Insolvency practitioners

44.80 In its submission on DP 72, the Insolvency Practitioners Association of Australia (IPAA) advised that privacy laws were impacting adversely on the conduct of insolvencies. In particular, the IPAA commented that the Privacy Act was hindering: the collection of information in connection with the investigatory functions of insolvency practitioners; and the disclosure of insolvency information to creditors and other interested parties.^[103]

44.81 Under the Corporations Act 2001 (Cth) and the Bankruptcy Act 1966 (Cth), insolvency practitioners have extensive powers of investigation and inquiry to determine the circumstances of insolvencies.^[104] The IPAA submitted that when its members make an inquiry it is not uncommon for agencies or organisations to withhold the information on the basis of the Privacy Act. The practitioner is then required to use a formal demand process to obtain the information.^[105]

44.82 Insolvency practitioners disclose personal information in order to inform creditors and members of the public about insolvency proceedings; in particular, in their reports to creditors on debtor’s affairs. Increasingly, insolvency practitioners are using web-based processes for this notification. A significant amount of information relating to insolvencies also is available on public registers, such as the National Personal Insolvency Index (NPII) database. The IPAA commented that the Privacy Act is hindering practitioners’ roles in making available this information.^[106]

44.83 In Own Motion Investigation v Bankruptcy Trustee Firm, the Privacy Commissioner considered the publication of bankruptcy information—including financial details—on an insolvency practitioner’s website.^[107] Some, but not all, of this information was publicly available from the bankrupt’s Statement of Affairs and the NPII. The Commissioner accepted that the disclosure of a bankrupt’s personal information to creditors for the purpose of administering the bankruptcy was permitted under the Act. She determined, however, that disclosure to parties who were not involved with the bankruptcy was a breach of the ‘Use and Disclosure’ principle. Publishing personal information on the internet without any limits on accessibility differs from accessing the information through publicly available sources. While an individual seeking access to the publicly available sources needs to make an application for a specific record and pay a fee, any internet user can browse hundreds of bankrupts’ files. The Privacy Commissioner recommended that the insolvency practitioner should take steps to prevent general internet users from browsing the bankruptcy files, for example by securing the information using password protection.^[108]

ALRC’s view

44.84 As a part of their functions, insolvency practitioners regularly handle, often sensitive, personal information. Their role includes collecting personal information through investigative processes and disclosing information to creditors and other interested parties. The ALRC does not, however, consider the Privacy Act to be unduly restricting this role.

44.85 Where inquiries or investigations made by an insolvency practitioner are specifically authorised under legislation, the disclosure of personal information by an agency or organisation will be permitted under the ‘required or authorised by or under law’ exception to the ‘Use and Disclosure’ principle.^[109] This is rightly limited by the scope of the insolvency practitioner’s statutory powers.^[110] Where an agency or organisation is unclear whether a particular disclosure is within the purview of an insolvency practitioner’s role, it is appropriate for them to request a more formal demand process.

44.86 There are clear policy reasons for insolvency proceedings to be made publicly available. This is reflected in the requirement that particulars of such proceedings be recorded on public registers. Insolvency practitioners’ disclosure of personal information, however, is by no means unrestricted. In particular, care must be taken where personal information is made available on the internet.

44.87 In Chapter 11, the ALRC considers the tensions between public registers of information and individual privacy interests. Agencies and organisations are encouraged to restrict the type and extent of personal information that they publish on the internet. The ALRC also recommends that the OPC develop and publish guidance setting out factors that agencies and organisations should consider before publishing personal information in an electronic form.^[111] This guidance will be relevant to insolvency practitioners that use web-based notification processes.