Am I liable for past security breaches when buying a tech company?

A security breach can sit in a company’s records long after the incident. Whether it becomes the buyer’s problem depends mainly on what is bought. The federal privacy law, PIPEDA, requires organizations to report breaches that pose a real risk of significant harm, to notify affected individuals and to keep records of all breaches. The Privacy Commissioner notes that knowingly contravening those requirements is an offence that could lead to fines.

Share purchase: the exposure stays in the company

When you buy the shares, the organization in control of the personal information is still the company, and the Commissioner says the duty to report, notify and keep records rests with that organization. A breach the company failed to report before closing is therefore a breach you now own. The Commissioner can ask to see the company’s breach records, and they must hold enough detail to show the risk of harm was assessed.

Asset purchase: the data arrives with duties

In an asset purchase the agreement sets which of the seller’s past obligations the buyer assumes. It does not take the personal information outside PIPEDA, whose breach duties attach to the organization that has the information under its control. After closing, PIPEDA lets a buyer use and disclose information received in the deal without fresh consent only if the agreement binds both parties to use it solely for its original purposes, protect it and honour any withdrawal of consent, the information is necessary to carry on the business that was the object of the deal, and one of the parties notifies the individuals within a reasonable time after completion.

What you can review before closing

Reviewing breach history means handling records of personal information. PIPEDA lets parties to a prospective transaction use and disclose that information without consent only if their agreement requires them to use it solely for purposes related to the transaction, protect it with safeguards suited to its sensitivity, and return or destroy it if the deal does not proceed.

Which privacy law applies

PIPEDA is the federal law, but the federal government can exempt organizations in a province whose own privacy law is substantially similar, for information collected, used or disclosed within that province. The Commissioner’s office offers an interactive tool showing which privacy law applies to a given organization.