On 6 March 2020, President Trump issued an order (the Order) forcing Beijing Shiji Information Technology Co., Ltd., organized in China, and its subsidiary Shiji (Hong Kong) Ltd., organized in Hong Kong (collectively, Shiji), to divest of their interest in StayNTouch, Inc., a Delaware hotel management software company (StayNTouch). Shiji's access to U.S. hotel guest data appears to have been the key national security concern underlying the president's decision. Shiji, which acquired StayNTouch in September 2018, has four months to complete the divestiture, unless an extension of up to three months is granted.

Shiji develops software applications and provides related services for the hospitality, food service, retail, and entertainment industries, including through payment gateways, data management, and visual content management systems. Shiji's website identifies Marriott, Hyatt, and Starbucks as customers. StayNTouch software applications operate on tablets and smartphones, allowing hotels to streamline operations, increase margins, and increase guest satisfaction.

The Order

The Order followed a review by the Committee on Foreign Investment in the United States (CFIUS), a U.S. government interagency committee that evaluates the national security implications of foreign investments in the United States. The Order requires Shiji to divest entirely its ownership interest in StayNTouch, citing "credible evidence" that Shiji may take action that threatens the national security of the United States. Although the Order does not specify the specific national security threat that Shiji's acquisition of StayNTouch poses, it appears that CFIUS' concerns related to Shiji's access to sensitive personal data (see, for example, Section 2, paragraph (c) of the Order, prohibiting Shiji from accessing hotel guest data through StayNTouch). CFIUS concerns about Chinese investors' access to U.S. citizens' sensitive personal data and the related concern that such access is tantamount to Chinese government access stretch back several years and are now reflected in the recent expansion of CFIUS' jurisdiction to non-controlling foreign investments in U.S. businesses that hold or have access to third-party sensitive personal data.

Prior actions taken by U.S. presidents

This is the third transaction in which President Trump has blocked a foreign acquisition of a U.S. business or ordered a foreign acquirer to divest of its interest in a U.S. business and only the sixth time a U.S. president has taken such action since the establishment of CFIUS:

  • In 2018, President Trump blocked the hostile takeover of Qualcomm Inc. by Broadcom, Ltd, a company organized in Singapore but headquartered in California.
  • In 2017, President Trump blocked the proposed acquisition of a U.S. semiconductor company by a Chinese venture fund.
  • In 2016, President Obama blocked a Chinese-owned German company from acquiring the U.S. semiconductor business of a German company.
  • In 2012, President Obama ordered a Chinese-owned U.S. company to divest of its interests in U.S. wind farm projects located near a U.S. Navy training facility in Oregon.
  • In 1990, President George H.W. Bush ordered a Chinese government-owned firm to divest of its ownership of a Seattle-based aerospace company.

Implications for foreign investments in the United States

Beyond the commercial ramifications of the Order for the parties, President Trump's Order is noteworthy because presidents so rarely take such action. Two key implications of the Order on foreign investments in the United States are these:

  • CFIUS continues to pursue non-notified transactions that raise national security concerns. Following the enactment of the Foreign Investment Risk Review Modernization Act of 2018, CFIUS has stepped up its pursuit of non-notified transactions those in which the parties initially decline to file with CFIUS. The Order is just the latest example. Based on press reporting, it appears that when Shiji acquired StayNTouch in September of 2018, the parties did not seek CFIUS's clearance. Subsequently, CFIUS apparently either affirmatively requested that the parties submit a post-closing filing or unilaterally conducted a review of the transaction. Now the President's Order will require a costly and burdensome wind-down and divestiture period for Shiji. Although acquisitions that raise national security concerns so severe that the President orders a divestiture are rare, parties to cross-border deals are well-advised to assess the potential CFIUS risks of their transactions as early as possible to avoid such adverse consequences.
  • CFIUS concerns about foreign access to sensitive personal data of U.S. citizens are industry-agnostic. The President's Order is consistent with other CFIUS actions during the past few years to scrutinize and, in some cases, force divestitures of Chinese proposed or completed acquisitions of U.S. companies that store or otherwise have access to large amounts of sensitive personal data. The U.S. targets have been in a variety of sectors, including social media, financial, life sciences, and insurance, highlighting that CFIUS' concerns in these transactions have been largely specific to Chinese access to the data, irrespective of whether the U.S. businesses themselves are engaged in activities traditionally considered sensitive. Therefore, for a controlling or non-controlling foreign investment in a U.S. business, the parties should assess whether the type and amount of sensitive personal data that the U.S. business holds or to which it has access might trigger a mandatory filing or otherwise subject the transaction to CFIUS' review.