White & Case Technology Newsflash
Due diligence considerations with respect to licensing data and acquiring data-dependent businesses.
In the relentless pursuit of the competitive advantages that arise from efficiency and speed, companies are increasingly using artificial intelligence and machine learning (AI/ML) in their businesses. But the story does not end there. Whether you believe it is the new "oil" or not,1 data is essential to such AI/ML technology—and every AI/ML application is only as good as the quality of data on which it is trained.2 As such, companies are increasingly looking to collect data not just via their own products and services but also from public and third-party sources (including from the internet through automated means like web scraping or by licensing from data vendors and aggregators). This article explores the rights and protections that may apply to such public or third- party data—and several due diligence questions to consider when looking to acquire or license such data.
In recent years, we have seen an increase in the number of M&A acquisition targets whose various products and services are based on or rely upon AI/ML technology or large pools of business-critical data. More and more of our clients are also seeking to license third-party data to power or augment their products and services. In both instances, the protectability of the data and how it is (or may be) exploited can lead to novel due diligence issues and determinations of risk allocation. We often hear target companies or vendors say that the relevant data is "in the public domain" or is not collected from "behind a login" and therefore may be freely accessed, collected and used in the relevant business. This analysis, however, is often not so straightforward. The rights that a target company or data vendor may have to certain data (and, in the licensing context, what rights such entity may grant) often turn on the nature of the data, how is it collected and processed, and its intended use.
Under United States law, data may be subject to various legal restrictions and regimes, including contractual protections, rights of privacy or publicity, and intellectual property rights. Further, certain computer trespass statutes and torts law claims may also apply depending on the manner in which the data is accessed and collected. Some of the more common rights and protections that may apply to data in the US are:
- Contractual rights – Website operators often place limits and restrictions on access to information3 through terms of service or other "browsewrap" terms and conditions (i.e., terms and conditions to which website users are purportedly bound due to the mere act of navigating or using the website). Generally, courts find that "browsewrap" agreements are unenforceable unless there is actual or constructive knowledge of such terms.4 Courts are, however, increasingly considering the nature of the user accessing the website (e.g., whether such user is a business or sophisticated party) and whether the user received actual or constructive knowledge outside of the ordinary website terms (e.g., via a cease-and-desist notice).5 If such "browsewrap" terms are held to form a binding agreement between the user and website operator, then the access, collection or use of data hosted on such website by the user in breach of such terms may give rise to a breach of contract claim against the user.
- Copyrights — While the underlying facts or data may not be protectable, a data set as a whole may be protected by copyright as a compilation if it has the required minimum level of originality.6 Moreover, unless the terms and conditions of a website explicitly allow the copying of particular images or text, then copyright law...
