Tips for handling IP and data privacy matters in M&A
Companies undergoing, or about to undergo, an M&A process must take note of IP and data privacy and protection matters that accompany the transaction and are advised to undertake the following:
Buyers should review applicable documents assigning ownership of IP developed for or on behalf of the target.
“Sellers are usually asked to provide copies of the IP assignment agreements executed by its employees and contractors that develop IP for or on behalf of any target company,” said Panganiban.
-
Look into the following issues: how mature and well-looked after the IP portfolio is, how much revenue generation can be attributed to it, where the IP portfolio places the business in terms of competition in the marketplace, anticipated lifespan of the IP portfolio relative to the investment required for the acquisition or merger, potential for regeneration of the IP portfolio and potential commercial vulnerabilities
-
Buyers must also be aware of any incumbrances and liabilities attached to the IP, which must be addressed in the sale and purchase documentations.
“The acquirer may suffer huge losses if it takes the place of the target company in an existing dispute arising from the target’s IP rights,” said Panganiban.
-
Ask for the appropriate measures the company has taken to protect sensitive IP assets from an insider or third party, if the IP is key to the M&A deal. According to Arammuang, sensitive IP assets include know-how, copyright and trade secrets, where the registration of ownership is not required and therefore ownership becomes arguable. Evidence of proof of ownership is also required. These include evidence of first creation, blueprint, original work, among others.
-
Review the target’s IP licenses, whether the target is the licensee or the licensor.
-
In the case of a merger, each party must disclose the IP management system they are using and discuss the similarity and differences of each party’s system and platform.
“Each company’s IP manager or IP lawyer must be involved in the discussion. Then, the parties must select a common platform to be used and referred to by both parties going forward,” noted Arammuang. “This is to ensure that they will discuss on the same page.”
-
Each party in the merger must also disclose the relevance of each of its IP assets to the company’s business function or business sector. For example, the company may state, “Patent A is used for the manufacturing process of Product X, Patent B is used to support the packing process of all products, and Patent C is planned to be used for the new line of products in the next two years.”
“Any research projects in the pipeline must also be disclosed and brought to the discussion. Once this information is disclosed, both parties will have a clearer picture of the entire IP portfolio of the company. Inputs from the business side of both companies are required at this stage to identify each other’s business plans and agree on the future business plan of the company after the successful merging by taking into consideration each party’s IP portfolio as well as understanding the strength, weakness and opportunity of the company based on the combined IP portfolio,” Arammuang added.
Discussions may also include the following: key IP assets that should be maintained, the redundancy of IP assets including pending patents, and research projects between the two parties that should be abandoned, suspended or combined.
-
The company’s business plan and existing IP assets which are relevant or contribute to each item of the plan, including the action plan for the utilization of these IP assets
-
Loophole technology or loopholes in research projects relevant to the company’s business and need to be fulfilled by additional research, cross-licensing or technology transfer
-
Cost projection on maintenance of the company’s IP assets, including the cost for recordation of assignment of ownership from one owner to another after the merger
-
List of unutilized IP assets
-
Persons who will handle the company’s IP portfolio going forward
“Be prepared to deal with any deficiencies,” said James Gong, a partner at Bird & Bird in Beijing. “This is particularly so after we have seen real cases where the buyers were penalized for violation of privacy laws by the target companies that have been purchased.”
In the Philippines, said Panganiban, non-compliance or non-showing of compliance with data privacy regulations may expose a business entity to the following: compliance and enforcement orders, cease-and-desist orders, temporary or permanent ban on personal information processing, payment of fines (though the Philippines’ National Privacy Commission has yet to release its schedule of fines) and/or civil damages, when appropriate.
In an M&A deal, it is the business enterprise which acquired the target company, that will eventually be at the receiving end of all these.
“In order to mitigate risks, the transaction agreement can obligate the parties to implement measures to remedy the situation going forward after closing,” said Panganiban. “In particular, the agreement may call for adequate protection to enable the acquirer to implement a new data protection management/governance structure that is also suited to rectify existing gaps under applicable data protection law.”