Conducting due diligence in an acquisition or investment transaction is intended to allow the buyer to kick the tires of the target. Diligence allows the buyer to identify, analyze, and manage risks, some of which are known to the target and some of which the target may not even know about. Cybersecurity and data privacy risks have been, and remain, a top concern for companies across industries, so it is not surprising that companies are increasingly conducting diligence specifically to address those risks in connection with transactions. Buying a business that suffers a data breach can affect a company's reputation, and result in costs to investigate, contain, and mitigate harm, not to mention the cost of lawsuits, distracting government investigations, regulatory fines, and the impact to normal business operations. Further, acquirers may value information assets based on the use of such assets for certain purposes that turn out to be prohibited based on the promises made by the target to consumers or business partners or under applicable laws. Accordingly, conducting cybersecurity and data privacy diligence is critical to avoid unwanted surprises.

Importance of Cybersecurity Diligence

Recent news shows the impact that security breaches can have on acquisition transactions. Verizon announced its planned takeover bid for Yahoo in July 2016, with a reported $4.83 billion merger price. However, in August 2016, Yahoo's systems were hacked. Over a billion Yahoo's user accounts were affected by a series of security breaches. The deal had been expected to close in first quarter 2017, but was delayed so Yahoo could assess the impact of the breach and meet closing conditions. The company said it was cooperating with federal, state, and foreign government agencies seeking information about the hack, including the FTC and the SEC. In early 2017, the parties came to an agreement on how to address the breach so the deal could move forward: the purchase price would be slashed by $350 million; the companies would split certain legal and regulatory liabilities stemming from the breaches, including from the non-SEC government investigations; and Yahoo would retain liability for any third-party litigation relating to the breaches.A 2016 Survey Report prepared by NYSE Governance Services and Veracode, “Cybersecurity and the M&A Due Diligence Process,” found that 52 percent of companies would consider acquiring a company that recently suffered a high-profile data breach, but only at a significantly lower value, and 22 percent of companies said such a breach would deter them entirely from completing the transaction. Of the directors and officers surveyed, 85 percent said the discovery of a major security vulnerability of the target would likely or very likely affect their final decision to acquire.

Due diligence can help companies to determine the risk of a breach, whether a breach is ongoing, and whether the company's processes will be resilient in the face of a breach.

Importance of Data Privacy Diligence

Data privacy due diligence is similarly important where the target company processes personally identifiable information (PII), particularly sensitive PII like health information, Social Security numbers, financial information, and credit card data. Companies often make promises to consumers and customers about how they will handle PII, and the law generally requires that those companies keep those promises. For example, if a company's online privacy statement tells consumers that their PII will never be shared with or sold to a third party, there is risk that just buying the PII assets of the business as part of an acquisition will violate that promise because an asset acquisition necessarily involves the transfer of PII to a new legal entity. Even in a stock purchase where the transaction does not result in a change of the legal entity collecting and holding the data, the buyer must make sure that it can live with the privacy promises made by the seller regarding the data. If, for example, a pharmaceutical company collects data for a clinical trial pursuant to consent forms signed by the study participants, and those consent forms say that the PII collected will only be used to perform the study and for no other purpose, then a buyer needs to understand that it may be limited in its ability to use the PII for other purposes, like for an unrelated research study.

The example that the FTC made of Facebook and WhatsApp illustrates some of these concerns. In 2014, the FTC notified Facebook and WhatsApp about their obligation to protect the privacy of their users in light of Facebook's then-proposed acquisition of WhatsApp. WhatsApp had made clear privacy promises to consumers, and both companies had told consumers that after the acquisition they would continue the current privacy practices of WhatsApp. The FTC warned that, if WhatsApp failed to honor these promises after the transaction, both companies could be in violation of §5 of the FTC Act for deceptive trade practices. So, before making material changes to how they use data collected from WhatsApp subscribers prior to closing, the FTC said that the companies must get affirmative consent from the subscribers. And, for changes that would only apply to subscriber data collected after the closing, the FTC said that subscribers should be given the opportunity to opt-out of such prospective changes.