Introduction
Celsius Network, a cryptocurrency platform and lender, filed for bankruptcy in 2022.1 Through its course of business, Celsius had acquired the financial data of about 600,000 customers that it planned to include in a bankruptcy asset sale.2 This included information about customer “wallet addresses, transaction histories, crypto holdings, [and] recent transactions.”3 The U.S. Trustee filed a motion for the appointment of a consumer privacy ombudsman to ensure protection of the customer data in an asset sale in accordance with the Bankruptcy Code.4 Celsius pushed back, saying the ombudsman was not necessary because the sale would comply with the preexisting privacy policy;5 the Bankruptcy Code allows appointment when a sale would violate the privacy policy.6 Even though the sale would comply with the Celsius privacy policy, the bankruptcy judge used his discretion to appoint an ombudsman to ensure compliance because he “believe[d] a neutral third party would be helpful” given the amount of data involved.7 In re Celsius Network LLC8 stands out for the U.S. Trustee’s concern for consumers’ data privacy and the judge’s decision to make a discretionary appointment.9
Companies acquire troves of data about their customers throughout the course of the companies’ operations, which raises various privacy concerns. Data is a valuable asset to companies,10 especially when it is personal data that can be used to predict, shape, and monetize consumer behavior.11 This accumulation of data brings with it privacy issues regarding misuse of data, nonconsensual data sales, and unauthorized access.12 Historically, regulators have aimed to protect consumer privacy through tort law and various statutory regimes.13 More recently, comprehensive data privacy legislation has been enacted across the United States and globally,14 including the California Consumer Privacy Act of 201815 and the European Union’s General Data Protection Regulation.16 With this development has come a renewed focus on data privacy in bankruptcy, where a debtor is likely to sell its customer data to pay its debts.17
In 2005, Congress created the ombudsman role to protect consumer data in bankruptcy data sales,18 but it has been ineffective at meeting that goal. There are various hurdles to ombudsman appointments, making it difficult for them to be brought into the process. And the tools ombudsmen do have to protect privacy, such as their reports, fail to produce tailored privacy recommendations. These shortcomings are due to the ombudsman’s tension with bankruptcy policy and the bargaining process. The ombudsman reduces the pool of funds that could go to creditors, introduces inefficiencies in the negotiation process, and has insufficient leverage in the bargaining process. But reforms can help the ombudsman be more effective. To better achieve Congress’s goal, the ombudsman role must be reformed to have more teeth, the U.S. Trustee and judges must be more proactive in seeking ombudsman appointments, and regulators must be more aggressive when enforcing privacy laws in bankruptcy.
This Note proceeds as follows. Part I explains the role of the ombudsman by looking at the statutory framework and what motivated Congress to create the role. Part II discusses the shortcomings of the ombudsman. Part III argues that the ombudsman has not lived up to expectations because it is in tension with bankruptcy policy and the bargaining process. Part IV looks at how consumer privacy in bankruptcy can better be protected going forward.
I. Background
A. Toysmart
The ombudsman emerged primarily in response to the prominent case of Toysmart attempting to sell children’s data in an asset sale.19 In 2000, Toysmart, an e-retailer that sold children’s toys, failed in the dot-com crash.20 Through its operations, Toysmart had collected personal information from website visits, including names, addresses, and children’s birthdays pursuant to its privacy policy.21 In its bankruptcy proceedings, Toysmart tried to sell consumer data — including the children’s information — to the highest bidder, even though its own privacy policy said it would “never” do so.22 The FTC brought a section 5 deceptive practices claim23 against Toysmart and sought injunctive relief to stop the sale of customer data in violation of Toysmart’s own terms of service.24 Ultimately, the action was settled, and the FTC allowed Toysmart to sell the data so long as certain conditions were met.25
B. Congressional Action
In 2005, Congress passed the Bankruptcy Abuse Prevention and Consumer Protection Act26 (BAPCPA), which created the consumer privacy ombudsman to protect consumer privacy in bankruptcy proceedings.27 With the growth of data collection, Congress saw that consumer data was at risk in bankruptcy proceedings because a debtor trying to survive is less likely to prioritize protecting sensitive consumer data. When speaking in support of his amendment to BAPCPA, Senator Patrick Leahy highlighted FTC v. Toysmart.com, LLC28 as an example of why an ombudsman is needed.29 He was alarmed that “the customer lists and databases of failed firms now can be put up for sale in bankruptcy without any privacy considerations.”30 He was hopeful that an ombudsman would “prevent future cases like Toysmart.com.”31 Therefore, the underlying rationale of the role is that requiring a privacy expert to be part of the process guarantees the consideration of consumer privacy interests.32
C. Role Description
An ombudsman must be appointed when a debtor intends to sell personally identifiable data in violation of the promises in its privacy policy.33 Section 363(b)(1) of the Bankruptcy Code provides the statutory requirements for when the ombudsman is appointed.34 Any party can seek appointment of an ombudsman, but “presumably . . . the U.S. Trustee, the court, or a debtor” motions for it.35 The bankruptcy judge retains discretion to appoint an ombudsman even when there is no violation of a privacy policy.36 Moreover, the ombudsman must be appointed at least seven days before a hearing approving the data sale.37
Once appointed, the ombudsman creates a report that often considers the conditions placed on the Toysmart sale.38 The ombudsman must investigate and inform the bankruptcy court about the debtor’s privacy policy, possible “losses or gains of privacy to consumers if [the] sale is . . . approved,” and suggested mitigations for “potential privacy losses . . . to consumers.”39 These considerations do not include any possible loss in value of the data.40 The ombudsman might also be able to give their opinion on whether the sale would violate any applicable nonbankruptcy laws.41 The court then considers this information and determines whether to approve the sale with any of the suggested conditions.42 After submitting their report, the ombudsman submits a fee application for their work.43 Upon court approval, the costs of the ombudsman and any professionals they hire come out of the estate.44
Consumer privacy ombudsmen tend to come from a small pool of privacy professionals. A recent dataset shows that there are about thirty-three ombudsmen, and the top seven most frequently appointed account for about two-thirds of cases where ombudsmen are appointed.45 Several of them have a privacy certification called the Certified Information Privacy Professional (CIPP/US) qualification, and the top seven are all attorneys.46 Some of these top ombudsmen have their own practices specializing in data privacy.47
II. The Ombudsman in Practice
In practice, the ombudsman struggles to ensure consumer privacy is a primary consideration in bankruptcy data sales. Two hurdles that hinder this goal are that (1) the ombudsman has difficulty getting appointed and (2) the ombudsman report does not meaningfully protect consumer privacy.
A. Hurdles to Appointment
Ombudsmen are reliant on other parties to be appointed. “[T]he U.S. Trustee, the bankruptcy court, or some other regulator or interested party can seek the appointment of an ombud[sman],”48 meaning they are not appointed automatically and do not have standing to move to be appointed of their own accord.49 However, consumers are unlikely to come forward and notify a regulator, judge, or trustee about a privacy violation because the individualized harm is not enough to motivate them.50 Debtors and creditors may want to avoid reducing the size of the estate, and an ombudsman reduces that pot.51 They also may not want to risk any delays in the sale process, which an ombudsman could extend.52 This leaves the U.S. Trustee and the bankruptcy court. But the Trustee has many other responsibilities and might not notice that privacy interests are of concern in a particular proceeding,53 suggesting that the U.S. Trustee is not monitoring as actively for privacy violations as they may be for other abuses. Therefore, the ombudsman relies on parties who are not prioritizing privacy interests in order to be appointed.
Debtors engage in an array of practices to avoid the appointment of an ombudsman. Debtors proactively add terms containing consumer-protective language in data asset sales,54 submit privacy reports by privacy experts and former ombudsmen at the time of filing a sale motion,55 and include boilerplate language about consumer data in sales motions.56 Essentially, debtors try to get the work of the ombudsman done before filing. While these approaches to avoiding ombudsmen have “streamlin[ed] a process that was already mostly theatrical,”57 they remove the ombudsman from the process in which Congress intended ombudsman participation.
Debtor actions to avoid appointment make it less likely that consumer privacy will be prioritized in bankruptcy. Congress intended for the ombudsman to be the one checking for any privacy issues precisely because Congress was distrustful of debtors who were abusing the process and selling data in violation of their privacy policies.58 While some of the debtor actions do help alleviate the concern for potential abuse by promoting consumer-protective language, these actions only give the illusion that the debtor is looking out for consumer privacy. An ombudsman hired by the debtor for this purpose is not a neutral party like a court-appointed ombudsman. A debtor-hired ombudsman’s job is to convince the court that there are no privacy concerns to worry about in the sale. A court-appointed ombudsman would not be concerned with tailoring their report to a debtor’s interests because they are not hired by that debtor.
B. Ombudsman Reports
When ombudsmen are appointed, their reports are often boilerplate summaries of privacy laws and commonly known mitigations.59 Rather than including material unique to the case, many ombudsmen rely on block quotes from the debtors’ privacy policies and other legal authorities, and much of the rest is “cop[ied] and paste[d]” summaries from prior reports.60 Typically, the suggested mitigations include the conditions from Toysmart instead of tailored recommendations.61 Copying from prior reports is not necessarily bad in itself; much of legal practice involves building off a template. But these reports could more thoroughly address privacy concerns.
The ombudsman report from In re Chrysler LLC62 shows some of these shortcomings. The Chrysler report focused primarily on compliance with the existing privacy policy and providing notice to consumers so they can opt out of marketing,63 which are Toysmart mitigations.64 Chrysler had one of the fastest bankruptcies in history,65 which could explain why the ombudsman did not further develop their mitigation analysis beyond what was discussed in Toysmart; it is possible they did not have time to write a thorough report.66 The ombudsman report from In re General Motors Corp.67 — submitted about a month after the same ombudsman submitted the Chrysler report — reproduced various portions of the Chrysler report.68 The practice of copying prior report language leaves open the possibility of subsequent reports having similar oversights. Even though speed is generally prioritized in bankruptcies,69 the congressional purpose to prioritize privacy should not be sacrificed as a result.
The Celsius ombudsman provides an example of a well-tailored report that still relies on Toysmart considerations and summarizes existing data privacy laws. In the eighty-six-page report, the ombudsman recommended the purchaser of the customer data be in the same line of business as the debtor, use data for the same purpose the debtor used it for, and comply with an appropriate Celsius data privacy policy — all of which were conditions imposed in the Toysmart data sale.70 A significant portion of the report summarized various data privacy laws.71 However, the report also thoroughly explained what kinds of risks a data sale would pose to Celsius consumers.72 To mitigate these risks, it considered mitigations that were unique to the consumers who had their data exposed in the Celsius data leak,73 suggested that certain inactive accounts not be included in the sale,74 and recommended that the purchaser agree to industry-standard security controls.75 Even though reports are not binding, judges have discretion to include any conditions on the sale, and debtors can also agree to conditions if they find them reasonable.76
While Celsius serves as a potential model for structuring a robust report, deficiencies result in ineffective protections of consumer privacy. The purpose of the ombudsman is to evaluate whether a data sale in a specific case raises any privacy concerns and then to propose mitigations for those specific concerns. The report is the only tool an ombudsman has to advocate for privacy interests, so these reports should be more thorough and tailored. While it may be the case that certain mitigations are industry standard and would appear across reports, it is an ineffective exercise to simply templatize these reports.
III. Bankruptcy’s Tension with the Ombudsman
In many ways, the ombudsman role was hindered from the start because Congress did not adequately account for the realities of the bankruptcy process when it created the role. The difficulties in appointment and ineffective reports can be explained by looking at bankruptcy policy and the bargaining process. Considering how bankruptcy functions in practice also provides guidance for reforming the role.
A. Bankruptcy Policy
Analyzing the ombudsman role requires understanding bankruptcy policy. Three policy goals of bankruptcy77 that are implicated by the ombudsman are the preservation of a debtor’s value, the possibility of a fresh start, and procedural efficiency.78 Ultimately, the ombudsman role is in tension with these three policy goals, which helps explain its shortcomings.
1. Preserving Value. — First, bankruptcy is meant to provide parties with a process that preserves the value of the debtor’s assets. Bankruptcy courts aim “to ensure that [the] patient doesn’t die on the operating table.”79 When a distressed corporation enters a Chapter 11 reorganization, it is already in a precarious position. Upon filing a petition for Chapter 11, a debtor has 180 days for its reorganization plan to be accepted, and if that time elapses, a creditor can propose a plan.80 The longer the process drags on, the more a debtor risks not surviving after bankruptcy because of the added costs. With more costs, corporation value will decrease, thereby shrinking the estate that would be distributed to creditors.
The ombudsman decreases the pool of funds that goes to creditors. For a debtor trying to survive bankruptcy, any additional costs effectively decrease what could be distributed to a creditor. In a dataset of every bankruptcy case where an ombudsman was appointed since BAPCPA was passed in 2005 to mid-2020, median total fees of ombudsmen were $13,876.04 and mean total fees were $23,761.63.81 The ombudsman fees for more high-profile cases can exceed $100,000.82 For example, the ombudsman in the Celsius bankruptcy charged about $127,000 for her services from late October 2022 through the end of June 2023.83 These fees do not include any additional costs associated with bankruptcy attorneys’ having to respond to the ombudsman and potentially challenging the ombudsman’s appointment, costs which can exceed $1,000 an hour.84 Unsurprisingly, creditors are concerned about how the financial cost of an ombudsman will impact the estate.
In addition to the direct costs of an ombudsman, their recommendations can also create an encumbrance on a debtor’s property. The suggestions in an ombudsman’s report can limit how data assets are sold. This can decrease the value of the data, making it less attractive to potential buyers. And in making their proposals, the ombudsman is not statutorily required to consider potential decreases in the value of the data.85 This is especially concerning for a debtor because data can be its “most valuable asset[].”86
In the Borders bankruptcy, In re Borders Group, Inc.,87 the ombudsman made a proposal that a buyer argued would decrease the value of Borders’s data. When Borders, a now-defunct multinational book retailer, planned to sell its customer data to Barnes & Noble, the consumer privacy ombudsman suggested that Barnes & Noble obtain opt-in consent from customers before certain data could be transferred to Barnes & Noble.88 This suggestion was meant to address the fact that Borders’s privacy policy did not stipulate that it could transfer or sell consumer data in a bankruptcy.89 Barnes & Noble opposed that and other suggestions by the ombudsman, saying the suggestions “would destroy the value of the transaction.”90 It explained that Borders would have to reach out to its customers to ask for opt-in consent, which customers would simply not reply to,91 “thereby materially reducing the value of the acquisition.”92 This suggestion was meant to protect consumer privacy, but it had the effect of reducing the perceived value of the data to the buyer. Ultimately, a debtor or buyer can challenge these conditions,93 but it is up to the judge whether they will impose any of the ombudsman’s suggestions.94
Because of these costs, debtors are incentivized to take steps to avoid and challenge the appointment of an ombudsman. A debtor can avoid ombudsman costs by frontloading some of the work that an ombudsman would do before the debtor files for bankruptcy.95 The minimal cost of including some boilerplate language stating that the privacy policy is not violated in a bankruptcy petition can help debtors avoid paying ombudsman and associated attorney’s fees. Similarly, a common argument for debtors, like Celsius, is to say they do not need an ombudsman because they will sell data in compliance with their privacy policy.96 This way, the onus is on the Trustee to file a motion seeking appointment,97 or on the court to initiate appointment, which may not happen.98 Therefore, a debtor’s actions to prevent appointment help preserve the value of the estate by ensuring the pool does not shrink.
2. Fresh Start. — Second, bankruptcy aims to give debtors a “fresh start” so that they can emerge from bankruptcy.99 One advantage of bankruptcy is that a debtor can discharge its debts, and that discharge “lies at the heart of bankruptcy policy.”100 Once the bankruptcy court gives approval of a sale or reorganization plan, discharge can be granted.101 This “fresh start” policy goal harkens back to the Bankruptcy Act of 1898,102 the predecessor to the modern Bankruptcy Code.103 This goal was implemented in the modern Bankruptcy Code by providing ways for debtors to “preserve a pool of property” they could keep after the bankruptcy.104
The ombudsman makes it harder for a debtor to discharge its debts by adding complexity and placing restrictions on data transfers. Customer data is important in determining a debtor’s value because it is part of the debtor’s assets. But the ombudsman is not concerned with facilitating the discharge of existing debts or maximizing the debtor’s assets. Rather, they are concerned with maintaining a certain level of data protection during and after the bankruptcy proceeding. The ombudsman aims to maintain the level of data protection that consumers have under the debtor’s existing privacy policy. That likely creates an incentive for their reports to ensure that whatever privacy protections were in place before bankruptcy stay the same in any sale. But requiring a debtor to ensure that its past privacy protections are maintained in the future makes it harder to sell that data.
In re Borders again helps showcase this problem. As an alternative to collecting opt-in consent for certain data, the ombudsman recommended that Barnes & Noble comply with the privacy policy that was in effect at the time Borders collected the data.105 Barnes & Noble argued that the practical effect of this was that it would have to maintain two privacy policies, one for the debtor’s customers and one for its own customers.106 This would not be “commercially practical” according to Barnes & Noble.107 Maintaining privacy policies “at the individual transaction level would be administratively difficult” and would confuse consumers about what privacy policy applies to them, especially because certain consumers were customers of both Borders and Barnes & Noble.108 While the ombudsman’s recommendation was intended to protect consumer privacy, the recommendation would impede the ability of Borders to discharge its debt because of the practical difficulties of implementation. A debtor or buyer would have to agree to these conditions in order for the court to grant a discharge, which seems unlikely given Barnes & Noble’s concerns. Even when the ombudsman is attempting to protect consumer privacy, this aim may be in tension with the policy goal of giving debtors a fresh start, as it adds a roadblock to a debtor’s ability to discharge debts. While the judge ultimately has discretion in imposing the conditions, judges in practice defer to the ombudsman.109 The debtor or buyer then would have to convince the judge that they should approve the sale despite these restrictions. This is likely to be difficult if the ombudsman identified concerns with the sale. The upshot of this is that it gives debtors an incentive to oppose appointment of an ombudsman.
3. Procedural Efficiency. — Third, bankruptcy policy prioritizes efficiency. Bankruptcy is about facilitating a bargain between debtors and creditors.110 The Bankruptcy Code does this by placing guardrails around parties so that they bargain without holding up the process.111 For example, the automatic stay, which is triggered upon a bankruptcy filing, “halt[s] all efforts to seek repayment from the debtor.”112 That stay funnels all claims against the debtor into the bankruptcy process and prevents claimants from racing to the courthouse before the estate runs out.113 Some bankruptcy judges also facilitate an efficient process by interpreting the Code in ways that help achieve the purpose of reaching a deal over strict adherence.114 Until recently,115 for nearly forty years, many bankruptcy courts interpreted the Code to allow debtors to discharge creditors’ claims against a nondebtor without the consent of those impacted claimants even though this was not explicitly authorized by the text.116 This allowed courts to efficiently discharge mass tort claims.117 These examples show that parties and courts favor the parties reaching an agreement, and that is no different in the context of an ombudsman.118
The ombudsman’s role extends the bankruptcy process. In Professor Christopher Bradley’s dataset, an ombudsman spent a median of 29.55 hours and a mean of 49.01 hours.119 But larger cases can exceed those numbers; the Celsius bankruptcy ombudsman spent about 230 hours on the matter from late October 2022 through the end of June 2023.120 These data points do not include any time the parties spent responding to ombudsman requests. Bankruptcy has features like the automatic stay that try to ensure an orderly process, but the ombudsman adds more steps in the process. The Code requires an appointment of an ombudsman “not later than 7 days before” a hearing to approve the sale of personally identifiable information.121 When the ombudsman issues their report, the debtor and buyer will have to take time to respond and object to any of the proposed conditions. Because a judge may defer to a privacy expert, debtors may fear that an ombudsman could hold up the process with their requirements. This perceived time burden is problematic for a “modern bankruptcy process [that] is . . . speedy[ and] relatively efficient,”122 and it helps explain why debtors try to streamline the handling of privacy issues.
Moreover, the ombudsman potentially hinders the ability of the debtor and creditors to reach an agreement. The consumers whom the ombudsman represents do not have a financial stake in the bargaining process between debtors and creditors who are trying to settle debts.123 The ombudsman is not at the bargaining table by default; they have to be brought in by a judge or requested by another party in the proceeding.124 While creditors and debtors are already at the bargaining table, neither has any incentive to bring in another party to bargain who may throw a wrench in the plans of the parties. That is likely why many debtors simply include template verbiage to preemptively show why an ombudsman is not needed.125 In the process of getting an ombudsman appointed, if the parties disagree about ombudsman appointments, they have to spend time filing motions and responses, and then, once one is appointed, bring an ombudsman into an already fast-moving process and get them up to speed. So, it is easier for debtors and creditors to wait for the U.S. Trustee or judge to move for the appointment of an ombudsman and then oppose it as burdensome. Bankruptcy is meant to provide parties with bargaining options, but ombudsmen decrease the room for bargaining. And when the bargaining process is complicated, it decreases the likelihood of reaching an agreement.126
B. The Bargaining Process
The ombudsman is not well positioned to protect consumer interests in the bankruptcy process because of (1) the adversarial nature of proceedings127 and (2) the ombudsman’s disadvantage in resources128 and bargaining leverage compared to debtors and creditors.
1. Adversarial System. — Bankruptcy includes several adversarial proceedings that are similar to those in civil cases.129 The adversarial system ideally makes it so that each party highlights key issues that are important to them. But debtors and creditors only represent their own interests; they do not represent the best interests of absent stakeholders, like consumers.130 That is why there are parties like the U.S. Trustee and the ombudsman to ensure that additional interests are taken into consideration.131
The ombudsman’s position as a neutral party makes it difficult to protect consumers in adversarial proceedings. The ombudsman may not have the tools that the parties have to represent their interests. For example, ombudsmen do not meet with consumers to seek approval for the proposed data asset sale.132 They also do not have standing to proactively move to be appointed.133 It therefore may not be possible for an ombudsman to effectively address the privacy interests of consumers. Debtors and creditors, on the other hand, typically have well-funded attorneys who meet with them and represent their interests.134
2. Resources and Leverage. — Debtors and large creditors can have outsized influence on the outcome of a proceeding based on how well-funded they are and on the amount of bargaining leverage they have. The ombudsman, on the other hand, does not have the same level of resources and leverage that many parties have.
In many cases the consumer privacy ombudsman is an attorney, but they are oftentimes interacting with parties who are represented by law firms with sophisticated restructuring practices.135 The top ombudsmen are typically sole or small-firm practitioners and may have to conduct an investigation into the debtor’s privacy practice on their own.136 Meanwhile, debtors and creditors are represented by restructuring firms with large amounts of staffing resources.137 This imbalance likely explains why most of the ombudsman reports are short and boilerplate.138 Ombudsmen may not have the time or resources to be able to fully develop a report with tailored recommendations. Moreover, the ombudsman is aware that their fees are coming out of the estate139 so they may be inclined to avoid such high fees. After all, they want to be appointed again in future cases.140 Developing a reputation for high fees and prolonging the process would be an easy way for them to stop being appointed. But these resource constraints mean the ombudsman is not able to fully focus on prioritizing the consumer’s interests.141
Ombudsmen do not have leverage to mandate their recommendations. First, the report recommendations are not binding on the debtor.142 Moreover, even if the ombudsman’s recommendations are accepted, the ombudsman cannot ensure compliance going forward.143 If a buyer ends up violating the conditions, a regulator would have to step in to enforce the sale conditions. While the FTC has intervened occasionally in the bankruptcy process,144 it does not publicize that it actively monitors compliance with data-sale conditions after the sale.145 This means that the ombudsman lacks teeth to enforce the privacy measures they propose, making them less effective.
IV. Protecting Consumer Privacy Going Forward
Together, Parts II and III show that the ombudsman as currently designed is not able to adequately protect consumer interests. To better prioritize consumer privacy in bankruptcy proceedings, (1) the ombudsman role should be given more teeth to better protect consumers, (2) the U.S. Trustee and judges should be more proactive in seeking ombudsman appointments to protect consumers, and (3) regulators should leverage federal and state consumer protection laws to intervene in the bankruptcy process. These changes would help make the ombudsman more effective at protecting consumer privacy.
A. Reforming the Role
The role of the U.S. Trustee is quite different from that of the ombudsman. The Trustee “serves as an independent guardian . . . of systemic integrity” to ensure compliance with the Code.146 As a watchdog of the executive branch, the Trustee looks out for the interests of all parties in bankruptcy and, in particular, tries to “ensure that business restructurings do not fall victim to abuse.”147 This mandate is much broader than that of the ombudsman, resulting in the Trustee being “involved in [nearly] every” aspect of the bankruptcy process and “interact[ing] with . . . every party involved.”148 But unlike other neutral parties such as the ombudsman, the “U.S. Trustee is automatically appointed in most bankruptcies,” and “[i]f there is sufficient interest among unsecured creditors, . . . the U.S. Trustee [must] form a committee of [those] unsecured creditors to act on their behalf.”149 In Harrington v. Purdue Pharma L.P.,150 the Trustee urged the Supreme Court to set aside the six-billion-dollar settlement because the broad liability releases for the Sackler family were not authorized by the Code.151 The Trustee was “the only major party . . . opposed” to the settlement.152 In addition to their higher appointment frequency, Trustees have certain tools available to them. Specifically, they have standing: the “ability to appear and be heard on matters relating to any issue in a case or proceeding under the Bankruptcy Code.”153 “Without standing, the watchdog is toothless . . . .”154 This power gives the Trustee the ability to request an examiner or ombudsman. Further, while “[a]n individual creditor may not have sufficient resources . . . to enter a notice of appearance, draft and file an objection, or argue at a hearing,” Trustees often do.155 Thus, many have come to view “the Trustee as a valuable part of the bankruptcy system.”156 But the Trustee also has a heavy workload and cannot oversee everything, which is why it is important to give the ombudsman role more power.
Like the Trustee, the ombudsman should be given standing to intervene in cases. Instead of being brought into the process, ombudsmen should have access to a Trustee-created watchdog program where ombudsmen can flag bankruptcies with a heightened privacy risk and should be able to move for appointment. Standing would allow the ombudsman to better contribute to the adversarial setting of bankruptcy proceedings because they could object to motions. Moreover, the ability to appear before the court before they are appointed would allow the ombudsman to avoid delays by beginning their investigation earlier in the process rather than waiting until appointment.
Ombudsman reports should also be more tailored and be given more deference. The In re Celsius ombudsman report shows how a report can better tailor its recommendations to a specific data sale.157 The ombudsman should be required to provide a detailed analysis about the risks the consumers face. Currently, these reports are overly templatized to the point of not adequately evaluating specific risks.158 Moreover, the reports should be given more weight. When an ombudsman does make recommendations, judges should defer to the expertise of the privacy expert. To ensure this happens, bankruptcy judges should adopt a strong presumption that the recommended sale conditions should be met, and there must be some reason to overcome that presumption. Moreover, the ombudsman should be able to audit buyers after the sale to ensure that privacy conditions are being met. These changes can be implemented through an amendment to the Code that provides more prescriptive reporting requirements and considerations for judges to weigh when deferring to ombudsmen. These reforms would help meet Congress’s goal of ensuring privacy risks are better considered in sales.
B. Proactive Appointments
The U.S. Trustee should be more proactive in seeking the appointment of ombudsmen. Given that many companies that go through bankruptcy are likely to have customer data, an ombudsman should be involved whenever consumer data is for sale. One way to address this is for U.S. Trustees to appoint ombudsmen more often and for judges to use their discretion to approve appointments even when there is no clear privacy violation.
Trustees should also be more vigilant of privacy abuses. The Trustee in In re Celsius became aware of the potential privacy implications because of a high-profile data leak.159 But other cases with less publicity are likely to fly under the radar of the Trustee. The U.S. Trustee should dedicate more resources to overseeing privacy abuses in bankruptcy. As a starting point, the U.S. Trustee can begin seeking a default ombudsman appointment whenever consumer data is involved to help bypass debtor efforts to avoid appointment.160
Judges should also use their discretion to approve appointments even when it is not clear that there is a violation of privacy policies. Section 363(b)(1) lists conditions for when an ombudsman must be appointed, but the judge has discretion when the conditions are not met.161 In re Celsius stands out in that the judge used his discretion to appoint an ombudsman even though the sale did not violate the seller’s privacy policy.162 The judge was likely being cautious because of the type of data involved and the publicity around it. Celsius made headlines when it filed for bankruptcy because it came out that the company had leaked consumer data about transaction history,163 and someone then used that data to create and disseminate a searchable database.164 This public attention over privacy concerns was likely a factor in the judge’s decision to appoint the ombudsman. In re Celsius teaches us that judges should err on the side of appointment, especially when customer data has been compromised.
C. Federal and State Enforcement
Federal and state governments can help solve the resource and leverage constraints that ombudsmen face. These regulators should more actively enforce consumer protection laws to put pressure on debtors. The primary reason why the ombudsman role was created was in response to the FTC’s involvement in the Toysmart bankruptcy.165 Since then, “the FTC and state regulators can and do intervene on occasion, but in the main run of cases, they do not.”166 And when these regulators have intervened, they have tended to be more protransaction minded.167 Recently, the FTC has shown that it can be more proactive in regulating consumer privacy.168 Doing so in the bankruptcy context would better protect consumer privacy.
The FTC relies on section 5 of the Federal Trade Commission Act of 1914169 to bring unfair and deceptive practices claims.170 The FTC has recently issued guidance that “[i]t may be unfair or deceptive . . . to start sharing consumers’ data with third parties or using that data for AI training — and to only inform consumers of this change through a surreptitious, retroactive amendment to its terms of service or privacy policy.”171 Similar arguments can be made regarding data sales in bankruptcy. For example, even when a privacy policy or terms of service says that data may be sold in bankruptcy, it does not mean that it is acceptable for a buyer to use the data in a way the consumer did not expect. If a buyer ends up using the data in a way that is not consistent with the original purpose, the FTC should bring a claim against the buyer. This could help address the ombudsman’s inability to ensure compliance after the sale.
When the FTC gets involved, it brings with it additional knowledge and resources that can help an ombudsman face the superior resources of a restructuring law firm. Regulators give the ombudsman leverage because they can put a stop to the sale with their enforcement authority, which the ombudsman does not have the authority to do. They can also bring civil penalties for misuses of data and violations of privacy policies, which the ombudsman cannot do.172 Likewise, the FTC is staffed with privacy experts who can provide additional resources so that the ombudsman can produce a more thorough report.173 If regulators were to work more closely with the ombudsman, it would place pressure on debtors to agree to the sale conditions, thereby giving the ombudsman some leverage in the process.
State attorneys general increasingly have tools to help in bankruptcy as well. The California Consumer Privacy Act, for example, gives the California Attorney General enforcement authority.174 The statute empowers consumers to opt out of data sales and requires that “[a] business’ collection, use, retention, and sharing of a consumer’s personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected.”175 Intentional and unintentional violations can result in steep penalties of $7,500 and $2,500, respectively.176 State attorneys general with these statutes can, similar to the FTC, work with the ombudsman and provide additional personnel in investigating data practices and may be able to enforce sale conditions if it is established that data sales constitute a violation of the state statutes.
Conclusion
The bankruptcy consumer privacy ombudsman was well-intentioned but flawed by design. The ombudsman is in tension with several features of bankruptcy, including policy goals and the bargaining process. Solutions or extensions of the role177 that do not grapple with the underlying bankruptcy policy are likely to be misguided. While ombudsmen are still better than nothing, reforms are needed to address the role’s weaknesses so that it can better protect data privacy in the bankruptcy process. With the momentum of recent state privacy legislation, now is the time to make these reforms.