by: Leonardo Neri
A mergers and acquisitions (M&A) operation represents the business apex of the capitalist system, as it portrays the successful creation of value by two companies in the market, one that achieves success in the realization of an idea and is acquired by another that has greater financial volume and thus will be willing to expand its horizons into new business segments.
However, what is not widespread in this type of corporate transaction is the importance of the issue of privacy and data protection in the operations, a point that has already become the main subject in international acquisitions, due to the financial impact of the new legislation.
After completion of an M&A, any hidden liabilities are assumed due to the business succession. Thus, the injured party will have a right of recourse for compensation.
The phase called Due Diligence is essential for the success of the operation, and must be carried out properly, to mitigate the risks for the target company and the acquirer.
An interesting practical case that occurred outside of Brazil that illustrates the economic damage that can be involved in a transaction vitiated by the investigation of irregular contingency of privacy and data protection rules, occurred in the acquisition of Marriot by the Starwood chain in 2016.
In July 2019 Marriot was fined (USD 123.7 mi) for failure of due diligence. That is, it was found to have failed to verify security vulnerabilities in its reservation systems.
This was identified in 2018, after a cyber attack that exposed 339 million hotel guest records.
Thus, it can be seen that the monitoring of data protection compliance and information security is already one of the most important elements in an M&A, especially those involving the acquisition of innovative companies that have been most prominent in the post-pandemic market.