Should I share my real numbers before a buyer has signed anything?

Summary revenue and profit figures describe the business. Privacy law becomes relevant when what you share is information about an identifiable individual, which PIPEDA defines as personal information. Payroll listed by employee, customer lists with names and contact details, and files on individual staff are examples to check before anything leaves your hands.

What PIPEDA says about a prospective deal

PIPEDA section 7.2(1) applies in addition to the circumstances set out in subsections 7(2) and (3). It says that organizations that are parties to a prospective business transaction may use and disclose personal information without the individual’s knowledge or consent if two things are met. First, they have an agreement requiring the recipient to use and disclose the information solely for purposes related to the transaction, to protect it by security safeguards appropriate to its sensitivity, and, if the transaction does not proceed, to return it to the organization that disclosed it, or destroy it, within a reasonable time. Second, the information is necessary to decide whether to proceed and, if so, to complete the deal. Under section 7.2(4), this does not apply to a transaction whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information.

Which law applies where

The Office of the Privacy Commissioner notes that Alberta, British Columbia and Quebec have their own private-sector privacy laws, and that organizations covered by a substantially similar provincial law are generally exempt from PIPEDA for information handled within that province. Quebec’s Act respecting the protection of personal information in the private sector, section 18.4, allows communication without consent where it is necessary for concluding a commercial transaction, but an agreement must first be entered into with the other party that stipulates, among other things, that it will destroy the information if the transaction is not concluded.

Staging what you share

• Ask what the confidentiality agreement says about use, safeguards and return or destruction.
• Strip names from payroll and customer data until the information is needed.
• Hold back anything the buyer cannot yet show a reason to need.

Your lawyer can also tell you what the agreement should cover beyond privacy. The guide to the letter of intent covers how a letter of intent fits into the sale sequence.