#CyberFLASH: Privacy And Cybersecurity Issues In Canadian M&A Transactions

a-woman-uses-her-computer-keyboard-to-type-while-surfing-the-internet-in-north-vPrivacy and cybersecurity have become areas of significant potential liability in Canada and elsewhere. Organizations that misuse personal information or fall victim to a data breach face reputational damage, regulatory scrutiny and possible class action lawsuits. In addition, businesses that fail to comply with “Canada’s Anti-Spam Law”2 (“CASL”) can be subject to significant fines.

In the context of M&A transactions, it is important for organizations to understand applicable statutory requirements and take steps to reduce and mitigate risks. This will involve consideration of privacy and cybersecurity issues in the due diligence process and negotiation of the purchase agreement, as well as attention to restrictions upon transfer and use of personal information on and after closing.

Due Diligence

In order to determine the amount and extent of privacy and cybersecurity due diligence that will need to be performed in a transaction, it is important to initially consider the nature of the target’s business. Some businesses, like traditional manufacturing companies, may process minimal sensitive or personal information. Therefore, it may be unreasonable to expect that such organizations would have detailed and comprehensive privacy compliance infrastructures, and risks related to privacy and cybersecurity may be limited. In such cases, the scope of due diligence with respect to privacy and cybersecurity matters could be fairly narrow.

However, in this “information age” the core function of many businesses revolves around data. When organizations seek to purchase these types of businesses, it is important to thoroughly canvas the target’s history and current practices and procedures, to identify any potentially significant liabilities. Poor information handling practices or outdated technological controls may require a significant investment to bring the business into compliance with all applicable laws, or in a worst case scenario could expose the business to costly litigation.

Read more here

About canux
© 2013 CyberTRAX Canada - All Rights Reserved.
Sponsored by C3SA Corp.