For many companies, the outsourcing of data hosting to an external hosting provider is attractive for security and cost reasons. Before sensitive or valuable data is managed externally, however, the management should consider a possible bankruptcy of the hosting provider. Such an event raises various legal questions, of which only a few have been clarified.
What happens if the hosting provider goes bankrupt? In the event of a bankruptcy of the hosting provider, the digital data managed by the hosting provider generally also fall into the bankruptcy estate. For the outsourcing company, the question then arises as to how the data can be reclaimed.
Who owns the company's digital data? Swiss law distinguishes between absolute rights which can be asserted against everyone and relative rights that exist only between parties. The strongest absolute right is ownership.
Legally, ownership can principally only be established on items. An item is a spatially limited, controllable, physical object. The discussion as to whether, on this basis, ownership of digital data can be established is only beginning in Switzerland. Since digital data is lacking in physicality, the tendency is that no ownership can exist for digital data.
However, digital data can undoubtedly be the subject of contractual agreements, for example purchase contracts or orders. The claim on certain digital data can thus result from a contract concluded between the parties.
How do I get my company's data back in the event of bankruptcy? In the case of bankruptcy, the return of assets can be achieved with the so-called segregation according to the Swiss Debt Enforcement and Bankruptcy Act (DEBA). However, the segregation requires the respective assets to be physical items, so digital data cannot be reclaimed on the way of the segregation.
Whether the digital data can nevertheless be recovered in the bankruptcy of the hosting provider depends therefore on the respective procedure of the responsible bankruptcy administration (for example continuation of the business, deadline setting for the data migration, etc.).
If the digital data qualifies as personal data according to the Data Protection Act, the affected persons are protected by the Data Protection Act in the bankruptcy of the hosting provider. This prohibits any unlawful processing of personal data.
What provisions can I make? In order not to be dependent on bankruptcy administration in the bankruptcy of the hosting provider, it is advisable to already take precautions at the time of the outsourcing of the digital data.
For this reason, in practice, the contract with the hosting provider determines that the ownership of the data (albeit untechnical) lies with the customer and that this data is always subject to a claim for surrender. A bankruptcy administration will hardly counteract a clearly defined assignment of the claim to the digital data.
In the area of virtual currencies, which are also digital data, the Federal Council intends to clarify shortly whether this ownership can be established (see the press release of the Federal Council of 1 February 2017 - in German).