During an M&A deal process huge amounts of sensitive data is shared in the cyber-space between buyers, sellers and their respective advisors. Infringement of this data’s cyber-security could leave parties open to significant claims. In addition to explicit contractual obligations which parties may impose upon each other in respect of data security, and regulatory duties imposed under legislation such as the Data Protection Act 1998 (DPA), both sellers and buyers (and any third party suppliers) will owe: (i) an equitable duty to individuals to preserve the confidentiality of their information, and (ii) a parallel duty through the tort of negligence to keep it secure.
How can parties be extra-vigilant to ensure that the security of the information being collated, reviewed and negotiated is not compromised or vulnerable to cyber-attack during the M&A process?
- Cyber-security policies and procedures should be carefully reviewed and updated by each party at the outset of the deal to ensure compliance with current best practice.
- Project names are a simple but effective security measure. Especially in email traffic, which can be voluminous and rapid, project names and party pseudonyms (where allocated) should be carefully and consistently used.
- Confidentiality agreements should be cautiously drafted and tailored around the specific organisational and technological channels which will be used to facilitate the deal. At a minimum, the degree of care extended to the security of the sellers’ data by the buyers should be that applied by the buyers to their own confidential information (in which case sellers should carry out reverse due-diligence to check that the buyers’ policies and processes are actually sufficient). Any obligation on buyers to flow-down contractual confidentiality protections to advisors or employees who are permitted to receive the sellers’ confidential information should be strictly implemented.
- Virtual data rooms are now common practice in M&A, and are an efficient way to control and manage the flow of information. However, by their very nature they are cyber data-sharing tools, so bring with them a whole host of cyber-risk concerns. In mitigation, most platforms are hosted by the sellers and password protected with individual accesses (including the ability to download, print or copy) restricted to specific areas and relevant documents. Documents can be watermarked to maintain confidentiality and due-diligence enquiries can be presented, updated and responded to all within the secure platform. Sellers should be diligent to ensure that all parties restrict the flow of data exclusively to the data room and avoid using less secure channels such as email.
- Properly anonymised data is not subject to the requirements of the DPA, which imposes duties on data controllers in respect of disclosing “personal data”. Sellers should therefore anonymise personal data before sharing. It is recognised that in business purchase situations TUPE legislation will require the disclosure of certain personal employee information but this should still be anonymised to the fullest extent possible and supported by a well drafted confidentiality agreement. Parties cannot avoid the application of the DPA if it is still possible to identify the individual from the anonymised data.
From May 2018 a set of new data protection rules, designed to establish a modern and harmonised data protection framework across the EU, will replace the DPA and (amongst other things) put a positive obligation on organisations to report personal data breaches to the regulator within 72 hours of becoming aware of them (except where the breach is unlikely to result in risk to the individual). Details of regulatory actions taken as a result of such disclosure will be publicly available. Financial penalties will also massively increase. Parties should therefore consider this impending change and its potential impact on timing, cost and deal-confidentiality if infringements occur during negotiations, and the buyer should also consider the wider, on-going implications for its (and the target’s) business post-completion.
- Cyber-security insurance is still in its relative infancy, with a 2015 government report on the role of insurance in cyber security suggesting that just 2% of large firms had explicit cyber cover, with the figure falling closer to zero for small firms. However, demand for explicit protection is increasing, particularly in response to the shocking financial and reputational impact of some recent (and very public) cyber-infringements.
The complexity of the cyber-risk category and general uncertainty around its ever-changing nature has previously made insurers question whether cyber-risks pose an opportunity or a threat to their industry. However, recent reports of Beazley and Munich Re teaming up to ‘push through the barriers’, doubling coverage amounts and including items such as physical damage (which are often excluded from policies in this area) suggest that now is a good time to ensure that target businesses and sellers/buyers alike are appropriately protected both pre and post completion. Increased regulatory focus and guidance (such as the recently published recommendations arising from parliament’s inquiry into cyber-security after the TalkTalk attack) may also make cyber-security risk easier to define and, in turn, insurance more accessible.
Whilst existing non-cyber specific insurance policies might respond to a cyber-attack event, this is still largely untested. It is wise to address the issue explicitly, being careful to check the policy scope and exclusions.
Cyber-security should be addressed at every stage of the M&A process; both in terms of risk within the target and risk within the deal process itself. It is not just a due diligence risk for buyers. Sellers, targets and advisors also need to stay alert to the potential for data breaches and/or cyber-attacks during negotiations and work together to mitigate the unique risks inherent within every deal. Everyone must remember to constantly re-evaluate their cyber-risk management plans.
Cyber-attacks will never be completely preventable: expect the unexpected and be prepared.
By Claire Miller, PSL
First published in Acquisition International, June 2016