In a previous blog entry we canvassed Canadian privacy legislation and offered businesses a cursory review on how to collect, use and disclose personal information legally in the context of a business transaction. Adding to that information, this entry will look at issues that arise during the due diligence phase of a business transaction and offer tips to assist organizations in complying with privacy obligations.
Due Diligence For Business Transactions
A comprehensive due diligence phase is often undertaken as one of the preliminary steps to help organizations evaluate business transactions. This evaluation looks to the potential value of the transaction as well as the associated risks and liabilities. A cornerstone of due diligence is the exchange and free flow of information from the target to the acquirer. However, often organizations will have a difficult time balancing legal obligations with the realities of the due diligence process.
As we have discussed in Part I, unlike the Alberta and BC statutes, PIPEDA lacks a business transactions exception to the general rule that consent is required prior to the disclosure of personal information. Consequently, individual consents may be required prior to the collection, use, and disclosure of personal information if applicable privacy policies and consents failed to contemplate disclosure during a transaction. That being said, it will generally be impractical, if not impossible, to obtain the consent of all affected individuals, which could be in the thousands, to a transaction. As such, it is highly recommended that private organizations implement privacy policies that contemplate such transactions in advance.
Further, parties to a proposed transaction will often entered into confidentiality or non-disclosure agreement, limiting the number of individuals involved or who are aware of the transactions, in the initial stages in contemplation of the exchange of confidential information. As such, attempting to obtain individual consents from individuals in the course of a transaction may in fact breach the confidentiality or non-disclosure agreement between the acquirer and the target. One way around this issue is ensuring that employee privacy policies contemplate and address disclosure during business transactions.
(a) Disclosure Mechanisms During Due Diligence
During the due diligence phase, information may be received not only directly from the target but also through document disclosure mechanisms such as SEDAR, the System for Electronic Document Analysis and Retrieval. Organizations should be cautious of the types of information that are being disclosed on SEDAR in order to protect against privacy breaches. The Alberta Information and Privacy Commissioner has previously found that an organization was in breach of Alberta's PIPA when schedules containing employees home addresses and Social Insurance Numbers were disclosed on SEDAR during a transaction.1
(b) Representations and Warranties
The due diligence phase also affords the acquirer the opportunity to evaluate the target's privacy compliance and controls. Generally, the target provides representations and warranties stating that they are in compliance with all applicable privacy legislation as well as their own privacy policy. However, the acquirer should still thoroughly investigate whether or not the target has a privacy policy in place and whether it satisfies obligations under both the policy and applicable privacy legislation.
The failure to satisfy privacy obligations is a potential liability and an acquirer should evaluate the remedial measures that would be required to bring operations into compliance. The acquirer should consider the types of data that the target collects and stores, look at the manner in which information is collected and stored and the process through which consents to use that information are obtained. If a third party service provider is employed to manage the data, the service agreement and practices of the service provider should be reviewed.
Acquirers often view the personal information collected by a target as an asset. However, it will need to be determined whether or not the acquirer will be able to use the information in the manner it intends to or whether they may be limited in the ways that they can use and disclose the information acquired.
Tips for Business
Given the foregoing considerations that arise during business transactions, organizations may benefit from the following tips in relation to personal information:
- Anonymous information is not "personal information." Make information anonymous by removing any identifying information such as a person's name or address.
- Consider whether privacy policies contemplate the intended future uses of information. Include a business transactions exception in the employee privacy policy.
- Increase protection through the use of confidentiality or non-disclosure agreements. Include provisions outlining procedures for personal information in the event that the transaction is no longer be pursued and address liability in the event of a breach.
- Ensure the necessary representations and warranties are provided. Consider the inclusion of indemnification clauses should the representations or warranties turn out to be inaccurate.
- Outline the mechanism for transfer of personal information in the purchase and sale agreement.
A final pearl of wisdom, in addition to the above, is that PIPEDA and the other similar provincial statutes speak only to personal information, that is, information about an "identifiable individual." These statutes have no application for non-personal business information such as trade secrets, business plans, financial reports, and other confidential information that is often exchanged during, or at the closing of, business transactions. If a target wishes to protect these types of information it must be addressed through provisions in the confidentiality agreement entered by the parties.
Organizations will want to consider many of the issues raised in this article when entering into a business transaction to ensure both protection against privacy breaches and efficiency of the information exchange process.
* Andrea Gray is an Articling Student at McCarthy Tétrault.
Footnote
1 Alberta Information and Privacy Commissioner, Investigation Report P2005-IR-005.
To view original article, please click here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
