Personal Data in Mergers and Acquisitions
Businesses usually process at least the personal data of their customers and employees. This personal data can be of considerable value in the event of a transaction, such as transfer of business, merger, share acquisition or other corporate arrangement, as it can affect the value and continuity of the business.
In a transaction, the seller as data controller should carefully consider at what point and on what basis it can lawfully disclose personal data to a prospective buyer. The processing of personal data in the context of a transaction should be planned before the exchange of data takes place. Data protection issues arise in particular in two ways in the context transaction:
whether personal data relating to the subject matter of the transaction can be disclosed to prospective buyers before the transaction; and
under what conditions personal data can be transferred to the buyer at a later stage as part of the transaction.
In principle, in a takeover situation, personal data should not be transferred to a prospective buyer before the transaction is completed. A separate agreement between the seller and the buyer is often concluded at the negotiation stage of the transaction to determine how the seller will assist the buyer after the completion of the transaction during the transitional period. For example, the agreement may provide for the seller to assist the seller in customer service until a certain date.
In addition, a confidentiality agreement or letter of intent is typically made during the negotiation phase of a transaction to ensure the proper use of other confidential information.
The seller should carefully consider whether it can disclose any extent of personal data to prospective buyers before the transaction is completed. Typically, this issue arises in the disclosure of personal data of employees and consumer customers of the company. As a general rule, personal data cannot be disclosed to a third party without a legitimate basis, such as the consent of the data subjects. It is therefore advisable to consider alternatives to the disclosure of personal data that avoid the disclosure of personal data altogether before the transaction is completed.
For example, at the negotiation phase, it is advisable to provide employee salary information by providing statistical data on salaries or a summary of costs by department, so that the information cannot be linked to an individual employee. In principle, other personnel data should also be disclosed in such a way that it cannot be linked to an individual employee, for example by anonymising the personal data.
However, under certain conditions, more detailed information on key employees may be disclosed at the negotiation stage. Even in such cases, the disclosure must be made with the consent of the persons concerned.
When a transaction takes place, personal data relating to the subject of the transaction will in principle be transferred from the seller to the buyer. In this case, the buyer will be responsible for the lawful processing of personal data and for updating, for example, the privacy policy. The buyer must also inform the data subjects of the completed transaction.