Data Protection In Corporate Insolvency: Who Is Responsible?

Insolvent companies often hold a large volume of personal data, such as customer lists or user data. Who is responsible for this information? Recently, the Irish High Court decided a case concerning the transfer of patient records from a private hospital in liquidation. The Court was asked to declare that upon transfer of patient records, the recipient, rather than the insolvent company or its liquidator, would be the "data controller" of the personal data in those records meaning that the recipient, not the insolvent entity or liquidator, would be responsible for future compliance with data protection law.

The case is a useful reminder that the identity of a data controller is a matter of fact and not contractual drafting.