The High Court has ruled that personal data can be lawfully transferred to the US in accordance with the Data Protection Act (DPA) to assist in the investigation into the $65 billion fraud conducted by Wall Street investment mogul Bernard Madoff.

Following the arrest and guilty plea of Bernard Madoff the New York Courts appointed Irving Picard to act as liquidator of Bernard L Madoff Investments Securities LLC (BLMIS), the principal company at the centre of the now infamous Ponzi investment scheme. Picard was interested in the strong links between Madoff's offices in New York and London and, in particular, irregularities in communication between them. This apparently included a ban being imposed on London staff communicating with the New York office through company email.

To assist with the investigation Picard and the joint provisional liquidators, appointed in respect of UK affiliates of BLMIS, made an application to the High Court in London seeking authority to transfer information (including personal data) held by UK companies linked to BLMIS to the US liquidators.

Under the DPA, personal data cannot be transferred to countries outside the European Economic Area (EEA) that do not provide 'adequate' protection for that data. The US is not currently sanctioned as providing such adequacy. However there are exceptions to this general rule, including (a) where the transfer is in the public interest or (b) is necessary in connection with any legal proceedings, including prospective legal proceedings.

In this case, the High Court ruled that both exceptions to the general rule applied. In relation to the public interest exemption Mr Justice Lewison stated:

"I am satisfied that it is in the public interest for an alleged fraud on this scale and of this complexity to be investigated, and on the evidence before me I am therefore satisfied that transfers of the information scheduled to the draft order are necessary for reasons of substantial public interest."

In finding that the exception in respect of legal or potential legal proceedings allowed the transfer of the information Mr Justice Lewison stated that the unravelling of the fraud "will undoubtedly involve legal proceedings."

This ruling appears to indicate that where there is clear criminal activity involved, the Courts will take a wide view of the derogation under the DPA so that data may be released to a third country.

Obviously, publicity surrounding the Madoff fraud, its scale and impact on the financial world was influential here. At the same time, the UK Court was still reluctant to relinquish legal control of the process going forward. Picard and the joint provisional liquidators had included in their application a request for the Court to grant them discretion to send further information to the US liquidators if it became necessary, effectively providing carte blanche to pass any personal data they wished to the US. Mr Justice Lewison rejected this application stating, "I do not think that the Court should make a blanket order of this kind without knowing what it is being asked to authorise."