On February 19, 2020 the European Data Protection Board
("EDPB") published its second statement on privacy
in the context of corporate transactions.
The statement, the full text of which can be read here, highlights the existence of concerns
related to the combination and accumulation of sensitive personal
data and the possibility that such combinations could result in a
high level of risk to the fundamental rights to privacy and the
protection of personal data.
The EDPB's statement does not propose any particular steps
to mitigate such concerns, but explains that:
- the privacy implications of a merger must be taken into account
by the parties to the transaction;
- in compliance with the principle of accountability under the EU
General Data Protection Regulation 2016/679 (the
"GDPR"), the parties must conduct in a transparent
way a full assessment of the data protection requirements and
privacy implications of the merger; and
