Toysmart

William FreyChuck Huff

José A. Cruz-Cruz

An Analogy• You visit a small village where the tribal leader is taken

sick. He gives you a thousand dollars and makes you promise that you will use it to build a statue of him after his death. You take the money and make the promise.

• After his death, a member of the village comes to you and asks that you use the money to buy the village children new shoes which they badly need.

• What should you do? Buy the new shoes for the shoeless children or keep your promise to the village chief and build the statue?

Toysmart’s Beginnings

• Dot-Com (Online startup financed by venture capitalists)– Out of 10 companies funded:• Two make it big, two make it, and the rest go belly-up

• Started in December 1998

• Specializing in educational toys

Toysmart and Disney• Holt Educational Outlet: Brick and

Mortar Toy Company in Waltham, Mass)• David Lord decides to create a

dot.com.

• Two choices–One Venture Capitalist offers 20 million–Disney offered 20 million in cash plus

25 million in advertising

Decision Point

• You are David Lord

• You have two offers for start-up financing

• Determine Toysmart values. – Hint: Educational Toys– Hint: Need to gain customer trust

• Are Disney values compatible with Toysmart Values? What happens if these conflict

“Click on your child’s potential”• Good toys– Toysmart seeks to become an outlet to quality

educational toys–Places before customers some 50,000 toys

• One stop shopping– Customers come, search, buy

• Transactions facilitated by exchanging PII and TGI– Personal Identifying Information• Information used to identify an individual (age, job)

– Transaction Generated Information• address, credit card numbers, buying preferences

So What?

• When you go to the grocery store, you exchange PII and TGI– People see you, how you look, how you dress, your age

(roughly), and other identifying characteristics– When you buy products, the cashier notices often

remembering your buying patterns, preferences, dislikes

• Why does digitalizing this information and placing it in cyberspace change things?

PII and TGI Create Customer Data Base• 260,000 profiles worth up to $500 each: – Name, address, billing information, shopping

preferences, family profiles (including names and birthdates of children), and credit card numbers

• One method of collecting customer information: a contest– Children entered contest at toysmart.com (= data

input)– Parents sent e-mail informing them child had entered – Winners’ parents give address to receive prize (= data

input)

• Information collected from children under 13

Decision Point Two

• You work for Blackstone, "an 18-person software business."

• Job:– Design an attractive webpage – Advise Toysmart on privacy and data security policy– How should Toysmart balance privacy (secure

customer information) and promote ease of Internet access (which requires information exchange)?

Gaining Customer Trust

• Potential customers stayed away for fear that their information would not be held secure

• How does Toysmart gain consumer trust?– By promising strong privacy practices– By posting a web certification seal such as

TRUSTe® or VeriSign®– By attesting to a strong set of core values

Privacy Guarantee (Promise Number 1)

• Toysmart Privacy Policy (since September 1999)

– Personal information, voluntarily submitted by visitors to our site, such as name, address, billing information and shopping preferences, is never shared with a third party.

– When you register with toysmart.com, you can rest assured that your information will never be shared with a third party.

– FTC announcement of suit against Toysmart• www.ftc.gov/opa/2000/07/toysmart.htm

TRUSTe Certification(Promise Number 2)

• toysmart.com was licensed by TRUSTe Privacy Program

• Trusted Universal Standards in electronic Transactions – “independent, non-profit privacy initiative dedicated to building

user’s trust and confidence on the Internet”

• Toysmart displayed TRUSTe trademark on website– In addition to guarantees that customer personal information

would be safe at toysmart.com

TRUSTe Guidelines for PII transfer (White Paper from 4/11/01)

• Specifically, these guidelines point to the following:

– “Mandated Third Party Oversight• The critical point in these guidelines is that personal information transfer requires third party

oversight as an important check against the singularly focused demands imposed by creditors. In an era marked by increasing consumer vigilance over privacy, third party oversight in data transfer is mandatory to the trust equation.

– Consumer Notice and Choice • TRUSTe recommends that giving customers opt-in is the best method to retain full value of a

customer database and extend trust to new users. Indeed, if a company has made the promise to never share personal information, then a change in data handling and uses requires consumer opt-in. In other situations, providing both an opt-out option and public notice will be sufficient.

– Privacy Policies Must Be Honored• The same promises a company makes while in business, must be honored when going out of

business. Given the current sensitivities towards privacy protection, consumer are beginning to understand that third parties exist – in the form of seal programs and government bodies – to ensure the integrity of privacy promises. To that end, both parties, the buyer and the seller, have an obligation to the consumer. ”

Opt-in vs. Opt-out• Out-out.

– Transferring the information is the default. Your PII will be transferred unless to take positive action to prevent this.

– Usually a procedure that requires you to fill out a card and send it to the information holder

• Opt-in– The stronger privacy practice– Your PII will not be sent unless you expressly consent. Here

not sending the information is the default. – To override you have to consent.

Obligations to TRUSTe• “1. Inform TRUSTe of impending business changes as they impact customers’

personally identifiable information and privacy practices.

• 2. Provide your customers and/or users with notice of the upcoming change.

• 3. If you have promised never to share personally identifiable information with a third party, at a minimum you must provide an opt-in before the information is shared with that third party.

• 4. If you have indicated in your privacy statement that you may share information with third parties, you should provide notice and an opt-out before sharing the personally identifiable information.

• 5. If the company will be sold in total to a company in a similar line of business with the same privacy policy, give notice to the customer.”

The Disappointing Christmas

• Toysmart expected sales of 20 million fizzle out at 6 million. (December 1999)

• Disney withdraws support

• Will Toysmart follow other dot.com companies to bankruptcy?– This was the period of the dot.com bust.

Toysmart goes bankrupt

• May 22, 2000:– FTC: Toysmart “announced that it was closing its

operations and selling its assets”– Lets go of 170 employees– Consults with The Recovery Group on evaluating

assets

• Toysmart’s creditors filed involuntary bankruptcy petition on June 9, 2000

• Toysmart files assent to bankruptcy petition June 23, 2000 (Chapter 11)

Steps for Bankruptcies• “Review the privacy statement to determine the promises made to Web site

customers and users. The privacy statement will indicate the restrictions that will apply to the transfer of the personally identifiable information.

• Inform TRUSTe of the company’s upcoming changes before filing for bankruptcy.

• Companies selling customer information as part of the asset portfolio must give all consumers a reasonable opportunity to prevent the sale of their personally identifiable information, if:– The PII will be used or disclosed by the buyer for a purpose not outlined in the

TRUSTe approved privacy statement,– The PII will be used for a purpose unrelated to the primary purpose for which it

was collected, or – The company promised not to sell, rent, or share the personally identifiable

information.

• Once a buyer of the database is identified, you must contact TRUSTe to determine the necessary level of notice and choice. ”

More Steps for Bankruptcies• “TRUSTe will need the following information to determine the

required levels of notice and obtaining choice.

– the name of the company purchasing the assets, – the effective date of the merger, – how the new company intends to use the personally identifiable

information in the customer database, – whether the new company will be adopting the privacy policies of the

licensee, or if it will have different privacy policies, and– whether the new company intends to maintain a relationship with

TRUSTe, (if not, you should follow the termination procedures of section 5 of License Agreement 6.0).

• Once you and your TRUSTe account manager determine how customers and/or users will be given notice and/or choice, provide TRUSTe with documentation of the notice and choice you intend to send to your customers prior to sending it.”

Procedure on filing bankruptcy

• Receive Creditors’ Committee Solicitation Form from Office of United States Trustee (OUST)– Form creditors’ committee

• Evaluate Assets

• Creditors’ committee has a fiduciary duty to creditors (duty of trust or loyalty)– Maximize value of debtor’s assets

Decision Point• You work for PAN Communications and have been providing advertising services for

Toysmart.

• Because of your knowledge of bankruptcy and accounting procedures, you have been asked to represent your company on this committee.

• Toysmart’s most valuable asset is its customer data base. The 260,000 profiles could be sold for up to $500 a piece.

• But Toysmart has promised not to exchange this information with third parties. It is also bound by the strong privacy standards of web certification company, TRUSTe.

• How should you work to balance customer concerns about privacy , Toysmart promises, and the rights of creditors to recover their money through the bankruptcy process?

Toysmart’s Assets• Bankruptcy Schedules

– 10.5 million in assets– 29 million in liabilities

• The Crown Jewells: Toysmart’s customer data base– 260,000 customers– Each customer worth “up to” $500

• In June 9, 2000, Disney places an ad in the Wall Street Journal offering Toysmart’s databases and customer lists for sale

• FTC alerted to problem by TRUSTe

• Warning issued late June 2000

Data Base for Sale

• Toysmart creditors place ads in the Wall Street Journal and Boston Globe announcing the sale of its customer data base.

FTC Files Complaint • July 10, 2000

• “seeking injunctive and declaratory relief to prevent the sale of confidential, personal customer information”

• Toysmart “has violated Section 5 of the FTC Act by misrepresenting to customers that personal information would never be shared with third parties, then disclosing, selling, or offering that information for sale”

Framework for FTC

• GeoCities Consent Order

– notice of the web site’s privacy policy;– consumer choice regarding the use of the

information collected;– consumer access to correct and update information;– safeguards securing the data;– parental control when children’s information is

involved; and– some enforcement mechanism

Results of FTC Legal Proceedings

• Late July 2000– FTC and Toysmart reach settlement– Toysmart must “file an order in the bankruptcy

court prohibiting the sale of its customer data as a “stand-alone asset.”

– Toysmart creditors “can sell electronic assets only if the purchasing company abided by the same privacy policy”

• On August 17, 2000, the federal bankruptcy court declines to accept the Toysmart/FTC settlement– Wait for buyers to come forward

Criticisms of Resolution

• Amendment to Bankruptcy law has problems– Ultimately prevents dot-coms from selling off their

most valuable assets, information

• The FTC settlement appears as value integrative– Sells off data base as asset– But includes consumer consent including opt out

procedures– And commits buyer to privacy policy of original

collector

The Final Curtain

• Disney Subsidiary, Buena Vista Toy Company buys data base for $50,000.

• Toysmart does not transfer information but destroys it.

• Provides affidavit to this effect.

Thought Experiment

• Should creditors of bankrupt companies be subject to the privacy policies/promises of the bankrupt company?

• In other words, do you take the money of the village chief and buy shoes or build the statue as you originally promised?