As this useful article from the Proskauer law firm explains, the Federal Trade Commission recently has focused attention on a oft-neglected component of privacy policies: the merger, acquisition or sale clause.
This provision tells your users that, in the event that your company or product is sold, user data may be shared or transferred with the purchaser. Since your userbase may be a key part of the value to a buyer, it’s important to make sure this disclosure is clear and complete.
Here’s how our template Policymaker language handles the point, under the title “Special”:
To operate the service, we also may make identifiable and anonymous information available to third parties in these limited circumstances: (1) with your express consent, (2) when we have a good faith belief it is required by law, (3) when we have a good faith belief it is necessary to protect our rights or property, or (4) to any successor or purchaser in a merger, acquisition, liquidation, dissolution or sale of assets. Your consent will not be required for disclosure in these cases, but we will attempt to notify you, to the extent permitted by law to do so.
In line with good practices, this language is clear that your user’s won’t have the opportunity to provide consent to a transfer of data, but that they will at least be told if a transfer happens, which is particularly important when that transfer involves personally identifiable information. This gives your users the option to request deletion of their personal information, if they are not comfortable with your buyer.