Cybersecurity and Due Diligence: Avoiding Liability for Someone Else’s Mistakes | The Legal Intelligencer

David Shonka, left, and Matthew Rotert, right, of Redgrave LLP.

Corporate acquisitions are like poker games—players have only limited opportunities to improve their hands before the betting ends. When one company acquires another, whether in a friendly deal, the sale of stock or assets in a Chapter 11 bankruptcy, or a hostile takeover, the result is the same: the acquirer bets on the privacy and security practices of the acquired entity. It not only assumes responsibility for protecting acquired personal information but also liability for any pre-acquisition security breaches. Assessing risks is difficult because often the acquiring company has little opportunity to evaluate the cards it does not see.  It lacks visibility into the target’s cybersecurity protocols and practices. In a friendly transaction, the target will be reluctant to allow any “outsider” to examine its sensitive security secrets; in Chapter 11, time pressures may limit any opportunity for scrutiny; and in a hostile takeover, the acquirer will not have any chance to examine these matters. The result: acquisitions are often consummated with the acquiring company having little knowledge of the target’s privacy and security protocols, the type of data subject to protection, the risks associated with that data, how the target uses the data, or the tools it uses to protect the data.  An acquiring company may be forced to gamble with the cards it has been dealt, and the resulting losses can be significant.

Want to continue reading?
Become a Free ALM Digital Reader.

Benefits of a Digital Membership:

• Free access to 3 articles* every 30 days
• Access to the entire ALM network of websites
• Unlimited access to the ALM suite of newsletters
• Build custom alerts on any search topic of your choosing
• Search by a wide range of topics

*May exclude premium content
Already have an account? Sign In Now

Let's block ads! (Why?)

from Poker