Sponsored briefing: Data as an asset – corporate M&A and joint ventures

The team at Eversheds Sutherland discuss data in M&A, joint ventures, and managing and leveraging data assets

Amongst other drivers, organisations invest in and buy because of the commercial value or, in the public sector, the wider public benefit of a target’s or relevant owner/licensor’s data assets. Let’s start from a few fundamental principles of data as an asset:

Data often has a significant commercial value.
Separately, in the public sector, providing open access to data, can exponentially increase efficiencies previously unavailable from closed, segregated data sets (eg New York Mayor’s Office, NY Open Data, which resulted in significant reductions in ambulance response times).
In the same vein, data can equally determine a liability value, either resulting from a failure to keep that data asset secure, contractual non-compliance or regulatory non-compliance leading to sanctions in the way of fines or notifications to customer and reputational damage.
Whilst data is often perceived as having value where it is personally identifiable (ie it contains personal information relating to an individual), data may equally have value as a trade secret, know-how, confidential information or other source of commercial or national security intelligence. Collections of data, in particular, may have very significant commercial value and be protected by IP rights such as Database Right (in the EU and UK), trade secrets, as well as contractual and legal restrictions around access and use.
Handling data which comprises personal information carries with it particular compliance requirements to keep that data secure and to process it fairly.
Achieving a certain degree of control over a specific category or categories of data or entering into arrangements, whether to share data or otherwise, may trigger competition and antitrust laws to avoid unfair competitive advantage.

Data in M&A

When appointing a processor to process any personal data on your behalf, prior to investing or buying a target, it is advisable to carry out effective due diligence (DD) and make suitable enquiries of a seller. Where data is involved, don’t assume that your customary DD enquiries and applicable step plan address all the appropriate questions and issues at hand. For instance:

Where there is a concern around regulatory or contractual compliance, is it simply resolved by requiring an indemnity?
Have you explored ownership of IP rights associated with collections of data, such as Database Right, trade secrets and (in some jurisdictions) copyright, as well as any contractual restrictions which apply to access to and use of the data?
Do your questions elicit sufficient responses around (i) ownership and use cases for data? and (ii) security incidents or near-misses?
And when does the seller respond to those questions – in the first or final round of further and more DD enquiries? Similarly, have the DD enquiries been
tailored to the nature of the target’s business and the data it processes?
Have you asked about associated rights in algorithms and ownership in AI and data insight tools (it’s not necessarily just about the data but the value of the tools which process that data)?
Do your enquires cover compliance with AI regulation, bias and ethical governance?
If you are a seller, have you ensured that all legacy data has been purged from systems (where that data is not part of the assets sold)?

Often, a breach of a compliance requirement may occur shortly after completion – where this is the case, a warranty which only applies up to completion may not bite.

Accordingly, it may be necessary to consider adjusting warranties to cater for non-compliance which arises from a failure to invest in effective compliance in the period preceding completion, coupled with either a price reduction or money held in escrow (together with a separate, distinct liability cap). In addition, the parties may agree a reduction in price attributable to an estimated cost – perhaps limited to a specific period – of remedying years of failed or insufficient investment in compliance.

Similarly, in restructuring, we would advise reviewing the relevant data assets and applicable data flows are assessed, so as to consider whether it may be necessary to assign or re-locate any data sets or corresponding responsibilities for compliance (or notification with relevant authorities). As part of this, establishing effective data retention will also be important to manage risk and reduce liability.

Data in joint ventures

Often in joint venture arrangements, the parties to a joint venture will inevitably share or need access to each other’s data. Sometimes this may be driven by a commercial opportunity and one of the parties may have access to a particular data set which may be needed by the other joint venture partners. Elsewhere, a regulator may have issued a mandatory requirement for suppliers in a specific industry vertical to share and report on certain operational or regulatory audit data. Whatever is the driver, it will be important clearly to set out:

The purposes for which such data is shared and any limitations around other use.
How the data may be shared and stored.
Which party will own IP rights associated with collections of data, which typically expand and evolve over time.
Any potential antitrust implications for the proposed data sharing arrangement.
Who is responsible for implementing and operation of the data sharing portal or repository.
Who is responsible for any regulatory compliance relating to that portal or repository.
How any implementation, operational and associated compliance costs will be borne and shared.
Corresponding warranties and indemnities relating to accuracy and rights in the data shared.
Return and use of data after the termination of the joint venture, including new data obtained by the joint venture during its life.

Leveraging and managing data assets

Data is just another form of content and, although it may not be perceived
as having quite the same attraction or value as a Hollywood blockbuster, it arguably has a greater value. Like any content licence, consider how best to exploit or limit usage by considering the extent to which any sharing arrangement or restrictive covenant is drafted including:

Any exclusivity.
Clear explanation of the purpose(s) for which data is shared.
Any restrictions upon onward sharing or usage rights.
Ownership and licensing of IP rights.
Rights to suspend or terminate data sharing.
What rights there are into and to pre-existing data, secondary or resulting data arising and any associated tools, methodologies or know-how developed.

In particular, from a technical and operational perspective, it may also be necessary to de-sensitise any data before it is shared and configure the access and usage rights associated with the corresponding portal or repository, to reflect and manage the terms upon which the data is shared. The parties may also wish to attach certain metadata to the data concerned to help manage tracking and auditing the use of the data, as well as help apportion or calculate and licence revenue or costs incurred as a result.

Carrying out a brief review of applicable licences in and out of various data sets and sources which may be feeding and emanating from a data repository will help inform any licensing or compliance risk and potential opportunities for commercial partnerships.

Competition and antitrust considerations

From a competition perspective, it may be appropriate to draft any such usage terms from the perspective of intellectual property (IP) licensing, rather than as simple contractual restrictions – the reason being that an IP licensing framework may be easier to defend and justify from an antitrust perspective, than a discussion around dividing field(s) of use and segregate particular usage areas and corresponding markets.

We would always recommend that competition counsel reviews and considers any data sharing arrangement to seek to identify any potential roadblocks or pitfalls arising.