Personal data is a valuable corporate asset. At times, the personal information collected from customers (such as email address, mailing address, phone number, etc.) can be a company’s most valuable asset. Unfortunately, when a company attempts to sell this asset, it can find the value of the data significantly diminished due to promises made in a privacy policy the company implemented years before it ever contemplated such a sale.
A company’s privacy policy sets forth the company’s promises to its consumers as to how it will collect, store, maintain, and share the consumers’ personal data. In an attempt to appeal to customer privacy concerns, it is common for a company to proclaim in such policies:
“We share your personal data only in the ways described in this policy,”
or
“We care about our customers and we will never sell or share your personal data.”
Most companies include these statements to highlight their promise not to capitalize on a consumer’s data by selling to third party marketers. However, many companies do not realize that statements such as these could also severely restrict the company’s ability to sell data as a corporate asset in a company sale, merger, bankruptcy, or similar corporate transaction, unless there is also a clear statement within the policy which permits data to be transferred during the course of such events.
There are steps a company can take leading up to the corporate transaction to smooth the transfer of customer data, such as updating its privacy policy, providing additional notice to consumers, requesting opt-out or opt-in consent to the revised policy and/or the data sale. Companies that fail to take these steps and attempt to transfer data in a manner that conflicts with promises made in its privacy policy may face regulatory scrutiny or litigation, both of which would ultimately diminish the value of their data assets in any eventual sale.