 16:46:13 29 of 53 Desc Main Document Page 3 of 16 Page 3 of 16 Debtors: Dots, LLC, et al. Case No.: (DHS) Caption: Order Pursuant to Sections 105 and 363 of the Bankruptcy Code (I) Authorizing the Sale of Certain Intellectual Property Free and Clear of Liens, Claims, Encumbrances, and Other Interests, and (II) Granting Related Relief FOUND AND DETERMINED THAT: A. The findings and conclusions set forth herein constitute the Court s findings of fact and conclusions of law pursuant to Bankruptcy Rule 7052, made applicable to this proceeding pursuant to Bankruptcy Rule B. The Court has jurisdiction over the Motion pursuant to 28 U.S.C. 157 and 1334, and this matter is a core proceeding pursuant to 28 U.S.C. 157(b)(2). Venue of these cases and the Motion in this District is proper under 28 U.S.C and C. The statutory predicates for the relief sought in the Motion are sections 105 and 363 of the Bankruptcy Code and Bankruptcy Rules 2002, 6004 and D. Due and adequate notice of the Motion, the proposed Sale, the Sale Hearing, and the subject matter thereof has been provided to all parties-in-interest, and no other or further notice is necessary. A reasonable opportunity to object or be heard with respect to the Motion and the relief requested therein has been afforded to all interested persons and entities. E. The relief requested in the Motion is in the best interests of the Debtors, their estates, creditors and other parties-in-interest. The Debtors have demonstrated good, sufficient, and sound business purposes and justifications for the relief requested in the Motion. F. The Sale was negotiated and proposed in good faith, from arms-length bargaining positions, and without collusion. The Purchaser is a good faith purchaser within the meaning of section 363(m) of the Bankruptcy Code and is entitled to the protection thereof. Neither the Debtors nor the Purchaser has engaged in any conduct that would cause or permit the sale of the Acquired Assets, as defined in the Purchase Agreement, to the Purchaser pursuant thereto and hereto, to be avoided under section 363(n) of the Bankruptcy Code / v.3 Approved by Judge Donald H. Steckroth May 22, 2014

30 Case DHS Case LMI Doc 649 Filed Doc 05/22/ Filed Entered 07/29/15 05/22/14 Page 16:46:13 30 of 53 Desc Main Document Page 4 of 16 Page 4 of 16 Debtors: Dots, LLC, et al. Case No.: (DHS) Caption: Order Pursuant to Sections 105 and 363 of the Bankruptcy Code (I) Authorizing the Sale of Certain Intellectual Property Free and Clear of Liens, Claims, Encumbrances, and Other Interests, and (II) Granting Related Relief G. The consideration provided by the Purchaser to the Debtors for the Acquired Assets (i) is fair and reasonable, (ii) is the highest and best offer for the Acquired Assets, (iii) will provide a greater recovery for the Debtors estate than would be provided by any other available alternative, and (iv) constitutes reasonably equivalent value and fair consideration under the Bankruptcy Code and under the laws of the United States, any state, territory or possession. H. The Debtors (1) have full corporate power and authority to execute the Purchase Agreement and all other documents contemplated thereby, and the sale of the Acquired Assets by the Debtors have been duly and validly authorized by all necessary corporate action of the Debtors; (2) have all of the corporate power and authority necessary to consummate the transactions contemplated by the Purchase Agreement; and (3) have taken all corporate action necessary to authorize and approve the Purchase Agreement and the consummation by the Debtors of the transactions. No consents or approvals are required for the Debtors to consummate the transactions other than the approval of this Court and those set forth in the Purchase Agreement. Neither the execution of the Purchase Agreement nor the consummation of the transactions in accordance with its terms will constitute a violation of any provision of the Debtors organizational documents or any other contract, instrument, law, regulation or ordinance by which the Debtors are bound. I. Debtors are the legal and equitable owners of the Acquired Assets and, upon entry of this Sale Order, they shall have full authority to consummate the transactions contemplated by the Purchase Agreement. The Purchase Agreement and the transactions have been duly and validly authorized by all necessary corporate action, as the case may be, of Debtors / v.3 Approved by Judge Donald H. Steckroth May 22, 2014