Southern Pacific Personal Loans Ltd, Re

A liquidator generally acts as agent of the company in dealing with its property and data. The company remains the data controller for personal data processed before liquidation, even though the liquidator controls that data and exercises statutory powers concerning it.

Personal data must not be retained longer than necessary under principle 5 of part 1 of schedule 1 to the Data Protection Act 1998. A liquidator may therefore dispose of data that is no longer required for the company’s business or liquidation, subject to retaining enough data to answer properly made subject access requests already received and to deal with claims in the liquidation. The data protection right of access is a right to information, not generally a right to copies of documents.

The joint liquidators of Southern Pacific Personal Loans Ltd, a company in creditors’ voluntary liquidation, sought directions under section 112(1) of the Insolvency Act 1986. The company retained approximately 50,000 files containing personal data relating to redeemed loans. Requests under section 7 of the Data Protection Act 1998 generated substantial processing costs.

The questions concerned whether the liquidators, rather than or in addition to the company, were data controllers; whether requests could be refused; whether the data could be disposed of; and whether it could be disclaimed. The court determined the data-controller issue and the disposal issue, but left the refusal and disclaimer questions undetermined.

The court determined that the joint liquidators were not data controllers in respect of data processed by or on behalf of the company concerning redeemed loans. It directed that the company, acting by its liquidators, might dispose of that data in a manner consistent with the Data Protection Act 1998, subject to specified qualifications.

1. Capacity of liquidators. A company continues to exist in liquidation and retains legal title to its assets. The statutory powers in schedule 4 to the Insolvency Act 1986, including powers to take control of, deal with and realise company property, are generally exercised on behalf of the company. The liquidator replaces the board’s control but does not thereby become principal or co-principal owner of the assets.
2. The same reasoning applies to personal data. The company remained the data controller because it had determined the purposes and manner of processing before liquidation. In exercising rights concerning the data, the liquidators acted as the company’s agents. The position was not fundamentally different in a compulsory winding up.
3. Retention and disposal. The fifth data protection principle required disposal of data that was no longer needed for the company’s business or the purposes of the liquidation. The company had to retain sufficient data to answer subject access requests received before disposal, because section 8(6) required information to be supplied by reference to the data existing when the request was received.
4. The liquidators also had to retain sufficient data to deal with claims lodged in the liquidation. They were not required to retain data merely so former customers or claims-handling companies could search for possible claims against third parties. After adequate notification and a reasonable opportunity to submit proofs, the liquidators could distribute assets without regard to unnotified claims.
5. The court did not finally determine whether the company could refuse subject access requests based on their purpose. Durant v Financial Services Authority [2003] EWCA Civ 1746 was not authority for either proposition. The right under section 7 was a right to specified information, not an automatic right to copies of all documents. The disclaimer question was unnecessary to decide.