"Instead I genuinely hope that YC will force companies taking the 7% into a no selling on data policy"

I did a paper on (sort of) this in law school. My focus was on civil law systems and I'm not claiming I'm the world's foremost expert on this topic.

With that out of the way, it's not that easy. When a company goes bankrupt, it doesn't have a say on what happens to its assets. Furthermore, a liquidator doesn't have to honor commitments made by the company. (this is also why 'software escrow' in the cheap form that is implemented so often is, imo, legally on shaky ground - this was the actual topic of my paper).

So what are the options? One is to put the 'ownership' of customer data (what that means exactly is a whole discussion in itself) into a separate company. But that company can't be owned by the 'real' company, it's tricky in many way. And costly. And makes things (very) difficult, operationally. And it takes away the ownership of a critical asset, making it near impossible to get investment (because who will invest in a company that doesn't 'own' its customer data?) Etc. I don't think anyone follows through on their claims of being 'careful with customer data' to this extent, but then again, of course I don't know the operations of every company in the world.

Basically, once you are in a database of a company, and if that database is worth anything, you are up shit creek when that company goes bust - good intentions and promises do not matter one bit. A new guy comes in who doesn't care about his 'reputation' in the field the company was in, who has a legal duty to get the highest price for any assets, and who is not bound by anything the company did or said. It doesn't take a law degree to figure out how that works out for the 'privacy' of the (former) users/customers.

What about a legal agreement with the users that the information will be deleted before a bankruptcy is filed and if they fail to deliver, then the users are owed so much for failure to deliver on the contract (and this debt is created in such a way it takes priority over other debt). Make the debt big enough that anyone owed money for a reason other than this deal (so investors and such) would see a greater payout by deleting the information and selling the other assets with their normal claim to its worth than by attempting to sell the customer data and split the proceeds with all the users.

Also make it legally solid enough that even if there was a lawsuit, the cost of the lawsuit would be higher than the worth of the data.

Brilliant idea, it's essentially you are giving a permanent license to your info; the problem below is a real one though, the investments we are seeing are often clearly hedged against resale of data... A rather scary market when Stripe will just charge credit cards if you have a users token!

I think a "no selling personal data" policy would make sense...user profiles, email addresses, credit cards, mailing addresses, photos, relationships with other users (e.g., if LinkedIn went out of business they shouldn't be able to sell the list of people to whom I am first-degree connected)

On the other hand, I think that proprietarily-generated data would be fair game if anonymized. A massive data set showing how people's usage of a given service varies based on age, geography, type of phone, whatever -- I think selling that to a third party would be morally and ethically defensible. [0]

There are likely a lot of edge cases here (the LinkedIn example above might be one), and it's an interesting topic. With all that said, recycling all of Homejoy's users' account info into a new enterprise without their explicit consent seems pretty plainly wrong to me.

Prediction: the fact that there's still no word from @sama or @paul probably means that they're working hard to provide a clear and decisive written response to this incident -- probably one that amounts to a new YC policy of some sort.

[0]: IANAL and not sure whether the possibility of an eventual sale of such user-generated data would need to be mentioned in the service's T&Cs from the get-go.

Isn't the ability to collect and sell data a hedge against the huge percentage of companies that are for all practical purposes worthless?

Kind of like a store selling its shelves as it goes out of business. May as well get money for anything that's not nailed down.

yup. and there are many well-funded startups that pivoted to buying/selling data from all the non-rocketships out there.