4

I’m considering buying the assets of an insolvent company that has gone into administration / receivership.

Included in the assets is a customer database.

How does GDPR apply?

  • is the purchasing company allowed to contact the customers of the old company?
  • are there specific considerations or rules?
  • do we, effectively, become the legitimate owner/processor of the data?

I’m very cognisant of our responsibilities to the consumers, irrespective of the legalities, in so much as we wouldn’t want to upset or offend them but making inappropriate contact even if it were legal. As it happens the businesses are aligned in their mission and we can give these customers the opportunity to continue to use a service they’ve lost. We would of course handle the comms politely, deferentially and cautiously.

My question is only about the legal rights and responsibilities when purchasing stressed assets that include PII.

  • Are you getting just the database, or are you going to serve the customers according to the contract they had with the insolvent company? – Greendrake Apr 11 at 11:23
  • The asset pack would include the database, possibly apps, domains, social accounts etc. I don’t yet know the details of the contracts the customers have but I would look to make good on any agreements they have with our comparable product, and comp’ them any subscription (ie. free of charge for life). For me, the important thing is that they are looked after & don’t lose out and happy advocates of value to us in and of itself. – Jim Morrison Apr 11 at 13:17
  • (I should say, I don’t expect my sentiment towards acting kindly/appropriately changes my legal responsibilities - hence the question) – Jim Morrison Apr 11 at 13:18
  • It makes a big difference whether you merely have chance to offer them your service/product by virtue of having their details, or you have to deliver them what the insolvent company failed to. Which of the two applies? – Greendrake Apr 11 at 13:41
  • Agreed/understood. Until I know more from the receiver I can’t be certain of my position. Our expectation would be precisely to deliver what the insolvent company failed to deliver. What I’m not yet certain about are the precise terms under which the data was collected - which seems pretty germane. – Jim Morrison Apr 11 at 21:33
3

The liquidator which sells the assets of an insolvent company is not allowed to sell personal data if it does not has a legal basis as defined in Art. 6(1) GDPR for it. Getting as much money as possible from the assets is not a valid legitimate interest. Subsequently the buyer is not allowed to buy it without legal basis. Because, if the buyer is not allowed to process the data, the data minimisation principle does not allow the buyer to have that data. If the personal data is sold anyway without legal basis, it is considered a personal data breach.

Personal data can only be processed for the same purpose as it was original collected. So if the new buyer continues the activities of the insolvent company, it if perfectly fine to use the personal data for it, in the same way as the insolvent company did. So that is also the only reason the liquidator is allowed to sell the personal data.

| improve this answer | |
  • Thank you. Yes, the expectation is to “continue the activity of the insolvent company”. The crucial thing on which I need absolute clarity is the agreement that was made at the point of data collection. Then I can be sure I’m not in breach as above. – Jim Morrison Apr 11 at 21:37
  • 1
    I have a doubt about the last paragraph. I would understand "continues the activities of the insolvent company" as "the buyer buys all of the company (assets and obligations) and the company continues to operate". Buying the data piecemal in the assets liquidation would not be the same, as the subjects have not agreed to anything with the OP's company and they are not in a contract that require the data for their fulfilment. I would advise the OP to query the ICO about guidance. – SJuan76 Apr 12 at 10:34
  • wimh makes fair points, but I agree with @SJuan76 that the new buyer "continues the activities of the insolvent company" is ambiguous insofar as performing the same actions as another person does not make one that other person. I have given a full, pedantic answer you are welcome to read and comment on if working from home leaves you with too much time on your hands. – Sam_Butler Apr 21 at 16:32
2

I will assume the jurisdiction is the United Kingdom.

An important distinction needs to be made in terms of who is the controller. Company A goes into administration, and continues to exist. It is a legal person and in respect of personal data it has been processing, it is the controller within the meaning of Art. 4(7) GDPR. Only the controller may make determinations as to the means and purposes of processing, and even then, any change in purpose must be communicated prior to commencing such processing under either Art. 13(3) or 14(4) depending on how the data were originally obtained.

If Company A, through or at the direction of an intermediary (or otherwise) transfers personal data in respect of which it is the controller, to Company B, then Company A must first communicate this fact to data subjects, along with all information required in connection with that new processing operation and purpose, and Company B will then be the controller as it will determine the means and purposes of processing thereafter, at which point it too will need to communicate with data subjects in accordance primarily with Art. 14, having obtained the personal data otherwise than from the data subject.

Purchasing a database implies transference of rights to the intellectual property and rights inherent in that database (ref. Copyright and Rights in Databases Regulations 1997), but you would expect any personal data it contains, especially in the case of a customer database, to be included in the transaction. However, failure to comply with data protection law in undertaking the disclosure/receipt of that data, would open both parties to litigation, and even if Company A is dissolved, there could still be cause of action against the receiver.

In my experience it is important not to think too rigidly about the requirements, and to be practical about how to meet them. For example, a notice of further processing from Company A and a privacy notice from Company B could be combined into the same communication, sent by or on behalf of Company A (by agency of the receiver) so that it is fair to Company A's customers and is more easily understood by them. This would of course be the first action after negotiating the purchase but before making the transfer, giving data subjects an opportunity to object (which is something the receiver might reasonably expect Company B to foot the bill for and which responsibility should be clearly delineated in any contract governing the sale).

Also remember that if the customers are private individuals, Company A will require explicit consent (see Art. 6(1)(a) and 7 GDPR) to target them with electronic direct marketing (e.g. email, SMS) under the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), since only Company A would benefit from the "course of a sale" exemption (Reg. 22(3)); this could not be transferred to Company B.

All of the above would be modified if the company was acquired, as in such a case Company A would continue to exist as a person and would continue to be the controller. The addition of Company B as a joint controller and eventual cessation of the existence of Company A, leaving Company B as the sole controller, would require fewer legal somersaults over a longer period. However, given that the company is in receivership, this would also mean taking on its liabilities and is unrealistic.

Finally, any transfer of personal data from Company A to Company B must take place while Company A continues to exist, as otherwise there is no controller to process (including disclose) the personal data, and its continued use, storage or disclosure by any other person would be unlawful, notwithstanding bona vacantia - but don't think you can talk to the Bona Vacantia Division of the Government Legal Department ("BVD") about data protection, nor to the ICO about BVD, because they don't have a clue (from first-hand experience).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.