TORONTO
Customers were told over the summer and fall that the purchaser, an affiliate of Ad Populum, was being given access to their names, contact and account information, transaction histories and communications.
Ad Populum did not detail what it would do with the data in its email notification and did not respond to requests for comment.
The sale is part of a growing trend where consumer data is treated as a lucrative asset in corporate insolvencies, experts say.
"I definitely see it as a growing issue and one that will become more and more relevant as different types of information get sold," said Dina Kovacevic, editor of Insolvency Insider, a Canadian newsletter covering bankruptcy and creditor protection news.
"Data is the currency. It's going to get wild out there."
By buying emails, addresses and phone numbers, firms do not need to build consumer bases from scratch and the data can make for a more smooth transition if they are revamping a business.
Customers do not always realize their data is up for grabs unless they scour court records or pay attention to the odd news article mentioning it.
Most find out when they receive a letter telling them their data has changed hands and offering them a way to request its deletion.
South of the border, consumer groups and attorneys general have sometimes intervened when data from insolvent companies is up for sale.
"We don't have that same sort of opportunity for involvement," Karbaliotis said. "What we have is ... after the fact, I can withdraw my consent."
Chantal Bernier, a lawyer who was interim privacy commissioner from 2013 to 2014, remembers only one acquisition she worked on where there was public "uproar" about consumer data changing hands.
In that case, a luxury business purchased a rival company selling more affordable goods and customers were concerned transferring data would turn them into targets for upselling.
Bernier's client deleted the data for customers who requested it.
South of the border, consumer awareness may be growing because of two recent deals.
Google has been offering US$10 million for Spirit Airlines data, which reportedly includes 100 million emails, 500 million Microsoft Teams messages and other employee records.
The tech giant wants to use the defunct air carrier's data to train AI systems, but unions and some policymakers are ringing alarm bells.
Then, there's 23andMe, a U.S. firm that used saliva samples to offer global customers insights about their ancestry, genetics and health risks.
When it filed for bankruptcy and put its consumer data up for sale last year, 27 states and the District of Columbia tried to block the move, arguing genetic data is too sensitive to transfer to a new owner without informed customer consent.
Karbaliotis suspects people swung into action because users realized "you can't change your genetic data. Once it's lost, it's lost."
A U.S. court ultimately gave the deal a greenlight, but some think the case was still an aha moment for many consumers.
"A lot of the time when there's a merger or acquisition transaction, you're like whatever, some big company sold my email to some other big company, it doesn't really impact me, but when it's your genetic data that's being sold, it's pretty scary," Kovacevic said.
"You're afraid that the purchaser might use it in some way that you don't want it being used, so that case, I think, became really very real for people."
For Karbaliotis, such incidents are yet another reminder that "before you give people information, you should be thinking about these things."
"Nobody contemplated the risk of insolvency, but everybody should be thinking, 'OK, what happens if this company is sold or goes bankrupt? Could it be acquired by somebody who's, you know, less trustworthy?'" he questioned.
"And how do you remain in control of personal information? Well, don't give it out."
This story was written by the e2gold.ca newsroom from reporting by BNN Bloomberg and CP24. Quotes are checked word for word against that reporting.