Consumer privacy ombudsman: selling personal data in bankruptcy, and the alternative

Short answer: when does a bankruptcy sale need a privacy ombudsman?

When three conditions line up: the debtor disclosed a privacy policy prohibiting the transfer of personally identifiable information to unaffiliated persons, that policy was in effect when the case began, and the estate wants to sell or lease that information in a way the policy does not allow. Under 11 U.S.C. 363(b)(1), the court can then approve the transaction only after a consumer privacy ombudsman is appointed under section 332, notice and a hearing, and a finding that no showing was made that the sale would violate applicable nonbankruptcy law.

Notice the verbs: sell or lease. Counsel should assume a license of customer personal data can be caught too. Licensing de-identified operating records, such as support resolutions, project files or engineering history with personal identifiers removed, is a different transaction. It may not engage the ombudsman provision at all, although section 363 still governs it as a use, sale or lease of estate property outside the ordinary course, which generally means notice and a hearing.

What do sections 363(b)(1) and 332 say?

The two sections work as a pair. Section 363 sets the trigger and the exits; section 332 sets up the ombudsman.

• The trigger. A privacy policy, disclosed by the debtor, that prohibits transferring personally identifiable information to persons not affiliated with the debtor, and that was in effect on the date the case began.
• Exit one. The sale or lease is consistent with that policy.
• Exit two. The court approves it after appointing an ombudsman, giving notice and holding a hearing, and finding that no showing was made that the sale would violate applicable nonbankruptcy law.
• The appointment. If a hearing is required, the court orders the US trustee to appoint one disinterested person, other than the trustee, as ombudsman, no later than 7 days before the hearing.
• The role. The ombudsman may give the court information to consider, such as the debtor's privacy policy, and may not disclose personally identifiable information obtained in that role.

The Code has its own definition of personally identifiable information in section 101, and it can differ from the definitions in state privacy laws. Read it with estate counsel before assuming a data set is in or out.

Who controls the decision in each type of case?

In chapter 11, the debtor ordinarily stays in possession and control of its assets as debtor in possession and proposes a plan, according to the federal judiciary's chapter 11 explainer; a plan can also be liquidating. In chapter 7, a trustee sells nonexempt property and distributes the proceeds. Either way, the party with authority to sign a data transaction is the estate's representative, and the court decides whether to approve it.

Outside bankruptcy the picture changes. An assignment for the benefit of creditors runs under state law, as the ABC data assets guide explains, and section 332 does not apply there, although privacy promises still do.

A recent example: 23andMe

In 23andMe's 2025 bankruptcy, the consumer privacy ombudsman recommended that any transfer of customers' genetic or personally identifiable data be prohibited absent renewed opt-in consent, as The Record reported. The recommendation shows how far scrutiny can go when the data is personal and sensitive. It says nothing about operational business records, which are the material SourceX licenses. For older cases, see the Toysmart to RadioShack history of bankruptcy data sales.

Approvals to map before any data transaction

Mapping these early makes a late objection that stalls a sale order less likely.

Selling personal data vs licensing de-identified operating records

The two transactions answer different questions and draw different scrutiny. The guide to licensing vs selling data covers the ownership side in more depth.

A privacy policy that says the company does not sell data raises its own questions even for a license; see what a 'we do not sell data' promise means.

How a restructuring professional makes the introduction

1. Preserve before you assess. Ask the estate's IT lead which systems are scheduled for shutdown and make sure complete exports exist; the estate's own team runs them.
2. Screen eligibility in plain terms: a US company that reached 50+ full-time employees at peak (contractors excluded), with several years of documented operations, rights to its records and an authorized representative who can sign. Operating, acquired and wound-down companies can all qualify if the data still exists.
3. Introduce the estate's representative through your referral link or the referral form. As a partner you never export, upload or describe confidential records.
4. SourceX qualifies the opportunity, the estate completes a data inventory, and de-identification and redaction rules are agreed before any work begins.
5. Price and terms are agreed, estate counsel seeks whatever court approval applies, buyers review, and data moves only after an executed agreement and the estate's authorization.

The company fit checker gives a preliminary, non-binding read before you raise it with the trustee or board. The referral program for turnaround consultants and CROs covers role-specific questions.

Questions for estate counsel

• Does any data set in scope contain personally identifiable information as the Code defines it?
• Which privacy policy was in effect on the petition date, and where is the archived copy?
• Is a de-identified records license ordinary course, or does it need a motion?
• Do lender consents, the financing order or a pending purchase agreement limit a license?
• Must any referral reward be disclosed to the court, or does it belong to the estate? Start with whether a referral reward belongs to the estate.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, up to $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee; no reward is guaranteed.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Next step

On your next engagement, add one line to the first-week checklist: list every system holding operating history before anything is shut down. Then register as a partner so you can introduce the estate when the records are worth a look.