If you can’t sell cupcakes, try selling customer data instead—or at least that was Crumbs Bake Shop Inc.’s plan when they filed for bankruptcy last month. But the U.S. Trustee nixed the notion saying that selling customer lists would breach the company's privacy policy.
There is currently an offer on the table from Lemonis Fischer Acquisition Company to purchase Crumbs. Part of the deal includes the company’s intellectual property (including customer lists). Crumbs privacy policy, however, “permits the transfer of customer information only if the company is compelled by a governmental authority, the consumer expressly consents or it's necessary to process transactions and provide services.” To protect Crumbs’ customers while the sale is negotiated, a consumer privacy ombudsman has been requested to safeguard personal customer information, like names, numbers and addresses. The appointed ombudsman would then aid the court in “considering how to treat personally identifiable data.”
Given that Crumbs’ privacy policy explicitly lays out the exceptions for the transfer of customer information, it is pretty clear that this sale infringes upon that. When dealing with sensitive information like customer data, it is important to adhere to the standards and precedents you set as a company. Unfortunately in this case the promise of sale was too tempting and it looks like Crumbs ultimately got its hand caught in the cookie jar.