Preparing for transaction: Potential privacy risks

In a transaction, several parties process personal data relating to data subjects associated with the target company. Data subjects may include employees and consultants, as well as individuals acting as contact persons for suppliers and customers. Agreements entered into with such parties may contain personal data, such as name, salary information or national identification numbers. Personal data may also appear in documentation relating to specific complaints, employee matters or other circumstances that may be considered necessary to disclose to a potential buyer as part of the transaction process. 

When personal data is processed, it is important to have a clear understanding of the roles of the various parties involved since it is significant in determining responsibility and legal obligations. It is therefore necessary to assess whether each party involved processes personal data for own purposes and thus acts as a controller, or whether the party processes the personal data on behalf of one of the other parties and therefore acts as processor. While a case-by-case assessment should be carried out, the potential buyer(s), seller, advisers and the target company can generally be expected to process personal data for their own respective purposes and therefore to act as controllers under the GDPR. 

In the following, we will provide certain observations that may help identify and mitigate the risk for the parties involved. 

When processing personal data for own purposes, a sufficient legal basis for each purpose for which the personal data is processed must be identified. From the target company's perspective, this may be relevant when sharing personal data relating to its employees, consultants, customers and suppliers with prospective buyers or their advisers via a virtual data room. Likewise, the potential buyer and its advisers must be able to demonstrate a legal basis for lawfully processing the personal data when acting as a controller. 

Legitimate interests may in many cases provide an appropriate legal basis. In such cases, the target company would be expected to have conducted and documented a legitimate interest assessment (LIA) before commencing the processing. A lack of a valid legal basis for processing, or an inability to demonstrate such legal basis, would constitute a risk. Ultimately, this risk would have to be borne either by the buyer acquiring the company or by the seller, who may face a buyer seeking to address the risk through the terms of the share purchase agreement or similar transaction documentation. 

The seller and the target company may benefit from ensuring that an appropriate legal basis for processing is in place and properly documented prior to, or at an early stage of, the transaction process. This may help prevent the issue from arising later in the transaction process and diverting time and attention from other more material matters.

The buyer must carry out a similar assessment and cannot rely on the target company's (or own advisers') legal basis. Where external advisers are engaged in the preparation of a due diligence report, consideration should be given to the extent to which they should include personal data in said report. In many cases, exposure can be minimized or avoided by anonymizing the information to the extent possible. 

As a rule, data subjects are entitled to receive information explaining, among other things, the identity of the controller processing personal data for own purposes, the purposes of the processing, and the legal basis on which the processing is based. Furthermore, information on the recipients (or categories of recipients) of the personal data shall be provided. The target company should include in its privacy policies that personal data may be disclosed to prospective buyers and advisers where necessary for the purpose of facilitating a sale of all or part of the business or the company. The applicable legal basis for such processing must also be specified. Companies should consider including this information its the privacy notice even before a transaction is contemplated.

Prospective buyers should be mindful of this and consider the extent to which it may be possible to avoid becoming subject to such obligations by, for example, anonymizing information made available by either the target company or their own advisers preparing the reports and information. In certain circumstances, it may not be possible to anonymize certain information, for example where the information relates to key positions within the target company and the individuals concerned may be identified by combining such information with information available from other sources. In such cases, it should be ensured that the affected individuals have been provided with sufficient information in accordance with applicable legal requirements.

The GDPR requires that personal data processed is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Any failure to comply with this requirement may therefore give rise to legal and compliance risks. 

The seller should therefore consider what information needs to be made available to the prospective buyer and/or its advisers. Furthermore, relevant measures may include pseudonymization, for example by redacting documents. A clean room should be considered when necessary to disclose sensitive personal data. Access should be strictly limited to need- to-know. Furthermore, due diligence reports should, to the extent possible, be anonymized and distributed on a need-to-know basis to avoid providing recipients with access to more personal data than necessary.

To minimize risk, parties should:

• Consider whether privacy policies should be updated to reflect a potential transaction.
• Assess whether a legal basis is required for the planned processing activity in connection with an imminent transaction (such as disclosure of personal data in a virtual data room) and, if so, determine the appropriate legal basis.
• Ensure that the legal basis for the processing is appropriately documented (for example, by conducting a legitimate interest assessment when relying on legitimate interests).
• Assess measures that may help minimize the processing of personal data in connection with a transaction, e.g., redaction or pseudonymization of documents, clean room with access restrictions, anonymization of due diligence report, restricted access to the due diligence report, disable printing and downloading of files from virtual data room, no sharing of personal data via unsecured email with attachments).