VID · Trade unions and professional associations · DE
…1 COMMENTS ON THE APPLICATION OF THE GDPR Harmonization of Data Protection Guidelines for Office Holders in Restructuring and Insolvency Proceedings When the GDPR was drafted, the special situation of office holders in restructuring and insolvency proceedings (in the following uniformly: „insolvency proceedings“) was most probably not taken into account. The data protection classification of the special situation of insolvency proceedings and of office holders in such proceedings therefore poses legal and practical problems. Inconsistent and incalculable interpretation and handling of data protection requirements lead to personal risks for office holders, time and cost requirements detrimental to all economic stakeholders in insolvency proceedings and potential impediments to its objectives.
…detrimental to all economic stakeholders in insolvency proceedings and potential impediments to its objectives. The problems with data protection issues arise in particular with regard to the GDPR-status of office holders, his or her responsibilities towards data subjects, the investigative powers (thus touching the issue of asset tracing) and the handling of asset deals (thus touching the issue of pre-packs). If the national legislator or data protection authorities don’t provide specific rules or guidelines for insolvency office holders, their status and responsibilities may not be sufficiently clear. In Germany that’s the case and the views and practice of the data protection authorities differ from state to state.
In Germany that’s the case and the views and practice of the data protection authorities differ from state to state. In fact, few data protection officials have knowledge of insolvency law and proceedings and some admit that they don’t know how to handle office holders in insolvency proceedings or they just treat them similar to the debtor. In view of this, it would be helpful to regulate some aspects of data protection law for insolvency proceedings and office holders in a uniform manner across the EU and align the objectives of data protection and insolvency law in a reasonable manner. Probably the easiest way to achieve harmonized standards would be to ask the European Data Protection Board (EDPB) for guidelines1, which would give binding guidance for all member states. 1.
…the European Data Protection Board (EDPB) for guidelines1, which would give binding guidance for all member states. 1. Status and responsibility of Office Holders Office holders in insolvency proceedings may be vested with various duties and powers by law or by the court, ranging from mere supervision of the debtor to assuming the full power of disposal over the debtor's assets, potentially including control over its business records and data (storage and processing). In the latter case this power may not be fully executed in practice due to e.g. lack of access to all assets and data, if the debtor or other stakeholders are not cooperative, or due to the legal possibility to not take non-valuable assets in possession or release them from the insolvency estate.
…due to the legal possibility to not take non-valuable assets in possession or release them from the insolvency estate. An office holder’s status and responsibility with regard to the GDPR should correspond with the powers and control over the debtor’s assets and data storing and processing. Guidelines in this connection could be the following: Office holders in restructuring and insolvency proceedings are responsible as „controllers“ according to Art. 4 No. 7 GDPR for their own data processing.
…insolvency proceedings are responsible as „controllers“ according to Art. 4 No. 7 GDPR for their own data processing. With regard to the debtor’s data storage and data processing office holders are only „controllers“ for the time and to the extent that they are vested with the power to control the debtor’s data storage or processing, determine the purposes and means of processing of personal data and effectively exercise that 1 https://edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en Ref. Ares(2024)975416 - 08/02/2024 2 control or are obliged to do so. They are not responsible for infringements of the GDPR which occured or occur outside the period or the range of their effective control.
…for infringements of the GDPR which occured or occur outside the period or the range of their effective control. 2. Lawfulness of investigation Office holders in insolvency proceedings are regularly supposed to investigate the debtor’s assets and affairs, e.g. in connection with asset tracing, the detection of misconduct or voidable actions or in connection with the review or preparation of a restructuring concept or plan. Tasks like these regularly involve the search or review of data files and the processing of data including personal data of persons, who may not even be stakeholders in the proceeding. In order to avoid any doubt regarding the lawfulness of such data processing and thus to avoid complaints by affected persons, a guideline like the following could be useful: Member states shall ensure legislative clarification that office holders in restructuring and insolvency…
…and other tasks office holders are supposed to fulfill with regard to the debtor’s assets and affairs. 3. Rights of data subjects The tendency – in particular of data protection authorities – to consider office holders in insolvency proceedings as the ones who fully assume the role of the debtor with regard to data protection provokes the conclusion that office holders are also subject to all the obligations of the debtor, including the obligation to provide information under Art. 15 GDPR and fulfill the data subject’s rights according to Articles 16 - 22 GDPR on data processing operations the debtor carried out in the past. Such information requests are sometimes misused for other purposes and in any case handling them with regard to data, office holders didn’t process themselves, can be extremely laborious and costly, as it regularly requires the involvement of a specialist.
…process themselves, can be extremely laborious and costly, as it regularly requires the involvement of a specialist. Occupying the office holder’s capacities and using funds of the insolvency estate to fulfil information requests is disproportionate taking into account that both data subjects and insolvency creditors have claims which were established prior to the opening of insolvency proceedings. In order to avoid that data subjects – to the detriment of insolvency creditors – receive preferential treatment with regard to the office holder’s capacities and the funds of the insolvency estate, a clarification in the sense of Art.
…regard to the office holder’s capacities and the funds of the insolvency estate, a clarification in the sense of Art. 23 GDPR or guideline like the following should be suggested: With regard to their own data processing and data processing under their control at the debtor, office holders in restructuring and insolvency proceedings are obliged to fully respect the rights of data subjects. With regard to data processing prior to taking over the control over the debtor’s data processing, office holders are not obliged to fulfil rights of data subjects. 4. Asset Deal Asset Deals in insolvency proceedings – possibly pre-packed – are a useful and essential tool to save viable businesses and jobs. In most cases they are only possible under high time pressure and they regularly involve the transfer of (personal) data of employees, customers and suppliers to the buyer.
…pressure and they regularly involve the transfer of (personal) data of employees, customers and suppliers to the buyer. In some cases these data may be the only or the essential asset, which makes the business interesting for investors and worth taking over. The available time frame between the identification of a buyer – maybe at the end of an M&A-process – and the transfer of the business hardly ever allows for several 3 weeks of time to collect the consent for data transfer from the affected data subjects. Some data protection authorities consider it sufficient for certain data in the balancing of interests under Art. 6 No. 1 lit (f) and No. 4 GDPR to give data subjects the right to object to the transfer of their personal data, while others consider active consent to be necessary.
…the right to object to the transfer of their personal data, while others consider active consent to be necessary. It would be extremely useful to clarify that granting the right to object is sufficient for the transfer of necessary data. A possible guideline could be the following: If the ongoing business of a debtor is transferred by way of an asset deal within a restructuring or insolvency proceeding, the data subjects‘ consent to the transfer of the necessary personal data to the acquirer can be assumed, if the data subjects don’t object to the transfer within 2 weeks after notification of the transfer. 5. Personal data The rigorous definition of personal data advocated by data protection authorities, especially when considering an asset deal, should be subject to possible restrictions.
15 → 12