Information Sheet 16-2002: Application of Key NPPs to Due Diligence and Completion when Buying and Selling a BusinessBackgroundThis Information Sheet is designed to help organisations involved in the sale and purchase of a business to comply with their obligations under the Privacy Act 1988 (Cth) (the Privacy Act). The Information Sheet was developed in collaboration with the Law Council of Australia. Sales of businesses are generally structured as either an asset sale, or an entity sale (that is, a sale of shares). The sale of a business may involve the disclosure and collection of a number of different types of personal information including:
If the personal information is 'sensitive' it may attract additional protection under the Privacy Act [1] How the Privacy Act applies to due diligence and completion of a sale may be affected by issues other than the National Privacy Principles (NPPs) in the Privacy Act. For example, if the personal information involved is credit-related information, Part IIIA of the Privacy Act may apply to it. Also, if the information is about employees, the employee records exemption may apply. In some cases, the small business exemption and the exceptions to the exemption may have an impact on a vendor's or a purchaser's obligations (see Information Sheet 12 - 2001 Coverage of and Exemptions from the Private Sector Provisions for information about the exemptions). However, this Information Sheet focuses mainly on the way the NPPs apply. Also, this Information Sheet assumes that the reader is familiar with the NPPs and the Privacy Commissioner's Guidelines and other Information Sheets. If you have not read these they can be found at www.privacy.gov.au. [2] Due diligencePersonal information may be disclosed by a vendor of a business (vendor organisation) to prospective purchasers of that business (prospective purchaser organisations), for the purposes of due diligence investigations. [3] Such disclosure will occur before the sale has been completed, (that is, at a time when the relevant contract has not yet been signed, or is still conditional upon completion of investigations). Information involved in due diligence Generally, during a due diligence investigation, prospective purchaser organisations, their lawyers, financial advisers and corporate advisers will review information (including personal information) relating to the business of the vendor organisation, including:
The amount of personal information that needs to be disclosed during a due diligence exercise will depend on the nature of the business being sold. For example, if the value of a business is directly linked to the expertise of its staff, then it may be necessary to disclose more personal information about those staff during the due diligence process than would otherwise be the case. Disclosure and collection of information in the course of due diligence - NPP obligations Where due diligence processes involve the handling of personal information, including sensitive personal information, organisations subject to the Privacy Act will need to comply with the NPPs. [4] During due diligence investigations, a vendor organisation:
During due diligence investigations, a prospective purchaser organisation:
Due diligence - vendor's obligations when disclosing to prospective purchaser It may sometimes be necessary for a vendor organisation to disclose personal information to a prospective purchaser organisation in the course of a sale of business. For instance, the vendor organisation will need to disclose preliminary information to enable prospective purchaser organisations to conduct due diligence investigations. To ensure that such disclosures are not misleading or deceptive under section 52 of the Trade Practices Act 1974 (Cth) or section 1041H of the Corporations Act 2001 (Cth) the information provided must not be incomplete. A vendor organisation may consider it needs to disclose certain personal information to meet these obligations, particularly if the personal information is important to a prospective purchaser organisation's decision about whether to buy a business and for how much. The vendor organisation may disclose personal information if the disclosure is permitted under NPP 2. In most cases, the vendor organisation's disclosure would be directly related to the primary purpose of collecting the information and within the individual's reasonable expectations, so that NPP 2 would not require the vendor to get the individual's consent before disclosing the information to the prospective purchaser. Disclosure of personal information about employees Where the vendor organisation discloses personal information about employees, the disclosure will fall within the employee record exemption if the information disclosed directly relates to a current or former employment relationship between the employer and the individual and to the employee record held by the organisation. The disclosure must also relate directly to such employment relationship. Examples would be where the disclosure is necessary to enable the prospective purchaser to assess whether or not to employ particular individuals from the vendor organisation. If information is provided about contractors or employees of other related organisations, it will not fall within this exemption. The Commissioner encourages vendor organisations always to consider whether disclosure of aggregated information relating to their employees is adequate for due diligence purposes regardless of whether the exemption might apply. Disclosure of personal information about trading partners, business
associates, customers, contractors However, as set out below, the Commissioner expects vendor organisations to impose restrictions on the handling of personal information by prospective purchaser organisations which aim to protect the privacy of the relevant individuals.
Due diligence - prospective purchaser's obligations when collecting personal information about employees, trading partners, business associates, customers, or contractors As noted above, it may be necessary for a prospective purchaser to review personal information (possibly including sensitive information) held by the vendor organisation. This paragraph applies to the collection of sensitive information and other personal information. Inspecting records of personal information during a due diligence exercise may not require the 'collection' of personal information by the inspecting party / prospective purchaser organisation (prospective purchaser). If it is not necessary for the prospective purchaser to do anything except inspect records and make a note of the fact that the records have been inspected (without recording the details of particular personal information), then it has not 'collected' the personal information for the purposes of the Privacy Act (because no personal information is 'held in a record' by the prospective purchaser). Since due diligence investigations must be conducted confidentially to protect the interests of the organisations involved, the Commissioner takes the view that, even if personal information is recorded by a prospective purchaser, it would generally be reasonable at this time for the prospective purchaser organisation to take no steps under NPP 1.5 to advise the individual about whom personal information is collected of the NPP 1.3 matters. However, taking no steps would only be reasonable where the prospective purchaser organisation decides not to proceed with the purchase of the business, and returns or destroys all records of personal information to the vendor organisation. It is expected that in only limited circumstances would an organisation need to collect sensitive information in the course of a due diligence process. In many cases, it should be possible to achieve the due diligence purpose either by not recording information or by using de-identified information. In other cases, it may be possible to imply an individual's consent to such collection. However, where these options are not possible or will not meet the due diligence needs of the prospective purchasing organisation, the organisation will need to get the individual's consent in order to comply with NPP 10.
CompletionAt completion, if the sale is a sale of assets, personal information will need to be transferred to the purchaser organisation to enable it to conduct the business. If the sale is the sale of shares in a company, there will be no transfer of personal information as the personal information is already located in the company which has been acquired. This section applies the NPPs in the 'sale of assets' scenario. Completion - vendor's obligations when disclosing to purchaser organisation Disclosure of personal information about
employees Disclosure of personal information about trading partners,
business associates, customers, contractors Where this does not apply, disclosure may be permitted if it can be shown that disclosure of personal information to the purchaser organisation is made for a purpose related to the primary purpose of collection and reasonably expected by the individuals concerned. For example, if the assets of the business include premises owned by the business which is subject to a lease and the organisation holds personal information about the tenant, the information will have been collected for the primary purpose of leasing the premises to the tenant. When the premises are sold the disclosure of personal information about the tenant to the new owner will be necessary to continue the lease. A similar result is likely to follow in the circumstances where contractual rights are assigned by the vendor organisation to the purchaser organisation. Another example is the transfer of personal information in customer transaction histories. Disclosure to the purchaser organisation might not be necessary for the primary purpose of collection. However this information may be necessary for the purchaser organisation to plan its resourcing to meet future orders. This purpose is closely related to the primary purpose, and an individual would reasonably expect that when a business is sold, the information would be passed to the purchaser organisation, particularly where the purchaser is continuing to provide the same goods or services. By contrast, where a business is not sold as a going concern, or the purchaser organisation contemplates significant changes to the character or operations of the business, the vendor organisation will need to give very close consideration to the question of whether a proposed disclosure is permitted under NPP 2.1. This will depend on the circumstances in which the vendor organisation originally collected the personal information and an objective analysis of what the relevant individuals would 'reasonably expect'. If the disclosure would fall outside what the relevant individuals would reasonably expect, the vendor organisation must get individuals' consent before disclosing the personal information.
Completion - purchaser organisation obligations on transfer when buying a business Where a purchaser organisation acquires personal information through buying a business, its proposed uses or disclosures of the personal information will be limited by the NPPs. The primary purpose of collection remains the same as that which applied before the ownership of the business changed. This would be the case even if a related body corporate of a purchaser organisation seeks to collect newly acquired personal information from the purchasing organisation. Uses or disclosures of personal information for purposes unrelated to the pre-purchase primary purpose would generally require getting individuals? consent. For example, where a business is not sold as a going concern or the purchaser organisation contemplates significant changes to the character or operations the purchaser would need to get consent for any proposed new uses or disclosures (unless the vendor has already done so). However, if the purchaser organisation uses or discloses an individual's personal information in its new capacity as the owner of the business sold by the vendor organisation in a manner that is consistent with NPP 2 taking into account the pre purchase primary purpose of collection, then there is no requirement to inform, or seek consent from, the individual. Completion - purchaser organisation?s obligations when collecting personal information Collection of personal information about employees Collection of personal information about trading partners, business
associates, customers, contractors If the purchaser organisation collects sensitive information on completion of a sale of assets, the purchasing organisation will need to give close consideration to whether collecting the personal information is permitted under NPP 10. In most cases, the purchasing organisation will need each individual's consent to be able to collect the personal information in these circumstances. To meet the requirements of NPP 1.5, the purchaser organisation will need to take steps that are reasonable in the circumstances to inform the individuals concerned of NPP 1.3 matters. The exact steps the purchaser must take will need to be determined in each particular case. In considering what constitutes 'reasonable steps' factors to be taken into account include the privacy implications for the individual of not being informed of the relevant information and the cost to the organisation in providing that information. In some circumstances the obligation to notify individuals may be satisfied easily. For example, if an asset sale agreement requires the vendor organisation to notify each party with whom the vendor organisation has contracts of the transfer of the business to the purchaser organisation it would be relatively easy for the vendor organisation to enclose the purchaser organisation's privacy statement with the notice (addressing the matters in NPP 1.3). The purchaser organisation could consider specific contractual provisions in the asset purchase agreement requiring the vendor organisation to co-operate with the purchaser organisation to satisfy its obligations under the Privacy Act. In other cases, for example, where the purchase includes larger customer lists, the easiest way of satisfying this obligation may be to include a privacy notice with the next regular communication to the customer (for example, with the next account statement or a direct marketing letter). Other options to be considered could include a newspaper advertisement advising of the change of ownership which includes a brief privacy statement with information about where to get more information.
Office of the Privacy Commissioner [1] For the definition of 'sensitive information'
see section 6 of the Privacy Act, or the Key Concepts section of the Guidelines
to the National Privacy Principles. For information about handling health
information by health services see Guidelines on Privacy in the Private Health
Sector. |