Can a seller hand over customer contact lists at closing?

A customer list is personal information as soon as it names individuals, and customers gave their details to the seller, not to whoever buys the business. Federal privacy law makes room for business sales anyway. For the handover at closing, the questions are which conditions must be in place and what the buyer may do with the list afterward.

What the agreement has to say

Under PIPEDA, once a business transaction is completed, the organizations that are parties to it may use and disclose the personal information shared during the deal without the individuals’ consent, but only on conditions. They need an agreement binding each of them to use the information solely for the purposes it was originally collected for, to protect it with appropriate safeguards, and to give effect to any customer’s withdrawal of consent. This is a separate requirement from the agreement that governs the exchange before closing, which is set out in an earlier subsection that also covers information needed to complete the transaction.

Necessary, and then notified

Two further conditions apply. The information must be necessary for carrying on the business or activity that was the object of the deal, which points a buyer toward taking only what it needs to serve those customers. And one of the parties must notify the individuals, within a reasonable time after completion, that the transaction is complete and that their information was disclosed.

When the exception does not apply

These provisions do not apply where the primary purpose or result of the transaction is the purchase, sale or other acquisition, disposition or lease of personal information itself. A deal that is really a customer-list sale, with no operating business behind it, falls outside them. A business transaction includes buying an organization, part of one, or its assets, so an ordinary asset purchase is covered.

Provincial law and breach duties

PIPEDA allows the federal government to exempt organizations where a substantially similar provincial law applies, and the Privacy Commissioner’s site offers a tool for finding which privacy law applies to you. Where PIPEDA applies, the buyer holds the list under its safeguard and breach-reporting rules after closing, including the duty to keep a record of every breach. For the stage before closing, see Can I share customer data with a buyer?