Bankruptcy Sales and the Consumer Privacy Ombudsman

Selling customer data in bankruptcy can require a court-appointed consumer privacy ombudsman under 11 U.S.C. §§332 and 363, and Texas adds its own limits for genomic data. This guide explains when the ombudsman is required and how to structure sale terms that protect privacy.

What the law requires

Bankruptcy does not turn customer information into an unrestricted asset. If a debtor gave customers a privacy policy that prohibits transferring personally identifiable information to unaffiliated persons, and the policy was in effect when the case began, the information may be sold or leased only if (11 U.S.C. 363(b)(1)):

• the sale is consistent with the policy; or
• after a consumer privacy ombudsman is appointed and a hearing is held, the court approves the sale, giving due consideration to the facts and finding no showing that the sale would violate applicable nonbankruptcy law.

When a hearing is required, the United States trustee must appoint the ombudsman no later than 7 days before it begins (11 U.S.C. 332(a)). The ombudsman may tell the court about the debtor's privacy policy, the potential privacy losses or gains to consumers, the potential costs or benefits to consumers, and alternatives that would reduce harm (§332(b)). The role is advisory, but ombudsman reports often shape the sale order's conditions on notice, deletion, use, and security.

Texas rules

Since September 1, 2025, a covered entity may not sell or transfer Texans' genome sequencing data in a bankruptcy or Chapter 11 reorganization to a foreign adversary, a state-owned enterprise of one, or a company domiciled in or controlled from one (Health & Safety Code §174.006). The buyer also remains bound by the Texas Data Privacy and Security Act's purpose limits (§541.101(b)(1)) and by chapter 521's duty to protect sensitive personal information (Bus. & Com. Code §521.052).

In the 23andMe bankruptcy (Bankr. E.D. Mo., No. 25-40976), the court approved the sale of the company and its genetic data to TTAM Research Institute for $305 million on June 27, 2025, over the objections of Texas and four other states.

Related topics

• Privacy in M&A: Data Is an Asset With Conditions
• Data Licenses, Transactions, and Data as an Asset
• Texas v. 23andMe (bankruptcy court)
• What Is the Texas Genomic Act

Sources and legal update

• 11 U.S.C. §332
• 11 U.S.C. §363(b)(1)
• Texas Health & Safety Code §174.006
• Texas Business & Commerce Code §§521.052, 541.101(b)(1)

Current through October 12, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.