Attorney General may bring actions for failures to meet these standards; however, as the promulgation of these standards is relatively recent, it is unclear whether courts will consider them as a metric for standard of care under California’s privacy laws.
Acquirers interested in target companies in, or that do business in, Massachusetts or California, or states with similar laws, should consider incorporating inquiries regarding compliance with such laws and regulations in their due diligence questionnaires and review.
Conclusion
Dire economic consequences may await the acquirer who does not follow through on comprehensive due diligence of cybersecurity risks. On September 22, 2016, Yahoo announced that 500 million Yahoo accounts were hacked in late 2014 by what Yahoo believed was a state-sponsored actor. The Yahoo breach of information was announced publicly after the parties entered into a definitive Stock Purchase Agreement earlier in July for the sale of all of the outstanding shares of Yahoo, as reorganized, to Verizon. This timing raises questions regarding what information may or may not have been appropriately disclosed by Yahoo in due diligence with regard to Verizon’s offer to purchase certain assets, as well as whether Verizon asked and followed up on responses that could have revealed the existence of that massive breach. At best, Yahoo is likely to face a request for a significant purchase price adjustment, or Verizon may seek to terminate the transaction completely.
Foreign acquirers of target companies in the United States should be cognizant of, and appropriately conduct their due diligence procedures in a thorough manner given, the increasing promulgation of complex regulations and laws related to privacy and cybersecurity issues at the state level, as well as federal regulations that have expanded dramatically in recent years. Conducting an appropriately expansive due diligence review of a target’s compliance with federal and state regulations could avert potential enforcement actions or litigation by state attorneys general, federal and state agencies, and individuals under a private right of action, as well as potentially expensive market fallout.
George H. Wang and Kenneth N. Rashbaum are partners in the New York office of Barton LLP.