Southern Pacific Personal Loans Ltd, Re

This application raises issues concerning the relationship between the Data Protection Act 1998 and the winding-up of insolvent companies and the duties of liquidators.

The application is made by the joint liquidators of Southern Pacific Personal Loans Limited (the company) under section 112(1) of the Insolvency Act 1986 for the determination of certain questions and consequential directions. There is no respondent named to the application, but the Information Commissioner (the Commissioner) was notified of the application and provided with the application notice and supporting evidence. At the invitation of Roth J in a letter dated 9 July 2013 which drew attention to the potentially wide-reaching implications of any declaration the court might make, the Commissioner has appeared by counsel and made representations. I am very grateful to the Commissioner and his counsel for the assistance which they have provided.

Before referring to the detail of the issues raised for determination by this application, it is convenient to set out the circumstances in which they arise.

The company is a member of the Lehman Brothers group of companies. It did not go into any insolvency process at the time of the collapse of the Lehman group in September 2008, when the principal operating companies in the United Kingdom were placed in administration. It entered creditors’ voluntary liquidation on 4 September 2012 and the applicants were appointed joint liquidators.

The company was incorporated in October 2000 and its business comprised the provision of personal loans to individuals resident in Great Britain, secured by way of second charge on their homes. It ceased making loans in about September 2007. It appears that all loans were provided through independent brokers who introduced borrowers to the company. Once loans were made, the company generally held the loans and supporting security on trust for various special purpose vehicles for inclusion in securitisation transactions. The special purpose vehicles were entitled to call for a transfer of the legal title to the loans and supporting security and did so in about August 2010. The company complied with those requirements and retained no further connection, legal or beneficial, with the transferred loans. The company continued to hold the legal title to loans and supporting security only in those cases where the loans had been redeemed prior to the date of the transfers (redeemed loans).

From the start of its business, the company collected and retained data relating to its borrowers. The data included names and addresses, the amount of loans, the borrowers’ repayment records and details of proceedings brought against them by third parties. The data clearly comprises or includes “personal data” for the purposes of the Data Protection Act 1998 (the DPA). The company was a “data controller” within the meaning of the DPA and was and remains registered as such.

From 2006 the data in question was stored with a loan servicing company called Acenden Limited (Acenden), which is also a member of the Lehman group. Acenden continues to hold the data relating to the redeemed loans for the company. Acenden performed various servicing activities in respect of loans made by the company. They included dealing with customer enquiries, monitoring and collecting loan repayments, initiating legal action for loans in default, handling complaints, producing annual statements and quarterly arrears statements, retaining records of mortgage files and correspondence and processing data subject access requests (DSARs) made under the DPA. It was a “data processor” for the purposes of the DPA and was and remains registered as such.

Following transfer of the live loans to the special purpose vehicles in 2010, the data with respect to those loans has ceased to be retained by or for the company. Acenden continues to hold data in respect of the redeemed loans. This comprises approximately 50,000 files, of which approximately 32,000 are held both electronically and in paper form and the remainder are held in paper form only.

The data held for the redeemed loans is, of course, no longer required for the purpose of administering those loans. However, the company continues to receive DSARs made under section 7 of the DPA and other requests for information or copies of documents. Generally speaking, both the DSARs and the other forms of request are generated by claims handling companies on behalf of customers. They are usually blanket requests for a complete set of statements for the accounts held by the customer in question. All, or the great majority of, such requests appear to share the common purpose of enabling the claims management companies to determine whether or not they consider the customer to have any sort of viable claim, usually in the context of having taken out a personal protection insurance (PPI) policy in connection with the loans from the company. PPI policies were not sold by the company nor were they required by the company. But, in a number of cases, PPI policies were sold by the brokers to borrowers. When a DSAR or other request is received, Acenden forwards the relevant data to Solex Legal Services Limited (Solex) which provides legal processing services to the company.

The statutory fee payable on the making of a DSAR is £10. The cost of complying with each such request is approximately £455, exclusive of VAT and exclusive of any fee payable to Acenden which has yet to be negotiated and agreed. Since the date of its liquidation, the company has been receiving approximately 88 DSARs per month, resulting in an average monthly cost of over £40,000. Extrapolated over a year, and including a figure for Acenden’s fee, this would involve a cost to the company of some £589,000. A continuation of costs at this level would have a material impact on the distribution of available funds to creditors of the company. The total estimated amount of liabilities, not all of which have yet been admitted to proof, is some £10,297,000 and the company currently has approximately £3,000,000 available for distribution.

The relevant provisions of the DPA may be summarised as follows. Section 1 contains definitions. “Data” extends to data held both in hardcopy and electronic form. “Data controller” is defined to mean

Section 4(4) of the DPA provides that it is the duty of a data controller to comply with “the data protection principles” in relation to all personal data for which he is the data controller. The data protection principles are set out in part 1 of schedule 1 to the DPA. They include that personal data must be processed fairly and lawfully, that it shall be obtained only for one or more specified and lawful purposes and not further processed in any manner incompatible with such purpose or purposes, that it shall be adequate, relevant and not excessive in relation to the purpose or purposes for which it is processed, and that it shall be accurate and, where necessary, kept up to date. Principles 5 and 6 are as follows:

Section 7 sets out the rights of access that individuals enjoy as regards personal data held in respect of them. Section 7(1) provides, so far as relevant, as follows:

to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that controller,

if that is the case, to be given by the data controller a description of –

the personal data of which that individual is the data subject,

the purposes for which they are being or are to be processed, and

the recipients or classes of recipients to whom they are or may be disclosed,

to have communicated to him in an intelligible form –

the information constituting any personal data of which that individual is the data subject, and

any information available to the data controller as to the source of those data

Section 7(8) requires a data controller to comply with a request promptly and in any event within 40 days or such other period as may be prescribed after receipt of the request. This requirement is enforceable by two means. First, the court may order compliance on an application made under section 7(9). Secondly, on the basis that a failure to comply with a DSAR would contravene paragraph 6 of the data protection principles, the Commissioner may serve the data controller with an enforcement notice under section 40, requiring the data controller to comply with the request. The exercise of these powers by the court and the Commissioner are in both cases discretionary. In addition, under section 13, an individual who suffers damage by reason of any contravention by a data controller of any requirement of the DPA is entitled to compensation from the data controller. Section 13(3) provides that it is a defence to any such claim to prove that the data controller had taken such care as in all the circumstances was reasonably required to comply with the relevant obligation.

The overall concern of the joint liquidators of the company is that they or the company should not be required to continue to hold data relating to the redeemed loans or to continue to incur the costs associated with responding to requests for information, whether made under section 7 of the DPA or otherwise.

The questions which the joint liquidators seek to have determined are set out in paragraph 1 of the application notice:

Whether or not Ian Christopher Oakley Smith and Julian Guy Parr (together, “the Liquidators”) are ‘data controllers’ within the meaning of section 1(1) of the Data Protection Act 1998 (“the DPA”).

If question 1(a) is determined in the affirmative, whether or not the liquidators may refuse to comply with requests made by ‘data subjects’ (under section 1(1) of the DPA) made pursuant to section 7(1) of the DPA.

Alternatively to question 1(b), whether or not the Liquidators may dispose of all ‘personal data’ (under section 1(1) of the DPA) in their control in their capacity as Liquidators of Southern Pacific Personal Loans Limited (“the Company”).

Alternatively to questions 1(b) and 1(c), whether or not the Liquidators may disclaim the personal data in their control, and thereby cease to be data controllers of the same.

The first question asks baldly whether the joint liquidators are “data controllers” for the purposes of the DPA. They are in fact both registered as data controllers for the purposes of duties which they may undertake as liquidators or other office holders in respect of insolvent companies or individuals. Some of the duties of a liquidator are undertaken by him as principal in that capacity and not on behalf of the company of which he is the liquidator. For example, where he receives and adjudicates upon proofs of debts submitted by those claiming to be creditors of the company, he does so as the liquidator and not as an agent of the company. Data, some of which is likely to be personal, will be processed and retained by the liquidator in the course of performing those duties. It follows that he is required to register as a data controller. Registration as a data controller is a single event and covers all activities in relation to data coming within the DPA, irrespective of the capacity in which he undertakes those activities. Accordingly, an insolvency practitioner will be registered once as a data controller, irrespective of the number of his appointments as an office-holder.

The issue is not whether the joint liquidators are data controllers in respect of data processed by them when acting in their capacity as joint liquidators. The issue is whether they are data controllers as regards the data processed by the company in respect of the redeemed loans. The data was collected at a time when the company was carrying on business and was held by it at the time it went into liquidation. Section 5(1) of the DPA provides that the Act applies to a “data controller” in respect of any data only if “(a) the data controller is established in the United Kingdom and the data are processed in the context of that establishment…” The company was therefore a data controller in respect of the data because it was established in the United Kingdom and it processed the data in the context of that establishment.

Any decisions taken by the company before the commencement of its liquidation in respect of data processed by it were taken by or on the authority of the directors. The directors do not act in a personal capacity but as agents of the company. A decision taken by them is the decision of the company. Given the definition of “data controller” as a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed, it might be argued that the directors as persons who in fact determine the purposes for which any personal data are to be processed on behalf of their company are within the definition. Correctly, however, it is not suggested by the Commissioner that the directors of a company are, by virtue of their position and authority as directors, data controllers. The person who determines the purposes for which and the manner in which data are to be processed is the company, albeit acting by its directors. Save as agents for the company, the directors do not make any determination, either alone or jointly or in common with their company. It is therefore the company alone which is the data controller. The DPA contains some measure of control over directors by providing in section 61(1) that where an offence under the Act is committed by a body corporate with the consent or connivance of or as a result of any neglect on the part of any “director, manager, secretary or similar officer of the body corporate”, he as well as the body corporate is guilty of the offence.

The issue is whether the commencement of a liquidation and the appointment of a liquidator renders the liquidator, in place of or in addition to the company, a data controller in respect of data processed by the company. For this to be the case, the relevant decisions as regards the processing of such data must be taken by the liquidator as principal in his capacity as an office-holder rather than as agent of the company, thereby distinguishing him from the position of directors prior to the liquidation.

As I have earlier mentioned, there are duties imposed on liquidators by statute which he will perform in his capacity as the liquidator rather than as an agent for the company. However, there are many respects in which the liquidator will act as agent of the company in liquidation. A company continues to exist as a separate entity, notwithstanding that it has entered liquidation. This is expressly provided in the case of a voluntary winding up by section 87(2) of the Insolvency Act 1986 which states that “the corporate state and corporate powers of the company, notwithstanding anything to the contrary in its articles, continue until the company is dissolved.” Legal ownership of the assets of the company remain vested in it. Rights arising from or in connection with the property of the company continue to be exercisable in the name of the company.

Schedule 4 to the Insolvency Act 1986 sets out powers of a liquidator, exercisable subject to such sanction, if any, as is required by sections 165-167. Many of the powers are exercisable on behalf of the company. Examples include:

“Power to bring or defend any action or other legal proceeding in the name and on behalf of the company.

Power to carry on the business of the company so far as maybe necessary for its beneficial winding up.

Power to sell any of the company’s property by public auction or private contract with power to transfer the whole of it to any person or to sell the same in parcels.

Power to do all acts and execute, in the name and on behalf of the company, all deeds, receipts and other documents and for that purpose to use, when necessary, the company’s seal.

Power to draw, accept, make and indorse any bill of exchange or promissory note in the name and on behalf of the company, with the same effect with respect to the company’s liability as if the bill or note had been drawn, accepted, made or indorsed by or on behalf of the company in the course of its business.”

The different capacities in which a liquidator may act are illustrated by legal proceedings which may be brought. A company in liquidation may commence or defend legal proceedings in its own name. If it does so it is the company which is the party and not the liquidator. In instructing lawyers to act on behalf of the company in such proceedings, the liquidator acts as the agent of the company. It is for that reason that security for costs may be ordered against a company in liquidation which brings proceedings. This may be contrasted with those proceedings brought by the liquidator in his own name, as provided by various provisions of the Insolvency Act 1986, such as sections 212-214 and 238-239. In those cases it is the liquidator himself who is the party and ordinarily security for costs will not be ordered against him.

The status of a liquidator as, for many purposes, the agent of the company is well recognised in the authorities. It was held in In re Anglo-Moravian Hungarian Junction Railway Company(1875) 1 Ch D 130 that a solicitor appointed by the liquidator of a company in compulsory liquidation had no claim against the liquidator personally for costs due to him. James LJ said at page 133:

Referring to what was said by James LJ in that case, Romer J said in Knowles v Scott[1891] 1 Ch 717 at 723:

The decision of the Court of Appeal in In re Farrow’s Bank Ltd[1921] 2 Ch 164 concerned the attempt by a liquidator to assign a lease without obtaining the consent of the lessor required by the lease, contending that the affect of the liquidation was, by analogy with a bankruptcy, to permit him to assign the lease free of such restriction. The Court of Appeal rejected the liquidator’s case. At page 173, Lord Sterndale MR said that the question turned upon the position of a liquidator in a compulsory liquidation. He referred to the powers of a liquidator now contained in paragraphs 4, 5 and 7 of schedule 4 to the Insolvency Act 1986 and continued:

Stead Hazel & Co v Cooper[1933] 1 KB 840 concerned a contract of sale made with a company which later went into liquidation. The liquidator caused the company to continue to carry on business and to adopt the contract. The sellers failed in their attempt to make the liquidator personally liable on the contract. They argued that a liquidator was in the same position as a receiver and manager appointed by the court, as to which Lawrence J said at page 843:

The position may be illustrated by the consequences of a company in liquidation continuing to occupy premises for the benefit of the liquidation. In such cases it is the company which remains in occupation and it is the company, not the liquidator, that is liable for rent and rates, albeit that they may be payable as expenses of the liquidation: see, as regards rates, In re Toshoku Finance UK plc[2002] 1 WLR 671 at [31] – [34].

The position of the Commissioner is that both the company and the liquidators are, following the commencement of the liquidation, the relevant data controllers. Mr Hopkins, on behalf of the Commissioner, drew attention to the definition of data controller which makes it clear that more than one person can be a data controller in respect of the same data, although he accepted that in the case of a company prior to its liquidation the directors were not data controllers in respect of data processed by the company.

As regards the unique position of liquidators, Mr Hopkins drew attention in particular to two matters.

First, he relied on the duty of liquidators to take into their custody or under their control all the property of the company. Unquestionably this is the first duty of a liquidator, recognised as such in the context of a creditors’ voluntary winding up by section 166(3) which provides:

to take into his custody or under his control all the property to which the company is or appears to be entitled;

to dispose of perishable goods and other goods the value of which is likely to diminish if they are not immediately disposed of; and

to do all such other things as may be necessary for the protection of the company’s assets.”

In my judgment, it cannot be deduced from the duty of a liquidator to get in the assets of the company and the power of the court to order delivery of property to the liquidator that the liquidator will hold the assets of the company as principal or as co-principal with the company. The provisions of the insolvency legislation taken as a whole, including those to which I have earlier referred, show that title to the assets of the company remains with the company notwithstanding its liquidation. In taking control of the company’s property, just as in dealing with it, the liquidator is not acting as principal but as agent, replacing the control formerly exercised by the board.

Secondly, Mr Hopkins relied on the purpose for which liquidators exercise their powers. They do so in order to give effect to the statutory scheme for the realisation of the company’s assets and the distribution of their proceeds among the creditors and, in the event of a surplus, among the members of the company. Unlike directors, they are not acting in the interests of the company as a separate entity or in the interests of its members. In an insolvent winding up they are primarily acting in the interests of creditors. It is undoubtedly true that the commencement of a liquidation brings into effect a scheme as regards the company and its property which is fundamentally different from that which existed prior to its liquidation. The beneficial ownership of the assets of the company is suspended pending the implementation of the statutory scheme: see Ayerst v C & K (Construction) Ltd [1976] AC 167. It does not, however, follow that in exercising his powers and fulfilling his duties in respect of the property of the company, the liquidator is acting as principal. As the authorities establish, he does so as agent for the company, in whose ownership the property remains vested, albeit not for the benefit of the company but in order to give effect to the statutory scheme.

The data to which this case relates belonged to or was under the control of the company when it went into liquidation. Ownership of data may be a complex subject, but it cannot be doubted that intellectual property rights in respect of the relevant data were vested in the company, which may also have been the owner of the paper files held by Acenden as the data processor. Those property rights and all rights to control the data remained vested in the company at and following its liquidation. It follows, in my judgment, that in exercising any rights in respect of the data, including those which define the role of a data controller, the liquidators would be acting as the agents of the company.

I will accordingly determine that the joint liquidators of the company are not data controllers within the meaning of section 1(1) of the DPA in respect of the data processed by the company prior to its liquidation.

The joint liquidators in this case are liquidators in a voluntary winding up. The position of a liquidator in a compulsory winding up is not identical to that of a voluntary liquidator but they are not fundamentally different. As Lord Diplock said in Ayerst at page 176:

The declaration I am making on this application relates to voluntary liquidators, but I do not think that the position is different as regards liquidators in a compulsory winding up. The continued ownership by a company of the legal title to its assets, the powers conferred by schedule 4 on liquidators and the capacities in which liquidators act are generally the same in both types of liquidation. Section 143(1) of the Insolvency Act 1986 provides that “the functions of the liquidator of a company which is being wound up by the court are to secure that the assets of the company are got in, realised and distributed…” Section 144(1) provides that “when a winding-up order has been made…the liquidator…shall take into his custody or under his control all the property and things in action to which the company is or appears to be entitled.” The liquidator must secure or take control of the assets of the company but they are not vested in him, as is made clear by section 145 which expressly provides that the court may on the application of a liquidator in a compulsory liquidation direct that all or any part of the property belonging to the company shall vest in the liquidator by its official name. The authorities to which I have referred deal with compulsory as well as voluntary liquidations and make clear that as regards the status of the liquidator there is no material difference between them.

The importance of this determination is that the liquidators are not personally responsible for compliance with the provisions of the DPA in respect of the data processed by the company, including but not limited to responding to DSARs made under section 7. They are nonetheless concerned to have the remaining questions in the application notice determined, to the extent necessary, as they affect the company. When DSARs are served on the company, it remains under a statutory obligation to deal with them provided that they are properly made under section 7. Enforcement action might be taken and orders might be made against the company, notwithstanding that it is in liquidation.

I will turn to question (c) before saying anything about (b) or (d). As I have earlier mentioned, all the data still held on behalf of the company relates to redeemed loans. None of it is any longer required for any business of the company or for any purposes of the liquidation, such as the realisation of assets. Mr Hopkins on behalf of the Commissioner submitted that in some cases the cessation of the relevant business would not immediately entitle the data controller to dispose of the relevant data. The need to scrutinise what the data controller has done with data under its control or the protection of the personal position of employees are examples which he gave of circumstances where it might be necessary to retain data. The Commissioner, however, accepts that in this case there are no such features present. Accordingly the fifth data protection principle, that personal data shall not be kept for longer than is necessary for the purpose or purposes for which it was processed, requires that the data held on behalf of the company should, looking at the matter purely from a DPA angle, be disposed of as soon as possible.

There are two qualifications to this, one arising under the DPA and the other arising in the context of possible claims in the liquidation. As to the first, the company must retain sufficient data to enable it to respond to DSARs made to the company before the disposal of the data. Section 8(6) provides that information to be supplied pursuant to a request under section 7 “must be supplied by reference to the data in question at the time when the request is received”. The second qualification is that the liquidators must retain sufficient data to enable them to deal with any claims that may be made in the liquidation. So far as the liquidators’ researches have gone, it does not appear that there are grounds on which PPI mis-selling claims could be made against the company. It was not itself involved in selling or promoting PPI policies. It may be the case that claims could be made against the brokers who sold such policies, and it appears from the requests which have been received by the company since it went into liquidation that their purpose is to obtain as much information as possible so as to determine whether any possible claims may be made. In these circumstances, the right course, which the liquidators propose to adopt, is to advertise for claims against the company, inviting claimants to submit proofs and setting a date by which such proofs must be lodged. Provided that adequate publicity is given to such notification and sufficient time allowed for the submission of proofs, the liquidators will be entitled to proceed with the distribution of assets without regard to any possible claims which have not been notified to them. Consistently, they will be entitled to dispose of all the data regarding redeemed loans, save for such data as is required to deal with such claims as may be lodged. The liquidators are not under a duty to retain data so that it can remain available to be mined by former customers or claims handling companies with a view to making claims against third parties.

Accordingly, subject to the qualifications which I have mentioned, I shall direct that the liquidators may dispose of all personal data in respect of which the company is the data controller, such data to be disposed of in a manner which complies with the DPA.

In the light of my answer to the question raised in paragraph (c), it is unnecessary to provide a final determination of the question raised in paragraph (b). It is likely that the company will continue to receive DSARs until the liquidators are in a position to dispose of the data, but their likely number is not so great as to make it appropriate to resolve the difficult issues arising under this question and provide a final determination. I will, however, outline the issues which were raised.

As a preliminary observation, it should be noted that the right of a data subject to seek information under section 7 is a right to request the information specified in section 7(1), it is not a right to require copies of documents. It may be that a data controller will decide to meet a request by supplying a copy of a document, but that is not the entitlement of the data subject. In many of the requests received by the company since its liquidation, the requests have been for complete copies of all documents held on file in respect of the relevant customer. Section 7 imposes no obligation on the company as the data controller to provide copies of documents.

Assuming that the DSAR was framed appropriately and accompanied by the prescribed fee, the liquidators advanced two grounds for suggesting that nonetheless the company would not be required to respond to the requests.

It was submitted, first, that since the apparent purpose of all or most of the requests was to collect information with a view to making claims in respect of possible PPI mis-selling, the requests were not made for a purpose for which the right was created and accordingly the company as data controller was entitled to refuse to comply with the request. In support of this submission, Ms Hilliard QC, on behalf of the liquidators, relied in particular on what was said by Auld LJ in Durant v Financial Services Authority[2003] EWCA Civ1746, [2004] FSR28 at [27]:

It should, however, be noted that this paragraph appears in the section of the judgment of Auld LJ dealing not with whether the validity of a DSAR can depend on the purpose for which it is made but on an issue as to what constitutes “personal data” for the purposes of the DPA. A further issue, which in the light of the conclusions of the Court of Appeal on the other issues was no longer live, was whether in the circumstances of the case the court at first instance had been right to exercise its discretion against ordering compliance with the claimants’ request under section 7(9). It was submitted for the appellant that the court had been wrong to take account of the purpose of the request and that the court had given undue weight to the proposition that the primary purpose of the Act was to enable people to check the accuracy of their personal data. Auld LJ confined his comments to saying that he considered that the discretion conferred by section 7(9) was “general and untrammelled”. It would follow that a court could take account of the purpose for which the request was made in considering the exercise of its discretion under section 7(9) but I do not consider that Durant v Financial Services Authority is authority, one way or the other, for the proposition that a data controller can refuse to respond to a request under section 7 on the grounds of its purpose. That is an issue which may arise for decision in another case.

The second ground advanced on behalf of the liquidators was based on section 8(2) of the DPA which provides as follows:

the supply of such a copy is not possible or would involve disproportionate effort, or

the data subject agrees otherwise;

Leaving aside difficult issues as to the ambit of the expression “disproportionate effort” in paragraph (a) of that provision and in particular whether it could be shown on the facts of this case, it was accepted on behalf of the liquidators that this provision would be of very limited use to them. It does not qualify the obligation, if it otherwise exists, to provide information in accordance with section 7(1). Section 8(2) imposes a further obligation to supply data pursuant to section 7(1)(c)(i) “in permanent form” unless one or other of the conditions in paragraphs (a) and (b) is satisfied.

If the court were to give a direction as asked in respect of question (b), it would not of course be binding on any data subject who submitted a DSAR or on any court which heard an application under section 7(9) or on the Commissioner in receipt of a request for the service of an enforcement notice under section 40. It would be open to the court, and could be appropriate, to give directions to the liquidators that on certain assumed facts they could reasonably take the position that the company was not required to respond to the request and leave the matter to be determined by the court or the Commissioner if the data subject took the matter further. This would not be, and could not be, a binding determination of the issue, but would be a direction to the liquidators similar to that given to trustees on a Beddoes application. As already explained, I do not consider it necessary or appropriate to give any direction on this particular application.

In the light of my conclusion on question (c), it is clearly unnecessary to determine question (d) and indeed the matter was not fully argued before me. In those circumstances, I shall say nothing about it.

In conclusion, I shall for the reasons given earlier make a declaration that the joint liquidators are not data controllers for the purposes of the DPA as regards the data processed by or on behalf of the company in respect of the redeemed loans. I shall also give a direction that the company acting by its liquidators may dispose of such data in a manner consistent with the DPA subject to the conditions mentioned earlier in this judgment.