united-kingdom gdpr corporate-law data-protection
If I buy assets (inc customer data) from receiver of a UK company, how does GDPR apply?
<p>I’m considering buying the assets of an insolvent company that has gone into administration / receivership.</p>

<p>Included in the assets is a customer database. </p>

<p>How does GDPR apply? </p>

<ul>
<li>is the purchasing company allowed to contact the customers of the old company?</li>
<li>are there specific considerations or rules?</li>
<li>do we, effectively, become the legitimate owner/processor of the data?</li>
</ul>

<p>I’m very cognisant of our responsibilities to the consumers, irrespective of the legalities, in so much as we wouldn’t want to upset or offend them but making inappropriate contact even if it were legal. As it happens the businesses are aligned in their mission and we can give these customers the opportunity to continue to use a service they’ve lost. We would of course handle the comms politely, deferentially and cautiously. </p>

<p>My question is only about the legal rights and responsibilities when purchasing stressed assets that include PII. </p>

<p>The liquidator which sells the assets of an insolvent company is not allowed to sell personal data if it does not has a legal basis as defined in <a href="https://gdprhub.eu/index.php?title=Article_6_GDPR#1" rel="nofollow noreferrer">Art. 6(1) GDPR</a> for it. Getting as much money as possible from the assets is not a valid legitimate interest. Subsequently the buyer is not allowed to buy it without legal basis. Because, if the buyer is not allowed to process the data, the <a href="https://gdprhub.eu/index.php?title=Article_5_GDPR#1c" rel="nofollow noreferrer">data minimisation</a> principle does not allow the buyer to have that data. If the personal data is sold anyway without legal basis, it is considered a <a href="https://gdprhub.eu/index.php?title=Article_33_GDPR" rel="nofollow noreferrer">personal data breach</a>.</p>

<p>Personal data can only be processed for the same <a href="https://gdprhub.eu/index.php?title=Article_5_GDPR#1b" rel="nofollow noreferrer">purpose</a> as it was original collected. So if the new buyer continues the activities of the insolvent company, it if perfectly fine to use the personal data for it, in the same way as the insolvent company did. So that is also the only reason the liquidator is allowed to sell the personal data.</p>

<p>I will assume the jurisdiction is the United Kingdom.</p>

<p>An important distinction needs to be made in terms of who is the controller. Company A goes into administration, and continues to exist. It is a legal person and in respect of personal data it has been processing, it is the controller within the meaning of <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">Art. 4</a>(7) GDPR. Only the controller may make determinations as to the means and purposes of processing, and even then, any change in purpose must be communicated prior to commencing such processing under either <a href="https://gdpr-info.eu/art-13-gdpr/" rel="nofollow noreferrer">Art. 13</a>(3) or <a href="https://gdpr-info.eu/art-14-gdpr/" rel="nofollow noreferrer">14</a>(4) depending on how the data were originally obtained.</p>

<p>If Company A, through or at the direction of an intermediary (or otherwise) transfers personal data in respect of which it is the controller, to Company B, then Company A must first communicate this fact to data subjects, along with all <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-law-enforcement-processing/individual-rights/the-right-to-be-informed/#ib2" rel="nofollow noreferrer">information required in connection with that new processing</a> operation and purpose, and Company B will then be the controller as it will determine the means and purposes of processing thereafter, at which point it too will need to communicate with data subjects in accordance primarily with <a href="https://gdpr-info.eu/art-14-gdpr/" rel="nofollow noreferrer">Art. 14</a>, having obtained the personal data otherwise than from the data subject.</p>

<p>Purchasing a database implies transference of rights to the intellectual property and rights inherent in that database (ref. <a href="https://www.legislation.gov.uk/uksi/1997/3032/contents/made" rel="nofollow noreferrer">Copyright and Rights in Databases Regulations 1997</a>), but you would expect any personal data it contains, especially in the case of a customer database, to be included in the transaction. However, failure to comply with data protection law in undertaking the disclosure/receipt of that data, would open both parties to litigation, and even if Company A is dissolved, there could still be cause of action against the receiver.</p>

<p>In my experience it is important not to think too rigidly about the requirements, and to be practical about how to meet them. For example, a notice of further processing from Company A and a privacy notice from Company B could be combined into the same communication, sent by or on behalf of Company A (by agency of the receiver) so that it is fair to Company A's customers and is more easily understood by them. This would of course be the first action <em>after</em> negotiating the purchase but <em>before</em> making the transfer, giving data subjects an opportunity to object (which is something the receiver might reasonably expect Company B to foot the bill for and which responsibility should be clearly delineated in any contract governing the sale).</p>

<p>Also remember that if the customers are private individuals, Company A will require explicit consent (see <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Art. 6</a>(1)(a) and <a href="https://gdpr-info.eu/art-7-gdpr/" rel="nofollow noreferrer">7</a> GDPR) to target them with electronic direct marketing (e.g. email, SMS) under the <a href="http://www.legislation.gov.uk/uksi/2003/2426/contents" rel="nofollow noreferrer">Privacy and Electronic Communications (EC Directive) Regulations 2003</a> ("PECR"), since only Company A would benefit from the "course of a sale" exemption (<a href="http://www.legislation.gov.uk/uksi/2003/2426/regulation/22" rel="nofollow noreferrer">Reg. 22</a>(3)); this could not be transferred to Company B.</p>

<p>All of the above would be modified if the company was acquired, as in such a case Company A would continue to exist as a person and would continue to be the controller. The addition of Company B as a joint controller and eventual cessation of the existence of Company A, leaving Company B as the sole controller, would require fewer legal somersaults over a longer period. However, given that the company is in receivership, this would also mean taking on its liabilities and is unrealistic.</p>

<p>Finally, any transfer of personal data from Company A to Company B must take place while Company A continues to exist, as otherwise there is no controller to process (including disclose) the personal data, and its continued use, storage or disclosure by any other person would be unlawful, notwithstanding <em><a href="https://en.wikipedia.org/wiki/Bona_vacantia" rel="nofollow noreferrer">bona vacantia</a></em> - but don't think you can talk to the <a href="https://www.gov.uk/government/organisations/bona-vacantia/#org-contacts" rel="nofollow noreferrer">Bona Vacantia Division of the Government Legal Department</a> ("BVD") about data protection, nor to the <a href="https://ico.org.uk/global/contact-us/" rel="nofollow noreferrer">ICO</a> about BVD, because they don't have a clue (from first-hand experience).</p>
