Available from RadioShack: three-prong adaptors, television antennas, cellphone cases, and millions of its former customers’ street addresses and emails.

Over its 90-year history, the company acquired personally identifiable information about its customers including social security numbers, emails, home addresses, telephone numbers, “and other government issued identification numbers unique to each consumer”, according to RadioShack’s legal filings.

The highly sensitive information (SSNs and the like) is retained at stores for two years and then purged. Less sensitive purchase records were expunged after three years in some cases, but RadioShack kept them “indefinitely” if customers bought a warranty, so if you bought insurance on your television in 1998, RadioShack remembers.

Now the company is trying to determine how much it will be able to legally sell in an effort to keep creditors at bay. It has decided emails and addresses are probably what it wants to sell, specifically “67 million customer name and physical mailing address files together with any associated transaction data collected by the Debtors within the five (5) year period prior” to its bankruptcy, according to a recommendation by the court appointed fiduciary, Elise Frejka.

The deal between RadioShack and Standard General, the company that placed the high bid for the bankrupt tech retailer’s assets, is set for a final hearing in a Delaware bankruptcy court later this week. If the deal is approved, it will maintain business as usual at many RadioShack stores and keep the data with them. If not, RadioShack will have a much harder time selling the data should it need to liquidate its assets.

“The firm has been working with the state attorneys general to ensure that the customer data is protected, and has committed to maintain RadioShack’s strict privacy policies,” said a spokesman for Standard General.



Jessica L Rich, FTC bureau of consumer protection director, said if the company wants to do that, it has to notify everyone involved. “[W]e believe it would be appropriate for RadioShack to obtain affirmative consent from its customers before it transfers the data. The consent process would allow customers to make their own determination as to whether a transfer of their information would be acceptable to them. For consumers who do not consent, their data would be purged.”

“The information you give us is treated with discretion and respect,” reads the RadioShack privacy policy in place at the time of the company’s bankruptcy. “We pride ourselves on not selling our private mailing list. From time to time, we may send you information from our company or from select, responsible companies that may join with RadioShack to bring you special offers.”

Soon, it will be the highest bidder looking to bring special offers to RadioShack’s former customers, and Rich is firing off a warning shot. “We are concerned,” she wrote, “that a sale or transfer of the personal information of RadioShack’s customers would contravene RadioShack’s express promise not to sell or rent such information and could constitute a deceptive or unfair practice under Section 5 of the FTC Act.”

RadioShack said in court filings that it collected more than 117m customer records, though many of the entries may be duplicates. Now that technology has made it possible for advertisers to look at data sets of that size at scale, that information is incredibly valuable to marketers who can design and target ad campaigns based on such massive amounts of personal information.

Tough talk aside, when the FTC censured Toysmart, an online toy retailer seeking to sell similar information in bankruptcy, the regulator published a set of guidelines. In her brief, Frejka proposed a very similar set of guidelines for anybody who wanted to purchase the data in a response to Rich’s letter.

If a buyer wants to take over the company and run it as a going concern with its websites and stores intact, Frejka wrote, there should be no problem with its maintaining RadioShack’s databases of personally identifiable information on its customers. Similarly, she contended that the courts should have no problem with the transaction if a high bidder agrees to abide by RadioShack’s privacy policies and give data-mined customers a heads-up, no permission asked.

The question of whether the consumer gets a say will probably be the sticking point between the company and the FTC.