Muddy property: generating and protecting information privacy norms in bankruptcy.

Author:Janger, Edward J.


Bankruptcy law does not deal well with website promises to protect personal information. The legal treatment of privacy policies in bankruptcy currently turns on whether such policies are viewed as creating contract rights or property rights. Neither characterization fits well and any attempt to shoehorn information privacy into either category has significant costs. Contract obligations are subject to discharge in bankruptcy, and any consumer expectations of privacy (contractual or otherwise) are likely to be defeated. By contrast, if personal information is deemed property of the website customer, information transfers that might benefit consumers will be stifled. This Article develops an approach, based on "muddy property rights," that has the potential to strike an appropriate balance between these two extremes.

The property/contract distinction within bankruptcy law mirrors a broader discussion in the legal academy, begun by Calabresi and Melamed, about the proper domain of property and liability. The debate among privacy scholars about data privacy similarly tracks the Calabresian divide. Larry Lessig favors propertization of personal information, while other privacy advocates, such as Marc Rotenberg and Jessica Litman, oppose Lessig's proposal because they believe commodifying personal information will ultimately be destructive rather than protective of privacy. All three misunderstand the effect of property on privacy: Lessig ex ante, and Rotenberg and Litman ex post. Lessig's focus on remedy (following both Calabresi and Coase) assumes that the content of the substantive right to information privacy is irrelevant, because an efficient allocation of rights will ultimately be reached, one way or another, by private negotiation. However, contractual negotiation is not always an efficient mechanism for allocating entitlements. Adhesion, information asymmetries, and coordination problems raise thorny issues where e-commerce transactions are concerned. In these transactions, one cannot rely on private negotiation or markets to generate the appropriate terms for data sharing. Rotenberg and Litman, by contrast, ignore the fact that without the status of "property, "information privacy norms will go entirely unenforced in bankruptcy.

By focusing on remedy, the information privacy literature has failed to explore the interaction between substantive rights (which can be crystalline or muddy), and remedies (which can be based in property or liability). I argue that "muddy property rights" based on fair information practices point the way toward a more nuanced approach to the interaction between right and remedy. As I have discussed in earlier work, muddy rules serve a dual function: (1) they deter troubling transactions; and (2) they force contracting parties, ex ante, to recognize that they might have to justify their contractual terms ex post. In the information privacy context, however, muddy entitlements, and muddy property rights in particular, could serve a third purpose. They would force information into the legal system about norm-related behavior, and allow judges and the judiciary to enforce and articulate privacy norms through the incremental development of common law rules.

In short, if privacy norms for e-commerce transactions are to be enforced in bankruptcy, they need to be protected by property rights, and if they are to be generated by public dialogue and public processes, those property rights should be muddy.

No statutory draftsman has a crystal ball in which he can read the future. The best he can do is make some kind of sense out of the recent past. A well-drafted statute will deal sensibly with the issues which have come into litigation during the twenty or twenty-five years which preceded the drafting. However, the focus of litigation has a way of shifting unexpectedly and unpredictably. New issues, which no one ever dreamed of, present themselves for decision. With luck, the statute will turn out to have nothing to say that is relevant to the new issues, which can then be decided on their own merits. (1)

TABLE OF CONTENTS INTRODUCTION I. BANKRUPTCY LAW, BANKRUPTCY LAWLESSNESS A. Privacy Promises in the Real World B. The Law: Outside of Bankruptcy C. Privacy Promises in Bankruptcy 1. Liability Rules--Executory Contracts and Unsecured Claims in Bankruptcy 2. Property Rules--Specific Performance, License Law, and Secured Claims in Bankruptcy a. Secured Claims in Bankruptcy b. Specific Performance in Bankruptcy c. Adequate Protection and Sale Free and Clear d. Licenses in Bankruptcy e. Property ex machina--The FTC Act D. Inadequacy of Current Law: Privacy Expectations v. Reorganization Policy II. PROPERTY AND LIABILITY V. CRYSTALS AND MUD A. Property and Liability in a World of Inefficient Bargaining 1. Property and Liability 2. Information-Forcing Liability Rules 3. Property Rules, Liability Rules, and Privacy Promises--The "Lemons Equilibrium" B. The Lemons Equilibrium, the Coase Theorem, and the Incoherence of the Property/Liability Distinction C. Defining Entitlements--Crystals, Mud, and Institutional Choice 1. Institutional Choice and Institutional Competence 2. Crystals, Mud, and Institutional Choice: Dividing Entitlements Along the Norm Axis 3. Muddy Rules and Norm-Related Information-Forcing D. A Typology of Entitlements 1. Muddy Property 2. Muddy Liability III. MUDDY PROPERTY RIGHTS, INSTITUTIONAL CHOICE, AND SYSTEMIC INFORMATION-FORCING A. The Positive Externality of Muddy Property B. Systemic Information-Forcing and Institutional Choice C. Muddy Property and Yachoo in Bankruptcy: An Illustration D. What Larry, Marc, and Jessica Don't Get IV. EVALUATING THE LEAHY AMENDMENT: MUDDY PROPERTY. FAIR INFORMATION PRACTICES IN BANKRUPTCY A. The Leahy Amendment B. Towards a FIPs Default C. Some Reflections on Forum Shopping CONCLUSION APPENDIX--The Leahy Amendment INTRODUCTION

Imagine that it is February 2000. The dot-com boom is resonating through the economy. Yachoo Corporation (Yachoo), the owner of a website called "," (2) has just gone public. is the brainchild of CEO and principal shareholder Max Headcold, and sells herbal and nutritional supplements over the World Wide Web. Yachoo's marketing focuses particularly on cold remedies. When customers visit the website they are asked to provide certain information about their particular respiratory ailments, or, as the case may be, their personal fitness goals. Yachoo's proprietary software then uses this information to provide the customer with a tailored herbal regimen. These customers have value in two ways: as relationships (i.e., people who buy Yachoo's products), and as information (i.e., preferences of people who might be convinced to buy other people's products).

Needless to say, this information would be valuable to other companies interested in marketing the latest form of high-tech tissue paper or ultrasonic vaporizer to Yachoo's customers. Yachoo, however, has posted a privacy policy on its website that states in no uncertain terms:

WE WILL NOT SHARE YOUR PERSONAL INFORMATION WITH THIRD PARTIES UNDER ANY CIRCUMSTANCES. WE MEAN IT! WE MEAN IT! WE MEAN IT!!!! Yachoo made this promise because Headcold felt that many of Yachoo's customers would be more comfortable doing business with Yachoo if they believed that their information would be held in confidence. Headcold also felt that when the time came to sell high-tech tissue paper or ultrasonic vaporizers to their customers, Yachoo would simply branch out into those businesses.

Now, fast forward to March 2003. Yachoo has fallen upon hard times, and has decided to reorganize under Chapter 11 of the Bankruptcy Code. During the planning discussions, you (Yachoo's lawyer) and Headcold explore a number of options. The first plan is to obtain financing and seek to continue the business. The second plan is to liquidate the assets of the business, either in whole or in part, carving up the various pieces in order to obtain the most value. Headcold also recognizes that reorganizing may require Yachoo to sell off some of its assets to raise cash. In this connection, Headcold turns to you and asks two questions: (1) "Given our privacy policy, can we sell Yachoo's customers with their personal information?"; and (2) "Can we sell that information without the customers' permission?" Your initial attempt to answer these questions would begin and, under current law, end with the somewhat delphic, and widely reported, story of cautionary tale that simultaneously left Toysmart unable to sell its customer data, and struck fear into the hearts of privacy advocates.

In the spring of 2000, an involuntary bankruptcy petition was filed against (3) Notwithstanding a published privacy policy under which it, like Yachoo, had promised not to sell personal customer information, Toysmart's liquidation consultants sought to sell the company's customer lists. (4) Public outcry and an FTC investigation stopped the Toysmart data sale in its tracks, and spawned a number of legislative proposals, including an amendment to the Bankruptcy Code introduced by Senator Patrick Leahy (Leahy Amendment), contained in sections 231 and 232 of the Conference Report (5) on the Bankruptcy Abuse Prevention and Consumer Protection Act of 2002 (Bankruptcy Reform Bill). (6) This Article seeks to show that both the Leahy Amendment and recent scholarly proposals, by Larry Lessig (7) and others, to protect data privacy through propertization are legally and intellectually incoherent for a common reason. Both focus on remedy without paying sufficient attention to the substantive privacy norms at stake.

The Toysmart story and its legislative coda raise three related questions, each of which implicates a common failing in bankruptcy law and in the scholarly literature on data privacy. First, should an entitlement to data privacy be protected by a...

To continue reading