Bill Boeck, Senior Vice President, Insurance & Claims Counsel for Lockton Financial Services, originally writing as a Guest Post for the D&O Diary Blog, made me raise my eyebrows when I first read this post, entitiled “Mergers, Acquisitions, and Data Privacy: The FTC is Watching.” Here Bill wisely cautioned companies to be careful what they promise in their company’s privacy policy, because regulatory agencies, like the Federal Trade Commission (“FTC”) are paying attention. For example, they are paying attention to transactions involving the sale of assets where the seller is providing the buyer with its customer list, that was subject to a privacy policy where the company promised its customers that it would not give away their information to a third party without their consent. He pointed out that the FTC, for one, is taking these promises seriously and, in fact, is alleging that these sorts of violations are deceptive trade practices in violation of the FTC Act, subject to FTC enforcement actions, citing examples.
When you or your clients are updating a privacy policy to provide a carveback for this type of M&A scenario, you should also check to be certain that the existing cyber/privacy insurance policy contains coverage for a regulatory action brought by the FTC or the like, and is not, in fact, excluded. If you or your company do not yet have a cyber/privacy insurance policy in place, there is no better time than right now to do so.
Bill’s insightful article (via the D&O Diary, which is also an excellent resource by Kevin M. LaCroix) on this topic can be found at http://www.dandodiary.com/2014/07/articles/cyber-liability/guest-post-mergers-acquisitions-and-data-privacy-the-ftc-is-watching/.
