Deal Breakers: The Importance of Privacy and Security Due Diligence in Transactions

Conducting due diligence in an acquisition or investment transaction is intended to allow the buyer to kick the tires of the target. Diligence allows the buyer to identify, analyze, and manage risks, some of which are known to the target and some of which the target may not even know about. Cybersecurity and data privacy risks have been, and remain, a top concern for companies across industries, so it is not surprising that companies are increasingly conducting diligence specifically to address those risks in connection with transactions. Buying a business that suffers a data breach can affect a company’s reputation, and result in costs to investigate, contain, and mitigate harm, not to mention the cost of lawsuits, distracting government investigations, regulatory fines, and the impact to normal business operations. Further, acquirers may value information assets based on the use of such assets for certain purposes that turn out to be prohibited based on the promises made by the target to consumers or business partners or under applicable laws. Accordingly, conducting cybersecurity and data privacy diligence is critical to avoid unwanted surprises.

Importance of Cybersecurity Diligence

Recent news shows the impact that security breaches can have on acquisition transactions. Verizon announced its planned takeover bid for Yahoo in July 2016, with a reported $4.83 billion merger price. However, in August 2016, Yahoo’s systems were hacked. Over a billion Yahoo’s user accounts were affected by a series of security breaches. The deal had been expected to close in first quarter 2017, but was delayed so Yahoo could assess the impact of the breach and meet closing conditions. The company said it was cooperating with federal, state, and foreign government agencies seeking information about the hack, including the FTC and the SEC. In early 2017, the parties came to an agreement on how to address the breach so the deal could move forward: the purchase price would be slashed by $350 million; the companies would split certain legal and regulatory liabilities stemming from the breaches, including from the non-SEC government investigations; and Yahoo would retain liability for any third-party litigation relating to the breaches.A 2016 Survey Report prepared by NYSE Governance Services and Veracode, “Cybersecurity and the M&A Due Diligence Process,” found that 52 percent of companies would consider acquiring a company that recently suffered a high-profile data breach, but only at a significantly lower value, and 22 percent of companies said such a breach would deter them entirely from completing the transaction. Of the directors and officers surveyed, 85 percent said the discovery of a major security vulnerability of the target would likely or very likely affect their final decision to acquire.