In a rare move, President Donald Trump has issued an Executive Order that the Committee on Foreign Investment in the United States (CFIUS) direct the foreign parties involved in the acquisition of StayNTouch, Inc., a U.S. company, to divest their interests in the company. Trump found credible evidence that Beijing Shiji Information Technology Co., Ltd., a Chinese company, and its wholly-owned subsidiary Shiji (Hong Kong) Ltd., a Hong Kong limited company (the “foreign purchasers”), “might take action that threatens to impair the national security of the United States.” StayNTouch, founded in 2013, is a mobile hotel property management system. The Shiji group made an initial investment in the company in 2016 and fully acquired StayNTouch in September 2018.

CFIUS is an interagency committee authorized to review certain transactions involving foreign investment in the United States and certain real estate transactions by foreign persons in order to determine the effect of such transactions on the national security of the United States. Because the process is highly confidential for the involved parties, it is unclear whether the foreign purchasers and StayNTouch originally notified CFIUS of the 2018 transaction. It would appear that such notification was not made and that upon learning of the acquisition, CFIUS directed a national security review. Ordering a full divestment of a foreign acquisition is rare because CFIUS and the involved parties are often able to negotiate and enter into a mitigation agreement that establishes certain safeguards and security procedures to prevent access to any sensitive commercial or personal data. In this instance, it appears that CFIUS and President Trump were concerned over the personal data and credit card information StayNTouch’s software and database system collects on hotel guests.

The executive order allows the foreign purchasers 120 days to divest all interests in StayNTouch, including all intellectual property, technology and data (i.e., customer data managed and stored in the company’s systems). Until the time of full divestiture, the foreign parties must refrain from accessing any hotel guest data and confirm that controls and procedures are in place to prevent any such foreign access to such data. In divesting their holdings, the foreign purchasers must notify CFIUS of the new buyer. CFIUS also has the authority to access certain corporate accounts and documents of StayNTouch in order to verify compliance with the president’s executive order.