Data Privacy Considerations in Mergers and Acquisitions: Safeguarding Personal Information of Employees
Introduction
In today’s digital age, privacy, and information security have emerged as critical concerns for businesses worldwide. With companies collecting, using, and storing vast amounts of personal data, safeguarding that information has become paramount. This is particularly crucial in the context of mergers and acquisitions (M&A), where privacy and data security can make or break a deal. Neglecting these aspects can lead to significant risks and potential liabilities, ranging from regulatory violations to data breaches. As the global recession of 2020 temporarily froze deal-making, the value of M&A transactions[i] remained substantial, signaling the resilience and importance of strategic business combinations. Companies, whether large or small, sought to leverage M&A transactions to acquire technology, scale, portfolio diversity, and financial efficiency. However, amidst the flurry of mergers, regulators scrutinized compliance with data protection regulations and the security of customer data.
The consequences of inadequate privacy and data security practices cannot be underestimated. Just consider the Verizon-Yahoo deal in 2017[ii], where a massive data breach resulted in a $350 million reduction in Verizon’s offer to acquire Yahoo. Such incidents highlight the potential damage to the global financial market and the reputation of the merging entities. While financial data and market movements traditionally dominate M&A discussions, it is crucial not to overlook[iii] the significance of integrating robust data privacy and security measures into the very fabric of the deal. Security failures can jeopardize transactions at the eleventh hour, while regulatory compliance becomes a fundamental aspect of post-merger operations. The complexities surrounding these issues keep chief financial officers awake at night, emphasizing the need for proactive due diligence and a comprehensive roadmap to ensure compliance both domestically and internationally.
Page Contents
How companies can adopt a holistic data privacy approach to protect customer’s data during an M&A?
During mergers and acquisitions (M&A), adopting a holistic data privacy approach[iv] is crucial to protect customer data and ensure compliance with applicable regulations. Companies must navigate various legal considerations to safeguard personal information throughout the M&A process. By integrating privacy concerns into the regional anatomy of the deal, organizations can enhance their data protection practices and derive further capabilities for the merged corporation. The four critical stages involved in adopting a comprehensive data privacy approach during M&A transactions are as follows:
1. Privacy Exposure Screening: To begin, companies need to thoroughly assess privacy exposure during the screening process. Noncompliance with privacy regulations poses significant risks, which should be factored into the deal’s value. If a business is noncompliant, potential revenue generated from customer data post-merger should be analyzed to determine any necessary discounts. Additionally, the cost of bringing the merged entity into compliance with existing regulations must be considered. Conducting a compliance maturity measure helps compare the target M&A cost with the cost of acquisition. If compliance maturity is low, the acquiring company may reconsider the deal.
2. Data Privacy Due Diligence: Data privacy due diligence is a critical step that should include a dedicated data room. In addition to conducting a risk audit, vulnerability mapping exercises, such as penetration tests and vulnerability assessments, should be performed. This exercise allows both companies to assess the internal data they collect, understand the reasons for data collection, and envision the combined data footprint post-merger. Attention must be given to personally identifiable information (PII) and the creation of a confidentiality agreement to mitigate unknown reputational risks. Establishing a secure data room ensures regulatory compliance post-merger, prevents data breaches, and protects sensitive customer and competitive information. The data room should be tightly controlled, requiring consent before sharing customer data, prohibiting data downloads or extractions, and aggregating data to avoid disclosing information about real individuals.
3. Deal Structure with Data Privacy: The deal structure itself must address data privacy concerns. Companies should identify the data they hold, how it is processed, and the relevant regulations governing such processing. Consent and data transfer agreements must comply with global regulations; otherwise, the sale of data between the merging firms could be rendered null and void post-merger. Both companies also need to ensure that customers are aware of the transaction and how their data will be used in the merged entity. The deal structure should account for efficient and robust handling of disputes, necessitating a comprehensive warranty agreement that considers any ongoing investigations or complaints.
4. Integration and Data Migration: Once the deal is finalized, integrating interrelated IT systems and migrating data becomes crucial for business continuity.
Steps to be be taken to ensure a smooth transition while maintaining data privacy:
Several steps should be taken to ensure a smooth transition while maintaining data privacy:
- Perform detailed discovery to identify personal data footprints in the merged entities and create a joint data inventory.
- Establish records of processing to ensure data is used as intended.
- Obtain customer consent, especially when conflicting customer files exist in both merging entities.
- Design and implement data privacy policies and guidelines for the merged entity.
- Develop a change management[v] training plan to educate employees about changes in privacy policies and processes, as employee training is the acquiring organization’s responsibility under privacy regulations.
- Define access rights in data subject access requests from both organizations.
- Determine the target operating model of the merged firm, whether decentralized, centralized, or hybrid.
- Utilize data exchange, quality, and governance technology to automate processes, increase implementation speed, and minimize the risk of data breaches caused by human error.
By following this holistic approach, companies can proactively address data privacy concerns, mitigate risks, and ensure compliance with applicable laws and regulations. Integrating privacy into the M&A process not only safeguards customer data but also contributes to the overall success of the transaction and the protection of the merged entity’s reputation.
Significance of conducting Data Privacy Due Diligence in M&A
Conducting data privacy due diligence[vi] is of paramount importance during mergers and acquisitions (M&A) transactions. It allows the buyer to thoroughly evaluate the seller’s data privacy and security practices, identify potential risks and liabilities, and make informed decisions regarding the transaction. The significance of conducting data privacy due diligence in M&A transactions are as follows:
1. Compliance with Data Privacy Laws: Data privacy due diligence enables the buyer to assess whether the seller has complied with applicable data privacy laws and regulations. By examining the seller’s privacy policies, disclosures, and industry-specific regulations, the buyer can determine if the seller’s data collection, storage, usage, and disclosure practices align with legal requirements. This analysis is crucial as non-compliance with data privacy laws can lead to substantial legal and financial consequences for the merged entity.
2. Identification of Personal Information: Through data privacy due diligence, the buyer can identify the types of personal information collected by the seller. Understanding the scope of personal data collected from various sources, such as customers, employees, and business representatives, is essential for assessing the potential data privacy risks associated with the merger. This information helps the buyer evaluate the sensitivity of the data and implement appropriate measures to protect it post-merger.
3. Evaluation of Privacy Policies and Disclosures: Reviewing the seller’s privacy policies and related disclosures provides insights into their compliance with legal requirements and industry best practices. The buyer can assess whether[vii] the seller’s privacy policies accurately disclose how personal information is collected, used[viii], stored, and disclosed. This evaluation helps identify any gaps or deficiencies in the seller’s privacy practices and enables the buyer to determine if adjustments or improvements are necessary to ensure compliance and protect customer data.
4. Information Security Measures: Data privacy due diligence includes an assessment of the seller’s information security policies and procedures. The buyer examines the safeguards in place to protect personal information from unauthorized access, data breaches, and security incidents. This analysis includes evaluating data encryption practices, remote working arrangements, access controls, business recovery plans, incident response protocols, and data retention policies. Understanding the seller’s information security measures allows the buyer to gauge the level of risk associated with the acquired data and implement necessary safeguards post-merger.
5. Vendor and Third-Party Risks: The buyer must assess the seller’s relationships with vendors and third parties who may have access to personal information. Evaluating vendor management procedures and reviewing relevant agreements helps identify potential risks associated with sharing personal data with external parties. By ensuring appropriate safeguards and agreements are in place, the buyer can mitigate the risk of data breaches and protect the privacy of individuals whose data is involved in the transaction.
6. Data Breach History and Legal Issues: Understanding the seller’s history of data breaches and security incidents is crucial. The buyer should be informed about any past incidents, regardless of their magnitude, and the seller’s response to those incidents. Additionally, the buyer should inquire about any litigation, complaints, regulatory inquiries, or penalties related to data breaches or the seller’s privacy practices. This information helps assess the seller’s track record and potential liabilities that may impact the merged entity.
7. Adjustments to Purchase Price: Based on the findings of data privacy due diligence, the buyer may consider negotiating adjustments to the purchase price. If significant data privacy risks or potential liabilities are identified, the buyer may seek to reduce the purchase price to account for the costs associated with mitigating those risks or addressing compliance gaps.
Thus, conducting data privacy due diligence during M&A transactions is critical as it enables the buyer to evaluate the seller’s privacy practices, address any deficiencies, and implement necessary measures to ensure data privacy and security in the merged entity.
Safeguarding Employee’s Personal Information during M&A
During an M&A transaction, the handling and transfer of employee information raise important data privacy considerations. It is crucial for businesses to inform and consult employees[ix] about the processing of their personal data and any potential impact on their employment. This legal analysis discusses the importance of such transparency and the obligations businesses should consider in this regard.
1. Legal Obligations: Businesses must adhere to applicable labor and privacy laws governing employee data at both the federal and state levels in the United States. For example, the California Privacy Rights Act (CPRA) imposes obligations on the protection of employee personal information, eliminating the previous exemption. In the European Union (EU), the General Data Protection Regulation (GDPR) governs the processing of employee data, considering it as personal information subject to specific protections.
2. Informed Consent: Businesses should ensure that employees are adequately informed about the processing of their personal data during an M&A transaction. This includes notifying employees of the purpose and legal basis for processing their data, any potential recipients of the data, and the rights they have in relation to their data. Informed consent should be obtained where required under applicable data protection laws.
3. Employee Consultation: It is essential to consult with employees regarding the processing of their personal data during an M&A transaction. This consultation should be meaningful, providing employees with an opportunity to express their concerns and ask questions. Consulting employees demonstrates respect for their privacy rights and fosters a transparent and collaborative approach.
4. Impact on Employment: Businesses should inform employees about any potential impact the M&A transaction may have on their employment. This includes disclosing any changes to their roles, responsibilities, working conditions, or any potential redundancies. Providing employees with clear and timely information allows them to understand the implications and make informed decisions regarding their employment.
5. Data Minimization and Purpose Limitation: During an M&A transaction, businesses should ensure that the processing of employee data is limited to what is necessary for the purpose of the transaction. Personal data should not be retained or used for purposes unrelated to the transaction unless specific consent or legal obligations require otherwise. Adhering to data minimization and purpose limitation principles helps protect employee privacy.
6. Security and Confidentiality: Businesses must implement appropriate security measures to safeguard employee data during an M&A transaction. This includes ensuring that data is protected against unauthorized access, loss, or destruction. Additionally, businesses should consider any confidentiality obligations they have towards employees and ensure that employee data is disclosed only to authorized parties involved in the transaction.
7. Employee Rights and Remedies: Employees have rights under data protection laws, such as the right to access, rectify, and erase their personal data. Businesses[x] should provide employees with information on how to exercise these rights and offer appropriate remedies if their data privacy rights are violated during the M&A transaction. Demonstrating a commitment to respecting employee rights reinforces trust and compliance with applicable laws.
Hence, businesses involved in an M&A transaction must prioritize data privacy considerations related to employee information. Informing and consulting employees about the processing of their personal data, as well as any potential impact on their employment, is crucial for transparency, compliance with applicable laws, and maintaining positive employee relations throughout the transaction.
Conclusion[xi]
Safeguarding customer’s and employee’s personal information during mergers and acquisitions (M&A) is a critical legal consideration that businesses must prioritize. The digital age has heightened privacy concerns, making data protection and security paramount in the success of M&A transactions. Neglecting these aspects can result in severe risks, including regulatory violations, reputational damage, and financial liabilities. To adopt a holistic data privacy approach, companies must integrate privacy concerns at every stage of the M&A process. This includes conducting privacy exposure screening, performing data privacy due diligence, addressing data privacy concerns in the deal structure, and ensuring smooth integration and data migration. By following these steps, businesses can proactively mitigate risks, ensure compliance with applicable regulations, and protect customer data throughout the transaction.
Conducting data privacy due diligence is of utmost significance during M&A transactions. It enables the buyer to assess the seller’s data privacy and security practices, identify potential risks, and make informed decisions. This includes evaluating compliance with data privacy laws, understanding the types of personal information involved, assessing privacy policies and disclosures, evaluating information security measures, and examining vendor and third-party risks. Data privacy due diligence helps the buyer negotiate adjustments to the purchase price based on identified risks and liabilities. Similarly, safeguarding employee’s personal information during M&A requires businesses to fulfill legal obligations, obtain informed consent, consult with employees, disclose the potential impact on employment, practice data minimization and purpose limitation, implement security and confidentiality measures, and respect employee rights and remedies. Prioritizing employee data privacy and maintaining transparent communication throughout the transaction is crucial for compliance and positive employee relations.
Therefore, integrating robust data privacy practices into M&A transactions not only protects customer and employee data but also contributes to the success of the deal and the reputation of the merged entity. By prioritizing legal compliance and transparency, businesses can navigate the complexities of data privacy in M&A transactions and ensure the long-term trust and confidence of customers and employees alike.
[i] Freshfields Bruckhaus Deringer, Data privacy accountability – a risk for M&A in Europe and beyond?, Lexology, May 19 2022, https://www.lexology.com/library/detail.aspx?g=3918553b-3bb9-4800-b074-a96a0619842e.
[ii] Richard Parker, Verizon-Yahoo Deal On The Ropes – Is Cyber Security Killing Deals?, Forbes, Jan 5, 2017,04:00pm EST, https://www.forbes.com/sites/richardparker/2017/01/05/verizon-yahoo-deal-on-the-ropes-is-cyber-security-killing-deals/?sh=1ed7b1ac2c27.
[iii] Brad Janssen, Matthew F Knouff, Rani Habash, Data privacy and security issues in M&A transactions: Part one, International Association of Privacy Professionals, April 26, 2016, https://iapp.org/news/a/data-privacy-and-security-issues-in-ma-transactions-part-one/.
[iv] Daniel Ilan, Cleary Gottlieb Steen & Hamilton LLP, Privacy in M&A Transactions: Personal Data Transfer and Post Closing Liabilities, Harvard Law School Forum on Corporate Governance, June 16, 2023, https://corpgov.law.harvard.edu/
[v] The Sedona Conference, Commentary on Data Privacy and Security Issues in Mergers & Acquisitions Practice, 20 SEDONA CONF. J. 233 (2019).
[vi] Loeb & Loeb LLP, Data Privacy and Security Considerations in M&A Transactions, Lexology, February 15 2022, https://www.lexology.com/library/detail.aspx?g=50d05a72-d10d-4f80-ac11-cee7c9931d00.
[vii] PwC Legal, Inadequate data protection due diligence in M&A transactions can lead to high fines, 11 Jul 2019, https://www.pwclegal.be/en/news/inadequate-data-protection-due-diligence-in-m-a-transactions-can.html.
[viii] Octillo, Privacy Considerations in M&A Transactions – Employee Data Transfers, NOVEMBER 2, 2022, https://octillolaw.com/insights/privacy-considerations-ma-transactions-employee-data-transfers/.
[ix] Amit Khandelwal, Cybersecurity due diligence in M&A and divestitures, Ernest & Young, https://www.ey.com/en_in/strategy-transactions/cybersecurity.
[x] Ibid.