Disclosing Personal Information in a Data Room: Is Consent Required?

April 03, 2006

Close

Written By Stephen Burns

When deciding what information to include in a data room in Alberta, it is important to consider not only what the purchaser will wish to see and what the vendor is prepared to disclose, but also the impact that Canada's private sector privacy legislation may have on the ability of the vendor to include personal information in the materials to be disclosed and, in particular, whether or not consent is required for such disclosure.

The Legislation

Private sector privacy is regulated in Canada, in part, on the basis of: (i) the nature of the information; (ii) the nature of the organization (federally or provincially regulated); (iii) where an activity occurs; and (iv) the nature of the relationship of the organization with the individual.

Generally, the federal legislation applies to all commercial activities involving personal information that occur between provinces or across national borders, or that are undertaken by federal works, undertakings or businesses. The federal legislation also applies to all commercial activities involving personal information that occur within a province unless the province has enacted substantially similar legislation. Alberta has enacted substantially similar legislation. The federal legislation does not generally apply to the personal information of employees, unless the individual is an employee of a federal work, undertaking or business or the information is disclosed in the course of commercial activities. The Alberta legislation does protect the personal information of employees.

Personal Information

Although the definition of personal information varies slightly between the federal and Alberta legislation, for our purposes, personal information shall include any information about an identifiable individual other than their business contact information, when such business contact information is used for the purpose of contacting the individual in their capacity as an employee or an official of an organization and for no other purpose. Accordingly, in the context of the disclosure of information in a data room, all information that can be traced back to an individual should be treated as personal information.

Is Consent Required?

Before considering if consent is required for the disclosure of personal information in a data room, it is important to note that both the federal and Alberta private sector privacy laws require that an organization: (i) only collect, use or disclose personal information for a reasonable purpose; and (ii) only to the extent necessary to meet that purpose. This threshold must be met before any consideration is given as to whether or not the personal information may be collected with or without notice to, or consent from, the individual.

That being said, and assuming that it is reasonable to disclose the information in the data room and that only information that is necessary to meet such purpose will be disclosed, the organization must next consider if consent is required for such disclosure.

Generally, unless otherwise provided in the applicable privacy legislation, organizations in Canada may only collect, use, or disclose personal information when the organization has the consent of the individual to such collection, use, or disclosure. The obligation to obtain consent does not always extend to the personal information of employees in Alberta. In particular, most organizations in Alberta are obligated to only collect, use, or disclose personal information concerning their employees with the consent of the individual employee, unless the information is solely related to establishing, managing or terminating the employment relationship and the organization has provided their employees reasonable notice that the information is going to be collected and the purpose for such collection.

In the recent decision of Builders Energy Services Ltd., Stikeman Elliott LLP, Shtabsky & Tussman LLP and Remote Wireline Services Ltd. ("Stikemans"), Alberta's Information and Privacy Commissioner found that the personal information of employees disclosed during a transaction does not constitute information that is solely related to the employment relationship and, as a result, the parties to the transaction needed the employees' consent to the disclosure of such information as part of the transaction. 

Is There an Exemption for Business Transactions?

Generally, the obligation to obtain consent extends to disclosure or collection activities related to any purchase, sale, merger, amalgamation, financing, securitization or other transaction involving the organization (a "business transaction").

The federal privacy legislation does not include an exemption from the requirement of consent for the use or disclosure (such as in a data room) of personal information in the context of a business transaction. The Alberta legislation does contain an exemption from the requirements of consent provided that certain conditions are met. Accordingly, it may be advantageous for an organization to structure its transaction to take advantage of such exemption or to conduct its activities in respect of the transaction in a manner that limits the impact of the privacy legislation on such transaction.

To rely on the Alberta exemption, the parties to the business transaction are required to enter into an agreement that:

  1. prior to the completion of the transaction (i) limits the collection, use, and disclosure of personal information to purposes related to the business transaction, and (ii) limits the information to be disclosed to that which is necessary for the parties to determine to proceed with the transaction and, if the decision is to proceed, for the parties to carryout and complete the transaction; and
  2. after the completion of the transaction, (i) restricts the use and disclosure of the information to only those purposes for which the information was initially collected, and (ii) limits the information to be disclosed to only the information that solely relates to the carrying on of the business or activity or the carrying out of the objects for which the transaction occurred.

In addition, should the business transaction not proceed, the personal information disclosed must be either destroyed or returned to the disclosing party.

Accordingly, where an organization wishes to rely on the business transaction exemption in the Alberta legislation, the organization will need to limit the nature and scope of the personal information to be disclosed in the data room to that which is necessary for the parties to determine to proceed with the transaction.

Where a transaction occurs in stages (for example, initial review by interested bidders, acceptance of a bid, initial due diligence, final due diligence) the nature and scope of the personal information that is necessary to be able to determine to proceed with the transaction may change with each stage.

Accordingly, the nature and scope of the personal information disclosed in the data room will likely change with each stage, with minimal information being disclosed at the initial stages and more detailed information available during final due diligence.

In addition, the structure of the transaction (i.e. share vs. asset sale) will also impact the nature and scope of the personal information that is necessary for the parties to determine to proceed with the transaction and, as such, the nature and scope of the personal information that may be disclosed in the data room.

The Commissioner in the Stikemans decision (supra) considered the issue of whether or not disclosure of the personal information of employees (names, home addresses and social insurance numbers) contained in a schedule to a purchase and sale agreement met the requirements of the business transaction exemption or if the consent of the employees was required for such disclosure.

The Commissioner found that the parties could not rely on the business transaction exemption in respect of the personal information disclosed in the schedule as the parties had exchanged more information than was necessary for the purpose of determining whether to proceed with the transaction. Although the Commissioner found that the parties had entered into an agreement that appropriately limited the use of the information disclosed, the Commissioner determined that disclosure of the employees' home address and social insurance number was not necessary for the purposes of the transaction.

In making his finding, the Commissioner provided some valuable guidance as to what personal information concerning employees may have the ability to impact the decision to proceed or the terms on which a transaction proceeds (including price), and thus be necessary for the purposes of a transaction. Although the facts of each case will govern, the Commissioner indicated that it may be "necessary" to disclose:

Accordingly, where an organization wishes to rely on the business transaction exemption from the requirement to obtain consent for the disclosure of personal information in a data room in Alberta, we recommend a careful review of the information to be disclosed to ensure that it is necessary for the parties to determine to proceed with the transaction and, if the decision is to proceed, for the parties to carry out and complete the transaction.

As noted earlier, the federal legislation may apply to activities that occur outside, or across the borders, of Alberta and accordingly, where the parties are unable to structure their transaction in a manner which results in only the Alberta legislation applying to the disclosure of personal information in the data room, the federal legislation may also apply and consent may be required for such disclosure.

Author

Related Links

Related Expertise



View Full Mobile Experience