Legal query over website ownership for involvent company

[judas]

Afternoon!

I'm CTO/Head of IT at a small web development company. While I was away on annual leave, one of our clients - a cancer charity - contacted us to say they were closing down as they were insolvent. Following this, we were contacted by a couple of their employees asking for a copy of their website and database, purged of all user records. My team, being the helpful types, tries to do this, but for complicated technical reasons, couldn't do so.

I've now returned to caught up on this and put an immediate halt on them doing anything further. My position is that in providing what are essentially former employees of the now insolvent company with a copy of the site and data, we would at least be causing a breach in the GDPR and also potentially opening ourselves up to legal action from the insolvency administrators as the site and data are assets of the company.

Would welcome any thoughts on this situation.

[andyb28]

Personally, I would have done the same as you and stopped my staff doing it.

The code is obviously already yours by default. So, the only question that would remain is about the data. As they dont exist as an entity anymore, any claim to the data is void in my opinion.

[Jordie Barretts sock]

What do they want it for? Is it to start up again or is it for nefarious activity?

[judas]

andyb28 said:

Personally, I would have done the same as you and stopped my staff doing it.

The code is obviously already yours by default. So, the only question that would remain is about the data. As they dont exist as an entity anymore, any claim to the data is void in my opinion.

Just to be clear, my company is not claiming ownership of the code. It's all open source and for any custom work we assign the IP over to the client. However, the site as a whole is an asset of the now-insolvent company and it's up to insolvency administrator to determine what happens to it, not the charity's former employees.

Jordie Barretts sock said:

What do they want it for? Is it to start up again or is it for nefarious activity?

This is something that's unclear. There was mention of it 'being valuable to other charities' but I don't have any context for this at the moment. But it does reinforce my notion that as a potentially saleable asset, us handing it over without the explicit consent of the adminstrators could be a Very Bad Thing.

[extraT]

Contracts are key here. You have / had one with the charity, which is insolvent. You don’t have one with the administrator or charity employees. Unless the charity direct or the administrator via legal routes ask you to share info, I wouldn’t.

If the administrator asks you and you refuse, you can also get them to ask the charity to inform your directly and ask them for clarification on sharing that info.

[akirk]

If they want a copy - not difficult for them to save a copy of most simple websites - or use Internet Archive etc.
but none of your business - as you rightly set out...
no contract with those people, it is probably not a GDPR issue if user data is removed, but still they have no right to require it from you...

I would sit out of it or go back to them saying that you are happy to help with building a new and very similar site for their phoenix / new business - but here is the cost etc.

[judas]

extraT said:

Contracts are key here. You have / had one with the charity, which is insolvent. You don’t have one with the administrator or charity employees. Unless the charity direct or the administrator via legal routes ask you to share info, I wouldn’t.

If the administrator asks you and you refuse, you can also get them to ask the charity to inform your directly and ask them for clarification on sharing that info.

My understanding (which admittedly may be wholly incorrect) is that the insolvency administrators take over the running of the business as a prelude to it being wound down, which effectively makes requests from them equal to requests from the charity itself - so no explicit contract with the administrators is necessary.

akirk said:

If they want a copy - not difficult for them to save a copy of most simple websites - or use Internet Archive etc.
but none of your business - as you rightly set out...
no contract with those people, it is probably not a GDPR issue if user data is removed, but still they have no right to require it from you...

I would sit out of it or go back to them saying that you are happy to help with building a new and very similar site for their phoenix / new business - but here is the cost etc.

The website is far from simple, and even with the user database anonymised or deleted, there is still content (stuff like cancer survivor stories, case studies etc) that are potential GDPR boobytraps.

There's little to no prospect of them phoenixing. We'd already quoted for a website rebuild, which was due to start in a few months...

I suspect they asked for a copy of the site as a bargaining chip to enhance their future employment prospects. We do a lot of work in the charity sector and it's very incestuous; we've seen people jumping from one charity to another with a fair old regularity, all the while working with us as they move jobs. Being able to bring this 'valuable data' to their new job - and probably being ignorant of the legal ramifications - is the likely driving force behind this.

But in any case, further work is on hold until the administrators contact us.

Thanks for everyone's input on this

[akirk]

judas said:

extraT said:

Contracts are key here. You have / had one with the charity, which is insolvent. You don’t have one with the administrator or charity employees. Unless the charity direct or the administrator via legal routes ask you to share info, I wouldn’t.

If the administrator asks you and you refuse, you can also get them to ask the charity to inform your directly and ask them for clarification on sharing that info.

My understanding (which admittedly may be wholly incorrect) is that the insolvency administrators take over the running of the business as a prelude to it being wound down, which effectively makes requests from them equal to requests from the charity itself - so no explicit contract with the administrators is necessary.

akirk said:

If they want a copy - not difficult for them to save a copy of most simple websites - or use Internet Archive etc.
but none of your business - as you rightly set out...
no contract with those people, it is probably not a GDPR issue if user data is removed, but still they have no right to require it from you...

I would sit out of it or go back to them saying that you are happy to help with building a new and very similar site for their phoenix / new business - but here is the cost etc.

The website is far from simple, and even with the user database anonymised or deleted, there is still content (stuff like cancer survivor stories, case studies etc) that are potential GDPR boobytraps.

There's little to no prospect of them phoenixing. We'd already quoted for a website rebuild, which was due to start in a few months...

I suspect they asked for a copy of the site as a bargaining chip to enhance their future employment prospects. We do a lot of work in the charity sector and it's very incestuous; we've seen people jumping from one charity to another with a fair old regularity, all the while working with us as they move jobs. Being able to bring this 'valuable data' to their new job - and probably being ignorant of the legal ramifications - is the likely driving force behind this.

But in any case, further work is on hold until the administrators contact us.

Thanks for everyone's input on this

correct on the administrators - you can take instruction from them - though your choice ref. payment / work.
sounds as though you are on top of the rest!