What privacy obligations apply to customer data when a tech company is sold?

Customer data is often the main asset in a technology company, and it is also personal information that privacy law keeps protecting after the company is sold. Federal law gives the parties to a business sale a defined route to share and transfer that information without asking each customer, but the route has conditions, and the conditions continue after closing. Safeguards are one of the fair information principles listed in the Privacy Commissioner’s overview of the law.

Before closing

The Personal Information Protection and Electronic Documents Act allows organizations that are parties to a prospective business transaction to use and disclose personal information without consent if they have agreed that the recipient will use it solely for purposes related to the transaction, protect it with appropriate safeguards and return or destroy it if the deal does not proceed, and if the information is necessary to decide whether to proceed and, if so, to complete the deal. Our page on sharing customer data with a buyer covers that stage.

After closing

Once the deal completes, the parties may keep using and disclosing the information if their agreement requires, among other things, safeguards and requires them to give effect to any withdrawal of consent, if the information is necessary to carry on the business that was the object of the deal, and if one party notifies each individual within a reasonable time that the transaction has been completed and that their information has been disclosed.

Limits and breaches

The exception does not apply to a deal whose primary purpose or result is the purchase, sale or other acquisition of personal information itself, so a data-only deal needs another basis. Breach duties continue throughout: the Privacy Commissioner’s guidance says organizations covered by the law must report breaches of security safeguards that pose a real risk of significant harm and keep records of all breaches, which matters when a data room holds customer records.

Which privacy law applies

The federal Act lets the government exempt an organization where a province has substantially similar legislation that applies to it, for information collected, used or disclosed within that province, so the governing law can depend on where the data is handled.