4 ms·

I think this is a great point. Does anyone know if it's possible to bulletproof against what an acquirer might want to do with the data? Is there a way, for i

I think this is a great point. Does anyone know if it's possible to bulletproof against what an acquirer might want to do with the data? Is there a way, for instance, to shift the ownership away from the company gathering the data such that if ownerhship of the company changes, ownership of the data does not?

nkw 10y ago
Lawyer here. Not my area of speciality but off the top of my head (and after thinking about it for all of 30 seconds) that strikes me as a surprisingly hard thing to do. Bankruptcy courts have extremely broad powers to administer the assets of debtors including disavowing contracts. There may be some way to do a structure where the data is escrowed with a 3rd party and the subject company is just holding the data as some sort of fiduciary, but I'm not sure anything like that has been tested. I would want to consult a bankruptcy expert to really figure something like this out.
- methehack 10y ago
  Super helpful -- thanks for chiming in. I think its really interesting that this isn't worked out yet. It feels like there should be a way to say to a consumer "I'm just looking after your data -- you still own it, etc. Even if I go bankrupt or get bought, I can't change that and the acquiring company should consider that when valuing me." I mean, banks do it with money (and other assets). One bank buys another and there's no way for it say "Now your money is mine! Muwahaha". Feels like it's a whole missing regulatory / legal area to me.
- avivo 10y ago
  What if Kite can't legally use the data for alternative purposes? I don't think disavowing a contract via a bankruptcy would let a company sell assets they don't own. So Kite should be able to avoid this fear by asking only for limited license. For example, a license can expire after 1 year, or be untransferable (or perhaps expire at bankruptcy?). Facebook does this to some extent: "This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it." Here's what Heroku does: "Heroku claims no ownership or control over any Content or Application. You retain copyright and any other rights you already hold in the Content and/or Application, and you are responsible for protecting those rights, as appropriate. By submitting, posting or displaying the Content on or through the Heroku Services you give Heroku a worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute such Content for the sole purpose of enabling Heroku to provide you with the Heroku Services. [...]" (IANAL)
jacobevelyn 10y ago
Disclaimer: I'm not a lawyer, but I did write my company's privacy policy with approval by lawyers. A lot of companies' privacy policies have a section explicitly dealing with how data is transferred when company ownership changes. Sometimes this just says that all data will be transferred, but sometimes there are stipulations (for instance, my company doesn't sell or rent user data for marketing purposes, and its privacy policy requires that an acquiring company won't do that either). Of course, there are edge cases (like what happens if the privacy policy changes) that complicate things, but the FTC has a pretty helpful discussion of all of this: https://www.ftc.gov/news-events/blogs/business-blog/2015/03/mergers-privacy-promises https://www.ftc.gov/news-events/blogs/business-blog/2015/03/...
macavity23 10y ago
I raised this point with my lawyer recently. His view is that this is essentially impossible - any rules in the company articles can be rewritten or dropped at the whim of the acquirer. Some technical solutions might be possible, in terms of allowing users provably to withdraw their data, but it would be messy and probably not bulletproof.

nkw 10y ago

Lawyer here. Not my area of speciality but off the top of my head (and after thinking about it for all of 30 seconds) that strikes me as a surprisingly hard thing to do. Bankruptcy courts have extremely broad powers to administer the assets of debtors including disavowing contracts. There may be some way to do a structure where the data is escrowed with a 3rd party and the subject company is just holding the data as some sort of fiduciary, but I'm not sure anything like that has been tested. I would want to consult a bankruptcy expert to really figure something like this out.

methehack 10y ago
Super helpful -- thanks for chiming in. I think its really interesting that this isn't worked out yet. It feels like there should be a way to say to a consumer "I'm just looking after your data -- you still own it, etc. Even if I go bankrupt or get bought, I can't change that and the acquiring company should consider that when valuing me." I mean, banks do it with money (and other assets). One bank buys another and there's no way for it say "Now your money is mine! Muwahaha". Feels like it's a whole missing regulatory / legal area to me.
avivo 10y ago
What if Kite can't legally use the data for alternative purposes? I don't think disavowing a contract via a bankruptcy would let a company sell assets they don't own. So Kite should be able to avoid this fear by asking only for limited license. For example, a license can expire after 1 year, or be untransferable (or perhaps expire at bankruptcy?). Facebook does this to some extent: "This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it." Here's what Heroku does: "Heroku claims no ownership or control over any Content or Application. You retain copyright and any other rights you already hold in the Content and/or Application, and you are responsible for protecting those rights, as appropriate. By submitting, posting or displaying the Content on or through the Heroku Services you give Heroku a worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute such Content for the sole purpose of enabling Heroku to provide you with the Heroku Services. [...]" (IANAL)

jacobevelyn 10y ago

Disclaimer: I'm not a lawyer, but I did write my company's privacy policy with approval by lawyers. A lot of companies' privacy policies have a section explicitly dealing with how data is transferred when company ownership changes. Sometimes this just says that all data will be transferred, but sometimes there are stipulations (for instance, my company doesn't sell or rent user data for marketing purposes, and its privacy policy requires that an acquiring company won't do that either). Of course, there are edge cases (like what happens if the privacy policy changes) that complicate things, but the FTC has a pretty helpful discussion of all of this: https://www.ftc.gov/news-events/blogs/business-blog/2015/03/mergers-privacy-promises https://www.ftc.gov/news-events/blogs/business-blog/2015/03/...

macavity23 10y ago

I raised this point with my lawyer recently. His view is that this is essentially impossible - any rules in the company articles can be rewritten or dropped at the whim of the acquirer. Some technical solutions might be possible, in terms of allowing users provably to withdraw their data, but it would be messy and probably not bulletproof.