Data protection considerations
Where the firm is being acquired outright but will continue to trade as before, with the same name and legal entity being the regulated entity, there is no change of data controller and all existing data protection paperwork remains valid. Otherwise, whether clients are acquired as part of a client bank purchase or a complete acquisition of a firm, the acquiring firm is a new data controller and must issue its privacy statement to the clients and establish a lawful basis for processing that personal data.
That sounds easy enough. Just issue the standard paperwork and, if the firm’s standard lawful basis is client consent, obtain that consent.
However, it is not as easy as that. The acquiring firm does not have any lawful basis for using client data to write to the clients in the first place!
This would appear to be a Catch 22 situation. How can the following requirements be satisfied?
- The seller is entitled to transfer the database to the buyer.
- The buyer is entitled to use the database under the relevant data protection legislation for the purposes that he intends to use it.
It is possible that the selling firm’s existing privacy notice/lawful basis process made explicit reference to this possibility. Possible, but unlikely.
So, in the absence of a pre-existing explicit lawful basis to transfer the data to the buyer, there is a requisite prior step whereby the selling firm contacts the clients to establish a lawful basis for transferring the data.
The selling firm will need to include in this pre-sale communication to clients that, as part of the sale of the business (or client bank), the client’s personal data will be transferred. The lawful basis for doing so should be explained to the client. The lawful basis most likely to be valid is legitimate interests.
The clients must be informed that the firm is relying on legitimate interests as the lawful basis for transferring the data and explain what those interests are.
The plain English explanation of legitimate interests is that it is in the selling firm’s legitimate interests to transfer the data in order to facilitate a continuing service to the clients and also in the client’s legitimate interests for that service to continue. The client, of course, should be informed that they can object to the lawful basis and to the transfer of their data.
Legitimate interests comes with quite a few conditions and we recommend that firms refer to the ICO website or a data protection specialist for further guidance.