In the context of privacy law, a transactional due diligence process is intended to provide the purchaser with an understanding of the rights and obligations of the target with respect to the personal information which the target company has collected, retained, used and disclosed as a part of its ongoing business operations. This presentation will address this vitally important process enabling the purchaser to carefully examine the business and activities of a target so that the risks associated with the transaction are understood and appropriately dealt with.
The presentation will include a discussion on the scope of inquiries which are to be made by a purchaser in order to determine the level of compliance by the target with its privacy requirements. A number of practical considerations which arise when determining the scope of these inquiries will be addressed, such as:
• the target’s business model;
• the cost of compliance versus consequences of (non)compliance;
• the possibility of the transaction falling into an exemption in the applicable privacy legislations; and
• the possibility of the transaction structure not being affected by the privacy (non)compliance.
The presentation also aims to address what strategies should be employed by the purchaser to deal with particular privacy issues which have been identified as a result of the due diligence process.
The presentation will analyze the nature and scope of privacy obligations which may be imposed on a target under applicable laws. And will subsequently discuss whether and on what terms it may be appropriate to complete the contemplated transaction depending on whether (and to what extent) the target has met those privacy obligations. For example a significant failure on the part of to target to live up to its privacy obligations (and therefore a significant risk to the business or assets of the target because of such failure) may result in the purchaser rethinking the transaction or identifying and implementing strategies to protect itself and the target from a failure to satisfy privacy obligations.