M+A NEWS EUROPEAN M&A AND THE NEW EUROPEAN DATA PROTECTION RULES: ADDITIONAL RISKS FOR TRANSACTIONS AND HOW TO AVOID THEM IN THIS ISSUE

Transcription

1 EUROPEAN M+A NEWS Spring 2016 IN THIS ISSUE M&A and the New European Data Protection Rules: Additional Risks for Transactions and How to Avoid Them Page 1 Current Developments Morrison & Foerster s 2015 M+A Annual Review Noteworthy Deals Beijing Enterprises Acquires German EEW Energy from Waste ChemChina to Acquire German KraussMaffei ChemChina Offers to Buy Swiss Syngenta for USD 43 Billion Shanghai Electric to Take Major Stake in German Manz German Bilfinger Group to Sell Water Technologies Division to Chinese Chengdu Techcent Environment Group IBM Buys German IRIS Analytics IBM Acquires German Digital Agency Aperto Ningbo Joyson Electronic and Preh Acquire German TechniSat Automotive German RNTS Media Acquires U.S.Based Heyzap, Inc. RNTS Buys Israeli Inneractive Salesforce.com Acquires German YOUR SL Page 5 M&A AND THE NEW EUROPEAN DATA PROTECTION RULES: ADDITIONAL RISKS FOR TRANSACTIONS AND HOW TO AVOID THEM By Hanno Timner and Alex van der Wolk After almost five years of intense debate, EU institutions have finally agreed on a new European data protection framework: the General Data Privacy Regulation (GDPR). The GDPR is expected to come into effect in The next two years will give companies a transitionary period in which to prepare for the changes effected by the GDPR. In the M&A context, purchasers should consider how the new framework may affect the risks and liabilities involved in a transaction, taking into account increased powers of data protection authorities (DPAs) and the potential for significant fines. The following aspects of the GDPR are of particular importance regarding M&A transactions: continued on page 2 Attorney Advertising

2 Does the target company fall within the scope of the GDPR? A very notable change is that the GDPR applies not only to companies established in the EU, but to all companies targeting EU markets or consumers. Therefore, companies in non-eu countries may soon find themselves with a significant investment backlog in privacy compliance and may be exposed to previously unknown compliance risks. Does the target company meet the GDPR s compliance burdens? The new framework provides comprehensive recordkeeping obligations and mandatory data protection impact assessments (DPIAs). Does the target company have a data protection officer (DPO) in place? What is at stake? Penalties for non-compliance will reach unprecedented heights with new maximum fines of EUR 20 million or 4 percent of group annual worldwide revenue (whichever is higher). 1. Scope of Applicability The GDPR will apply to the processing of personal data by controllers and processors that are established in the EU, but also to companies outside of the EU that (a) offer goods or services to individuals located in the EU (regardless of whether payment is sought) or (b) monitor the behavior of individuals in the EU (insofar as that behavior takes place in the EU). The offering of goods or services criterion requires some form of targeting of individuals in the EU. The mere accessibility of a website from the EU, or the use of a language that is also used in Europe (where such language is also the language of the controller s country) does not necessarily lead to applicability. A combination of factors, such as the ability to order goods and services in an EU language, payment options in EU currencies, and providing local content, may lead to the determination that the company is targeting EU individuals. The monitoring behavior of individuals criterion which will potentially include the tracking and the profiling of EU individuals through websites, cookies and other remote activities requires that such behavior take place in the EU. Consequently, even if the target company is located outside of the EU, it may still be subject to the GDPR. 2. Compliance: Documentation Duties and Mandatory DPIAs Purchasers should closely evaluate the type of processing activities that the target company is engaged in and make an inventory of its current state of compliance. The purchaser will then be in a better position to assess which measures and potentially substantial investments are necessary within the next two years to meet the new level of compliance required under the GDPR. In particular, the new regulation introduces comprehensive recordkeeping duties, mandatory processes to safeguard data subjects rights, and DPIAs for high-risk processing activities. The GDPR requires data controllers and processors to maintain extensive records of processing activities (Art. 30), which must be available to DPAs. These records must provide, among other things, the name and contact details of the controller or processor and data protection officer, if any; the purposes of the processing (controllers); the categories of processing (processors); the transfers (including the list of the third countries to which data will be sent); the retention and erasure periods (controllers); and a description of the company s technical and organizational security measures. Furthermore, companies should have processes in place to meet the requirements on individuals rights. This includes procedures on how to grant access to data, as well as how to trace and remove individuals from databases ( the right to be forgotten ). The procedures should allocate these responsibilities within the company and provide target response times. Purchasers should screen target companies for high-risk processing activities that require a DPIA, such as profiling or the large-scale use of sensitive data. DPAs will maintain lists of the processing activities for which DPIAs will be required. The DPIA is a written review process that companies should implement; it includes a systematic description of the company s processing operations and an assessment of the necessity and proportionality of the processing, as well as its risks and safeguards. Importantly, if the DPIA indicates that the processing would result in a high risk that cannot be mitigated the company must consult with the DPA. If the DPA is of the opinion that the processing would violate the GDPR, it will provide written advice to the 2 European M+A News, Spring 2016 continued on page 3

3 controller (Art. 36(2)) and may (ultimately) use its enforcement powers (Art. 58) and prohibit the processing. 3. Does the Company Need a DPO? The GDPR introduces an obligation to appoint a DPO (Art. 37) for controllers and processors, which is currently not mandatory under the EU Data Protection Directive 95/46/EC (but under some national laws, e.g. in Germany). The appointment of a DPO is obligatory where the core activities of an entity involve the large-scale processing of sensitive data or regular and systematic monitoring of data subjects on a large scale (e.g. online behavior tracking or profiling, or the monitoring of employees by an employer). This may affect many multinationals (if, for instance, they engage in such activities as Data Loss Prevention or have centrally managed employee expenses). The GDPR furthermore sets requirements for the qualifications of a DPO, so companies are advised to review whether their organizations are subject to the DPO requirement. 4. Increase in Fines and Enforcement Powers for DPAs (Art. 55 and 83) The past years have seen an increased level of enforcement initiated by the DPAs in the EU (e.g. in Spain, France and Belgium). In the M&A context, the Bavarian DPA announced in July 2015 that it had imposed substantial administrative fines on both the seller and the purchaser of a company who had transferred personal customer data as part of the transaction. The stakes are raised under the GDPR. The new framework grants broad powers to the DPAs, encompassing the power to launch investigations, suspend data flows, terminate processing activities and impose fines of increasing levels of severity. Certain infringements (such as those pertaining to consent requirements, individual rights, transfer restrictions and compliance with certain DPA orders) may be sanctioned with fines of up to EUR 20 million or 4 percent of a group s global annual turnover (whichever is higher being the maximum). The GDPR also grants broad rights for individuals to lodge complaints with DPAs and obtain judicial remedies and compensation from companies. CURRENT DEVELOPMENTS Morrison & Foerster s 2015 M+A Annual Review The M&A market hit a new high in 2015, as did Morrison & Foerster s M&A practice. We enjoyed our best year ever, continuing to handle significant deals for clients across the globe. We advised on 138 transactions, with a total value of USD 195 billion; of those, 19 transactions each had a value greater than USD 1 billion. Our cross-border transactional offerings remained a hallmark of our M&A practice in 2015, as our Europe, U.S. and Asia teams combined forces on a number of significant cross-border deals. We had a particularly busy year handling crossborder transactions involving Asia-based companies. We bolstered our European capabilities in 2015 with the addition of several new partners in London, and our Berlin team continued to dominate in the technology and media space. We invite you to visit our 2015 M+A Annual Review to read more about the deals we worked on this past year. NOTEWORTHY DEALS 1. Beijing Enterprises Acquires German EEW Energy from Waste Beijing Enterprises Holdings has acquired EEW Energy from Waste, a market-leading German energy-fromwaste company which is also active in Luxembourg and the Netherlands, from EQT Infrastructure II, a Swedish private equity investor, for EUR 1.44 billion the largest Chinese direct investment in a German company in history, according to EQT. EEW operates 18 energyfrom-waste plants and produces electricity, district heating and process steam for industrial use, with sales of about EUR 539 million in ChemChina to Acquire German KraussMaffei China National Chemical Corp. ( ChemChina ), China s leading chemical company, has agreed to buy KraussMaffei, the German machinery maker, for EUR 925 million from Onex Corp., Canada s largest buyout firm. KraussMaffei, which generated revenue of EUR 1.1 billion in 2014, supplies machines that process and produce plastics and rubber, with customers in industries ranging from automotive to consumer goods and pharmaceuticals. KraussMaffei, with a corporate history of 178 years, will continue to operate in its current corporate structure and at its current locations. 3 European M+A News, Spring 2016 continued on page 4

4 The transaction is expected to close in the first half of 2016, subject to regulatory approval. 3. ChemChina Offers to Buy Swiss Syngenta for USD 43 Billion ChemChina has made an offered to acquire Syngenta, the Swiss agrochemicals giant, for USD 43 billion, which would be the largest foreign acquisition ever by a Chinese company. ChemChina offers USD 465 per share, plus a special dividend of CHF 5 per share to be paid upon and before the deal s closing. Syngenta, which specializes in producing pesticides and genetically modified seeds, has over 28,000 employees in over 90 countries. In 2015, it generated sales of USD 13.4 billion. Under the deal, Syngenta would continue to be based in Switzerland and be run by the current management team. The deal is expected to close by the end of the year, subject to regulatory approval. 4. Shanghai Electric to Take Major Stake in German Manz Chinese power and electrical group Shanghai Electric has agreed to buy a stake of at least 29.9 percent in German technology group Manz, with the possibility of a full takeover. Manz produces equipment for the solar industry, and machines for the manufacturing of smartphones and tablets. In order to enable Shanghai Electric the acquisition and to strengthen the financial performance, Manz plans to increase the company's capital stock by 43 percent against cash contributions (corresponds to 29.9 percent after the capital increase) by issuing new shares from the authorized capital with the inclusion of the shareholders subscription rights. 5. Bilfinger Sells Water Technologies Division to Chinese Chengdu Techcent Environment Group The leading German engineering and services group Bilfinger has sold its water technologies division to Chinese company Chengdu Techcent Environment Group for EUR 200 million. Bilfinger s water technologies division has 1,600 employees and generated sales of EUR 300 million in The acquisition was closed at the end of the first quarter of IBM Buys German IRIS Analytics IBM has acquired IRIS Analytics, a German startup company which specializes in real-time analytics to identify patterns in payment fraud. The acquisition will enable IBM to offer its clients solutions to detect fraud more accurately so respective countermeasures may be implemented more quickly. The financial terms of the transaction were not disclosed. 7. IBM Acquires German Digital Agency Aperto IBM has acquired Berlin-based digital agency Aperto. Upon completion of the transaction, Aperto will join the IBM Interactive Experience (IBM ix) team, supporting IBM s growth in Germany. Aperto s 300-plus employees will continue to serve its clients, which currently include companies such as Airbus Group, Volkswagen and Siemens. The financial terms of the transaction were not disclosed. 8. Ningbo Joyson Electronic and Preh Acquire German TechniSat Automotive Chinese Ningbo Joyson Electronic and its subsidiary, Preh Holding GmbH, are each acquiring 50 percent of the TechniSat Automotive division from TechniSat Digital GmbH. TechniSat Automotive develops and produces innovative products and software solutions in the fields of car infotainment, navigation, vehicle networking and telematics. It has 1,200 employees in Germany, Poland and China and generated sales of EUR 450 million in Within the Joyson Group, TechniSat Automotive will be operated in the as Preh TechniSat Car Connect GmbH. The financial terms of the transaction were not disclosed. 9. German RNTS Media Acquires U.S.-Based Heyzap, Inc. Berlin-based media holding RNTS Media N.V. has acquired Heyzap, Inc. for up to USD 45 million. RNTS is the parent company of Fyber GmbH, a Berlinbased company running a leading mobile advertising technology platform. Heyzap Inc. is a quickly growing mobile advertising technology company based in San Francisco. The deal consists of an initial cash consideration of USD 20 million, with potential earnout payments in cash and shares of up to USD 25 million upon achievement of certain performance targets by A cross-office team of Morrison & Foerster advised RNTS on the transactions. 10. RNTS Buys Israeli Inneractive RNTS Media N.V. has acquired Inneractive Ltd. for up to USD 45 million. Inneractive Ltd.,which is based in Tel Aviv, operates a global market for mobile advertising ('Ad Exchange') and specializes in display, native and video formats. The purchase price amounts to USD 72 million and includes an initial cash payment of USD 46 million and possible earnout and final payments of up to USD 26 million in the next three years. Morrison & Foerster advised RNTS on the acquisition. 4 European M+A News, Spring 2016 continued on page 5

5 11. Salesforce.com Acquires German YOUR SL Salesforce.com has acquired YOUR SL, a German consulting company in the field of digital business optimization. Salesforce is based in San Francisco and a leading cloud solution for sales, marketing, customer service, application development, communities and data science. Founded in 1999, it was the first company to offer software via the cloud. YOUR SL is a Berlin-based consulting company with more than 100 employees that covers the full range of digital business optimization, from planning to implementation of methods, processes and IT solutions. We are Morrison & Foerster a global firm of exceptional credentials. Our clients include some of the largest financial institutions, investment banks, Fortune 100, and technology and life sciences companies. The Financial Times has named the firm to its lists of most innovative law firms in Northern America and Asia every year that it has published its Innovative Lawyers Reports in those regions. In the past few years, Chambers USA has honored MoFo s Bankruptcy and IP teams with Firm of the Year awards, the Corporate/M&A team with a client service award, and the firm as a whole as Global USA Firm of the Year. Our lawyers are committed to achieving innovative and business-minded results for our clients, while preserving the differences that make us stronger. Because of the generality of this newsletter, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. The views expressed herein shall not be attributed to Morrison & Foerster, its attorneys or its clients. This newsletter addresses recent mergers and acquisitions. If you wish to change an address, add a subscriber or comment on this newsletter, please write to: Morrison & Foerster LLP Marketing Team Potsdamer Platz Berlin Germany germanymarketing@mofo.com 5 European M+A News, Spring Morrison & Foerster LLP