PROTECTION OF PERSONAL DATA IN MERGER AND ACQUISITION PROCESS 12 December 2022

PROTECTION OF PERSONAL DATA IN MERGER AND ACQUISITION PROCESS

I. INTRODUCTION

The concepts of personal data and the protection of it have started to be of great importance for both legal entities and natural persons with the increasing technological developments in the recent period. In this context, access to the personal data in question, the establishment of the security of the transactions regarding the storage and transfer of these data are among the legal issues that need to be focused on today. One of the most important steps taken to emphasize this importance is the Law on the Protection of Personal Data, which entered into force in Turkey on April 7, 2016, and the secondary legislation enacted by the Personal Data Protection Authority afterwards.

II. TRANSFERRING/ DISCLOSING PERSONAL DATA TO THE PURCHASHER

In addition to the declarations and commitments made by the parties in the M&A process in order to protect mutual personal data, it is seen that the process of due diligence (in the process of a company acquiring another company or investing in an investor; researching the company, entrepreneur, business idea and market) is also quite common. In this context, within the scope of M&A transactions, personal data can be transferred to the buyer at the due diligence stage before the transaction or at any time until the closing moment of the transaction. The data subject to the transfer is mostly the personal data of employees, customers, suppliers, stakeholders and other business partners. In this part, it is important for both parties to prevent the violation of data protection laws covering the transfer.

The processing of personal data is based on a number of legal reasons. Aforementioned transactions are:

• With the express consent of the data subject
• The processing is clearly mandated by law.
• For a person who is unable to express their explicit consent, the processing is required for the safeguardingmof his/her or a third person's life or physical wellbeing.
• The processing is directly related to the formation or execution of an agreement to which the data subject is a party.
• The processing is required for the data controller to satisfy its legal obligation.
• The data to be processed has been made public by the data subject.
• The processing is mandatory for the establishment, use or protection of a right.
• On condition that it does not harm the data subject's fundamental rights and freedoms, the processing is mandatory for the legitimate interests of the data controller.

A. Evaluation of the Legal Basis of Explicit Consent in the Transfer of Personal Data

In accordance with Article 3 of the KVKK, express consent is defined as “consent related to a certain subject, based on information and expressed with free will”. In this context, the consent to be given by the relevant parties must be clear, without hesitation, and based on the necessary illumination and information that will ensure its validity.

Due to the nature of the M&A process, the transfer of personal data can be done confidentially until the closing stage. So that, in general, it is seen that many mergers and acquisitions are done in secret from the beginning until the closing. In this case, the employee, customer, supplier, etc. of the company that is planned to be acquired may not be aware of the transaction in question due to confidentiality reasons. As stated at the beginning, express consent should be a consent that is explained with free will due to the necessity of its structure, and that is based on having knowledge of the subject right in a sense. In this context, express consent can be used in practice only in cases where there is a limited person who is aware of the process. Based on this, it is generally not possible to count the express consent as a suitable legal reason for the transfer of data due to the reasons mentioned above. At the same time, the fact that the aforementioned declaration is a right attached to the person and the risk of withdrawing the given consent at any time is another problem related to the subject. In summary, it is often not possible to rely on explicit consent in mergers and acquisitions.

B. Can the Legitimate Interest of the Data Controller/Recipient be considered as a Reason for Compliance with the Law?

As stated in Article 5/2 of the KVKK, “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.” By emphasizing the concept of legitimate interest, the article refers to one of the other reasons for compliance with the law.

Considering the merger and acquisition agreements, since the existence of a legitimate interest is not usually easy to detect, it may be necessary to use applications such as balance testing to ensure the determination. In this context, personal data processing activities are subjected to a balance test and a comparison is made with the fundamental rights and freedoms of the individual.  As a result, it is stated that the interests of the person should outweigh.

 With the decision of the Personal Data Protection Board dated 25 March 2019 and numbered 2019/78, the conditions to be met in case of processing personal data for their legitimate interests by data controllers:

• The basic rights and freedoms of the person concerned are at a competitive level with the benefit to be obtained as a result of the processing of personal data.

• Legitimate interest must already exists, be specific and clear

• In case of obtaining a legitimate interest that can compete with the fundamental rights and freedoms of the person concerned, a benefit will be obtained, and it is not possible for this benefit to emerge in another way and method without the processing of personal data.

• While determining the legitimate interest, it is based on transparent and accountable criteria such as the fact that the said benefit affects a large number of people, is not only aimed at generating profit or economic benefit, and facilitating business processes or a functioning.

• Keeping the data subject away from all foreseeable, clear and imminent dangers in order to prevent damage to his fundamental rights and freedoms, especially the protection of his personal data.

• Taking all kinds of technical and administrative measures in order to ensure that personal data are processed in a data recording system in accordance with the law for a limited purpose and to prevent damage and violations.

• Ensuring compliance with general principles in the processing of personal data

• Performing a balance test by comparing the fundamental rights and freedoms of the individual with the legitimate interests of the data controller.

In this context, in cases where the aforementioned conditions are not met, relying on the legitimate interest of the data controller will be unlawful. If the conditions are met, legitimate interest can be counted as a valid legal reason for the processing of personal data by the target company. However, even in this case, it is seen that some problems arise due to the parties of the transaction, and the foremost of these problems is that the party of the transaction is not actually the direct interlocutor whose data are processed.

It is important to avoid excess data in order to accurately determine the relevant and necessary personal data within the scope of merger and acquisition projects. In other words, the data used should be proportional to the purpose and unnecessary data transfer should be avoided in line with a detailed evaluation. If the said conditions are met, it can be said that the legitimate interest in general will create a basis that can make the data processing and transfer activities in M&A agreements lawful.

C. Evaluation of the Eligibility of Establishment or Performance of a Contract as a Legal Reason

As stated before, those whose personal data are transferred within the scope of M&A are employees, customers, suppliers, stakeholders and other business partners. Under normal circumstances, the establishment or performance of a contract, data processing or personal data transfer can be considered as an appropriate legal reason. The problem here is that the persons whose personal data are transferred are not the main contracting parties in the M&A contracts. For this reason, those whose personal data are transferred directly are not parties to the contract. Therefore, this situation makes it hardly possible to show the establishment or performance of a contract as a direct reason for compliance with the law in merger and acquisition contracts.

3. CONCLUSION

In order to protect personal data in merger and acquisition agreements, there are certain factors that the recipient and target company should pay attention to during the data transfer phase. As an example, the declarations and commitments made by the parties on behalf of the mutual protection of personal data and in addition to these, due diligence can be given.

In the transfer of personal data to the recipient, express consent, legitimate interest, whether the establishment or performance of a contract can be considered as a legal reason should be determined by looking at the concrete case and its suitability should be determined based on this.

Finally, one of the issues that should be considered in terms of the protection of personal data in M&A contracts is to determine and transfer only the necessary data, and to ensure proportionality in this context. Considering all these issues, it can be said that if the merger and acquisition agreements are continued, transactions with higher legal compliance will be involved.