Data privacy at the point of failure: key issues in an insolvency context

There have been a number of high-profile insolvencies this year involving data-heavy businesses, most recently TalkTalk and Harvey Nichols. Personal data can be one of a failed business’s most valuable assets but can also present a significant compliance risk. 

Formal insolvencies aim to preserve and/or realise value for creditors, most commonly through administration (a rescue-oriented process) or liquidation (a terminal process where the company’s assets are realised and distributed to creditors). In each, the company continues to hold its assets and liabilities while the administrator or liquidator exercises statutory powers, including those previously vested in the directors. 

We have considered some of the key data privacy issues in an insolvency context below.

Who is the controller?

Under the UK GDPR, the controller test is functional: it looks at who actually decides why and how personal data is processed. Whether an insolvency practitioner (an administrator or liquidator) is a controller is therefore fact-specific and must be assessed activity-by-activity. 

The leading case, Re Southern Pacific Personal Loans, held that a liquidator often acts as the company’s agent rather than as a separate controller, though some statutory duties (such as adjudicating proofs of debt) are performed as principal. Green v SCL Group (2019) applied the same reasoning to administrators. However, both cases concerned pre-insolvency processing under the Data Protection Act 1998, so the position under the UK GDPR and the Data Protection Act 2018 (DPA 2018) remains untested. In practice, the safest course is to revisit the controller question for each new processing activity after appointment. 

Group structures add a further layer of complexity. Where systems are shared but only part of the group is insolvent, previously uncontroversial intra-group data sharing can become more complex. Each group entity’s role as controller, joint controller or processor must be established, as this affects access, the lawful basis for sharing and the corresponding contractual arrangements required. 

Focus on what changes

Appointment of an insolvency practitioner does not mean revisiting the lawful basis for every processing activity: where processing continues for the same purpose, the existing basis still applies. The focus should be on new purposes arising from the insolvency, such as imaging devices to secure books and records or reviewing potential claims against directors. Existing privacy notices also need checking: insolvency being public is unlikely, on its own, to justify relying on exemptions to the UK GDPR transparency provisions for new processing activities. 

The DSAR conundrum

Insolvency tends to drive an increase in DSARs, as individuals assess potential mis-selling claims or simply want their data before it is lost. The spike often starts before formal insolvency, so practitioners can inherit a backlog just as access to key HR, legal and IT staff becomes harder. 

The ICO's action against 23andMe (see our previous blog) made clear that insolvency does not absolve an organisation from complying with the UK GDPR, yet response costs are borne by the estate ahead of most creditors. The Green judgment proposes a two-stage approach to help insolvency practitioners balance these conflicting requirements: does assisting serve creditors generally or discharge statutory duties, and, if assistance is refused, would that unfairly harm the individual as a creditor? This is not an exemption from the UK GDPR however: non-fulfilment of DSARs would still be a breach of those requirements.

Buying distressed data

Distressed sales are usually asset sales, so datasets move to a new controller, on a largely non-recourse basis, and purchasers may even be asked to indemnify the insolvency practitioners for post-completion privacy compliance. Due diligence therefore remains important, even on compressed timetables. Purchasers should check the provenance and permitted uses of key datasets, test that planned use is compatible with what individuals were told, and should not assume that marketing consents transfer with customer lists.

Outlook

Data protection obligations do not pause on insolvency but must be balanced against insolvency practitioners' duties to creditors. For practitioners and purchasers alike, early identification of privacy issues remains the most effective way to preserve value while managing regulatory risk. 

If you would like further information, please see our briefing, a version of which was first published in Privacy Laws & Business UK Report, or our latest Digital Horizon Scanning podcast.