Research and analysis

Processing personal data for Individual Voluntary Agreement Research

Published 16 January 2024

Applies to England, Scotland and Wales

This privacy notice tells you about how the Insolvency Service (the agency) will be processing personal data for its research into Individual Voluntary Agreements (IVAs) to be conducted by the end of 2023/24.

1. Who is the data controller for the information we process

The data controller for personal information processed for the purposes specified in this notice is the Department of Business and Trade (DBT). The Data Protection Officer for DBT can be contacted via [email protected].

The Insolvency Service is an executive agency of DBT and handles data protection matters on a day-today basis under a delegated authority. The agency’s Information Rights Team can be contacted via email at [email protected].

2. How do we get your information

Your personal information is sent to the agency by Insolvency Practitioners (IPs) so we can record IVAs.

This information is then sent to our research partner RSM UK Creditor Solutions LLP (RSM) who will conduct the research on our behalf, following a fair and open procurement process.

IVAs, particularly concern regarding the take-on experience of some consumers of IVAs, has attracted attention. This has typically been called ‘mis-selling’, but it should be noted there isn’t an agreed definition of what ‘mis-selling’ is; and others dispute that this is a relevant phrase in this context.  Nevertheless, we are using the proxy term ‘mis-selling’ in this context to describe a set of poor-quality take-on practices.

RSM will return to the agency aggregated data that will indicate the scale of potential mis-selling.  In order to assure the checks RSM are conducting, a very small number of cases will also be reviewed by the agency.

3. The categories of personal data we process

The agency will process information relating to the IVAs handled by IPs.  This will include names, addresses and financial situations for those being sold IVAs. The kind of information includes the types of documents and records listed below:

• IVA proposal
• Creditors meeting
• Chairmans report
• Case files
• Annual reviews
• Breach notice
• Termination notice
• Recordings of telephone calls related to the IVAs

4. The purpose and lawful basis for processing your personal data

The purpose of processing is research to understand the scale of ‘mis-selling’ in IVAs, the most prevalent types of ‘mis-selling’ and where any ‘mis-selling’ occurs.

The lawful basis for the agency to process your personal data is Article 6(1)(e) of UK GDPR - performance of a public task or reasons of public interest.

The agency might also process special category data under the lawful basis at Article 9(2)(j) UK GDPR - where it is necessary for research purposes. 

In relying on Article 9(2)(j) UK GDPR the agency also relies on para. 4 of Part 1 of Schedule 1 of the DPA 2018 (where doing so is necessary for research purposes).

The agency might also process information about criminal convictions and offences under the same lawful basis and further conditions.

5. Who we share your personal data with

The Insolvency Service may share your information, where it is necessary to do so, with:

• other government departments and agencies
• legal representatives and courts (including where legally obliged by court order)
• regulators, including IP Recognised Professional Bodies
• authorised intermediaries
• external auditors
• HMRC (for tax and NI contributions)
• The National Archives, when files are selected for transfer for permanent preservation
• data processors we use to deliver our functions

In some circumstances (such as under a court order) the Insolvency Service is legally required to share your information.

Publication of research

Any publication of the research findings will contain only anonymised information unless specific consent has been obtained (such as for a ‘case study’ example).

Use of data processors

The agency uses a data processor called RSM to conduct the research on our behalf.

Overseas transfers

The agency (and its data processors) uses data centres located in the European Economic Area.  In doing so, the agency relies on adequacy decisions made under UK GDPR Article 45.

6. Your rights

Data protection law gives you a number of rights, however, the agency might also not comply (or might partly comply) with requests because a lawful exemption applies. 

Any of the rights can be exercised by emailing [email protected].

The rights are:

• Access

You can ask to see the personal information we are processing about you for this research.

• Rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

• Erasure

You have the right to ask us to erase your personal information in certain circumstances.

• Restriction

You have the right to ask us to restrict the processing (such as deletion) of your information in certain circumstances.

• Data portability

Where you have given us information necessary for a contract you have the right to ask that we transfer the information you gave us from one organisation to another or to give it to you.

• Objection

You have the right to object to processing if we are able to process your information because the process forms part of our public tasks or is in our legitimate interests.

• Automated decision-making

This right does not apply, as the agency does not make automated decisions for this research.

• To complain to the Information Commissioner’s Office

You have the right to complain to the Information Commissioner, who is the UK’s regulator of data protection law:

          https://ico.org.uk/make-a-complaint/

The Insolvency Service tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

If you have any questions or want to make a complaint about the way we have processed your personal information, you can contact us at [email protected].

7. Changes to this privacy notice

We keep this privacy notice under regular review. This version was last updated in December 2023.

8. How long we will keep your information for

You can find out how long the Insolvency Service retains your personal information in our retention periods guide.