End of gay teen Web site sparks privacy concerns

A now-defunct Web site that catered to gay youth is now ensnared in a federal bankruptcy proceeding that the founder says could result in as many as 1 million profiles being sold to creditors, putting its former subscribers' privacy at risk.

XY, which billed itself as a young gay men's magazine and could be found at XY.com, ceased publishing in 2007. Its founder filed for bankruptcy protection earlier this year, which could put names, addresses, e-mail addresses, unpublished personal stories, and other information about gay minors into creditors' hands.

The Federal Trade Commission recently expressed its concerns, saying in a letter to creditors and attorneys involved in the case that "any sale, transfer, or use" of XY's personal information "raises serious privacy issues and could violate" federal law.

XY's creditors have hired a lawyer to obtain the personal information held by the magazine and Web site. But because XY.com's privacy policy said that "We never give your info to anybody," any personal data should be "destroyed," wrote David Vladeck, the head of the FTC's bureau of consumer protection, in a letter this month.

The question of who owns personal data collected by a failed company--and what should be done with it--is not exactly a new question.

A decade ago, as the dot-com bubble collapsed, failed companies scrambled to sell assets to appease creditors. In 2000, Boo.com sold its customer list to Fashionmall.com. The same year, Toysmart.com, majority-owned by the Walt Disney Co., tried to follow suit, but abandoned its plans following pressure from state attorneys general.

But none of those bankruptcy proceedings included information as sensitive as the customer list for a magazine and Web site that targeted gay youth between 13 and 17 years old who were in the process of grappling with their sexual identity.

In February 2010, XY founding editor Peter Ian Cummings filed a personal bankruptcy petition in federal court without using a lawyer. He listed a vehicle worth $1,500 and zero income, saying he is now a graduate student "living mostly on student loans and small loans from friends and family." Cummings said he has "lived with friends" and has had "no fixed abode for the last three years," and has even lived in his car.

The only significant asset Cummings listed is the "customer list, personal data, and editorial and back issue files of XY Mag and XY.com." Cummings says he believes that giving the information to his creditors violates California privacy law and the FTC Act, which prohibits deceptive business practices.

It's not quite clear what happens next. Cummings appears to have personally guaranteed some of the loans or investments made by his business partners, including Peter Larson and Martin Shmagin. Larson could not be immediately located on Monday; Shmagin, who is owed about $180,000, did not respond to a request for comment.

Shoshana Schiff, a partner with the Trenk law firm who is representing the court-appointed bankruptcy trustee, told CNET that: "Any property listed on the debtor's bankruptcy petition is property of the bankruptcy estate and my client intends to administer those assets for the benefit of creditors."

In a motion filed in bankruptcy court in May, Shmagin and Larson said they may sue XY founder Cummings for fraud if he does not turn over the personal data. "The ownership dispute has not been resolved," they wrote. "Until resolved, the prospect of litigation as to the ownership of the assets remains outstanding."

And a subsequent filing from Shmagin and Larson says that "regardless of the debtor's privacy concerns, altruistic or not, the fact remains that movants have fraud claims" that could yet be the subject of a separate lawsuit.

Ari Schwartz, vice president of the Center for Democracy and Technology in Washington, D.C., said that it makes sense for the bankruptcy judge to appoint a consumer privacy ombudsman in cases like this. Changes to federal privacy law in 2005 permit judges to select an ombudsman if a "policy prohibiting the transfer of personally identifiable information about individuals" exists.

Update 5:55 p.m. PDT: Schiff sent me mail about a bankruptcy trustee saying: "To my knowledge, one has not been appointed." I haven't found any record of one being named either. (There has been no response yet from the other parties I contacted.)

Here are two excerpts from the letter sent by the FTC suggesting that, in the agency's view, there might be little room for a bankruptcy trustee to permit the data transfer: "Due to the nature of the information, the passage of time, and the closure of the magazine and Web site in 2007 and 2009, respectively, the continued use of the data may pose privacy risks not reasonably contemplated by subscribers when they provided the data, and not consistent with their course of dealing with the company."

"With regard to the street addresses collected by XY, many of these were provided by minors living with their parents or others who may have been unaware of their sexual orientation. With the passage of time since the magazine and Web site's demise, many of these minors may have moved. At the time the Web site and magazine were operational, minors who moved, especially those concerned about the confidentiality of their subscriptions, were able to go online to update promptly any change of address. Former subscriber expectations, however, have likely changed over the past several years. They do not expect to receive any future communications from XY. The magazine has ceased publication and has been dormant for three years. The Web site no longer functions, making it impossible to update any changes of address, even if there were an expectation that future communications might occur. Accordingly, any effort to contact former subscribers via mail now carries the risk of unintentionally revealing their sexual orientation to individuals residing at the former subscribers' addresses."