How do POS and inventory system data transfer in a retail business sale?

A retail sale moves two kinds of information that sit in the same system. Inventory and sales records are business records, and they transfer however the agreement says assets and records transfer. Records that identify customers are personal information, and a federal privacy law adds conditions before they pass to a buyer.

Inventory and sales records

Item lists, stock counts, costs and sales history describe the business rather than a person, and the Personal Information Protection and Electronic Documents Act (PIPEDA) deals with information about an identifiable individual. The CRA notes that in some cases a sales agreement sets out a value for the inventory of the company. See also how retail inventory is valued at closing.

Customer-linked data

Loyalty accounts, emailed receipts and purchase histories tied to a named customer are personal information. Subject to the limits in subsection 4(2), PIPEDA’s privacy rules apply to personal information an organization collects, uses or discloses in the course of commercial activities, and it defines a business transaction to include buying or selling an organization or any of its assets. Under subsection 7.2(1), parties to a prospective business transaction may use and disclose personal information without the individual’s knowledge or consent if their agreement requires the organization receiving it to use it solely for purposes related to the transaction, to protect it with safeguards appropriate to its sensitivity and, if the transaction does not proceed, to return or destroy it within a reasonable time. The information must also be necessary to decide whether to proceed and, if so, to complete the deal. The answer on sharing customer data with a buyer goes further.

After closing

Once the deal is completed, subsection 7.2(2) lets the parties keep using and disclosing that information without consent if their agreement requires each of them to use it solely for the purposes for which it was collected or permitted to be used before closing, to protect it, and to give effect to any withdrawal of consent. The information must also be necessary for carrying on the business or activity that was the object of the transaction, and one of the parties must notify the individual, within a reasonable time after the transaction is completed, that it has been completed and that their personal information has been disclosed. Subsection 7.2(4) says these rules do not apply to a deal whose primary purpose or result is buying or selling personal information itself.

The seller’s copy and the provincial question

Sellers should ask for a full export of the sales history before access ends, because the CRA’s record-keeping guidance covers electronic records and backups and how long records must be kept. PIPEDA also lets the Governor in Council (the federal cabinet) exempt an organization or activity from Part 1 of the Act, for personal information collected, used or disclosed within a province, where it is satisfied that substantially similar provincial legislation applies, and the Privacy Commissioner’s site has an interactive search for which privacy law applies.