Multi-state Settlement Reached in Radio Shack Customer Data Row | Practical Law

Multi-state Settlement Reached in Radio Shack Customer Data Row | Practical Law

The Texas Attorney General has announced a multi-state settlement regarding the sale of certain personally identifiable information (PII) in the Radio Shack bankruptcy proceeding that calls for the buyer to destroy most customer data and provides notice and opt-out rights to persons whose information is transferred.

Multi-state Settlement Reached in Radio Shack Customer Data Row

Practical Law Legal Update 7-614-3565 (Approx. 4 pages)

Multi-state Settlement Reached in Radio Shack Customer Data Row

by Practical Law Bankruptcy and Practical Law Intellectual Property & Technology
Published on 22 May 2015 • USA (National/Federal)
The Texas Attorney General has announced a multi-state settlement regarding the sale of certain personally identifiable information (PII) in the Radio Shack bankruptcy proceeding that calls for the buyer to destroy most customer data and provides notice and opt-out rights to persons whose information is transferred.
On May 20, 2015, Texas Attorney General, Ken Paxton, issued a press release announcing that a coalition of 38 state attorneys general have reached a settlement with the buyer in the Radio Shack Chapter 11 bankruptcy proceeding (In re: Radio Shack Corporation, et al., Case No. 15-10197 (Bankr. D. Del)). The settlement was reached through mediation and resolves the objections that the attorneys general filed to Radio Shack's proposed sale of personally identifiable information (PII), which the attorneys general alleged violated the privacy policies under which the company collected the information. The parties to the agreement are Radio Shack, as the debtor-in-possession, the attorneys general and the purchaser of Radio Shack's intellectual property assets (including the PII), General Wireless, Inc. The Consumer Privacy Ombudsman is not a party to the agreement, but participated in the mediation.
According to the mediation term sheet that memorializes the essential terms of the settlement, over the course of many years, Radio Shack collected customer information resulting in a database of approximately 117 million records, including over 170 data categories. Radio Shack had proposed to include approximately 67 million complete customer name and physical address files, including approximately 8.3 million records that included an e-mail address, in the sale of its IP assets. The proposed sale included transaction data.
The parties' settlement calls for limiting the information to be transferred to:
  • Customer e-mail addresses that were active within the two-year period prior to the petition date.
  • The following transaction data fields collected within the five-year period prior to the petition date:
    • store number;
    • ticket date/time;
    • SKU number;
    • SKU description;
    • SKU selling price;
    • tender type; and
    • tender amount.
The transferred PII will remain subject to the existing Radio Shack privacy policy. All data not transferred will be destroyed unless subject to a litigation hold.
According to the terms, Radio Shack will not sell:
  • E-mail addresses that were active more than two years prior to the petition date.
  • Customer telephone numbers.
  • Fourteen transaction data fields previously marked for sale.
  • Any credit or debit card numbers.
  • Any other customer or transaction data not specifically provided for within the terms of allowable sale, including social security numbers and dates of birth.
The agreement further calls for General Wireless to provide notice and opt-out opportunities to persons whose PII is to be transferred. Where e-mail addresses are available for persons whose PII is to be transferred:
  • It must send an e-mail that clearly and conspicuously advises the recipient of the purchase of his information and providing a seven-day opt-out period by toll-free telephone number.
  • The PII attached to that e-mail address may not be transferred if:
    • the e-mail is returned as undeliverable; or
    • the recipient opts out.
  • The PII may only be transferred after the opt-out period expires.
Where the PII does not include an e-mail address, but there is a mailing address, at the time General Wireless makes a postal mailing, it must likewise provide notice of the sale and an opt-out opportunity. The opt-out period is 30 days for postal mailings. If the mailing is returned as undeliverable, then the PII associated with that mailing must be destroyed. The Purchaser must also provide an opt-out option on the Radio Shack website.