The Insolvency and Bankruptcy Code, 2016 (“the IBC”) is increasingly moving towards data-driven approaches, utilising artificial intelligence to improve efficiency and outcomes. This necessitates a robust Digital Personal Data Protection Act 2023 framework to ensure that data is used ethically and responsibly.
Overview of the Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 (“the DPDP Act”) aims to safeguard personal data, empower individuals with rights, and regulate data processing by data fiduciaries. It establishes guidelines for processing and handling personal information, emphasizing responsible practices and accountability for organizations. The Digital Personal Data Protection Act 2023 grants individuals rights to access, correct, and erase their data, and it also provides mechanisms to lodge grievances and nominate representatives. Sections 33 and 34 specifies penalties for various violations, such as a Rs 250 crores fine on failures to take security measures to prevent data breaches.
Read more : Legal consequences of misrepresentation in insolvency petitions
Overview of the Insolvency and Bankruptcy Code, 2016
The IBC provides a comprehensive framework for resolving insolvency and bankruptcy in India, encompassing corporate, individuals, and partnership firms. It introduces a more efficient and time-bound process for resolving insolvency, aiming to reduce delays and streamline the procedures. The key stakeholders involved in the resolution process include the corporate debtor, financial creditors (banks and financial institutions), operational creditors (such as suppliers, services provides, and employees), insolvency professionals (IPs) to manage the corporate insolvency resolution process (CIRP), the National Company Law Tribunal (NCLT), and the regulatory body responsible for overseeing the insolvency process and IPs, the Insolvency and Bankruptcy Board of India (IBBI). During the CIRP, a company’s assets and information are handled with a focus on preserving value and facilitating a resolution that maximises stakeholder interests.
Data Governance During Insolvency Proceedings
IPs handle various types of personal data, including financial information, assets, and liabilities of the corporate debtor. They must ensure the confidentiality of this information and comply with the Digital Personal Data Protection Act regarding data protection. Resolution Professionals (RPs) have specific responsibilities under the DPDP Act to protect and manage this data ethically and legally. They are obligated to maintain the confidentiality of all information they handle, including personal data, as per clause 21 of the Code of Conduct appended to the First Schedule to the Insolvency and Bankruptcy Board of India (Insolvency Professionals) Regulations, 2016 (“IP Regulations”).
Legal and Compliance Challenges at the Crossroads
The Digital Personal Data Protection Act 2023 recognises the need for creditors to access information relevant to resolving a debt, particularly in bankruptcy situations. This requires a careful balance to ensure that data is accessed legitimately and used only for the purpose of resolution. While consent is generally needed for processing personal data, it allows for exceptions in legal contexts. For example, a data fiduciary can share data with the Committee of Creditors (CoC), buyers, or liquidators during a bankruptcy process, without individual consent, provided it’s necessary for the resolution process and complies with the law. This Act emphasises responsible data handling, including secure storage, limiting access, and ensuring the erasure of data when it’s no longer needed for CIRP.
Regulatory Ambiguities and Gaps
The IBC lacks specific data protection protocols, leading to potential risks for data privacy during the insolvency process. While the DPDP Act provides a general framework for data protection, its application to IBC-related data handling needs to be more clearly defined to apply to the unique circumstances of insolvency proceedings. This lack of specificity can result in the misuse or mishandling of sensitive information during the resolution process.
Need for Harmonisation Between DPDP Act & IBC
To address these risks, it is crucial to establish clear guidelines and protocols for data protection within the IBC framework. This would help ensure that the insolvency process is conducted fairly and efficiently, while also protecting the privacy and interests of all parties involved. The IBBI needs to establish training programmes for IPs on data privacy obligations. There is also a need for sector-specific data protection guidelines during insolvency. Further, potential amendments to the Digital Personal Data Protection Act 2023 and the IBC could involve clarifying certain provisions, addressing ambiguities, and ensuring better alignment between the two legislations. Specifically, clarifications relating to consent, data breach notifications, and the scope of “connected persons” under the IBC are being discussed.
Global Comparisons and Best Practices
The US data protection landscape is fragmented, with federal and state laws governing specific sectors and individuals. This includes laws like the Health Insurance Portability and Accountability Act for healthcare data and state-level data privacy laws like the California Consumer Privacy Act, which frants consumers rights to know about, delete, and opt-out of the sale of their personal data. The UK’s data protection regime is based on the General Data Protection Regulation, which provides individuals right to data access, rectification, erasure, and portability. Singapore’s Personal Data Act regulations the collection, use, and disclosure of personal data, with a focus on consent and data minimisation.
Conclusion
The DPDP Act and the IBC, while dealing with distinct areas, present some key challenges and potential overlaps. The DPDP Act’s focus on data protection and the IBC’s focus on insolvency resolution can create conflicts and operational challenges for business, particularly in situations where personal data is essential to the insolvency process. Data protection compliance is crucial in the IBC to safeguard sensitive data, ensure fair and transparent proceedings, and avoid legal penalties. It helps maintain stakeholder trust, prevent data breaches, and uphold the integrity of the insolvency framework.
FAQs
Can insolvency professionals access all personal data of a company?
IPs can access some, but not all, personal data of a company. They have a need to access certain information, such as financial records and details relevant to the insolvency process, but they are also bound by confidentiality obligations and data protection laws.
What happens if a data breach occurs during CIRP?
During CIRP, a data breach can lead to financial penalties, legal action, reputation damage, and potential loss of the company’s rights to operate.
Who is accountable for data under IBC proceedings after the DPDP Act?
The DPDP Act defines a data fiduciary as the person who determines the purpose and means of processing personal data, which under the IBC could be the corporate debtor, the IPs, or other stakeholders, depending on who is responsible for managing the data of the company.