Personal data plays an important role in mergers and acquisitions (M&A). Some businesses process only employee and customer data, while in other businesses customer data is a large part of the business value.
The transfer of this data must comply with the General Data Protection Regulation (AVG).
Equity versus asset/liability transactions
In a share transaction, only the shares change hands and the company - and thus the person responsible for personal data - remains unchanged. As a result, little changes for customers and employees, and there are usually no major AVG concerns.
In an asset/liability transaction, the situation is different. Here, business units, including customer and employee data, are transferred to a new party. This is not allowed just like that; there must be a valid legal basis for the transfer of personal data.
What legal bases are possible?
The AVG provides some specific bases for processing and transferring personal data in a business acquisition. Two of these are particularly relevant in an M&A context.
The first is explicit consent from the data subject, which can be arranged in advance by clearly stating in the privacy policy that personal data can be transferred in an acquisition. Customers must actively consent to this. A disadvantage of this basis, however, is that consent can be withdrawn at any time.
The second basis is legitimate interest of the entrepreneur, which can be applied when the company is taken over as a whole and the services for customers remain unchanged. In this case, the new owner may continue to use the personal data as before, as long as the original purposes do not change.
Strict explanation
However, when only a few assets are acquired, there will not always be a legitimate interest of the entrepreneur for that transfer. Whether this is the case will have to be assessed on a case-by-case basis, and there is quite a bit of uncertainty in this regard.
Indeed, the Dutch Personal Data Authority (AP) applies a very strict interpretation of the AVG on this point; it took the position until recently that transfer for (purely) commercial reasons was always in violation of the AVG - resulting in substantial fines for the parties that relied on it for the sale of personal data (see e.g. Fine KNLTB | Authority Personal Data, in which the Tennis Association sold member data to sponsors).
Recently, however, the European Court of Justice reprimanded the AP for this overly strict interpretation. A sale for commercial reasons does not necessarily violate the AVG. This will have to be assessed on a case-by-case basis. The AP has (reluctantly) heard this (see LinkedIn message AP), but for now it is unclear how it will look at similar transactions in the future. So this will require attention in each transaction.
Communication with data subjects
Transparency is crucial. Regardless of the basis chosen, it is essential that customers and employees are informed in a timely manner about the transfer of their personal data and its consequences. When consent is the basis for data processing, customers must have the opportunity to withdraw it. In the case of legitimate interest, the new owner must inform data subjects about the takeover and their rights.
In addition, customers can sometimes oppose a contract acquisition, which also prevents the transfer of their personal data. This can affect the value of the customer database and should therefore be considered upfront in the M&A strategy.
Conclusion: ensure a thoughtful approach
Personal data plays an increasingly important role in business acquisitions. Entrepreneurs would be wise to think about the possible sale of personal data at the time of its collection.
Entrepreneurs would be wise to seek legal advice to minimize risks and ensure a smooth acquisition.
