Joint liquidators of a company were not data controllers within the meaning of section 1(1) of the Data Protection Act 1998 in respect of data processed by the company prior to its liquidation.

David Richards J so held on an application for directions by the applicants, Ian Christopher Oakley Smith and Julian Guy Parr, the joint liquidators of Southern Pacific Personal Loans Ltd (“the company”), for determination of the questions whether or not the applicants were “data controllers” within the meaning of section 1(1) of the Data Protection Act 1998 and whether they might dispose of all “personal data” in their control in their capacity as liquidators of the company.

The company’s business comprised the provision of personal loans to individuals secured by way of a second charge on their homes. From the start of its business the company had collected and retained data relating to borrowers. From 2006 the data was stored with a loan servicing company, A Ltd, which continued to hold the data relating to the redeemed loans for the company. The company entered creditors’ voluntary liquidation in 2012.

Section 1(1) of the Data Protection Act 1998 provides: “In this Act ‘data controller’ means a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be processed.”

DAVID RICHARDS J said that the issue was not whether the joint liquidators were data controllers in respect of data processed by them when acting in their capacity as joint liquidators but whether they were data controllers as regards the data processed by the company in respect of the redeemed loans. Any decisions taken by the company before the commencement of its liquidation in respect of data processed by it were taken by or on the authority of the directors, who acted as agents of the company. A decision taken by them was the decision of the company. The issue was whether the commencement of a liquidation and the appointment of a liquidator rendered the liquidator, in place of or in addition to the company, a data controller in respect of data processed by the company. For that to be the case, the relevant decisions as regards the processing of such data had to be taken by the liquidator as principal in his capacity as office holder rather than as agent of the company, thereby distinguishing him from the position of directors prior to the liquidation.

The Information Commissioner’s position was that both the company and the liquidators were, following the commencement of the liquidation, the relevant data controllers. First, he relied on the duty of liquidators to take into their custody or under their control all the property of the company. In his Lordship’s judgment in taking control of the company’s property, just as in dealing with it, the liquidator was not acting as principal but as agent, replacing the control formerly exercised by the board. Secondly, the commissioner relied on the purpose for which liquidators exercised their powers. They did so in order to give effect to the statutory scheme for the realisation of the company’s assets and the distribution of their proceeds among the creditors and, in the event of a surplus, among the members of the company. His Lordship said that it was true that the commencement of a liquidation brought into effect a scheme as regards the company and its property which was fundamentally different from that which existed prior to its liquidation. The beneficial ownership of the assets of the company was suspended pending the implementation of the statutory scheme. It did not, however, follow that in exercising his powers and fulfilling his duties in respect of the property of the company, the liquidator was acting as principal. He did so as agent for the company, in whose ownership the property remained vested, albeit not for the benefit of the company but in order to give effect to the statutory scheme. The data to which the present case related belonged to or was under the control of the company when it went into liquidation. It could not be doubted that intellectual property rights in respect of the relevant data were vested in the company, which might also have been the owner of the paper files held by A Ltd as the data processor. Those property rights and all rights to control the data remained vested in the company at and following its liquidation. It followed that in exercising any rights in respect of the data, including those which defined the role of a data controller, the liquidators would be acting as the agents of the company.

Accordingly the court would make a declaration that the joint liquidators were not data controllers for the purposes of the Data Protection Act 1998 as regards the data processed by or on behalf of the company prior to its liquidation in respect of the redeemed loans. The declaration made related to voluntary liquidators, but the position was no different as regards liquidators in a compulsory winding up. Subject to two qualifications the court would also direct that the company acting by its liquidators might dispose of such data in a manner consistent with the 1998 Act.