TGIF 14 August 2020 – The trade must go on: Federal Court orders director to disclose passwords to company servers and trading platforms

This week's TGIF considers the recent Federal Court case of Krejci, in the matter of Union Standard International Group Pty Ltd (Administrators Appointed) (No 2) [2020] FCA 1111, where the Federal Court ordered the director of a company to disclose passwords to the company’s servers and trading platforms to allow the administrators to fulfil their statutory obligations and responsibilities.

Key takeaways

• The Court’s power to make a direction under s 90-15(1) of the Insolvency Practice Schedule is broad and confers a level of protection for administrators against claims they have acted unreasonably or in breach of duty.
  
  
• However, where a course of action creates unquantified risk and may impact third parties, the Court may prefer alternative remedies with less risk yet uncertain efficacy.
  
  
• Should directors fail to furnish information required by administrators, s 438B(3)(b) of the Act permits an order to be made to compel such production.  

What happened?

The company was a financial services business dealing with derivatives, foreign exchange contracts and providing margin trading services via an online platform. Its sole shareholder was registered in Samoa, the director a resident of Burma, and trading information was held on servers in London, New York, Tokyo and Cyprus.

On 8 July 2020, administrators were appointed by resolution of the directors under s 436A of the Corporations Act 2001 (Cth) (the Act).

Due to, amongst other things, the substantial offshore activities of the company, the administrators were granted an extension of the convening period for the second meeting of creditors.  

However, it became apparent, following the first meeting and the administrators preliminary inquiries, that there was a disparity in the company’s records between the products creditors understood they had been offered and the products reflected in the company’s records and, separately, discrepancies in client equity positions.

Despite repeated attempts by the administrators to obtain access to the company’s trading platforms, the director, through his solicitors, refused and was only prepared to grant limited access (i.e. to certain select platforms on one company server and with that information restricted to what a person holding ‘administrator access’ allows).

As a result, and due to a concern data would be erased and/or falsified and transferred to other platforms, the administrators applied for a direction under s 90-15(1) of the Insolvency Practice Schedule to shut down the servers and trading platforms (being the only practical means by which to secure control over the company’s records).

However, shutting down the  servers could expose the company to liability to third parties and its own clients. For that reason, the administrators sought the protection provided for under s 90-15(1).

Protection afforded

The effect of such a direction is that an administrator who acts in accordance with a judicial direction is afforded protection against claims they have acted unreasonably, inappropriately or in breach of their duty in making the decision or undertaking the conduct.

The administrators argued the direction sought was justified given:

• the company appeared to have already transferred some client accounts to a new operation in Vanuatu, established shortly before the company entered into voluntary administration;  
  
  
• accumulated profits had decreased by nearly $58 million within a month of their appointment; and
  
  
• unauthorised attempts had been made by an unidentified person to direct client trust funds be transferred from the company’s bank account.

However, taking such action would mean that clients and entities using the company’s software license would be prevented from trading or closing out open positions. The administrators acknowledged this could also lead to the inadvertent loss of data and might breach certain sublicensing agreements.

What did the Court decide?

Despite finding the administrators required complete access, the Court was not prepared to make the direction sought. This was due to a concern (without being critical of the administrators) that the likelihood of the risks attached to such an approach had not been adequately assessed and that the impact on third parties had not been quantified.

As a result, the Court ordered that the director provide administrators with ’administrator access’ (or complete access) to the servers and platforms of the company. In making this order, the Court did not accept the director’s argument that granting such access would breach confidentiality of client and related company information such as to warrant such access being withheld.

In reaching this conclusion, the Court held that compelling disclosure of the relevant passwords to facilitate such access was “information about the company’s business, property, affairs [or] financial circumstances” within the meaning of s 438B(3)(b) of the Act. Therefore, the director was obliged to give that information to the administrators in order for them to fulfil their statutory obligations and responsibilities.  

Comment

The Court’s reasoning in this case demonstrates the ways in which making a direction under s 90-15(1) will involve a balancing of different interests. For that reason, administrators seeking a direction must be able to demonstrate their reasons and decision making process, including consideration of the risks attached to the direction they seek.

Further, it serves as a useful reminder to directors of their obligations to co-operate with administrators and what will constitute “information” about a company’s affairs that is required to be disclosed.