Data Controllers, Liquidators and Redeemed Loans

August 13, 2013

In Re Southern Pacific Personal Loans Ltd [2013] EWHC 2485 (Ch) Mr Justice David Richards had to consider the relationship between the Data Protection Act 1998 and the winding-up of insolvent companies and the duties of liquidators

The application before the court (made under the Insolvency Act 1986, s 112) aimed to establish the extent of the duties owed by the joint liquidators under the Data Protection Act 1998. 

Southern Pacific was part of the Lehman Bros group and had collapsed into insolvency. It held a good deal of data about redeemed loans. That data had become the subject of much interest as it was relevant to the improper selling of PPI. The company was receiving so many data subject access requests, each of which cost it about £500, that the distribution of assets to creditors was being affected. The overall concern of the joint liquidators was that they or the company should not be required to continue to hold data relating to the redeemed loans or to continue to incur the costs associated with responding to requests for information, whether made under s 7 of the DPA or otherwise. The first question on which they sought guidance was whether they were ‘data controllers’ within the meaning of the Act. They also sought the court’s authorisation for the disposal of all the personal data that they controlled as liquidators.

As to the first question, the court determined that the liquidators were merely acting as agents of the company and therefore were not data controllers within the meaning of s 1(1) in respect of the data processed by the company prior to its liquidation. As to disposal of personal data, since all the data still held on behalf of the company related to redeemed loans and was no longer required for any business of the company or for any purposes of the liquidation, such as the realisation of assets then, in the absence of special circumstances, the fifth data protection principle (that personal data shall not be kept for longer than is necessary) applied and effectively required that the data held on behalf of the company should be disposed of as soon as possible. The judge highlighted two qualifications to this principle:

·        the company must retain sufficient data to enable it to respond to DSARs made to the company before the disposal of the data;

·        the liquidators must retain sufficient data to enable them to deal with any claims that may be made in the liquidation – the liquidators plan to advertise for claims against the company, inviting claimants to submit proofs and setting a date by which such proofs must be lodged, was endorsed.

The judge remarked that:

‘The liquidators are not under a duty to retain data so that it can remain available to be mined by former customers or claims handling companies with a view to making claims against third parties.’

The judge went on to deal with the difficult interim period and made some interesting observations on data subject access requests:

  1. …It is likely that the company will continue to receive DSARs until the liquidators are in a position to dispose of the data, but their likely number is not so great as to make it appropriate to resolve the difficult issues arising under this question and provide a final determination. I will, however, outline the issues which were raised.
  1. As a preliminary observation, it should be noted that the right of a data subject to seek information under section 7 is a right to request the information specified in section 7(1), it is not a right to require copies of documents. It may be that a data controller will decide to meet a request by supplying a copy of a document, but that is not the entitlement of the data subject. In many of the requests received by the company since its liquidation, the requests have been for complete copies of all documents held on file in respect of the relevant customer. Section 7 imposes no obligation on the company as the data controller to provide copies of documents.
  1. Assuming that the DSAR was framed appropriately and accompanied by the prescribed fee, the liquidators advanced two grounds for suggesting that nonetheless the company would not be required to respond to the requests.
  1. It was submitted, first, that since the apparent purpose of all or most of the requests was to collect information with a view to making claims in respect of possible PPI mis-selling, the requests were not made for a purpose for which the right was created and accordingly the company as data controller was entitled to refuse to comply with the request. In support of this submission, Ms Hilliard QC, on behalf of the liquidators, relied in particular on what was said by Auld LJ in Durant v Financial Services Authority [2003] EWCA Civ1746, [2004] FSR28 at [27]:

In conformity with the 1981 Convention and the Directive, the purpose of s.7, in entitling an individual to have access to information in the form of his “personal data” is to enable him to check whether the data controller’s processing of it unlawfully infringes his privacy and, if so, to take such steps as the Act provides, for example in ss.10 to 14, to protect it. It is not an automatic key to any information, readily accessible or not, of matters in which he may be named or involved. Nor is to assist him, for example, to obtain discovery of documents that may assist him in litigation or complaints against third parties. As a matter of practicality and given the focus of the Act on ready accessibility of the information – whether from a computerised or comparably sophisticated non-computerised system – it is likely in most cases that only information that names or directly refers to him will qualify. In this respect, a narrow interpretation of “personal data” goes hand in hand with a narrow meaning of “a relevant filing system”, and for the same reasons (see paras [46-51] below). But ready accessibility, though important, is not the starting point.

  1. It should, however, be noted that this paragraph appears in the section of the judgment of Auld LJ dealing not with whether the validity of a DSAR can depend on the purpose for which it is made but on an issue as to what constitutes “personal data” for the purposes of the DPA. A further issue, which in the light of the conclusions of the Court of Appeal on the other issues was no longer live, was whether in the circumstances of the case the court at first instance had been right to exercise its discretion against ordering compliance with the claimants’ request under section 7(9). It was submitted for the appellant that the court had been wrong to take account of the purpose of the request and that the court had given undue weight to the proposition that the primary purpose of the Act was to enable people to check the accuracy of their personal data. Auld LJ confined his comments to saying that he considered that the discretion conferred by section 7(9) was “general and untrammelled”. It would follow that a court could take account of the purpose for which the request was made in considering the exercise of its discretion under section 7(9) but I do not consider that Durant v Financial Services Authority is authority, one way or the other, for the proposition that a data controller can refuse to respond to a request under section 7 on the grounds of its purpose. That is an issue which may arise for decision in another case.
  1. The second ground advanced on behalf of the liquidators was based on section 8(2) of the DPA which provides as follows:

“The obligation imposed by section 7(1)(c)(i) must be complied with by supplying the data subject with a copy of the information in permanent form unless –

(a) the supply of such a copy is not possible or would involve disproportionate effort, or

(b) the data subject agrees otherwise;

and where any of the information referred to in section 7(1)(c)(i) is expressed in terms which are not intelligible without explanation the copy must be accompanied by an explanation of those terms.”

  1. Leaving aside difficult issues as to the ambit of the expression “disproportionate effort” in paragraph (a) of that provision and in particular whether it could be shown on the facts of this case, it was accepted on behalf of the liquidators that this provision would be of very limited use to them. It does not qualify the obligation, if it otherwise exists, to provide information in accordance with section 7(1). Section 8(2) imposes a further obligation to supply data pursuant to section 7(1)(c)(i) “in permanent form” unless one or other of the conditions in paragraphs (a) and (b) is satisfied.