The discovery of a data security breach affecting over 500 million Yahoo! Inc. accounts during the proposed billion-dollar purchase by Verizon Communications Inc. alarmed many in the business community. This “mega-breach,” termed as the “largest hack ever” by many media outlets, potentially delays the acquisition, invites further investigations, and might reduce the final sale price. This was highlighted further when Yahoo announced another breach in December affecting over a billion accounts from August 2013.
The Verizon/Yahoo situation isn’t unique. In 2014, Facebook’s acquisition of WhatsApp drew attention over user data use and transfer concerns. These events emphasize the importance of data protection in M&A activities, not just in major digital and telecommunication corporations, but also in traditional businesses. In today’s digital era, data is a valuable asset for almost all businesses. With increasing data protection regulations like the GDPR in the EU, and rising customer expectations about data privacy, data protection has become a crucial aspect of any business transaction.
However, data protection concerns are often overlooked during M&A processes. As an example, in 2014, just two weeks post-acquisition by TripAdvisor Inc., Viator Inc. reported a data breach affecting 1.4 million customers. Not addressing such issues early can disrupt transactions and even question the feasibility of a deal. Thus, it’s essential to consider data protection during the sale or acquisition of a business.
To avoid data protection issues, businesses need to prepare. During M&A transactions, companies should be prepared to address data protection at three main stages: initial engagement, during due diligence, and post-acquisition during IT integration.
Privacy is crucial not just for major deals like those involving major tech giants.
During initial stages, sellers should ensure compliance with data protection regulations. They should audit the personal data they hold, determine its relevancy, and understand the intricacies of its processing. Having up-to-date privacy policies is also crucial.
For buyers, understanding a target’s data protection and security is vital. This understanding can influence the overall strategy of the acquisition. Considerations should include changes in data handling post-acquisition, the need for new customer consents, and any potential changes in products, services, or technologies that might influence privacy and compliance needs.
In essence, both sellers and buyers need to give due consideration to data protection issues to ensure smooth and compliant business transactions.
Key Takeaways
- Expansion and Compliance:
- Acquirers intending to expand the target company’s business into new markets must consider any data protection implications, especially when entering highly regulated sectors like health care or financial services.
- If business expansion involves customer profiling, market research, or direct marketing campaigns, they must comply with relevant data protection and direct marketing requirements.
- Preparatory Considerations:
- Determine the nature and volume of personal data held by the target.
- Evaluate the data necessary to continue the target’s operations post-acquisition.
- Assess if the buyer’s intended use of data differs from the seller’s use.
- Identify if the target possesses sensitive or special categories of personal data, such as genetic or biometric data.
- Due Diligence and Data Protection:
- Parties should review the target’s privacy policies and applicable laws to understand what personal data can be shared and the restrictions on data transfers.
- Data transfers between potential acquirers and sellers are common in M&A transactions. However, such transfers must adhere to data protection laws.
- Sellers must notify data subjects about any data disclosures to third parties, but there are practical challenges in doing so.
- Anonymisation and Risk-based Approach:
- Anonymising the data can avoid the need for notifications.
- If anonymisation is not practical, sellers might consider holding back personal data until later in the transaction or minimizing data volume.
- Sellers should seek non-disclosure agreements with confidentiality undertakings from prospective buyers.
- Data transfers outside the EEA should be conducted with care and under specific conditions.
- Categories of Data:
- Customer and supplier data should be anonymised before disclosure unless express consent is obtained.
- Sensitive personal data disclosures typically require explicit consent and should be avoided.
- Employee data under the Transfer of Undertakings (Protection of Employment) Regulations 2006 does not need anonymisation, but additional employee data should be.
- Tailored Due Diligence:
- Due diligence should be tailored to the company’s activities and operations.
- With the GDPR’s emphasis on “accountability,” a simple review of privacy policies is insufficient. Active evaluation of a company’s data protection practices is essential.
By keeping these key takeaways in mind, acquirers can ensure that they follow proper data protection practices throughout the M&A process. Proper due diligence and adherence to data protection laws not only avoid potential legal complications but also ensure the trust of stakeholders and customers.
Data Protection Implications in M&A Transactions
In mergers and acquisitions, understanding and addressing data protection nuances is crucial for a seamless transition. During the course of due diligence, translating insights into comprehensive representations and warranties within transaction documents is vital. Discovering compliance discrepancies during this process can necessitate strong data protection provisions, along with both pre and post-completion commitments from the selling party.
These findings play a pivotal role in shaping the deal’s representations, warranties, and indemnities. Sellers, for instance, should provide guarantees concerning the target’s data protection practices, ensuring:
- Proper notifications and consent were procured from individuals for data processing.
- Adherence to privacy choices of individuals, like opt-out preferences.
- Implementation of effective measures to prevent unauthorized data access or disclosures.
- Establishment of compliant agreements with data processors in alignment with data protection laws and the target’s privacy policies.
- No history of breaches, unauthorized access, or violation of privacy policies.
Post the deal’s culmination, data protection remains a priority. Buyers may seek indemnities for potential breaches discovered during due diligence. Survival periods of such provisions should take into account factors like IT integration timelines, network security post-completion, and data protection-related limitation periods.
Tackling Data Protection Concerns Promptly
Rather than solely focusing on contract details, imminent data protection issues uncovered should be immediately addressed. If risks associated with the target’s IT security framework are substantial, or if crucial personal data is compromised, renegotiating the purchase price might be warranted. In cases where such issues cannot be resolved before finalizing the deal, mechanisms like escrow accounts or other risk allocation measures between the buyer and seller might be necessary.
Further, buyers could also require the target to adopt specific remedial actions before the deal’s completion, including security enhancements or modifications to existing agreements.
Ensuring Post-Completion Compliance
Data protection implications don’t cease after transaction documentation is signed. Compliance with data transfer laws, especially during share or asset sales, is paramount. In asset sales, there’s a clear need to notify data subjects of their personal data’s transfer. For sensitive data, explicit consent is often needed, making it pivotal to assess potential implications on the involved parties. Inappropriate transfers can lead to significant consequences, both regulatory and reputational.
Evaluating Non-Compliance Risks
At certain transaction phases, parties might find themselves grappling with data protection dilemmas. Understanding the repercussions of non-compliance, such as financial penalties or criminal offenses, is essential. Given the potential of heavy fines and heightened scrutiny from regulatory bodies, it’s crucial to emphasize rigorous due diligence during M&A activities.
A Proactive Approach to Data Protection in M&As
As personal data becomes increasingly central to businesses, ensuring data protection compliance is no longer optional in M&As. Comprehensive due diligence tailored to a target’s specific risks should be a priority. Potential challenges can arise at any transaction stage, so being proactive from the onset to post-completion is essential. Addressing data protection issues after the deal doesn’t eliminate the risk of past non-compliance repercussions. Hence, ongoing assessment and vigilance are crucial for a successful merger or acquisition.
Conclusion:
In the evolving landscape of M&A transactions, data protection has emerged as a paramount concern. It’s not just a matter of regulatory compliance but also deeply interwoven with the very valuation and desirability of the business entity in question. As businesses become increasingly data-centric, the spotlight on how they handle, protect, and transfer this data intensifies. Navigating these waters requires comprehensive due diligence, swift resolution of red flags, and unwavering post-completion vigilance. The stakes are high, encompassing not just financial penalties but also reputational repercussions that can alter the business’s trajectory. It is thus vital for entities, whether they’re buyers or sellers, to treat data protection as a core tenet of their M&A strategy.
Q/As
Q: What are the main considerations for data protection in M&A transactions? A: The main considerations include comprehensive due diligence, ensuring compliance with data transfer laws, addressing potential red flags promptly, evaluating non-compliance risks, and ongoing post-completion assessment.
Q: How can potential data protection risks affect the valuation of a business entity in an M&A transaction? A: Data protection risks can lead to regulatory penalties, reputational damage, and potential renegotiations of the purchase price. These factors can consequently affect the perceived value and desirability of a business entity.
Q: Why is post-completion vigilance crucial in M&A transactions? A: Data protection issues don’t end once a deal is signed. Ongoing assessment ensures compliance, prevents potential future breaches, and protects both parties from latent non-compliance repercussions.
Q: What role does due diligence play in ensuring data protection during M&As? A: Due diligence helps in uncovering compliance discrepancies, assessing the target’s IT security framework, ensuring adherence to privacy choices, and verifying that no previous breaches or violations have occurred. Proper due diligence is instrumental in shaping the deal’s representations, warranties, and indemnities.
Q: How should businesses approach sensitive data during M&A transactions? A: Businesses should obtain explicit consent for the transfer of sensitive data. In cases where consent is challenging to acquire, a thorough assessment of potential implications on the involved parties is vital. Any transfer likely to cause harm or distress should be stringently avoided.
