As data are quickly becoming a significant corporate asset, lawyers in corporate transactions need to consider the legal risks associated with data. Failure to understand and address these risks can result in significant future costs to the acquiring company. There are a number of due diligence considerations for a potential buyer with respect to data assets. The first post in this series discussed due diligence in connection with privacy/data protection issues. This post will examine due diligence of a target company’s rights in its data assets.
There are two primary considerations when conducting due diligence on the target company’s rights in its data assets. First, whether the target company is adequately protecting rights it may have in its own data. The second is to make sure that the target company’s use of data is not violating the rights that third parties may assert in their data.
Protection of Rights in Data
Unfortunately, intellectual property rights in data are not as clear as with many other types of intangible assets, such as software. For example, in the U.S. factual data – such as directories, or places of interest – generally only receive “thin copyright” protection.[1] That is, the data themselves are not protected by copyright, but how the data are organized or structured might be protected. In other jurisdictions, such as in the European Union, there is legislation that specifically protects intellectual property rights in data bases.[2] However, this legislation is subject to much uncertainty as well.
If the target company is using data solely for internal purposes, the primary question from a due diligence question is whether it has worked with third parties to collect, process or analyze the data. For example, the target company might have hired a vendor to track its mobile assets using GPS-enabled devices. Alternatively, it may have hired a company to analyze customer movements through its retail stores. Each of these scenarios raises data protection and privacy issues. However, it is also important to review the agreements to determine what rights the target company has granted in the original data and whether it has sufficient rights to use the processed data. It will also be important to understand what rights (contractual or otherwise) the target company has in any products or services that may have been derived from the original data.
If the company creates data products and services that are shared...
