RadioShack Could Auction Personal Data for 117 Million Customers

— -- RadioShack wants to auction off customer data for as many as 117 million customers as part of its bankruptcy proceedings, according to a legal filing tied to the Texas company's bankruptcy case that attempts to block the data sale.

The Office of the Texas Attorney General has filed paperwork with the U.S. Bankruptcy Court in Delaware, which is handling the retailer's case, in which it objects to the sale of data covering names, email and mailing addresses, and purchases.

RadioShack filed for Chapter 11 bankruptcy protection last month, claiming more than $1.3 billion in liabilities and $1.2 billion in assets.

RadioShack, via email, declined to comment on the possible data sale -- but privacy experts were not surprised to hear a data sale was a possibility.

Adi Kamdar, activist with the Electronic Frontier Foundation, said it would come in an era when online start-ups rely on customer data as assets.

"It's worrisome, though, if the data isn't treated under a privacy policy similar to RadioShack's when the customer information was first collected," Kamdar said.

The Texas attorney general's legal objection noted that RadioShack's online privacy policy has disclaimers such as: "We will not sell or rent your personally identifiable information to anyone at this time."

"RadioShack gave explicit assurance to its customers not to sell their personal data, and attempts to do so would not only be a direct violation of its own privacy policies, but also a violation of Texas law," said Cynthia Meyer, a spokeswoman for Texas Attorney General Ken Paxton. "We will continue fighting to protect consumers’ personally identifiable information."

Adam Levin, founder of IdentityTheft 911, hopes the Texas law and other similar state laws are enough to block the sale of the data.

"Customer information -- including names, emails, phone numbers and addresses -- is a valuable marketing toolkit that third parties should not be able to purchase," Levin said. "Personal information collected by Radio Shack over the years is a valuable asset, but it should not be transferable, in this case.

"In light of the fact that RadioShack's policy states that customer data cannot be sold to a third party, the bankruptcy court should stand up for consumer privacy," Levin added.

Besides the Texas attorney general's objection, another factor might yet prevent the sale of the data.

Standard General, which has been discussed as a potential buyer of RadioShack, has been working with state authorities to ensure that, if it takes over, all of RadioShack’s policies will stay intact and customer data will not be misused, according to a source familiar with the matter.

Levin hopes the sale of the data can be blocked, saying personal data presents security risks beyond just unwanted calls from marketers.

"If this data ends up in the hands of hackers, it can be used to launch phishing attacks, leaving customers exposed to malware by email, phone and text, in order to steal more personal and financial information," Levin said.