Canada has seen a recent peak in M&A deal activity (for further details please see "2022: will Canada's M&A surge continue?"). Privacy and cyber risks that go undiscovered in the M&A transaction process can result in potentially significant costs and liabilities post-closing. Further, the M&A transaction process itself can give rise to privacy and cyber risks (for further details please see "Managing cyber risks in M&A transactions").
Therefore, organisations should take steps throughout the M&A transaction process to identify potential and existing privacy and cyber risks and to avoid creating new ones.
This article provides three checklists for Canadian organisations when handling privacy risks in M&A.
- Engage in privacy and cyber-specific due diligence of the target.
- Understand the target's collection and use of personal information, including the data flow through the target's organisation.
- Understand the privacy laws that apply to the target's personal information handling practices and consider whether the target has complied with specific obligations under those privacy laws.
- Ensure the purchase agreement addresses privacy and cyber risks identified in due diligence, including appropriate representations and warranties.
- Include indemnities, holdbacks and insurance obligations that address privacy and cyber risks (where appropriate).
- Ensure the purchase agreement contains appropriate provisions that comply with applicable privacy laws to permit the sharing of personal information post-closing.
- Implement policies and procedures to transfer personal information to the purchaser post-closing.
- Notify individuals of the disclosure of their personal information during the M&A transaction process as required by applicable privacy laws.
- Remediate the privacy and cyber risks identified in due diligence.
For further information on this topic please contact Sepideh Alavi, Katherine M Stanger or Danielle Windt at Borden Ladner Gervais LLP by telephone (+1 416 367 6000) or email ([email protected], [email protected] or [email protected]). The Borden Ladner Gervais LLP website can be accessed at www.blg.com.