In Re Southern Pacific Personal Loans Ltd [2013] EWHC 2485 (Ch) Mr Justice David Richards had to consider the relationship between the Data Protection Act 1998 and the winding-up of insolvent companies and the duties of liquidators.
The application before the court (made under the Insolvency Act 1986, s 112) aimed to establish the extent of the duties owed by the joint liquidators under the Data Protection Act 1998.
Southern Pacific was part of the Lehman Bros group and had collapsed into insolvency. It held a good deal of data about redeemed loans. That data had become the subject of much interest as it was relevant to the improper selling of PPI. The company was receiving so many data subject access requests, each of which cost it about £500, that the distribution of assets to creditors was being affected. The overall concern of the joint liquidators was that they or the company should not be required to continue to hold data relating to the redeemed loans or to continue to incur the costs associated with responding to requests for information, whether made under s 7 of the DPA or otherwise. The first question on which they sought guidance was whether they were ‘data controllers’ within the meaning of the Act. They also sought the court’s authorisation for the disposal of all the personal data that they controlled as liquidators.
As to the first question, the court determined that the liquidators were merely acting as agents of the company and therefore were not data controllers within the meaning of s 1(1) in respect of the data processed by the company prior to its liquidation. As to disposal of personal data, since all the data still held on behalf of the company related to redeemed loans and was no longer required for any business of the company or for any purposes of the liquidation, such as the realisation of assets then, in the absence of special circumstances, the fifth data protection principle (that personal data shall not be kept for longer than is necessary) applied and effectively required that the data held on behalf of the company should be disposed of as soon as possible. The judge highlighted two qualifications to this principle:
· the liquidators must retain sufficient data to enable them to deal with any claims that may be made in the liquidation – the liquidators plan to advertise for claims against the company, inviting claimants to submit proofs and setting a date by which such proofs must be lodged, was endorsed.
The judge remarked that:
‘The liquidators are not under a duty to retain data so that it can remain available to be mined by former customers or claims handling companies with a view to making claims against third parties.’
The judge went on to deal with the difficult interim period and made some interesting observations on data subject access requests:
In conformity with the 1981 Convention and the Directive, the purpose of s.7, in entitling an individual to have access to information in the form of his “personal data” is to enable him to check whether the data controller’s processing of it unlawfully infringes his privacy and, if so, to take such steps as the Act provides, for example in ss.10 to 14, to protect it. It is not an automatic key to any information, readily accessible or not, of matters in which he may be named or involved. Nor is to assist him, for example, to obtain discovery of documents that may assist him in litigation or complaints against third parties. As a matter of practicality and given the focus of the Act on ready accessibility of the information – whether from a computerised or comparably sophisticated non-computerised system – it is likely in most cases that only information that names or directly refers to him will qualify. In this respect, a narrow interpretation of “personal data” goes hand in hand with a narrow meaning of “a relevant filing system”, and for the same reasons (see paras [46-51] below). But ready accessibility, though important, is not the starting point.
“The obligation imposed by section 7(1)(c)(i) must be complied with by supplying the data subject with a copy of the information in permanent form unless –
(a) the supply of such a copy is not possible or would involve disproportionate effort, or
(b) the data subject agrees otherwise;
and where any of the information referred to in section 7(1)(c)(i) is expressed in terms which are not intelligible without explanation the copy must be accompanied by an explanation of those terms.”
