Privacy obligations: sale of business and the insolvency practitioner (Part 2)

This article was initially published in the Lexis Nexis Privacy Law Bulletin, January 2024 (Vol 20 No 10).

Extract

This second of two articles considering privacy obligations in relation to ordinary sale or other disposal of a business examines in detail the rights and obligations of the insolvency practitioner.

Key Takeaway Points for Privacy Lawyers in Insolvency Practice:

• Insolvency firms and the entities they oversee may be subject to privacy obligations under the Privacy Act 1988 (Privacy Act).
• APP entities, including insolvency practitioners’ firms, must only collect personal information when reasonably necessary for their functions or activities.
• When insolvency practitioners’ activities are authorised by legislation like the Corporations Act, the disclosure of personal information is permitted under the ‘required or authorised by or under law’ exception to APP 6.
• The scope of disclosure under the APP 6 exception must be limited to what is necessary.
• Privacy considerations in insolvency practice involve additional mechanisms and factors

Introduction

The first of our two articles considering privacy obligations in relation to sale or other disposal of a business by an insolvency practitioner, considered what personal information may be held by businesses and outlined privacy watchpoints in relation to an ordinary sale. We then asked:

• Do insolvency practitioners face different privacy hazards from those of the ordinary business buyer of a company? and
• What are the pitfalls?

before introducing particular privacy hazards for insolvency practitioners and examining how the ARITA Code of Ethics[i] and Inspector-General Practice Guideline 2 address protection and use of information. However, our main focus is corporate insolvency.

Many of the actions and practices of insolvency practitioners who are APP entities would constitute interferences with the privacy of individuals under the APPs were it not for the CA legislation whereby the exception under APP 6.2 is engaged; that is, use or disclosure of personal information about an individual is permitted if

…

(b) the use or disclosure of the personal information is required or authorised by or under an Australian law or a court/tribunal order.

…

We now examine insolvency practitioners’ work in depth through a privacy lens. First, we consider the range of roles within insolvency practice and their legislated powers in relation to information, then what information access rights creditors have, and issues associated with information obtained by means of coercive powers.

Finally, we list some privacy hazards for the assistance of insolvency practitioners.

As an Appendix, we consider two privacy determinations in the insolvency context.

What data do insolvency practitioners collect and disclose?

Under Schedule 2 of the Corporations Act (CA) (the Insolvency Practice Schedule (Corporations)), only a registered liquidator can perform certain roles, such as that of the receiver of the property of a corporation, the administrator of a company or of a deed of company arrangement, the restructuring practitioner for a company or for a restructuring plan, or the liquidator of a company. The specific role the insolvency practitioner is performing in an engagement will determine what legislated powers it has in relation to the distressed company and its information holdings.

1. Receivers

The CA provides receivers with extensive powers. Depending on the terms of their instrument of appointment and the extent of the property they are appointed over, receivers may:

• carry on the business of the company (s 420(2)(h)) and then subject to approvals, during a winding up (s 420C(1));
• dispose of property of the company (s 420(2)(b)) and convert property of the company into money (s 420(2)(g));
• engage or discharge employees of the company (s 420(2)(o));
• where the security interest respecting which the receiver was appointed includes security over uncalled share capital, make a call for that capital (s 420(2)(s)) and enforce payment (s 420(2)(t)); and
• bring or defend proceedings on behalf of the company (s 420(2)(k)) and where a debt or liability is owed to the company, make a claim for that debt in a bankruptcy, liquidation or winding up (s 420(2)(r))

These activities all require the receiver to have access to and deal with the subject company’s collection of personal information. For this reason, receivers are given power to inspect the books of the company[ii] that relate to the subject property that they are appointed over, at any reasonable time (s 431 CA).

2. Voluntary administrators

The appointment of a voluntary administrator marks the ceding of control of the subject company’s affairs. During the administration, the administrator has power under the CA to:

• control and carry on the company’s business, property and affairs (s 437A(1)(a) and (b)); and
• may terminate or dispose of all or part of that business and dispose of any or all of that property (s 437A(1)(c)).

Further, as soon as practicable after commencement, administrators are required under the CA to investigate the company’s business, property, affairs and financial circumstances to enable them to advise the creditors. This advice addresses whether it would be in the creditors’ interests for the company to execute a deed of company arrangement, for the administration to end or for the company to go into liquidation (s 438A). These matters must be considered by creditors at a so-called ‘second creditors’ meeting’, called pursuant to s 439A.

To enable administrators to carry out these functions, as soon as practicable after commencement, each director must deliver to the administrator all books in that director’s possession (s 438A(1)) and within five business days after commencement, provide the administrator with a report as to the affairs of the company (s 438B(2)). Failure to provide access is an offence (s 438B(4) and (5)). In addition, the CA gives administrators rights to the books as against third parties (s 438C).

Further, for the second creditors’ meeting, the Insolvency Practice (IP) Rules[iii] 75-225 require that the creditors be provided with a report as to the company’s business, property, affairs and financial circumstances and contain the administrator’s recommendations regarding the future of the company. Reports to creditors generally include creditor lists, because these are material to a company’s financial circumstances and therefore likely return to creditors and to voting at the meeting if a poll is called (IP Rules 75-115).

However, although creditors as a body or individually can seek further information about the company’s affairs from an administrator, access may be denied where requests are unreasonable (see further below under “What information access rights does a creditor have?”)

In addition, material debts owed to the company may also be separately listed. This list may contain personal information where debtors are individuals. Unless individuals were officers of the company, any listing would probably be limited to name and amount of debt or indebtedness. However, in the case of company officers, the nature and extent of information provided will depend on whether any breaches of duty have been identified, and if so, whether there could be claims, and then, prospects of recovery should a claim be made, and that information may include references to personal assets. It could also include information about the transfer of assets to family members, if such transfers could be overturned, another layer of personal information.

3. Deed Administrators

Insolvency practitioners often become Deed Administrators as a follow on from their appointment as voluntary administrator, in which case they already have access to extensive information including personal information.

Further, because they are responsible for administering and therefore making payments pursuant to any deed of company arrangement, deed administrators must maintain creditor lists. In addition, where the transfer of shares is contemplated by the deed pursuant to s 444GA (which permits a deed administrator to transfer shares with the consent of the shareholder or by leave of the Court), it will be necessary for the deed administrator to access the company’s share register.

4. Liquidators

Under the CA, liquidators, like administrators, may carry on the business of a company (s 477 (1)(a)) and sell or otherwise dispose of all or any part of the property of the company (s 477 (2)(c)). They are also entitled to inspect the books of the company at any reasonable time (s 447 (3)), with refusal an offence.

If there is a prospect of paying a dividend in the liquidation, they too may be required to settle creditor lists. Of course, liquidators are obliged to get in the assets of the company, including any outstanding debts, respecting which personal information may be held.

Further, liquidators are required to settle a list of contributories where the share capital is not fully paid, and contribution is required to meet liabilities in the winding up or where there will be a surplus available for distribution or there is a need to adjust rights as between contributories. (s 478).

Liquidators and other external controllers of companies also have powers to summons people for examination regarding the company’s affairs. These powers are discussed below.

5. Other external appointments

The CA also recognises other external appointments such as restructuring practitioners (s 453B) and empowers restructuring practitioners to access company books (s 453F(1)(c) and s 453G).

What information access rights does a creditor have?

The CA gives creditors rights to inspect the books kept by external administrators at all reasonable times (Schedule 2 70-10).

Further, creditors can request information or a document by resolution (Schedule 2 70-40(1)). However, the external administrator may refuse if:

• the information is not relevant to the external administration (Schedule 2 70-40 (2)(a)) – which may well be the case with personal information; or
• it would be a breach of duty to comply (Schedule 2 70-40(2)(b)); or
• it would otherwise be unreasonable (Schedule 2 70-40 (2)(c)).

Unreasonableness is dealt with in the Insolvency Practice Rules Division 70 – Information. So, it may be unreasonable to comply with a creditor’s request where:

• the information could prejudice another creditor (IP Rules 70-10 (2)(a));
• disclosure could found an action in breach of confidence (IP Rules 70-10 (2)(c)); or
• the request is vexatious (IP Rules 70-10 (2)(g)).

Individual creditors can request information or a document (Schedule 2 70-45 (1)) with the same bases for refusal as for requests by creditor resolution (Schedule 2 70-45 (2)).

Practitioners’ coercive powers and information access

Liquidators’ examinations

The external administration provisions of the CA are intended to assist in the administration of the affairs of distressed companies where assets available to creditors may be:

• non-existent,
• limited proportionate to claims, or
• dependent on successful claims brought against directors, officers, preferred creditors and other persons with involvement in or, in some cases, knowledge of challengeable activities.

Sometimes liquidators cannot gain a complete picture of a company’s affairs from its books, so they and other external controllers of companies are empowered to summons people for examination regarding the company’s affairs. Examinations are conducted before officers of the court and are open to the public. Creditors or officers of the company can inspect transcripts without fee, although anyone else must pay (s 597 (14A)).

Directors and officers may be summoned as of right. Others may be summoned with leave of the Court where the Court is satisfied the proposed examinee took part or was concerned in examinable affairs of the company, and had been or may be guilty of misconduct respecting the company, or may be able to give information about the examinable affairs of the company (s 596B). Persons summoned for examination may also be required to produce documents that may be in their possession that relate to the company or any of its examinable affairs. (s 596D (2)).

Compelling attendance at an examination is an exercise of the coercive power of the State and examinees cannot avoid answering questions on the basis of tendency to incriminate (s 597 (12)).[iv] However, if at the time of answering the examinee states that the answer may incriminate, then the answer cannot later be used against the examinee in a criminal or penalty proceeding, save respecting a proceeding for perjury in the examination (s 597 (12A)). Therefore, the power to compel attendance and provision of information is a powerful tool in the hands of liquidators.

The Courts have acknowledged the tension between the importance of gathering information for the purposes of a winding up and the inconvenience and intrusion into the privacy of an examinee  ̶  especially an examinee who is not a director or officer of the company. This is the reason why leave to examine must be given. In striking this balance, the Court has said:

[T]he exercise of the power can involve tension between two important public interests. The first is the public interest[v] in a liquidator obtaining necessary information to properly discharge the function of liquidator in the winding up of the company for the benefit of the creditors. The second is the right of the individual to privacy in regard to his or her affairs, documents and papers.

………..

The relevant test as to the sufficiency of the relationship between the person against whom the examination was sought and the affairs of the company in liquidation was whether in the opinion of the court, the person was, or may be, able to give information relevant to increasing or protecting the assets available in a winding up.[vi]

The cases make it clear that examinable affairs can extend to the existence of insurance policies and assets held by an examinee – personal information – as these matters go to whether the examinee can satisfy a judgment should proceedings be brought.[vii]  Accordingly, there is a real likelihood that the personal information of examinees may be made available to the public.

Nevertheless, Courts may exercise a protective discretion in relation to individuals’ privacy in that they have power to give directions regarding the examination process, including respecting:

• whether, by reason of special circumstances, parts should be in private (s 597 (4)) and if so, who may be present (s 596F (1));
• that someone may be excluded even if the examination is conducted in public (s 596F(1) (d));
• access to records of the examination (s 596F (1)(e));
• the publication or communication of information about the examination including questions asked and answers given (s 596F(1)(f)); and
• the destruction of documents that relate to and were created at the examination (s 496F(1)(g)).

Orders for private examinations are not lightly made, given the purposes of liquidators’ examinations. Adverse publicity alone is not considered a ‘special circumstance’.[viii] The prejudice suffered through publication must outweigh the publicity contemplated by the legislation.[ix] However, a pending criminal prosecution may justify a private examination in light of the potential to expose lines of defence and also, if there is publicity, to affect potential jurors.[x]

We note that where insolvency issues are dealt with by the Federal and Supreme Courts in their oversight jurisdiction, these Courts and practitioners before them generally follow practices that minimise exposure of third-party personal information where that information is not material to the facts and matters supporting the reasons for judgment.

So, for example, in making orders adjusting or declaring rights as between parties, and the assessment of amounts, the subject of such orders, which are based or rely upon other individuals’ personal information, affidavits or other documents disclosing that information to the Court can be ordered to be treated as confidential.  This means they will be inaccessible on the Court file save for further Court order or if information has to be disclosed as a necessary part of the order – identifying numbers or initials only may be used, with identifying lists kept confidential.

Use of documents obtained via the exercise of coercive powers

In our first article we cited cl 5.17 of the ARITA Code of Ethics and the limitations it imposes on use of information obtained during the course of an insolvency appointment.

In addition, we noted that where documents or information are obtained in a Court process then the Harman undertaking will arise.[xi] The Harman undertaking protects the interests of parties who are required by the coercive power of the Courts to disclose their confidential and personal information. It has been described by the High Court as follows:

Where one party to litigation is compelled, either by reason of a rule of court, or by reason of a specific order of the court, or otherwise, to disclose documents or information, the party obtaining the disclosure cannot, without the leave of the court, use it for any purpose other than that for which it was given unless it is received into evidence.[xii]

Breach of the Harman undertaking is a contempt of Court so in cases of doubt, prudence dictates that insolvency practitioners will seek leave of the Court to use the information or documents.[xiii] This is because the undertaking can be released only by a Court.

The Courts have made it clear that liquidators are not excused from the reach of the Harman undertaking, however documents produced to the Court in response to a liquidator’s summons are produced for the purposes of the liquidation so using them in the liquidation is not a breach of the undertaking.[xiv] More difficult questions arise where litigation funding may be in prospect or consideration is being given to assigning a company’s claims.[xv]

Further, Clause 5.17 of the Code would apply to all documents obtained via the coercive power granted by the CA.

Privacy hazards for insolvency practitioners

Our brief review shows that privacy issues arise in a variety of contexts in insolvency administration, with obligations upon insolvency practitioners not limited to the CA. Accordingly, in our view insolvency practitioners could benefit if a single source designed to assist them to navigate between their legislated information-handling powers and responsibilities and the principles of privacy best practice were available. Such a compilation and summary would touch upon not only general privacy issues and how they pertain to insolvency, but also factors specific to individual appointments and the order in which privacy issues may arise, as follows:

• whether their firms or the entities they are appointed over are subject to the Privacy Act. That will enable them to determine the scope of their obligations under privacy legislation;
• how their powers and obligations under the CA interact with their privacy obligations;
• whether the entity they are appointed over is subject to other privacy, confidentiality or information management obligations by reason of the nature of its business for example, in the legal or health sectors;
• upon appointment, whether the information could be or has been subject to cyber compromise or other data breach and what cyber risk minimisation steps should be followed;
• where a business or business assets may be sold, how privacy issues should be managed during the sale process;
• whether by reason of previous or current litigation, the entity holds materials subject to the Harman undertaking and if so, whether leave to use the information should be sought;
• in discharging their reporting obligations, how they balance privacy concerns with creditor entitlement to information regarding the affairs of the company both respecting the content of their reports and accessibility (for example, ensuring online access is password protected or similar)
• where creditors seek access to the company’s books and records, whether any issues arise that could create an exception to the general statutory right of access or whether a special confidentiality regime should be put in place;
• where personal information has to be disclosed in any Court documents, whether individuals can be deidentified with names and other details protected by confidentiality orders;
• where information has been obtained via a liquidator summons or similar, what information management practices should be adopted during the administration given the impact of the Harman undertaking, whether leave to use the information may need to be sought in particular cases and then how the information should be dealt with once the appointment has been concluded.

Conclusion

The OAIC’s 2023 Australian Community Attitude to Privacy Survey (ACAPS)[xvi] found that three in five (62%) Australians see the protection of their personal information as a major concern in their life. Commissioner Angelene Falk noted in her foreword that recent events and factors such as high-profile data breaches and the speed of tech innovation have intensified individuals’ focus on privacy in relation to their sense of control and autonomy, human dignity and other key values.

Insolvency administrators wanting to meet their compliance obligations and play their part in building trust in today’s business environment should not forget the OAIC’s top three recommended actions to protect personal information:

1. Only collect it when it’s necessary.
2. Take proactive steps to protect it.
3. Delete it when it’s no longer needed.

APPENDIX

Privacy determinations in the insolvency context

On two occasions, both now historic, a Privacy Commissioner has made determinations on issues relating to insolvency, and both cases contain some useful learnings.

Complainant J v Statutory Entity) [xvii] concerned the production of documents upon service of a s 530B notice, which compels production of the company’s books to the liquidator. The notice had been served upon a statutory entity that licensed certain trade activities. The complainant had a legal dispute with the company and had sent numerous unsolicited letters to the statutory entity regarding the company’s conduct. A close associate of the company director had also sent unsolicited letters to the statutory entity about the company, the complainant and several other customers of the company.

Given the ‘delicate nature of the letters’, the statutory entity sought clarification from the liquidator as to whether the notice extended to the unsolicited correspondence, and was advised that it did. The statutory entity then sought and obtained written undertakings of confidentiality, limitation of use and return of the documents before providing the documents.

The complainant was also in discussions with the liquidator and became aware that the liquidator had received the correspondence that contained damaging assertions about him, and complained first to the statutory entity and then to the Victorian Privacy Commissioner.

The Privacy Commissioner determined that the matter would turn on the ambit of s 530B and whether ‘company books’ meant books belonging to the company and not merely documents relating to it and concluded that that would be a matter for VCAT if the matter was not conciliated. Conciliation was successful.

This determination raises an interesting question as to whether VCAT has jurisdiction over a liquidator’s powers under s 530B, however arguably if the correspondence was not within power, the liquidator would not be protected. That said, if the correspondence had been part of the company books, the liquidator may obtain access by some other means.

The determination also illustrated the point that liquidators must take care with how they use documents obtained through the coercive powers given under the Corporations Act, especially where due to their ‘delicate nature’ they may contain defamatory material.

In this instance, the interests of both the complainant and the other correspondent to the statutory entity may need protection. Contrast the putting of potentially damaging and possibly defamatory correspondence to an examinee in the course of a liquidator’s examinations where the proceeding is under court supervision and directions regarding confidentiality can be made. It is another to do it privately in interviews not overseen by the Court. Further, without proper protections in place, the liquidator could also be liable for damages in defamation through republication.

Own Motion Investigation v Bankruptcy Trustee Firm[xviii] concerned information about a bankrupt estate published on the bankruptcy trustee’s firm website. The information included financial details and the firm’s opinion as to whether certain persons had breached the requirements of the Bankruptcy Act.

The matter had been drawn to the Commonwealth Privacy Commissioner’s attention by a member of the public and the Commissioner decided to conduct an ‘own motion’ investigation. The firm argued that the trustee had obligations to lodge certain information to the Insolvency and Trustee Service of Australia (ITSA) that maintained the National Personal Insolvency index that was publicly available, and that some but not all of the information on the firm’s website had been available there.

The Commissioner concluded that by allowing the information to be generally available on the internet, rather than placing limitations on access, the firm had interfered with the privacy of the bankrupt and had failed to comply with (then) National Privacy Principle 4.1 that requires an organisation to take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure. Therefore, the Commissioner recommended password protection.

On-line reporting is now widely used by insolvency practitioners and the ARITA Code of Conduct provides that where websites are used to communicate with creditors, they should comply with privacy laws. Further, if appropriate, access should be restricted to those with an entitlement to access, say through password protections (6.12).

The Commissioner also recommended that the trustee’s opinion on whether bankrupts had breached the Bankruptcy Act be removed from the file made available to creditors.

As to opinions on possible breaches of the law, unfortunately the reported findings do not provide insight into the Commissioner’s understanding of the requirements of the Bankruptcy Act. Nevertheless, prudent insolvency practitioners will ensure that they do not exceed their reporting obligations.

GENERAL EDITORS NOTE

This article is the second instalment in a series of two, focusing on privacy obligations in the context of insolvency practice. The first article explored privacy concerns related to the ordinary sale or disposal of a business, while this second article delves into the specific rights and responsibilities of insolvency practitioners in managing personal information. Both articles consider the complexity of privacy issues faced by insolvency practitioners.

[i] ‘Collectively, an Introduction, the Code of Ethics, Code of Professional Practice: Insolvency Services (COPP: Insolvency Services) and Code of Professional Practice: Advisory Services (COPP: Advisory Services) form the ARITA Code. The ARITA Code is supported by Practice Statements which provide detailed explanations to support the ARITA Code but do not form part of the ARITA Code. Rather, the Practice Statements provide guidance to assist Members.’

[ii] The meaning of ‘the books of the company’ is considered in Complainant J v Statutory Entity VPrivCmr 4 (18 May 2004) discussed below.

[iii] Made under s 105-1 of Schedule 2 to the CA.

[iv] A related issue was recently the subject of Deane, in the matter of MSB Capital Holdings Pty Ltd (in liq) [2023] FCA 919 (8 August 2023). It concerned a summons to produce books under s596B of the CA. The examinee claimed privilege against exposure to penalty in respect of certain documents.

[v] The Courts have also recognised a secondary public interest element in examinations in that they assist in the regulation of companies by providing a public forum for the examination of examinable company officers. Kirman v Bazzo [2020] WASCA 43 [54] – [64].

[vi] Grosvenor Hill (Qld) Pty Ltd v Barber (1994) 48 FCR 301 at 308; 120 ALR 262 at 269 

[vii] Grosvenor Hill (Qld) Pty Ltd v Barber (1994) 48 FCR 301; 120 ALR 262; Re McEachern [2014] FCA 1364; Tolric Pty Ltd v Taylor [2015] FCA 1051 at [51] –[54].

[ix] Friedrich v Herald and Weekly Times Ltd [199] VR 995 per Kaye, Fullagar and Ormiston JJ applied in Re New Tel, op. cit. at [91]

[x] Re Plutus Payroll Australia Pty Ltd [2020] NSWSC 46 at [10] to [14] per Gleeson J.

[xi] Harman v Secretary of State for the Home Department [1983] 1 AC 280

[xii] Hearne v Street (2008) 235 CLR 125 [96] per Hayne, Heydon and Crennan JJ.

[xiii] In Re Southern Equities Corporation Ltd (in liq); Bond & Caboche v England (1997) 25 ACSR 394, the Full Court of the Supreme Court of South Australia said that the undertaking covered documents produced to the Court in response to an examination summons. However, using the documents in the liquidation, including in any proceeding brought to get in the assets of the company, falls within the purpose for which the documents were sought (Lander J at 437, Cox and Bleby JJ agreeing) so no contempt arises.

[xiv] Re Southern Equities Corporation Ltd (in liq): Bond & Caboche v England (1997) 25 ACSR 394.

[xv] See LCM Operations Pty Ltd, in the matter of 316 Group Pty Ltd (in liq) [2021] FCA 324. where the assignee of a claim was given leave to use documents produced under compulsion.

[xvi] https://www.oaic.gov.au/engage-with-us/research-and-training-resources/research/australian-community-attitudes-to-privacy-survey/australian-community-attitudes-to-privacy-survey-2023

[xvii] VPrivCmr 4 (18 May 2004)

[xviii] PrivCmrA 5 (1 April 2007)