REGULATION OF DATA OWNERSHIP POST-INSOLVENCY: LEGAL FRAMEWORK AND CASE LAWS

1. INTRODUCTION

Data ownership post-insolvency concerns the legal status, control, transfer, valuation, and protection of digital information when a company enters insolvency resolution, liquidation, restructuring, or acquisition by a new owner. Business databases, customer records, employee information, transaction histories, proprietary algorithms, software, research datasets, and digital archives may possess substantial commercial value.

However, the insolvency of a company does not automatically make every item of information it holds freely transferable property. A distinction must be drawn between ownership of a database or software system, intellectual property rights in its structure, contractual rights to use information, and the personal data of individuals whose information is stored within it.

In India, this subject is governed principally by the Insolvency and Bankruptcy Code, 2016 (IBC), the Digital Personal Data Protection Act, 2023 (DPDP Act), applicable intellectual property legislation, contractual obligations, and the constitutional right to privacy. The central legal challenge is to maximise the value of an insolvent company's assets without unlawfully transferring, disclosing, or exploiting information belonging to or concerning third parties.

2. LEGAL FRAMEWORK

A. INSOLVENCY AND BANKRUPTCY CODE, 2016

Section 3(27) of the IBC broadly defines property, while Section 18(f) authorises the interim resolution professional to take control and custody of specified corporate-debtor assets, including intangible assets and intellectual property. Section 36 addresses the liquidation estate and includes relevant intangible assets, subject to statutory exclusions.

These provisions may support treating a proprietary database, database structure, software, or related contractual rights as an asset where the corporate debtor has the necessary ownership or enforceable rights. Nevertheless, the precise classification of a database as an insolvency asset remains legally unsettled in India.

Section 30(2)(e) requires a resolution plan not to contravene existing law. Consequently, asset valuation and transfer under the IBC must be reconciled with applicable privacy, intellectual property, confidentiality, and contractual obligations.

B. DIGITAL PERSONAL DATA PROTECTION ACT, 2023

The DPDP Act establishes a framework for processing digital personal data. It distinguishes the individual to whom personal data relates, known as the data principal, from the data fiduciary that determines the purpose and means of processing.

The Act regulates processing through applicable requirements concerning notice, consent or legally recognised legitimate uses, security safeguards, retention, and individual rights. A company entering insolvency does not thereby obtain unrestricted permission to commercialise personal information.

The Act's commencement and the phased application of its provisions must be checked against the relevant government notifications. The legal position applicable to a particular insolvency transaction therefore depends on the provisions in force at the relevant time.

C. INTELLECTUAL PROPERTY AND CONTRACTUAL RIGHTS

Copyright in software, database compilation, confidential business information, and contractual licences may have independent value. The Copyright Act, 1957, and applicable contract law determine the scope of relevant rights.

A purchaser may acquire ownership of a database structure without automatically acquiring every third-party licence, copyright, trade secret, or unrestricted right to reuse personal information contained in that database. Assignment restrictions and confidentiality agreements must also be examined.

3. IMPORTANT CASE LAWS

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Authority: Direct authority on constitutional privacy; analogous to data ownership during insolvency.

The Supreme Court recognised privacy as a fundamental right protected by the Constitution. The judgment established that privacy, personal autonomy, and informational self-determination are important constitutional interests.

Legal significance: A company's insolvency cannot, by itself, eliminate the privacy interests of individuals whose information it holds. The commercial value of customer records must be distinguished from the legal authority to process or transfer those records.

2. Committee of Creditors of Essar Steel India Ltd. v. Satish Kumar Gupta (2020) 8 SCC 531

Authority: Direct authority on insolvency resolution and value maximisation; analogous to data assets.

The Supreme Court considered the structure of the corporate insolvency resolution process and the commercial role of the Committee of Creditors, while emphasising the importance of the IBC's statutory objectives and the limits of judicial interference in commercial decisions.

Legal significance: Data may contribute to the commercial value of an insolvent business, but its valuation and transfer must remain consistent with the IBC and other applicable laws. Value maximisation does not authorise unlawful exploitation of personal data.

3. ArcelorMittal India Private Limited v. Satish Kumar Gupta (2019) 2 SCC 1

Authority: Direct authority on the statutory structure of corporate insolvency resolution; analogous to digital-asset transfers.

The Supreme Court interpreted eligibility and resolution-plan requirements under the IBC, emphasising the statutory framework governing corporate insolvency resolution.

Legal significance: A prospective resolution applicant must comply with the applicable statutory requirements. A plan involving the transfer or continued use of digital assets should identify the rights being acquired and address legal restrictions affecting their use.4. Vodafone Idea Ltd. v. Union of India (2020) 6 SCC 791

Authority: Direct authority on the distinction between ownership and licensed rights; analogous to data assets.

The Supreme Court considered the legal status of telecom spectrum in the context of insolvency proceedings and government dues. The dispute illustrated that a commercially valuable right does not necessarily constitute property owned by the corporate debtor merely because the debtor possesses or uses it.

Legal significance: The principle is relevant by analogy to databases, licensed software, and third-party datasets. A company cannot necessarily transfer rights it does not own, even when those rights contribute substantially to its commercial value.

5. Federal Trade Commission v. Toysmart.com, LLC (2000–2001)

Authority: Foreign authority directly concerning customer-data transfers in bankruptcy.

Toysmart.com, a US online retailer, sought to sell customer information during bankruptcy despite having made privacy commitments restricting disclosure. The Federal Trade Commission challenged the proposed sale, and a settlement established restrictions on transferring the information, including requirements concerning the purchaser and existing privacy commitments.

Legal significance: The case demonstrates that customer information may possess commercial value while remaining subject to restrictions arising from privacy promises and applicable law. It is a foreign authority, not binding Indian precedent.

6. In re RadioShack Corporation, No. 15-10197 (Bankr. D. Del. 2015)

Authority: Foreign authority directly concerning the sale of customer information in insolvency.

During RadioShack's bankruptcy, the proposed sale of customer information attracted objections from regulators and other stakeholders because of privacy commitments made to customers. A court-approved arrangement permitted a restricted transfer of certain information subject to conditions, including limits on the data transferred and safeguards for affected customers.

Legal significance: Insolvency-related transfers should consider existing privacy representations, the sensitivity of information, the purchaser's intended use, and appropriate protective conditions.

7. Jilubhai Nanbhai Khachar v. State of Gujarat, 1995 Supp (1) SCC 596

Authority: Analogous authority on the legal concept of property.

The Supreme Court discussed the broad meaning of property in constitutional law. The judgment supports the general proposition that property is not necessarily confined to tangible physical objects.

Legal significance: The decision may support an argument that certain proprietary interests in databases or digital systems can have legal and commercial value. It does not, however, establish that personal data itself is owned by a company or that a database is automatically an asset available for sale under the IBC.

4. DISTINGUISHING DATA OWNERSHIP FROM DATA CONTROL

A sound legal analysis should distinguish the following categories:

A. PERSONAL DATA

Names, contact details, purchase histories, employee records, and identifiable behavioural information concern individuals. A company may collect and process this information under applicable legal permissions, but insolvency does not confer unrestricted ownership or commercialisation rights over it.

B. PROPRIETARY DATABASE STRUCTURE

Database architecture, indexing systems, software, original compilation, and certain analytical tools may embody intellectual property or other proprietary interests. Their treatment depends on the rights actually held by the company, the applicable law, and any contractual restrictions.

C. THIRD-PARTY LICENSED DATA

Information supplied under licence or contractual arrangements may remain subject to restrictions on assignment, sublicensing, disclosure, or commercial use. The resolution professional or liquidator must establish the scope of the debtor's rights before attempting a transfer.

D. ANONYMISED OR AGGREGATED DATA

Properly anonymised information may present different privacy considerations from identifiable personal data. However, aggregation alone does not necessarily remove privacy risks, and the legal classification depends on whether individuals can still be identified and on the applicable statutory requirements.

5. PRACTICAL COMPLIANCE REQUIREMENTS

Organisations managing data during insolvency should adopt the following measures:

Conduct a data-asset audit: Identify databases, software, intellectual property, personal information, licences, and third-party datasets.

Verify legal ownership: Examine contracts, licences, copyright records, privacy notices, and other documents establishing the rights held by the corporate debtor.

Assess transfer restrictions: Determine whether consent, contractual approval, regulatory permission, or another legal condition is required before transferring information.

Protect confidential information: Restrict access by prospective resolution applicants and use confidentiality agreements and secure data rooms.

Minimise disclosures: Provide anonymised, aggregated, or redacted information where it is sufficient for due diligence.

Preserve cybersecurity: Maintain access controls, encryption, incident-response procedures, and records of authorised access during insolvency.

Address data in resolution plans: Specify the assets being transferred, applicable restrictions, data-security obligations, and responsibility for continued lawful processing.

Establish retention and deletion rules: Retain information only as legally justified and securely dispose of copies that are no longer required, subject to applicable retention obligations.

Consider cross-border restrictions: Examine applicable foreign data-protection, localisation, and contractual requirements where information is stored or transferred internationally.

6. CONCLUSION

Regulation of data ownership after insolvency requires reconciliation between the IBC's objective of value maximisation and the legal protections governing personal information, intellectual property, confidentiality, and contractual rights. Sections 18 and 36 of the IBC provide a basis for dealing with qualifying intangible assets, but they do not establish unrestricted ownership of every dataset held by a corporate debtor.

The principles in Puttaswamy, Essar Steel, ArcelorMittal, Vodafone Idea, and Jilubhai Nanbhai Khachar, together with the foreign bankruptcy examples of Toysmart.com and RadioShack, help explain the distinction between an asset's commercial value and the legal authority to transfer it. None of the cited Indian Supreme Court decisions directly determines ownership of a corporate database in insolvency.

Accordingly, the most defensible approach is to identify precisely which rights belong to the debtor, preserve the privacy and contractual rights of third parties, and ensure that any transfer is authorised by applicable law. Clearer insolvency-specific rules would improve certainty for creditors, resolution professionals, purchasers, and individuals whose information is held by insolvent businesses.