20 July 2020

Buying or Selling a Business? Know the Rules Regarding Personal Information

By: Laurie Propeck

The adoption of privacy legislation in the early 2000s by the federal government and various Canadian provinces such as Quebec, Alberta and British-Colombia regulating the collection, use and disclosure of personal information, being information that allows an individual to be identified, demonstrates the importance given to protecting personal information. Quebec law imposes strict obligations on parties holding individual’s personal information which, amongst other things, include a requirement to obtain the prior consent of an individual before communicating his personal information to a third party (referred to as the Consent Principle).

In the context of M&A transactions, personal information of the vendor’s employees, clients and suppliers is inevitably disclosed to the purchaser, and each of them must be mindful of their respective obligations and restrictions. During the due diligence process, the purchaser will likely be given access to various documents of the vendor containing personal information, such as service and employment contracts,  disputes involving the vendor as well as lists detailing the vendor’s clients, suppliers and employees.

Consequently, respecting the Consent Principle in M&A transactions is often very hard to achieve. In fact, various commissioners or ombudspersons who are responsible to oversee provincial or territorial privacy legislation, as the case may be, have held accountable parties to M&A transactions, including their legal counsel, for exchanging personal information in breach of the applicable privacy legislation. For instance, in an Alberta, two renowned law firms inadvertently included in their purchase and sale documentation home addresses and social insurance numbers of employees of the vendor, and such information was subsequently posted on SEDAR, a non-password protected website. The Alberta Commissioner determined that: (i) the disclosure of the employees’ personal information was not necessary to conclude the business transaction; (ii) the disclosure of the information by the purchaser’s lawyers to the vendor’s lawyers contravened to the Alberta Personal Information Protection Act; and (iii) the vendor remained accountable for the breach by the law firm it was represented by.

On June 12, 2020, the Quebec government introduced Bill 64 to modernize the legal framework applicable to the protection of personal information, including an exception to the Consent Principle in the context of M&A transactions which already exists under the federal and certain other provincial acts. This bill is expected to come into force one year after the date of its assent which assent is however not likely to occur before Fall 2020. Amongst other things, such bill proposes to add article 18.4 to the Act Respecting the Protection of Personal Information in the Private Sector allowing a vendor to communicate to a purchaser personal information relating to an individual such as a client, supplier or employee, without the consent of the individual concerned, to the extent that: (i) such information is necessary to conclude a commercial transaction involving a transfer of ownership of all or part of an enterprise, and (ii) the parties agree to certain terms.

If this bill is enacted, the parties to an M&A transaction will be able to share necessary personal information without consent of the relevant individuals if they enter into an agreement stipulating that the receiving party will:

  1. use such information solely for the purpose of concluding the transaction;
  2. not communicate/disclose this information to any other party without previously obtaining the consent of the party concerned;
  3. put in place measures to ensure the confidentiality of the information; and
  4. destroy the information if the transaction is not concluded or if such information is not necessary to conclude the transaction.


Whether or not this exception to the Consent Principle comes in force, parties to M&A transactions should be aware that disclosure of personal information is generally prohibited without the interested person’s consent. They should ensure that their legal counsel help them navigate through the applicable privacy restrictions so that the purchaser obtains the information required to make an informed purchase decision while the vendor complies with applicable legislation. KRB’s corporate group can help you adequately comply privacy legislation while helping you achieve your business goals.

Back to blog