Representations and Warranties Insurance

1. Purposes and Functions

• Protects against seller's breaches of representations and warranties and losses that may arise therefrom post-closing.
• Reduces or eliminates seller's indemnify obligations 
• May provide additional protection over specified indemnities

2. Not intended to provide protection against:

• "Knowledge" of a breach (no sandbagging to be allowed from insurer's perspective) - insured prefers to limit knowledge to actual knowledge (no constructive knowledge) and limit "Knowledge Persons" to as small a group of management employees as possible.
• "Fraud" - definition of fraud as a carve-out from the coverage needs to be reviewed with caution; ensure that definition in the purchase agreement is identical to the definition in the insurance policy; the broader the definition of fraud, the greater the risk of buyer; seller (e.g., PF funds in platform sales) needs to ensure that (i) buyer does not amend or modify the policy in a manner that is adverse to seller (attache the policy as an exhibit) and (ii) buyer does not enter into any agreement with any person (insurer) that is broader than or inconsistent or conflicts with buyer's rights, interests or obligations under the purchase agreement (e.g., scope of subrogation rights in the policy) and any such broader, inconsistent or conflicting right, obligation, covenant or agreement will not be effective or binding against seller.
• Working Capital Adjustment - purchase price issue
• Adequacy of specific reserves on a balance sheet
• Underfunded pension obligations
• Covenants of a seller (state of matters v. actions)
• Absence of due diligence (moral hazard)
• Forward looking statements

3. Buyer's perspective

• Increase or augment indemnity
• Extension of survival period of reps and warranties (24 m - 36 m up to 6y; 6y for fundamentals)
• Ease of collection
• Backstop in public deals or seller bankruptcy
• Sweeten bid in auction
• Manage post-closing relationships with customers, suppliers and management of target

4. Seller's perspective

• Reduce contingent post-closing liabilities 
• Enable distribution of all sale proceeds upon closing
• Protect passive sellers (LPs)
• Attract best bids by maximizing indemnity
• May offer separate indemnity package for tax, employment, environment or real property

5. Usage

• More frequently used in stock deals, PIPES, mergers and Section 338(h)(10) transactions where buyer assumes pre-closing liabilities
• Less frequently used in asset transactions where seller is retaining pre-closing liabilities

6. Terms

• Coverage: 100% plus of purchase price or may bifurcate (fundamental v. regular reps)
• Retention (Deductible): seller's skin in the game; 1-2% of purchase price; esp. insisted regarding fundamental reps and warranties; step-down retention after a certain period post-closing
• Premium: as of 2016 2-4% of coverage
• Underwriting fee: $15,000-$50,000

Purchase Price Adjustment Provisions - Jones Day Article

Accounting True-Up vs. Valuation Dispute

January 2017

Chicago Bridge Decision from Delaware Chancery says Accounting Expert Has Exclusive Jurisdiction over $2.5 Billion Contract Dispute

On December 2, 2016, a Delaware Chancery Court held that the courts had no role in considering a purchase price adjustment dispute based on "plain language of the purchase agreement" that made arbitration by an independent accounting firm the "mandatory path" for resolving disputes over a closing date adjustment.[1] As discussed in our prior Jones Day Commentary, purchase price adjustment provisions are common, and disputes over the amount and bases of the resulting calculations occur frequently. Clients, therefore, should take note of the substantive assertions and contract clauses in Chicago Bridge that led to the dispute so as to avoid potential disputes and unintended consequences in their transactions.

Background

In Chicago Bridge, a dispute arose under a textbook post-closing purchase price adjustment provision.[2] Under the Chicago Bridge agreement, the purchase price was to beadjusted based upon a comparison of closing net working capital to a specified target net working capital amount ($1.174 billion). The seller (Chicago Bridge) calculated an estimated closing net working capital amount of approximately $1.601 billion, which would have resulted in a $428 million payment from Westinghouse, the buyer. Following the closing, the buyer recalculated closing net working capital as negative $976 million, which would have resulted in a $2.15 billion payment from the seller to the buyer.

Of particular importance were the bases on which the buyer proposed adjustments to the seller's calculation. The buyer went beyond challenging the underlying calculation and, instead, used its proposed adjustments to challenge whether the seller's calculations were GAAP (generally accepted accounting principles) compliant. Specifically, based on the facts described in the opinion and pleadings, in three of the four adjustments, the buyer appeared to apply its own, different accounting estimates and judgments to project costs for nuclear plant construction.[3] These adjustments consisted of the following:

• A 30 percent reduction to an outstanding receivable on the target's balance sheet called "claim costs." "Claim costs" represented costs incurred by the target for items that would be recovered from either the project owners or the buyer—either as a matter of contractual entitlement or as claims for overruns for which the target was not responsible. The buyer asserted that the seller's estimate of "100% collectability" violated GAAP.[4]
• An adjustment of the same claim costs receivable to reflect costs of design changes allegedly mandated during a regulatory review, resulting in a reserve for these costs (ostensibly under GAAP) and thus a further reduction to net working capital.
• An increase of the cost estimates to complete the projects by 30 percent, which created an additional liability on the balance sheet. This adjustment reflected the buyer's view that it would cost $3.2 billion more to complete the projects than the seller had initially predicted.

In its fourth adjustment, the buyer separately claimed that the seller had violated GAAP by omitting a non-cash, purchase accounting liability of $432 million that related to the seller's 2013 acquisition of the target.[5]

The Chicago Bridge purchase agreement stated that the representations and warranties, including those covering historical financial statements, would not survive the closing. Accordingly, the crux of the seller's argument was that the buyer's recharacterization of net working capital line items was an attempt to circumvent the limit on indemnities for breaches of representations and warranties by challenging target's historical GAAP compliance through the post-closing purchase price adjustment. In contrast, buyer took the position that it did not waive its right to raise issues of GAAP compliance in respect of balance sheet accounts through the closing date adjustment.

The Chicago Bridge adjustment provisions referred to calculation according to both the "illustrative calculation and Agreed Principles" (commonly referred to as a "sample statement") as well as GAAP consistently applied by the seller. This dual standard created an opportunity for the parties to assert competing and conflicting accounting treatments. Based on the court's reading of this contract language and existing Delaware case law, the chancery court held that the buyer's challenges to the calculation methodology were properly within the scope of the adjustment provision itself.

Challenging a Seller's Working Capital Calculation as Not GAAP Compliant

The source of the dispute in the Chicago Bridge case and in the line of Delaware cases cited by the Chicago Bridge court is the inconsistent and potentially erroneous application of accounting principles. Purchase agreement provisions covering financial statements have two sometimes competing objectives: (i) to ensure that all financials are GAAP-compliant, and (ii) to use an apples-to-apples comparison of the target's financial condition to measure changes in assets, liabilities, and other financial metrics between a specified measurement ("balance sheet") date and the closing. In order to properly measure changes in financial attributes, the agreement should require consistency in methodology between the pre-closing reference balance sheet and closing calculations. Under this construct, parties need to analyze the accounting policies used to set the target at the outset to ensure proper application of GAAP and to carry through this application in the true-up.[6] If the agreement does not require consistency, the buyer's adjustment can potentially reflect a change in accounting treatment.

The Chicago Bridge case brings home the importance of the specific contract language used in the purchase price adjustment provision. If the contract is silent or unclear, or makes GAAP an overriding consideration, a buyer's accountants may adjust the balance sheet prepared by a seller for GAAP inconsistencies. In contrast, if consistency of application of accounting principles is emphasized in the contract, any challenges to GAAP compliance must generally be raised in an indemnity claim and subject to the caps and baskets typically included in these contracts to limit such claims.

The contract in Chicago Bridge did not contain language clarifying that the intent of the parties was solely to measure changes in net working capital, or that the processes were not intended to permit the application of judgments or estimation methodologies that differed from those used in the initial calculation. Such language would have strengthened the seller's argument that the buyer's recalculation of net working capital under its own accounting estimates was simply a back door indemnity claim.

Importance of Scope of Representations and Warranties on Financial Statements

The Chicago Bridge court emphasized that the scope of accounting adjustment proceedings is a function of the governing contract terms. The court discussed Delaware precedent in which the terms of a GAAP compliance representation expressly covered the reference statement (the sample statement by which a target's working capital is determined). This contractual language required that a challenge to the GAAP compliance of a seller's "reference statement" only be brought as an indemnity claim.[7]

In other Delaware cases, however, different governing contract terms allowed a buyer to contest the GAAP compliance of values in the seller's reference statement in an accounting adjustment procedure. Specifically, in Alliant Tech Systems v. Mid-Ocean Bushnell Holdings,[8] the court concluded that if the seller had not followed GAAP in its initial calculation (by which the target was set), then the buyer could assert its own GAAP-compliant calculation in an accounting procedure. The court relied on the purchase agreement's requirement that closing net working capital be "calculated in accordance with GAAP" to conclude that the contract anticipated that GAAP issues could be raised in a post-closing price adjustment procedure as well as in an indemnity claim.

Pros and Cons of Accounting Arbitration

An underlying rationale behind post-closing purchase adjustments is that fluctuations in financial metrics (such as working capital) should fall within a range of past, normalized working capital levels. Deviations that materially exceed these parameters may be an indication that something has gone awry or of a larger or different dispute between the parties relating to valuation of the business or the integrity of the financial statements. Accordingly, it may be prudent to limit mandatory accounting arbitration to adjustments that do not exceed some percentage of the target amount or to some appropriate fixed amount, or to include language limiting the scope of the accountants' work to an "apples-to-apples" comparison intended to capture only changes over time to working capital.

Sellers, especially, should be wary of drafting contracts that allow complex questions of contract interpretation or high-dollar issues of seller compliance with GAAP to be decided through the (appropriately) abbreviated process typical of accountant price adjustment determinations.[9] The "quick and dirty" process used in accountant determinations can make them less than suitable for complex, high-value cases involving contract interpretation or complicated application of accounting principles. Accountants typically do not have the experience and background to assess legal issues concerning contract construction. There is no opportunity for discovery, testimony, or cross-examination. Accounting dispute resolution also normally involves a single neutral, which may increase the risk of a poorly reasoned award. And, as with any arbitration, judicial review is tightly circumscribed.

Material disputes involving contract interpretations and claims of noncompliance with applicable accounting standards may be better decided in full-scale "legal" (as contrast to accountant-led) arbitrations or in lawsuits. Each of these alternatives allows for some degree of discovery and requires decision according to governing legal standards. Arbitration is typically quicker and less expensive than full-scale litigation.

In addition, should the parties wish to have decision-makers with specialized expertise, arbitration allows the parties to make contractual provisions for that. For example, the International Center for Conflict Prevention and Resolution ("CPR") has established a specialty banking, accounting, and financial services panel comprising attorneys with financial background and expertise in resolving disputes which arise in the context of mergers and acquisitions and other corporate deals.

Further, arbitrations can be confidential if the parties so desire. If the parties are committing material disputes over accounting adjustments to a full arbitration proceeding, then specialized arbitrators, such as those in the Certified Public Accountant Panels available from CPR can have advantages. Typically, post-closing accounting adjustment provisions call for the parties to choose an accounting firm to make the final determinations regarding adjustments. Finding an experienced accounting neutral without a relationship with one or more of the parties is often difficult and time consuming, especially in light of the consolidation and dissolution of what used to be the "Big Eight" into the "Big Four" firms.

Broadening dispute resolution to CPR and similar proceedings would also: (i) deepen the bench of available neutrals to include experienced and well-regarded commercial arbitrators in multiple jurisdictions, and (ii) avoid the conflicts of interest associated with accounting firms that regularly provide audit, tax, and other services to the parties.

Reasons for rejecting arbitration of a legal dispute associated with a price adjustment include: (i) many arbitrators have the tendency to do some sort of "baby split" award as opposed to a reasoned analysis of the merits; (ii) there are extremely limited appeal rights unless the parties write an appeal provision into the arbitration provision into the contract;[10] (iii) since court decisions are subject to review and appeal, the prospect of being overturned often results in judicial decisions being grounded more firmly in law governing contract interpretation; and (iv) many U.S. clients prefer litigation as the "devil they know"—at least in the United States—as compared with a less-certain process in arbitration.

Arbitration can be cheaper and faster than litigation, and it is private (or at least it can be if the parties so specify). But if the main concern is getting the right decision, these considerations may well be less compelling. Litigating a dispute in court allows the opportunity for challenging a plaintiff's claims as a matter of law through summary judgment and, more important, allows for appellate review. If the claims present mixed questions of law and accounting under the agreement, or implicate bad faith, fraud, or breach, a court proceeding or a formal arbitration under AAA or CPR rules may be the better option.

Lessons Learned and Practice Tips

As illustrated by Chicago Bridge and prior cases, attempts to clarify the parties' intentions regarding net working capital adjustments through arbitration before an accounting expert are poor substitutes for a detailed and specific set of accounting provisions prepared with the benefit of expert financial accounting advice, thorough due diligence, and precise drafting. Accordingly, contract drafters and business development professionals should take into account the following:

Pre-closing Accounting Due Diligence. The parties should highlight and assess treatment prior to the sale of potential areas of dispute, including:

• Reserves and accruals for liabilities that would typically be covered by seller indemnity, such as taxes, litigation, environmental, or off-balance-sheet amounts.
• "Debt-like" items, such as equipment leases.
• Contingent liabilities, such as litigation and claim reserves.
• Industry-specific accounting methodologies and business attributes (such as seasonality, deferred revenue, or installment accounting) that could distort closing calculations artificially, depending on when the closing occurs.
• Accounts receivable and inventory values and reserves (including excess and obsolete reserves), processes for closing date physical inventories and the potential for revaluations.

Precise Formula. Any accounting, including working capital, formula should list the specific components of the formula, and refer to line items on a referenced balance sheet, or general ledger. Referring simply to "net working capital," "current assets," "current liabilities," or similar broad categories creates ambiguity as to what's in and what's out of the calculation.

Intent to Measure Changes. If applicable (and particularly in sell-side representations), the adjustment provision should state that the calculation is intended to measure changes from the target working capital to the closing working capital, thereby countering any inference that a de novo calculation of historic, booked amounts is permissible.

Consistency of Accounting Policies and Estimates. The purchase agreement should clarify that a target's past accounting practices, and the same accounting principles, estimates, judgments, methodologies, policies, and the like—including judgments as to loss and gain contingencies and materiality determinations—used to prepare the target should be respected in calculating the closing statement.[11] Conversely, if representing a buyer, consider permitting use of prior principles only if in compliance with GAAP, and enabling the buyer to correct errors and omissions and to take into account all accounting entries regardless of their amount.

Hierarchy if Accounting Principles Conflict. The purchase agreement should be clear as to which principles—GAAP, "modified"-GAAP, or seller's non-GAAP/sample statement principles—take precedence in the event of a conflict.[12]

Operation of Exclusive Remedy Provisions. Parties, particularly sellers, should be wary of language contained in indemnity exclusive remedy provisions that exclude purchase price adjustment provisions. Courts have looked to such language as supporting the buyer's right to apply GAAP to correct a seller's working capital calculations through an accounting arbitration even though such claims could also be asserted as a breach of rep claim.

Additional Protective Provisions. Sell-side adjustment provisions should include standards that would limit a buyer's right to assert its own, sometimes novel adjustments. Such provisions could include:

• Excluding the effect of the operation of the business of the target after closing.
• Consideration only of information available to the parties up to the closing date or the date seller delivers the notice of disagreement.
• Preparation of the calculation on the basis that the target is a going concern.
• Exclusion of purchase accounting adjustments, the effects of any post-closing reorganizations, or the post-closing intentions or obligations of the buyer.
• Exclusion of any provision with respect to any matter that could form the basis of an indemnity in favor of the buyer under the agreement.
• Exclusion of any item to the extent the buyer is financially responsible for such item under the agreement.
• Exclusion of amounts to the extent such amounts are subject to, and included as, a separate adjustment to the purchase price under the agreement (e.g., net debt calculation).

Timelines for Closing Statement Calculations. According to Chicago Bridge's complaint, Westinghouse requested and Chicago Bridge granted a 30-day extension to permit Westinghouse to prepare its closing statement, which may have given Westinghouse more time to develop creative accounting positions to rebut the seller's initial calculation. Absent special circumstances, the parties should be held to the contract timetable to minimize such risks.

Express Limitations on an Accounting Arbitrator's Authority. Express limitations on post-closing accounting arbitration and the arbitrator's authority can remove uncertainty about the purpose and scope of the proceedings. Such limits could include restricting the accounting expert's determinations to the application of accounting principles, as defined in the agreement, and limiting determinations of contract interpretation or law. An arbitration decision that exceeds the express limits of an arbitrator's authority represents one of the few avenues for appeal of an arbitration award. Thus, express limitations can provide certainty and protection to the parties in connection with post-closing adjustments.[13]

Lawyer Contacts

For further information, including sample contract provisions and guidance on alternative dispute resolution procedures, please contact your principal Firm representative or one of the lawyers listed below. General email messages may be sent using our "Contact Us" form, which can be found at www.jonesday.com/contactus/. 

Michael P. Conway 
Chicago 
+1.312.269.4145 
mconway@jonesday.com  

Bryan E. Davis 
Atlanta 
+1.404.581.8631 
bedavis@jonesday.com  

Elizabeth C. Kitslaar 
Chicago 
+1.312.269.4114 
ekitslaar@jonesday.com  

James A. White 
Chicago 
+1.312.269.4161 
jawhite@jonesday.com  

Jones Day publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our "Contact Us" form, which can be found on our website at www.jonesday.com. The mailing of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm. 

---

[1] Chicago Bridge & Iron Company, N.V. v. Westinghouse Electric Company, LLC, et al., C.A. No. 12585-VCL 2016 (Del. Ch. Dec. 2, 2016). On December 5, 2016, the Court issued a corrected Memorandum Opinion and Chicago Bridge filed its notice of appeal to the Delaware Supreme Court.

[2] Post-closing purchase price adjustments are almost universally present in definitive agreements for the sale of privately held businesses. These provisions—which include earn-out clauses, working capital adjustments, and debt/net debt true-ups—require an adjustment to the purchase price paid at closing, based on calculations relative to pre-closing targets, standards, or formulas. Such provisions set forth not only the methodology for determining the amount of the adjustment, but also a resolution process in the event the parties disagree on the amounts to be paid. These processes typically include (i) an exchange of the relevant financial calculations and access to work papers and supporting documentation, (ii) submission by the recipient party of objections to the calculation, (iii) a period of time within which the parties will attempt to resolve the dispute in good faith, and (iv) submission of the unresolved issues to a neutral accounting firm for ultimate resolution.

[3] Chicago Bridge's complaint intimates that prior to closing, Westinghouse (in its role as project consortium partner) settled and released claims with the project owners for less than what Chicago Bridge had been carrying on its books, thereby supporting Westinghouse's post-closing assertion that GAAP required a write down of claim costs. Such write down had the effect under the net working capital adjustment of artificially shifting such released costs foregone through such settlements back to Chicago Bridge.

[4] According to Chicago Bridge's complaint, on the closing date, Westinghouse announced that it had named a new subcontractor to take over management of a significant portion of the construction at the nuclear facilities designed by Westinghouse at which Chicago Bridge had been principal contractor. Chicago Bridge asserted that Westinghouse, the subcontractor, and the project owners developed their own new timelines and cost estimates for the projects as a result of the performance commitments negotiated by Westinghouse in its claims settlement with the project owners, which in turn would have resulted in new cost and recovery estimates. According to Chicago Bridge's complaint, during the negotiations on the working capital adjustment and the Delaware case proceedings, Westinghouse refused to provide the seller with copies of the settlement agreements with the project owners.

[5] According to Chicago Bridge's complaint, not only did this purchase accounting entry not represent future cash outflow liability, but it also was not included in the calculation of the working capital target.

[6] In 2014, 62 percent of post-closing adjustments were to be determined in accordance with GAAP, or GAAP applied consistent with past practice. 33 percent—roughly half as many—were to be determined by another standard, such as modified GAAP, or principles set forth in a schedule to the purchase agreement. Source: 2015 ABA Business Law Section Private Target M&A Deal Points Study.

[7] See OSI Systems, Inc. v Instrumentarium Corp., 892 A.2d. 1086 (Del. Ch. 2006).

[8] Alliant Techsystems, Inc. v. MidOcean Bushnell Holdings, L.P., C.A. No. 9813-CB (Del. Ch. Apr. 24, 2015).

[9] Under Delaware law, such proceedings presided over by accountants are treated and reviewed by courts as arbitrations. Viacom Int'l v. Winshall, 72 A.2d 78 (Del. 2013). It should be noted that certain other states, most relevantly, New York, have separate provisions and proceedings associated with expert accountant determinations. See New York Civil Practice Law and Rules 7601.

[10] CPR (International Institute for Conflict Prevention & Resolution) has an appeal protocol, for example, that provides for another arbitrator or set of arbitrators to provide appellate review of an arbitration award.

[11] Compare the Chicago Bridge equivalent provision: "[T]here shall be no changes to accounts receivable reserve accounts or inventory reserve accounts that are not in accordance with GAAP as in effect on the Closing Date and the accounting principles, practices, methodologies and policies described under "General" above [past accounting practices of the Company and sample calculation, and supported by the Company books and records] or that are not supported by a change in facts, the underlying criteria or a change in the related account balance." (emphasis added)

[12] See note 6 supra.

[13] Current practice is to permit accounting arbitrators to hire counsel to assist with legal determinations along the following lines:

Arbitrator may seek and consider the views of legal counsel not associated with the parties if he deems such to be necessary in resolving the dispute submitted hereunder and if the parties both consent. Arbitrator will not consult outside counsel until he has presented the issue to the parties for their input. Arbitrator will either utilize counsel jointly selected by the parties or will secure the approval of the parties of the choice of counsel made by him. In either event, counsel shall submit an estimate for its work to be approved by the parties and [accounting firm] shall be reimbursed for the cost of such counsel. Even if Arbitrator consults with outside counsel, Arbitrator retains full decision-making power related to items in dispute.

Consider whether a better option would be to include an AAA or similar arbitrator provision governing disputes with mixed issues of accounting and law that allows a single "legal" arbitrator to retain an independent expert to assist with accounting issues but leaves ultimate authority with the arbitrator.

HR Issues in M & A - BNA Report by Baker & McKenzie LLP

http://www.bakermckenzie.com/-/media/files/insight/publications/2016/12/rest-easy-how-to-master/ar_na_resteasy_oct16.pdf?la=en

Right and Wrong as a Clue to the Meaning of the Universe

He is the only comfort, he is also the supreme terror: the thing we most need and the thing we most want to hide from. He is our only possible ally, and we have made ourselves his enemies. Some people talk as if meeting the gaze of absolute goodness would be fun. They need to think again.

Anything You Say or Do May Be Used Against Your Company - How To Cope With Data Security Breach.

1. Data Security Policy. Before you decide whether and how to disclose information about your company's data security practices, keep in mind that any such disclosures could well end up being used by plaintiffs’ lawyers and courts as support for a claim that your company overstated and misled consumers regarding those practices. It is important to remember that, even when plaintiffs survive a motion to dismiss, the company maintains the right to  defend the accuracy of its statements once the facts are properly before the court. Nevertheless, the costs incurred in defending the statements’ accuracy through litigation, or  to  settle a  matter, can be  significant. Those costs should be kept in mind when deciding  whether and how to make statements about the company’s data security measures.  Any such statements should be carefully crafted and should match the company’s actual data security practices.

• After Zappos.com experienced a data breach incident, consumer plaintiffs relied on an alleged statement the company allegedly communicated to shoppers on its e-commerce site that "shopping on Zappos.com is safe and secure—guaranteed’’ to assert that the company negligently misrepresented the safety of plaintiffs’ financial information and violated California’s unfair competition statute. In re Zappos.com, Inc.,  No.  12-325, 2013  BL 239619 (D. Nev.  Sept. 9, 2013). The court found the statement sufficient to form the basis for both counts at the motion to dismiss stage. Id.  
• Plaintiffs have also relied on  statements in  privacy policies to assert deception-based claims. In Grigsby v. Valve Corp., for  example, a consumer plaintiff  relied on statements allegedly made in the company’s privacy policy to  support a claim of unfair or deceptive practices. Grigsby v.  Valve Corp., No.  12-553, 2013  BL 96372 (W.D.  Wash. Mar. 18,  2013) (12 PVLR 649, 4/15/13). Prior to the breach, the privacy policy purportedly indicated that ‘‘Valve has taken reasonable steps to protect the information users share with us, including, but not  limited to,  setup of  processes, equipment and software to avoid unauthorized access or disclosure of this information. . . .’’ Plaintiff, characterizing this statement as a representation that users’ information ‘‘would be  protected,’’ alleged that he relied on this representation in choosing to purchase goods from the company. This assertion was sufficient, at the motion to dismiss stage, to allege that Valve  acted unfairly or deceptively (finding plaintiffs stated a claim by relying on a statement in the privacy policy that the company used "reasonable administrative, technical, and physical security controls,’’ despite separate language in the policy stating that no security measure is 100 percent effective) (13 PVLR 1604,  9/15/14).

2. Press Release. Consider carefully what information to disclose after a breach and make sure such disclosures are accurate because such disclosures may be relied on by courts to determine whether the plaintiffs were sufficiently injured or face an imminent risk of injury to have standing to sue either in a federal court under Article III of the U.S. Constitution or a state court. Actual damage is generally an element of the causes of action plaintiffs bring over data security breaches. At the motion to dismiss stage, one source of information courts may use to determine whether a sufficient injury exists is the company’s own statements, if any, about the extent and effect of the breach.

• See, e.g.,  Reilly v. Ceridian Corp., 664 F.3d  38, 41 (3d  Cir.  2011) (concluding  that "Appellants’ allegations of hypothetical, future injury do  not  establish standing under Article III’’) (10 PVLR  1859, 12/19/11); Maglio v. Advocate Health & Hosps. Corp., 40 N.E.3d 746,  753 (Ill. App. Ct. 2015) (finding ‘‘plaintiffs’ allegations of injury are clearly speculative, and therefore plaintiffs lack standing to bring suit’’)  (14  PVLR 1091,  6/15/15).
• In Remijas v. Neiman Marcus, Neiman Marcus posted public statements on its website to keep customers abreast of the data security breach it had suffered, including acknowledging that 350,000 cards were potentially exposed, and 9,200 of those cards had experienced fraud. Remijas v.  Neiman Marcus Grp.  LLC, 794 F.3d 688, 690 (7th Cir. 2015) (14 PVLR 1807, 10/5/15). Neiman argued in its  motion to dismiss that the consumer plaintiffs did not face an actual or imminent risk of harm sufficient for Article III standing. The Seventh Circuit focused on Neiman Marcus’s own public statements, particularly the statement that 9,200 of the potentially exposed payment cards had already suffered fraudulent charges, to conclude that future harm was sufficiently imminent to confer standing to the company’s customers.
• C.f.,  SuperValu, Inc., Customer Data Sec. Breach Litig., No.  14-4660, 2016  BL 3925 (D. Minn. January 7, 2016) (finding consumer plaintiffs lacked standing, rejecting Plaintiff’s reliance on the company’s press releases because those press releases in fact stated that there had been no determination that customer data had been stolen and no evidence that it had been misused).

3. Offering Credit Monitoring Services for Free in the wake of a breach. Offering credit monitoring to consumers whose information may have been compromised may be treated as an admission that those consumers face an imminent risk of injury. Many companies that suffer a data security breach offer free credit monitoring to consumers whose personal information may have been compromised in order to reduce the possibility that consumers could argue in litigation that they are ‘‘injured’’ from having to purchase such monitoring themselves. Consider including a statement clarifying the reason for the offer.

• In  Neiman Marcus, the U.S. Court of  Appeals for the Seventh Circuit treated Neiman Marcus’ offer of credit monitoring to its customers as an effective admission that the customers faced a sufficiently imminent risk of fraud to give them Article III standing. Neiman Marcus, 794  F.3d at 694. The court found the offer ‘‘telling,’’ reasoning that ‘‘it is unlikely that’’ Neiman Marcus made the offer ‘‘because the risk [to plaintiffs’] is so ephemeral that it can safely be disregarded. These credit-monitoring services come at a price that is more than de minimis.’’ Id.

4. Consider Ways to Protect Communications and Documents under the Attorney-Client Privilege or Work Product Doctrine. 

• In  the  wake of  the  cyber-attack, Target set up a two-track response program. The first track involved a team of forensic experts who were engaged on behalf of several credit card brands (the PCI Investigator). The purpose of  the second track was to assist counsel in conducting an   investigation of the data breach to enable counsel to provide legal advice to Target. This track involved two key groups: (i) the Data Breach Task Force, which was made up of, among other persons, internal counsel and information technology specialists, and (ii) forensic experts engaged by Target’s outside counsel. During discovery, Target produced all communications with the PCI Investigator, but withheld communications with, and the work product of, the Data Breach Task Force and the experts engaged by counsel. Financial institutions pressing class actions against Target filed a  motion to compel Target to produce, among other things, documents generated by the Data Breach Task Force and the forensic experts engaged to support counsel. The U.S. District Court for the District of Minnesota denied the motion as to documents generated by the Data Breach Task Force and the forensic ex
• perts engaged by counsel. In re Target Corp.  Customer Data Sec. Breach Litig., No.  14-2522 (D.  Minn. Oct. 23,  2015). "T
he work of the [second track] was focused not on remediation of the breach, as plaintiffs contend, but on informing Target’s in-house and outside counsel about the breach so that Target’s attorneys could provide the company with legal advice and prepare to defend the company in litigation.’’ Id. Target also ‘‘produced documents and other tangible things, including forensic images, from which Plaintiffs can learn how the data breach occurred and about Target’s response to  the breach.’’ Id.

Yahoo Data Security Breach and Merger Agreement with Verizon

July 23, 2016, Yahoo and Verizon entered into a Stock Purchase Agreement (https://www.sec.gov/Archives/edgar/data/1011006/000119312516656036/d178500dex21.htm). Months after, but prior to the closing, Yahoo publicly announced that data associated with at least 500 million user accounts had been stolen in 2014. The data included customer names, email addresses, phone numbers, dates of birth, passwords and security questions and answers.

Within days of the announcement, several class action lawsuits were filed against Yahoo claiming that the company intentionally or recklessly failed to protect user data in violation of various state and federal laws, including the Federal Trade Commission Act and California privacy statutes.

Assuming you were the corporate fiduciary looking to minimize your risk of personal liability, you should consider the following when contemplating your next merger or acquisition:

One - Choose the Right Deal Structure

VZ seems to be trying to acquire Yahoo to obtain its proprietary advertising and content assets, but not other underperforming aspects of Yahoo's business. Yet, VZ structured the transaction as a stock acquisition and not as an asset sale. By acquiring all of Yahoo's stock, VA will acquire all of its liabilities, including those associated with the data security breach that occurred in 2014. When evaluating a transaction, fiduciaries should consider whether an asset sale or stock sale makes more sense given the momentum behind the transaction. If the transaction is driven by discrete assets, carving out and purchasing only the desired assets and excluding explicitly any data (and all liabilities) associated with the other assets would make sense.

Two - Consider Stripping Knowledge and MAE Qualifiers in IP / Data Reps

In order to address data breach liabilities, the purchase agreement between Yahoo and VZ included the following rep under Section 2.16 Intellectual Property:

"(p) To the Knowledge of Seller, there have not been any incidents of, or third party claims alleging, (i) Security Breaches, unauthorized access or unauthorized use of any of Seller’s or the Business Subsidiaries’ information technology systems or (ii) loss, theft, unauthorized access or acquisition, modification, disclosure, corruption, or other misuse of any Personal Data in Seller’s or the Business Subsidiaries’ possession, or other confidential data owned by Seller or the Business Subsidiaries (or provided to Seller or the Business Subsidiaries by their customers) in Seller’s or the Business Subsidiaries’ possession, in each case (i) and (ii) that could reasonably be expected to have a Business Material Adverse Effect. Neither Seller nor the Business Subsidiaries have notified in writing, or to the Knowledge of Seller, been required by applicable Law or a Governmental Authority to notify in writing, any Person of any Security Breach. To the Knowledge of Seller, neither Seller nor the Business Subsidiaries have received any notice of any claims, investigations (including investigations by a Governmental Authority), or alleged violations of Laws with respect to Personal Data possessed by Seller or the Business Subsidiaries, in each case that could reasonably be expected to have a Business Material Adverse Effect."

*** Knowledge ***

As reported by media, Yahoo had been unaware of the breach for over two years. The late discovery is not uncommon since most hacks rely on malicious codes that enter a network disguised as a mundane attachment and then sits silently until activated, days, weeks, months or even years later. It is very plausible for a buyer to acquire a business, only to suffer a host of post-closing consequences of a data breach facilitated by bugs implanted pre-closing. Had Yahoo and VZ closed the transaction prior to the discovery of the data breach, VZ would have inherited significant data breach liabilities, but would have had limited recourse against Yahoo because Yahoo technically did not breach the reps under Section 2.16(p) of the purchase agreement.

*** MAE ***

In the case of data security breaches, it is often very difficult, if not impossible, to quantify whether an incident will have a material adverse effect until a significant amount of time has passed after closing. The duration of lawsuits, magnitude of fines, full impact of reputational damage, and cost of internal remediation and revamping of security protocols and systems can remain largely unknown for an extended period of time.

Every data security breach is unique and the Yahoo breach does not seem to involve credit cards or issuing banks, two factors that may significantly increase the cost of remedy. Termination of the purchase agreement for MAE or renegotiation of the purchase price seem to be one of the limited options that the parties may have, but neither party would know the full scope of what is being renegotiated. Thus, reaching an agreement may prove quite elusive.

Setting threshold in the definition of MAE in the context of a data breach might be helpful to specifically delineate the parties rights and remedies such as an event involving fewer than 50,000 accounts except for any event involving any unauthorized disclosure of or access to PHI.

Consider setting a separate escrow pool for data security breaches.

Three - No Substitute for Thorough and Affirmative Due Diligence

Buyers should insist on provisions in the purchase agreement that allows 3rd party testing of target's technology and systems for identifying latent date breach issues and significant vulnerabilities, similar to those Phase I and II testing for environmental liabilities, including rights to conduct additional extensive testings upon discovery of potential issues to fully understand the scope of the problem and the magnitude of the potential liabilities.

M & A - Common Interest Agreement

In an M & A transaction, where the transaction will violate the rights of a third party or will require a certain kind of regulatory clearance, both parties may wish to coordinate their legal analysis and may agree that they recognize that some information sharing in connection therewith may be privileged and suggest a so-called "common interest agreement" or "joint defense agreement," under which the parties agree that certain information is disclosed for purposes of pursuing the parties' common legal interest and disclosure is therefore not a waiver of privilege.

Early 2016, the New York Court of Appeals, the highest court in New York, decided a case involving Bank of America's acquisition of Countrywide - Ambac Assurance Corp. v. Countrywide Home Loans (New York 2016). A third-party plaintiff wanted access to privileged communications which had been shared in the course of the diligence and planning process under a carefully-drafted common interest agreement. The third party asserted that the privilege was nevertheless waived when Countrywide disclosed the information to Bank of America, which subsequently acquired Countrywide. The Court of Appeals, after some historic analysis of the common interest exception, held that the common interest exception to privilege waiver only applies when the common interest is the defense, essentially as co-defendants, of a pending or reasonably anticipated litigation. Economic common interest is not sufficient. The fact that the party to whom the information is disclosed will shortly own the company that's the subject of a claim and will therefore bear the economic risks of the matter is not sufficient. In essence, the court took the world back to the traditional common law view of the privilege waiver. It noted that the common interest exception to waiver was intended originally only for common criminal defendants in a single proceeding, and that the great liberalization in New York had been to extend it to common defendants in civil litigation. But the court wasn't prepared to go any further than that, notwithstanding that fact that, as it recognized in its opinion, quite a number of jurisdictions take a more liberal view.

Can you avoid the problem simply by selecting a governing law for your agreement other than New York and a forum for disputes other than New York? The unfortunate fact is you cannot. Privilege is an evidentiary rule as to which the governing law is not entirely clear. It may be the law of the forum, or the law of some other jurisdiction that the forum court determines has a greater interest in the matter or as to which the parties reasonably relied. More importantly, the case in which the waiver is going to be asserted isn't likely to be a case under the acquisition agreement, or a case in which the acquisition agreement's venue provisions or choice of forum provisions control. It's going to be, as was the case in Countrywide, a third-party claim, whether a governmental claim or a private claim. If that claim is brought in New York, the court may well apply the Ambac decision.

There are a couple of things you can do to reduce risk. One, if this is a diligence issue and maintaining the privilege is important, try to recreate the legal advice. If the contingency you're trying to examine is a governmental investigation, provide another expert regulatory counsel retained by the buyer all the non-privileged information that's been generated in the course of the matter - all the communications with the government, all the facts provided by the company to its counsel - and let that counsel come up with its own view. This might be too expensive and time-consuming.

Another option is available if the issue involved is one that arises from the particular transaction, such as possible violation of the rights of a third party or the antitrust laws. The Court of Appeals expressly recognized in its Ambac opinion that the privilege is protected if the parties engage common counsel to review the matter. You could engage a neutral law firm to analyze, for example, the transaction from an antitrust perspective. That law firm can collect information from both parties, write a report that analyzes the transaction and give it to both parties. The parties can then negotiate the deal on the basis of the conclusions that are reached in that report.