Table of Contents
- What a buyer should watch for in an asset purchase transaction involving personal information.
- What should the buyer do to prevent liability in an asset purchase transaction?
What a buyer should watch for in an asset purchase transaction involving personal information.
Over the past decade the importance of personal information as a separate asset in M&A transactions, and in particular asset purchase agreements, has increased drastically.
The reason for that is that many companies involved in M&A transactions collect some sort of personal information from their customers, users, clients, employees, etc.
Even collection of minimal information, such as names and email addresses, is enough to trigger compliance with the applicable data protection laws.
Even when the personal information is not one of the main assets being sold in an asset purchase transaction, there could be multiple state and federal privacy and data security laws that need to be taken into account by the seller and the buyer.
What should the buyer do to prevent liability in an asset purchase transaction?
1. During the due diligence process the buyer should request that all data protection and privacy documentation be included in the data room, so the buyer can conduct proper due diligence. During the due diligence process the buyer should look to identify:
- what type of personal information the seller has been collecting, from what subjects (customers, users, employees, etc.) and if there is any sensitive information collected or other information that is subject to stricter regulations.
- examine and evaluate the seller’s privacy policy, whether it is compliant with the applicable legislation and whether it provides all required disclosures for collection and processing of personal data and also the required consents regarding the contemplated transaction (i.e. it if allows personal data to be transferred from the seller to the buyer);
- evaluate seller’s privacy practices and the information security policies, measures, and procedures that seller has in place (for instance requesting information about data security measures implemented by the seller, how personnel is trained, if the seller has procedures to respond to consumer requests, etc.) The ultimate goal of this evaluation is to find out whether the seller’s privacy practices adequately reflect the disclosures and representations made in the seller’s privacy policy.
- find out whether the seller has experienced any security breaches, incidents and threats and how such have been handled.
2. During the negotiations of the asset purchase agreement, the buyer should make sure to include warranties and representation regarding the seller’s compliance with the applicable data protection legislation and seek indemnification for consumer or customer claims related to personal data in order to ensure that buyer is not taking on any potential data privacy-related liability, including potential liability for a past data breach.
3. Post-closing considerations – once the transaction is completed, the buyer needs to make sure to be able to adequately comply with the seller’s privacy policies and implement the required privacy practices in order to avoid data security liability occurred after the closing date.
