The UK High Court recently ruled* that data could be transferred from England to the US as the transfer of the data was necessary for reasons of substantial public interest, and for the purpose of legal proceedings and establishing legal rights. The ruling was given in the context of the investigation into the alleged fraud by Bernard Madoff, in which Madoff is alleged to have defrauded investors world-wide of some $50 billion.

Mr Picard has been appointed by the New York Courts as the office holder, the trustee in bankruptcy concerned with the liquidation of Bernard L Madoff Investment Securities LLC, a company operating in the United States. The joint provisional liquidators of an English company, Madoff Securities International Limited, applied to the UK High Court for authority to transfer personal data from the UK to Mr Picard in the US. Both parties claimed that the transfer of the data was necessary in order to unravel the alleged fraud and what has happened to the assets which have been invested in the Madoff Empire.

The UK Data Protection Act 1998 ("the UK Act"), like the Irish Data Protection Acts 1988 & 2003 ("the Irish Acts"), prohibits the transfer of personal data to a country outside the EEA unless that country ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. The US has not been approved as providing such an adequate level of protection (unless the US organisation in question has signed up to the Safe Harbour arrangement). The UK Act, again like the Irish Acts, contains an exemption from this prohibition where: "The transfer is necessary for reasons of substantial public interest". The High Court found that it was in the public interest for an alleged fraud on the scale and complexity of that in the Madoff case to be investigated, and on that basis found the transfers of data to be necessary for reasons of substantial public interest.

The High Court also found that two other exceptions to the prohibition of transfers applied, namely, that the transfer was necessary for the purpose of legal proceedings and to establish legal rights, on the grounds that the unravelling of the fraud would undoubtedly involve legal proceedings. There are in fact two such proceedings already on foot, namely, the liquidations in New York and in the UK.

Comment

The decision shows that the courts will interpret the exemptions to the prohibition on transfers of data to third countries broadly, where such information will assist an investigation into substantial fraudulent activity. However the court would not go so far as to grant an order giving the joint liquidators discretion to disclose to the Mr Picard such further unspecified information in their possession or under their control, as they consider to be necessary. The court refused to make a blanket order of that kind without knowing exactly what it was being asked to authorise.

To assist understanding of the legal framework relating to transfers of personal data from the EEA to third countries the European Commission recently published a list of FAQs. The FAQs document helpfully provides a diagram of the step by step decision-making process to be undertaken before any transfer of personal data takes place. The FAQs are divided into four categories consisting of: (a) general questions; (b) standard contractual clauses; (c) binding corporate rules; and (d) derogations.

FAQs relating to transfers of personal data from the EU/EEA to third countries

*In the Matter of Bernard L Madoff Investment Securities LLC v In the Matter of Madoff Securities international Ltd [2009] EWHC 442 (Ch)