Personal Data Processing in the Acquisition of a Company
By Gabriele Borghi, Baldi & Partners Avvocati e Commercialisti
The attention to national and EU data-protection legislation has currently become increasingly (and incessantly) relevant in the evaluation process of a corporate acquisition transaction, since it is aimed at eliminating – or rather, reducing – the risk for the potential purchaser to be subject to the application, by the competent Supervisory Authority, of considerable administrative sanctions under art. 83 of the GDPR, or to run into considerable management (and advisory) expenses in order to adapt the newly acquired company to the aforementioned legislation: therefore, the execution, during the due diligence process, of a thorough investigation of the adequacy of the so-called target company, is of crucial importance.
In this regard, the exemplification of the Starwood Hotel & Resorts/ Marriot International case is absolutely emblematic. In September 2016, Marriott Hotel Group completed the acquisition of Starwood, although unaware that, back in 2014, Starwood had suffered a major and significant data breach involving approximately 339 million stakeholders: an event discovered only in November 2018, i.e. two years after the closing of the abovementioned corporate transaction.
Following the incident, on 30 October 2020, the Information Commissioner’s Offce (ICO) fined Marriott – even though not directly responsible for the personal data breach – EUR 20 million, since Marriott had failed to undertake suffcient due diligence in the acquisition of Starwood and should also have done more to secure its systems.
Gabriele BorghiGGI member firm
Baldi & Partners Avvocati e Commercialisti
Advisory, Auditing and Accounting, Fiduciary and Estate Planning, Law Firm Services, Tax
Reggio Emilia, Italy
T: +39 0522 271 220
Baldi & Partners was born from the merger between two GGI member firms: Studio Baldi (Tax & Accounting) and Studio Legale Baldi (Legal). It is a multidisciplinary professional firm specialising in legal, tax consulting, audit and accounting, and further advisory services. Its sister company, Baldi Finance, extends the array of offered services to corporate finance.
Gabriele Borghi Italian Lawyer, has been part of the Baldi & Partners Avvocati e Commercialisti staff since 2014. He advises within the areas of privacy and data protection, M&A, due diligence procedures, and litigation.
Published: Auditing, Reporting & Compliance Newsletter, No. 05, Spring 2021 l Photo: Renáta Sedmáková - stock.adobe.com