Page 8 - Cybersecurity

S8 | MONDAY, JUNE 5, 2017 | Cybersecurity | NYLJ.COM
Deal Breakers: The Importance of Privacy And Security Due Diligence in Transactions
BY JENNIFER DANIELS
C onducting due diligence in an acquisi- tion or investment transaction is intend- ed to allow the buyer to kick the tires
of the target. Diligence allows the buyer to identify, analyze, and manage risks, some of which are known to the target and some of which the target may not even know about. Cybersecurity and data privacy risks have been, and remain, a top concern for compa- nies across industries, so it is not surprising that companies are increasingly conducting diligence specifically to address those risks in connection with transactions. Buying a busi- ness that suffers a data breach can affect a company’s reputation, and result in costs to investigate, contain, and mitigate harm, not to mention the cost of lawsuits, distracting government investigations, regulatory fines, and the impact to normal business opera- tions. Further, acquirers may value informa-
JENNIFER DANIELS, a partner at Blank Rome in New York, can be reached at [email protected].
tion assets based on the use of such assets for certain purposes that turn out to be pro- hibited based on the promises made by the target to consumers or business partners or under applicable laws. Accordingly, conduct- ing cybersecurity and data privacy diligence is critical to avoid unwanted surprises.
Importance of Cybersecurity Diligence
Recent news shows the impact that secu- rity breaches can have on acquisition transac- tions. Verizon announced its planned takeover bid for Yahoo in July 2016, with a reported $4.83 billion merger price. However, in August 2016, Yahoo’s systems were hacked. Over a billion Yahoo’s user accounts were affected by a series of security breaches. The deal had been expected to close in first quarter 2017, but was delayed so Yahoo could assess the impact of the breach and meet closing condi- tions. The company said it was cooperating with federal, state, and foreign government agencies seeking information about the hack, including the FTC and the SEC. In early 2017, the parties came to an agreement on how to
address the breach so the deal could move forward: the purchase price would be slashed by $350 million; the companies would split certain legal and regulatory liabilities stem- ming from the breaches, including from the non-SEC government investigations; and Yahoo would retain liability for any third-party litigation relating to the breaches.
A 2016 Survey Report prepared by NYSE Governance Services and Veracode, “Cyber- security and the M&A Due Diligence Process,” found that 52 percent of companies would consider acquiring a company that recently suffered a high-profile data breach, but only at a significantly lower value, and 22 percent of companies said such a breach would deter them entirely from completing the transac- tion. Of the directors and officers surveyed, 85 percent said the discovery of a major security vulnerability of the target would likely or very likely affect their final decision to acquire.
Due diligence can help companies to deter- mine the risk of a breach, whether a breach is ongoing, and whether the company’s pro- cesses will be resilient in the face of a breach.
Importance of Data Privacy Diligence
Data privacy due diligence is similarly important where the target company process- es personally identifiable information (PII), particularly sensitive PII like health informa- tion, Social Security numbers, financial infor- mation, and credit card data. Companies often make promises to consumers and customers about how they will handle PII, and the law generally requires that those companies keep those promises. For example, if a company’s online privacy statement tells consumers that their PII will never be shared with or sold to a third party, there is risk that just buying the PII assets of the business as part of an acquisition will violate that promise because an asset acquisition necessarily involves the transfer of PII to a new legal entity. Even in a stock purchase where the transaction does not result in a change of the legal entity col- lecting and holding the data, the buyer must make sure that it can live with the privacy promises made by the seller regarding the data. If, for example, a pharmaceutical com- pany collects data for a clinical » Page S12
SHUTTERSTOCK