On a recent transaction where a client was purchasing an Ontario company we encountered some issues in conducting our due diligence.  On this deal, the vendor refused to disclose any personal information of any contractors, employees, customers or other relevant individuals related to their business to us or our client due to confidentiality concerns.  A timely amendment to the Personal Information Protection and Electronic Act (“PIPEDA”), however, enabled us to get past that hurdle.

What’s the issue? 

In BC, we rely on the Personal Information Protection Act (British Columbia) to disclose and receive personal information during the due diligence stage of a business transaction.  This act permits the disclosure of personal information to potential purchasers evaluating a company without obtaining consent.  Various other provinces however, including Ontario, do not have similar legislation (other than legislation directed at health information) and are instead subject to PIPEDA.  Prior to the aforementioned amendment, there were no exemptions similar to that in the BC Act and PIPEDA required a vendor to obtain an individual’s consent prior to disclosing their personal information to a potential purchaser.

What’s changed? 

In June of this year various amendments to PIPEDA came into force, including an exemption for obtaining consent to disclose personal information in the context of a business transaction.  In particular, if parties are involved in a prospective purchase and sale of an organization or its assets, merger or amalgamation of two or more organizations, financing to an organization, or charging, leasing or licensing an organization’s assets (each defined as a “Business Transaction”), such parties can use and disclose personal information without obtaining any individual’s consent if certain conditions are met.  One exception to this exception is where the primary purpose of the Business Transaction is the acquisition or disposition of the personal information itself.

How does it work?

In order to avail oneself of the exception to obtaining consent to use and disclose personal information under PIPEDA the following conditions must be met:

1. the party disclosing, and the party receiving the personal information must enter into an agreement that requires the receiving party to only use the personal information for purposes related to the proposed Business Transaction, keep such personal information confidential and if the proposed Business Transaction does not proceed, to return or destroy such disclosed personal information;
2. the personal information disclosed must be necessary both to determine whether to proceed with proposed Business Transaction and, if proceeding, to complete it; and
3. with respect to the use and disclosure of personal information after the proposed Business Transaction completes:
   • both parties to such Business Transaction must enter into an agreement that requires both of them to only use and disclose personal information for the purposes for which it was collected or permitted to be used prior to the completion of the such Business Transaction, keep such personal information confidential and give effect to any withdraw of consent from an individual done in accordance with PIPEDA;
   • the personal information must be necessary to carry on the business that was the object of the proposed Business Transaction; and
   • one of the parties must notify each individual whose personal information was disclosed that the proposed Business Transaction completed and that their personal information was disclosed.

What does this mean?

For those of you familiar with the due diligence process with respect to the disclosure of personal information in BC, such process is now similar across the country.  For anyone involved in the acquisition, sale, lease or financing of a business, it is now easier to obtain, use and disclose personal information to evaluate and complete such transaction.