RadioShack Sold Consumer Data to Pay Off Its Debts

http://www.slate.com/blogs/moneybox/2015/05/18/ftc_radioshack_consumer_privacy_letter_court_should_protect_people_s_data.html

by wglb • 11 years ago

299 147 11 years ago

slate.com

carlmcqueen2• 11 years ago

I can't say this is a big surprise. My first job was at a chicagoland radioshack so I have followed their news and watched their fall with mixed feelings.

It felt very odd in 2001 to try and sell electricians that would come in the store at opening to buy 10-11 fuses if they wanted a cell phone, and bother people just getting batteries for their first and last name so they could 'return their item'. We got dinged for each person who refused us. So there is potentially a LOT of data this company is getting.

crusso2• 11 years ago

You just triggered my earliest Radio Shack memories of being annoyed at a company for asking for my personal information when making small purchases.

Radio Shack was definitely in the vanguard of data collection.

konsptheory• 11 years ago

These occasions are never-miss for my alter egos to shine through and dazzle my interlocutors :)

waterlesscloud• 11 years ago

Indeed. They were the first company I ever gave a fake name to.

JoeAltmaier3• 11 years ago

The last CEO cancelled that policy as their first act. So for some years, that data was not collected. I wonder what data they had to sell?

Anyway, this is a warning to all of us. No matter what promises that honest startup gives you, the minute they are sold (and most sell in the end) the new owners are free to do whatever they like with your 'private' information. In fact it will be hawked in the marketplace like a chicken.

claudius2• 11 years ago

Anyway, this is a warning to all of us. No matter what promises that honest startup gives you, the minute they are sold (and most sell in the end) the new owners are free to do whatever they like with your 'private' information. In fact it will be hawked in the marketplace like a chicken.

Is that really the case in the US? In Germany, I don’t see why simply transferring ownership of the data should not also transfer ownership of the agreements bound to that data. If I agree to let company X use my data for purpose A under terms T and company Y buys company X, in my view company Y would still be bound to stick to terms T and purpose A. Otherwise any leaked/stolen and subsequently published personal data could be used by anyone for anything…

mikeash3• 11 years ago

That raises an important question: why aren't those promises legally binding?

exelius• 11 years ago

The data is still valuable as a point-in-time snapshot. Remember, marketers are as interested in your past as your present, because there's still value in knowing that you lived in California in 2004 and that you now live in Chicago.

And this is why privacy is dead: so long as there is a financial incentive to having this data, it will be bought and sold like any other commodity.

Raphmedia2• 11 years ago

This is very anecdotal, but I swear that the minute I gave my email address to Radio Shack, I started to receive heavy spam.

pki• 11 years ago

I bought one <$10 item. Once.

http://i.imgur.com/4ztWmxW.png

jhallenworld• 11 years ago

I'm sure they have no choice but to sell assets with value.

But is the original privacy policy equivalent to a license (that we consumers grant Radio Shack)? If it isn't, maybe this will be a chance to set a precedent for this to be the case.

joelgrus• 11 years ago

Wow, this really sucks for whoever has the phone number that I had in 1991.

ja27• 11 years ago

And for whatever numbers they typed in when I refused to even make up one myself.

imglorp• 11 years ago

When I visit the hair cutting place, they refuse to serve you without a phone number. So I always give them the standard TV placeholder: xxx-555-1212.

The stylist is often confused why there are 20 people with that phone number.

ExpiredLink• 11 years ago

"... and we deliver our frozen products gratis to your door-steps ... " beep beep beep

tedunangst2• 11 years ago

How so? What is Standard General going to do to them?

matwood• 11 years ago

Apple and AT&T tried/is trying to stop them:

http://gizmodo.com/apple-sues-to-prevent-radioshack-selling-...

devcpp• 11 years ago

Apple "I-want-all-your-data" and AT&T "you-have-to-opt-out-of-tracking". Of all companies. We have to count on our enemies to protect us because we are powerless. Let's just hope they start privacy wars.

rsynnott• 11 years ago

Is _Apple_ known for being "I-want-all-your-data"? Historically, they don't seem to have been terribly interested, certainly not as compared to the web-centric companies.

CountSessine• 11 years ago

That's really a lazy mischaracterization of Apple. They've never been especially interested in your personal data. The only service they have where they maintain any sizeable, persistent consumer information seems to be the iTunes store, and as far as I can tell, they've never tried to monetize/share that information with anyone. I'm more curious why you would think of Apple this way - "I-want-all-your-data"? Maybe Apple "you-didn't-really-buy-your-hardware", but "I-want-all-your-data"?

If anything, I would liken Apple to a jealous and abusive boyfriend - they'll beat and abuse their customers with sometimes arbitrary controls over what they can do with their hardware, but God help you if you try to do the same to their customers. Whether you're a third-party developer, an accessory manufacturer, or anyone with a relationship with those customers, Apple will come down on you HARD if they think that you're harming their platform or exploiting their customers. From that point of view, Apple's action here - trying to interfere with RS' sale of Apple customers' personal data - is typical of Apple.

SloopJon• 11 years ago

Slate puts rather a different spin on this than other articles I've read. Slate:

The FTC is so displeased that Jessica Rich, its consumer protection director, has written to the bankruptcy court handling RadioShack’s case, asking that consumers' personal data be protected.

Ars Technica:

The Federal Trade Commission (FTC) sent a letter to the bankruptcy court presiding over RadioShack's supervised asset sell-off suggesting a compromise that would allow RadioShack to sell its database of information from 117 million customers.

Previous coverage portrayed Apple as intervening to protect customers (although it seems to have more to do with enforcing their reseller agreement):

http://www.imore.com/apple-wades-radioshack-sale-protect-cus...

http://daringfireball.net/linked/2015/05/14/apple-radioshack...

http://arstechnica.com/tech-policy/2015/05/apple-asks-court-...

brudgers• 11 years ago

Of all the things I'm supposed to be outraged about as a consumer of news, this one rises to the whoopdie fucking so what? level. Radio shack was collecting in their best ever year maybe half a dozen data points on me. It's not like they had my DNS requests over the past ten years or my history of cell tower signals or my click history following searches for "painful rectal itch" or how long I typically watch dwarf porn before closing the browser...if I were to do such a thing.

There are big privacy issues and little ones and this is definitely the latter. How revealing the Radio Shack's data is of people's behavior should be measured by the outcome of Radio Shack during the period in which it had exclusive access...and here the context is a bankruptcy proceeding.

tsieling2• 11 years ago

While RS had no real data on me, what this story points out is that companies will do this in bankruptcy, maybe even after carrying a no-share/no-sell policy for years. The wider issue it illuminates is that there seem to be few general protections for these cases, where having your data sold wasn't part of the bargain you were asked to make, until they changed the deal.

nsxwolf• 11 years ago

This is the quaint 1990s kind of privacy concern - when the privacy experts of the day warned us we would receive a lot of junk mail and credit card offers if we weren't careful with our data.

ascagnel_2• 11 years ago

This case can be used to test how binding a privacy statement can be. If Radio Shack is allowed to sell the data to a third party over AT&T & Apple's objections, basically every privacy policy is worthless. There are always increasing amounts of data collected with increasingly invasive means, but this can make bulk data collection less intrinsically valuable.

dm210• 11 years ago

It's harming other businesses too because people are much more likely to put in false data in order to avoid this situation.

Lawtonfogle4• 11 years ago

Those policies are already worthless. Trust is dead to anyone paying attention. The entire notion of contracts between large corporations and individuals leaves me feeling dirty because I was raised being taught that consent is meaningless in a vast power difference, where a vast power difference is magnitudes smaller than the difference in these cases.

Perhaps I'm too cynical, but when the only recourse is through lawsuits that most can't afford, and even that has been taken away by biased arbitration, we are at a point where most keep their eyes down and hope they don't become a victim of the system.

joshstrange2• 11 years ago

Agreed, if they allow the sale then they are pretty much saying that you can put in all the protections you want in a PP and then turn around and sell your company making all previous agreements near-null-and-void.

rayiner• 11 years ago

To be fair, contractual obligations are pretty worthless in bankruptcy. That's the whole point.

gr3yh47• 11 years ago

is this still true if you bought a mobile phone from them in the early-mid 2000s? I seem to remember a form with lots of sensitive info.

astrodust• 11 years ago

This is a company that famously required people to give a phone number to buy batteries.

belorn• 11 years ago

If we were in opposite sides in a court case, and I were to receive Radio shack data regarding you, your lawyer, all the witnesses, the judge, and all members of the jury, would you be fine with that?

If the answer is no, then how can trading such information ever be acceptable when you don't know who in what context that information will be used?

tsieling2• 11 years ago

Battery Card Club, you've turned against me.

driverdan• 11 years ago

This is exactly why you should never give your data to someone unless it's absolutely necessary. If someone asks for your contact info just so you can buy batteries just say no.

Lawtonfogle4• 11 years ago

Maybe with new AR devices coming out soon, maybe you can quickly do a picture to social media lookup, and then use that to see if the employee has their address/phone number online. The look on their face as you give them their own personal info would be priceless.

The investigation for stalking, not so much.

madaxe_again3• 11 years ago

I see this kind of thing all too frequently. Our clients are retailers. From time to time, one goes pop, and goes into administration. The liquidators look at all of their assets - initially, at things like stock and other physical assets - but then look at their other less tangible assets, like user data, as selling it can be the difference between settling with creditors or not.

Typically, when you license your data to a company you accept that they can sell that data as part of the sale of the business, in the event of administration or liquidation, and a variety of other situations in which you don't want to have to ask the permission of your N million users to go ahead with a merger or other essential business activity.

Further to this, we've also seen client service agencies who are processors of data seizing user data as an asset if a client goes into administration and leaves their service providers as unsecured creditors (i.e. "you're up the creek, we'll pay you £0.000001 for every £ we owe, your £80,000 is now £0.80"), as they also have a responsibility to mitigate their own losses, and again, contracts usually allow for the seizing of assets in the case of default.

So, long story short, this is not even slightly abnormal, and something consumers should consider before providing their data to anyone.

dm210• 11 years ago

The "we will never sell your data to anyone" in a Privacy Policy effectively means nothing at all.

Why are there not consumer protection laws in place to prevent this? In my opinion, in order to sell customer data you should have to go to court and have a judge look over the data to determine what can be sold.

ascagnel_2• 11 years ago

This is an instance where a judge can create a consumer protection common law.

madaxe_again3• 11 years ago

I've little faith that any judge would do anything other than "ah. This is something... computer. don't know. Yes?". It's the same "shutters coming down with a bang!" phenomenon as one sees with most non-technical folks the moment they think something technical might be coming their way.

Either way, this is a very grey area, as if you tie up corporate affairs with every single one of your customers, it would make your business unsaleable, and make liquidation impossible, so while consumer protection is desirable, there also have to be measures that allow businesses to operate without the explicit consent of each and every one of their customers for any action.

matthewmcg3• 11 years ago

There's actually a whole section[1] of the bankruptcy code that requires precisely that. The court can even appoint a special consumer privacy ombudsman as it determines what data may be transferred.

[1]https://www.law.cornell.edu/uscode/text/11/332

oldmanjay2• 11 years ago

well, "your" data in perhaps some rhetorical sense. "data about you" would be more intellectually honest, but slate is nothing is not manipulative. it's okay, they know they're promoting correct opinions so little tiny manipulations in service of that is okay.

deong2• 11 years ago

well, "your" data in perhaps some rhetorical sense.

In this context, "your data" is 100% of the time used to indicate data you've provided to someone else about you. Have you ever seen an article saying "Facebook to target ads based on their photos" or "Google using their data to make money"?

tedunangst2• 11 years ago

I think you've overshot with the Facebook photos. They are, in fact, not their photos and remain the property of the uploader.

oldmanjay2• 11 years ago

Well yes, as I indicated, the author is using a phrase in a rhetorical sense to frame the narrative emotionally. I'm sorry if I wasn't clear that I understand what the technique is accomplishing. I am merely pointing out the essential dishonesty in its use.

mc323• 11 years ago

I hope the FTC wins its case and establishes precedent that consumer data is non transferable and most importantly not a good to be bought and sold unregulated. I understand there are circumstances when data has to shared, transferred etc. (health networks, but this regulated) But consumer data needs to be well regulated and not treated as a commodity and "asset", that's not a desirable incentive.

Consumer data should be one of those things which most companies consider something toxic but necessary so they handle it with care and use the least amount possible rather than collect as much as possible and worry about things later.

RadioShack may not have the reams of data an ISP has, but still need a precedent for future data handling and ownership resolution. It'd be great to see this kind of data devolve back to the consumer, i.e. destroyed, once its original user is no longer there to use it in support of ongoing business operations and should not be a mainline of business per se.

legohead• 11 years ago

I thought user data was one of the most valuable assets of a business.

When I worked at Company X, one of our competitors was failing and offered us to buy them out. The most expensive part of the buyout was calculated basically by #users*<some price>. And really that's all we wanted, was their userbase, since we already had the product they wanted. We could absorb their users and immediately grow our business.

mc323• 11 years ago

I think there's a difference between we'll sell you all this data we have on our users, some of which is related to conducting business with them, and here are our paying customers who you can acquire and continue to provide goods and services to.

fleitz• 11 years ago

"data" is a valuable asset, however, in many jurisdictions 'user' data is considered property of the user, not the agency that collected it.

Think of it like software, your data is not the property of Facebook, but rather, they have a license to use it.

gcb02• 11 years ago

expensive part of the buyout was calculated basically by #users<some price>

I bet this had nothing to do with user data, but with user acquisition cost.

if company spends $10 on marketing and $15 on R&D per new user every quarter, then paying #users$10 when buying a dying competitor is a bargain.

dm210• 11 years ago

I do agree but there are some huge flaws with this that need to be worked out first.

How would you sell one company to another? There isn't much difference between a company being sold because it's being acquired and a company's assets being sold because it's bankrupt and needs to pay creditors.

mc323• 11 years ago

Perh a start would be strict ToS inheritance and much richer consumer data regulation. Any change on tos after an acquisition would have to be opted into by the user. So if Verizon buys experia, they don't suddenly do all kinds of things with that data I didn't expect.

JadeNB• 11 years ago

Consumer data should be one of those things which most companies consider something toxic but necessary so they handle it with care and use the least amount possible ….

This is a beautiful slogan. I think that it is far from something by which that businesses will ever abide, or laws will ever try to force them to abide, but I would love to live in a world in which it was true.

matthewmcg3• 11 years ago

Even if the FTC wins, this case will not establish a general precedent that consumer data is not transferable.

The issue here is whether RadioShack may sell the consumer data when its privacy policy said it would never do so.

Whatever the result of this case, it won't apply where the privacy policy permits transfer in bankruptcy (as most now do).

asuffield• 11 years ago

Suppose one company buys another company outright. Should that company keep its customer list (effectively transferring it to the new owner), or throw it away, ditch all its customers, and start from square 1? Would you be happy as a customer if you were told that because your cellphone company had been bought, your contract is cancelled and they can't offer you another one, you have to go to the store and start over? Would you be happy as an employee of this company being bought?

Now, suppose the purchasing company isn't buying the entire business, but (say) half of it? What's changed? (This is roughly what is being proposed here)

tw04• 11 years ago

Nothing has changed. In both cases, you should be able to continue using that customer data to provide a service they've asked you to provide (not what is being proposed here). You should not, in either case, be allowed to sell that data to marketers who will turn around and use it to either build profiles on people, or to spam/harass them with unwanted advertising(what IS being proposed here).

There is no gray area here.

kevando• 11 years ago

This is why Google's "Don't be evil" mantra freaks me out. Yeah they're not evil now, but who knows in 15 years? That mantra is gonna be like a slap in the face.

jcadam• 11 years ago

Yeah they're not evil now

Oh come on, I was drinking coffee when I read that :(

iamcurious• 11 years ago

They can always redefine evil...

Merriam-Webster defines evil[1] as:

    : morally bad
    : causing harm or injury to someone
    : marked by bad luck or bad events

Google defines evil[2] as:

    profoundly immoral and malevolent.

Surely Google isn't profoundly immoral and when they happen to be I'm sure they can add a few hyperbolic adjectives to their definition.

[1] http://www.merriam-webster.com/dictionary/evil [2] http://google.com/search?hl=en&q=evil

new_hackers• 11 years ago

are you sure they aren't evil now?

c22• 11 years ago

It's possible Google has always been evil. What better motto for an evil entity to have?

ck2• 11 years ago

It is one thing for private corporation to sell their sales data.

Some people don't have a problem with that, though I think they should.

You might be outraged however to discover that your state DMV will happily sell your license/cartag data to corporations.

fiatmoney• 11 years ago

It is standard in bankruptcies to dissolve existing contracts (after all, the point of bankruptcy is that you can't fulfil all of your existing contractual obligations). So it's not surprising on face that privacy policies would be included in this.

(This is distinct from "selling / buying the company" which usually means assuming all obligations).

For a class of contractual obligation to be "special" in the context of bankruptcy you typically need some kind of legislative protection (some states have rules about "outstanding payroll gets paid first", student loans are nondischargable, etc). Or some kind of bankruptcy cour ruling that liquidating the assets in this way would be somehow inefficient or against the public interest, which looks like how the FTC is approaching it. But in a circumstance where a huge portion of the business's assets were "private information", I could see a bankruptcy court ruling the other way - this doesn't necessarily establish binding precedent.

chris_wot• 11 years ago

In Australia, we have a set of clear privacy principles outlined in law. These are called the Australian Privacy Principles, and there are 13 of them.

The first principle is "Australian Privacy Principle 1 — open and transparent management of personal information", and it states that every organisation must publish a privacy policy and it must state "the purposes for which the entity collects, holds, uses and discloses personal information".

That's legally binding. If the company violates it, there are massive fines and the Privacy Commisdioner can investigate.

lazyjones• 11 years ago

I don't know the case's specifics, but doesn't typically the bankruptcy court decide what assets are to be sold? The former management and staff (what we are thinking of when slate.com writes "RadioShack Sold...") has no influence over this and should not be blamed. The bankruptcy court is the new management, they can do what they want and must according to law to satisfy creditors, blame them.

agwa• 11 years ago

They collected and stored data unnecessarily, so former management absolutely shares blame.

jmkni• 11 years ago

I have worked a company where this has happened, and it wasn't even the company themselves really.

They went into administration, and the administrators came in and wanted to see if they had anything of value.

Data is of value, so they sold it to a rival company. Not a lot you can do about it really, apart from not store the data in the first place.

kefka• 11 years ago

The answer is: Do not have a privacy policy.

If you have a privacy policy and you violate it, the FTC comes after you. No policy? No harassment from FTC.

Aside that fact, it's not like they really matter. Right?

matthewmcg3• 11 years ago

The laws of many jurisdictions require you to have a privacy policy if you are going to collect personally identifiable information from residents of that jurisdiction. See, for example, the California Online Privacy Protection Act.

rglover• 11 years ago

SO that's why I just got a random call from Michigan selling me a security system.

JackFr• 11 years ago

The question comes down to is the private equity group a successor organization.

If Best Buy had swooped in and bought Radio Shack, maintaining it as an ongoing concern I don't think anyone would have objected to them getting the data and honoring Radio Shack's original agreement. That is, they are not a third party, they are the successor to the party of the first part, viz Radio Shack.

Also had a private equity group come in and bought Radio Shack and taken them private, few would have objected to the now private Radio Shack under new management, maintaining the data and the agreements they held.

But by dragging Radio Shack through bankruptcy, they begin to lose the appearance of a successor organization, and begin to look more like a third party.

strathmeyer• 11 years ago

It's pretty hilarious this is being 'reported' on a site that won't let you read the article unless you give them your personal information.

bcheung• 11 years ago

Did they sell the data or the company? I'd be curious to know if the new owner is still obligated to follow the same privacy statement? In either case, I'm not going to lose any sleep over this.

jms703• 11 years ago

Isn't everyone doing this in some form?

anigbrowl• 11 years ago

And people wonder why I am less exercised about government snooping than most, when it arguably has much less impact on most people's lives. (This is not the same as saying that it's OK; I just don't think it's the #1 tech-social problem).

gcb02• 11 years ago

Just makes you wonder, what if Google, Apple or Facebook go broke tomorrow?

cmdrfred• 11 years ago

Never gave them a fucking scrap of data, in fact I actively gave them bad but valid enough looking information so they (and now whoever they sold it to) will waste time and money.

bhartzer• 11 years ago

Luckily, I've ditched my landline since I bought stuff at Radio Shack. So any calls to my old landline phone number won't get through.

Is there any indication that what you bought there, along with your contact info was sold? Or just your contact info?

kw71• 11 years ago

Those calls may not get through to you, but they'll get through to a bloke like me, who happened to get your old number, hates marketing calls and will play games with the callers (Billy speaking, Yes your ridiculous offer is relevant to my interests, I'll take it) and extracting data from them bit by bit (My address? I still live in Pratville and haven't moved. OK, Fine, I'll confirm the details you read to me.)

If I had fewer scruples I'd actually use the data for criminal acts, but I simply amuse myself by seeing how far I can get with callers.

antidaily• 11 years ago

Oh fuck. Someone knows I bought some RJ45 connectors!?!

dredmorbius2• 11 years ago

Maciej Cegłowski "The Internet With a Human Face"

http://idlewords.com/bt14.htm

As a wise man once said, if you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.

But there are also dangerous scenarios that don't involve government at all, and that we don't talk enough about.

I'll use Facebook as my example. To make the argument stronger, let's assume that everyone currently at Facebook is committed to user privacy and doing their utmost to protect the data they've collected.

What happens if Facebook goes out of business, like so many of the social networks that came before it? Or if Facebook gets acquired by a credit agency? How about if it gets acquired by Rupert Murdoch, or taken private by a hedge fund?

What happens to all that data?

RadioShack Sold Consumer Data to Pay Off Its Debts

Related Stories