Insolvency lawyers and privacy experts say customer names, contact details and transaction records are becoming valuable assets in business bankruptcies and sales.
The Story
A sale connected to Toys “R” Us Canada has highlighted how consumer data can move alongside corporate branding during insolvency proceedings, with experts saying the practice is likely to become more common.
In June, Toys “R” Us Canada announced it was selling its branding to a U.S. firm, but customers were also later told that the purchaser would receive access to their information. The company’s notifications, sent over the summer and fall, said the purchaser—an affiliate of Ad Populum, which also owns Party City and manages the Chia Pet brand and the Elvis Presley attraction Graceland—was being given access to customers’ names, contact and account information, transaction histories and communications with Toys “R” Us Canada.
The notifications did not explain in detail what the purchaser would do with the data, and Ad Populum did not provide specifics on its plans when asked for comment. Next Century, the affiliate tied to the sale, said it will open Toys “R” Us Canada departments within Staples Canada locations starting Nov. 14.
Experts said the Toys “R” Us Canada deal is part of a broader shift in how troubled companies seek buyers for assets. When a company is heavily in debt, sellers often look first to items like leases, inventory, equipment and intellectual property, but consumer data can also be lucrative, particularly because buying customer lists can reduce the need to rebuild an audience from scratch.
Dina Kovacevic, editor of Insolvency Insider, said she views the growing market for data as a significant issue. “I definitely see it as a growing issue and one that will become more and more relevant as different types of information get sold,” Kovacevic said. “Data is the currency. It’s going to get wild out there.”
Privacy counsel Constantine Karbaliotis said consumer awareness in Canada may be lower than in the United States, where consumer groups and policymakers have sometimes intervened when data from insolvent companies is up for sale. “We don’t have that same sort of opportunity for involvement,” Karbaliotis said. “What we have is … after the fact, I can withdraw my consent.”
Chantal Bernier, a lawyer who served as interim privacy commissioner from 2013 to 2014 after spending five years as assistant commissioner, said she remembers only one acquisition involving public “uproar” about data transfers during her work. She described a case involving a luxury business that purchased a rival selling more affordable goods, where customers were concerned that transferring data as part of the sale would increase the likelihood of being targeted for upselling.
Bernier said her client deleted the data for customers who requested it and that it was notable how many people cared about privacy.
Karbaliotis pointed to cross-border examples in the United States to illustrate heightened concern. He referenced Google offering US$10 million for Spirit Airlines data, which reportedly includes 100 million emails and 500 million Microsoft Teams messages, with the company seeking to use the information to train artificial intelligence systems. He also referenced 23andMe’s bankruptcy and the sale of consumer data, noting that multiple U.S. states and the District of Columbia attempted to block the move due to concerns about transferring genetic data without informed consent.
Kovacevic said cases involving sensitive consumer information can make people more attentive to how their data may be used after a business fails. She contrasted ordinary concerns about emails being sold with the fear that genetic information, once transferred, cannot be changed.
For Karbaliotis, the issue underscores a need for consumers to think about what happens if a company is sold or goes bankrupt. “Nobody contemplated the risk of insolvency, but everybody should be thinking, ‘OK, what happens if this company is sold or goes bankrupt? Could it be acquired by somebody who’s, you know, less trustworthy?'” Karbaliotis said. “And how do you remain in control of personal information? Well, don’t give it out.”
← More stories