Transfer of personal data in bankruptcy: is GDPR a blocking factor?

More bankruptcies expected due to coronavirus

Every week, dozens of companies in the Netherlands go bankrupt. The number of bankruptcies is expected to rise significantly in the aftermath of the coronavirus (COVID-19) pandemic. The question whether personal data may be transferred to third parties after a bankruptcy, has become increasingly relevant. The question arises: Is the General Data Protection Regulation (GDPR) a blocking factor for the transfer of personal data in a bankruptcy?

In a bankruptcy everything must be sold

As a former receiver in bankruptcies – I worked as a receiver in Amsterdam for two years – I can speak from my own experience that a receiver has to deal with all aspects of a company in a bankruptcy. Often, the receiver has to deal with personal data, not only employee data but also customer data. The customer database often includes existing customers, but also former and new (potential) customers. Realizing high sales results for the benefit of creditors, is one of the obligations of the receiver. Basically, everything that can be sold, must be sold. Even if it concerns a customer database that has a certain value. When there is a restart after a bankruptcy (in Dutch: ‘doorstart‘), this means that the entire company is sold, usually including the entire customer database. Is this still possible under the GDPR? I believe this is (and should be) still possible.

Letter from the AP

The Dutch Data Protection Authority (in Dutch: “Autoriteit Persoonsgegevens” or “AP”) recently sent out a different signal in this regard. In a published letter (in Dutch) to INSOLAD (the association of lawyers who act as receiver in bankruptcies), the AP warned that the receivers may not sell personal data without the consent of the persons involved. I quote (translated from Dutch):

“The sale of personal data (e.g. in the form of a customer database) (…) involves a transfer to another controller. (…) Such provision of personal data should be based on the prior consent of the data subject(s) in accordance with Article 7 GDPR. ”

The AP apparently wants to draw a line when it comes to its conviction that only “prior consent” can be a suitable legal basis for the transfer of personal data to a third party. However, this statement will (unnecessarily) lead to unworkable situations in practice. In addition, this reasoning is inconsistent with previous statements made by the AP, which indicated that a transfer of personal data can be based on the legal basis of “legitimate interest”. However, the words “legitimate interest” do no appear in AP’s letter to INSOLAD. This is striking, because the legal basis of “legitimate interest” is a (more) suitable legal basis for the transfer of personal data in a bankruptcy.

Transfer of Travelbird and doctor’s practices

For example, in the bankruptcy of travel organization Travelbird at the end of 2018 (when the GDPR was already effective), the (former) customers of Travelbird were informed in advance by the receiver about the company’s restart by Secret Escapes, another travel organization. The customers were given the opportunity to object against the transfer of their personal data to the third party, Secret Escapes. At the end of the given objection term, all customers who had not objected, were transferred. This method was praised by the AP as “the way it should be”. The legal basis here was clearly “legitimate interest” and not “prior consent”, since no explicit consent was requested. However, the AP explains nowhere that (and why) it has changed its mind.

Another example: the VvAA (“Association of Physician Motorists”) published on 1 August 2019 (well after the GDPR came into effect) on its website a reassuring message for doctors: the AP had confirmed in a statement to VvAA that after an acquisition of a doctor’s practice, no explicit consent needs to be requested from patients for the transfer of their files. Informing them in advance and giving a notice period would suffice. If an entire doctor’s practice can be transferred this way (which involves sensitive personal data, and not only current treatment agreements are transferred), why would this option not exist in bankruptcies? There is no good reason for this.

When to apply “legitimate interest”?

According to the GDPR, any processing of personal data must be lawful. This means that at least one “legal basis” as referred to in Article 6 GDPR must apply. “Consent” is one option, but “legitimate interest” is another option (Article 6 paragraph 1 sub f GDPR). “Legitimate interest” is often used when another legal basis is not possible or illogical. For example, this applies to: camera surveillance, fraud prevention, or informing existing customers about products or services. The AP confirms this in its norm interpretation regarding “legitimate interest” (in Dutch). However, the AP does not mention anywhere that “legitimate interest” also applies to company takeovers or transfers in a bankruptcy. This was a missed opportunity for the AP to provide clarity on this, in line with its previous statements about customer data transfers in the bankruptcy of Travelbird and doctor’s practice takeovers.

Applying “legitimate interest” in a bankruptcy

In order to apply “legitimate interest” as a legal basis, three “test questions” must be answered. These test questions are mentioned in the AP’s norm interpretation regarding “legitimate interest” (in Dutch). Other European data protection authorities (such as UK’s ICO) also apply the same test questions and published more detailed guidance on the application of “legitimate interest”:

1. Is the interest legitimate? (“Purpose test”)
2. Is the processing necessary? (“Necessity test”)
3. Have I balanced all interests? (“Balancing test”)

I will discuss these three test questions below, to see whether “legitimate interest” can be applied in a bankruptcy.

1. Interest must be legitimate (“Purpose test”).

The first test question is: is there a “legitimate” interest? According to the AP’s norm interpretation, there must be an interest that is stated in a general law, or follows from a general legal principle. This is the case in a bankruptcy: According to the Dutch Bankruptcy Act (Article 68), the receiver has the task to “manage and liquidate” a bankrupt company. This means that the receiver must sell everything of value, for the benefit of its creditors. It is therefore the legal task of the receiver to achieve the highest sales result possible. However, this legal task seems to clash with another statement of the AP that a “entirely commercial interest” or “profit maximization” can never be a “legitimate interest”. This statement leads to many questions and discussions, because: When is something entirely commercial? Where is the line between “entirely” and “non-entirely” commercial? Why does the AP think that commercial interests are bad anyway? Many questions remain unanswered by the AP, but in any event: considering the legal task of a receiver, there is a “legitimate” interest, and the “purpose test” is met.

2. Processing personal data must be necessary (“Necessity test”)

The second test question is whether the processing of personal data is necessary for the aforementioned interest. If a company goes bankrupt, all assets must be sold in order to pay off the company’s debts as much as possible. The company’s activities are sometimes temporarily continued by the receiver, but that is usually for a very limited period of time, due to the costs and liability risks for the receiver. In order to liquidate the company, everything has to be sold eventually. Sometimes, a restart (in Dutch: “doorstart”) is possible, in which all assets of company are sold and transferred to a third party, which will “continue” the company’s activities, often under the same name as the bankrupt company. In a restart, there is always a transfer to a third party, as the bankrupt company ceases to exist as soon as it is liquidated. The transfer of a company, including its customer data, is necessary to achieve a restart. The “necessity test” is therefore also met.

3. All interests must be balanced (“Balancing test”).

The third test is perhaps the most important one: the balancing of interests. In a bankruptcy, there are several players who all have their own interests:

• The creditors have an interest to realize the a high sales result, so that the debts are paid as much as possible.
• The receiver acts on behalf of the creditors and has an interest to sell all assets of the bankrupt company to a restarter (this often leads to the highest sales result).
• Employees have an interest in a restart, because then they have a chance to be employed. Employees of a bankrupt company are all fired, but they can be hired by the restarter.
• The restarter usually wants to take over all assets of bankrupt company, including the entire customer database. The customer database is often an important asset of the bankrupt company and represents a large part of the “goodwill” that the restarter is willing to pay to the receiver.
• Customers of the bankrupt company have an interest in protecting their privacy and that their personal data is not being sold without their knowledge. Customers want to be informed in time and be “in control” of their personal data. However, customers may also have an interest in a restart, e.g. to continue their medical treatments or contracts, or to purchase products or services. In a restart, the risks for customers are rather limited, because it usually concerns “non-sensitive” personal data, such as names and contact details. In addition, a restarter will often use the customer data for the same (or compatible) purposes (as confirmed in an article by Ms. Minke Reijneveld (in Dutch), who will obtain her doctorate on this topic). In a 2004 decision (in Dutch), the Amsterdam District Court also assumed that a restarter can use personal data for the same purpose as the bankrupt company did.

Step-by-step plan for the receiver

Before personal data can be transferred in a bankruptcy, the receiver will have to take a number of steps:

1. The receiver answers the above-mentioned three “test questions” and documents the “balancing test”, for accountability purposes.
2. The receiver agrees with the buyer (restarter) that the personal data may only be used for the same (or compatible) purposes as for which the bankrupt company used it (purpose limitation).
3. The receiver informs everyone in the customer base about the intended transfer, and customers are given the opportunity to object against the transfer of their personal data. In practice, a term of 2-4 weeks is often applied.
4. The data of the customers who object, will not be transferred.
5. Customers who have not objected within the set term, will be transferred to the restarter.
6. The restarter informs the customers whose data have been transferred, about the products or services that the restarter can (continue to) provide to them. In accordance with the GDPR, the customers can, of course, always make a request for removal of their data.

Transfer of personal data in bankruptcy: GDPR is not a blocking factor

It follows from the above that “legitimate interest” is an appropriate and logical legal basis for the transfer of personal data in a bankruptcy. The required “balancing of interests” does justice to the interests of all parties involved:

• creditors (payment of debts),
• the receiver (liquidation of bankrupt company),
• customers (to be “in control” of their personal data, provided they are properly informed, and to be able to receive products or services) and
• employees (continued employment).

In this time of crisis, in which more bankruptcies are expected in the aftermath of the COVID-19 pandemic, there is a need for legal certainty. This requires a consistent explanation of the concept of “legitimate interest”. This legal basis may not be pushed aside or denied, if the GDPR explicitly allows for this. If an appeal on “legitimate interest” would no longer be allowed, this will have far-reaching consequences for all bankruptcies (and possibly also for all company takeovers): it could block a restart after a bankruptcy, causing unnecessary loss of company value. This is in nobody’s interest. That is why the AP should confirm (again) that the application of “legitimate interest” in a bankruptcy is still possible!

If you have any questions, or need advice, about the transfer of personal data in a bankruptcy, please contact me.