M&A 2018 Annual Review

to the interplay between the differing levels of materiality that often apply in different reps and covenants. What to Do? In a pre- Akorn world, the inclusion of an MAE qualifier comforted many targets when agreeing to expansive reps and warranties or preparing disclosure schedules. Now that a Delaware court has found anMAE and has emphasized the importance of contractual risk allocation, targets may require more guidance to understand the practical implications of including an MAE qualifier in their merger agreements for their specific businesses. • For example, as there is still no bright-line rule, disclosure schedule preparation may become a more time-consuming task, as targets are less willing to rely upon an MAE qualifier as their primary protection. Targets should be cautious, however, when balancing the legal instinct to over disclose in the schedules against business considerations, as over disclosure could potentially have a chilling effect on the deal (for example, by implying that less significant items could rise to the level of an MAE or that problems lurk from myriad potential causes). • In addition, targets and buyers are also likely to spend more time thinking about the need (mostly from the target’s perspective) for specific carveouts to an MAE definition and targets could also find themselves focusing on these issues with respect to a buyer when accepting stock as the form of payment. We note that one occurrence of an MAE does not a trend make. The threshold for an MAE is still high. The outcome of Channel Medsystems Inc . v . Boston Scientific Corp ., which will decide the validity of another buyer terminating a deal due to an MAE, may give Delaware courts another chance to decide whether Akorn is an anomaly or the first of many more MAEs to come. 5 NON-TECH COMPANIES BUYING TECH COMPANIES One trend that continues to reshape the M&A market is the participation of “non-tech” companies as major buyers in the technology market. According to 451 Research, strategic acquirers from outside the tech market have now spent more than $40 billion on tech M&A in each of the last three years. Prior to that period, according to 451 Research, non-tech acquirers never spent more than $35 billion in any single year following the dotcom bubble of 1995 to 2001. Deal-makers anticipate this trend will continue, with 68% of respondents to MoFo’s October 2018 Tech M&A Leaders’ Survey predicting an increase over the next three years in non-tech companies acquiring tech companies. The shift correlates with the increasingly blurred lines between what is considered a “technology” and a “non-technology” business, as connectivity, automation, mobility and data have permeated the business world and traditional non-tech companies are now utilizing technology in order to solve internal gaps or enhance external offerings. The speed at which technology disruptors can enter and reinvent a targeted market has also added pressure on non-tech companies to develop their tech arsenal at a rapid pace or risk losing ground. Oftentimes this means acquiring an established technology business rather than attempting to develop a digital platform internally. 9 6 NEW PRIVACY LAWS SWEEP IN FROM THE EU TO CALIFORNIA AND BEYOND Privacy and data issues continued to gain prominence in 2018, as new laws required companies to adopt new compliance procedures and exercise increased vigilance and the risk of the occurrence and costs of breaches continued to increase. • The EU’s New GDPR . Nearly all companies felt the impact of the new EU General Data Protection Regulation (GDPR), which overhauled EU data protection laws and grabbed headlines with its new penalty provisions of up to €20 million or 4% of global worldwide turnover (whichever is more). GDPR not only set new rules for companies operating in the EU, but extended these obligations to companies operating outside of the EU that target or monitor individuals in the EU. In the M&A context, GDPR has become a key priority in privacy-related due diligence, particularly of data-driven businesses, whether B2C or B2B. 10 • California’s Upcoming CCPA . In the wake of GDPR, a California ballot initiative triggered a landmark new privacy law. This law, California’s Consumer Privacy Act of 2018 (CCPA), creates unprecedented new privacy rights, such as giving California residents the right to view personal information that a company maintains about them. Significantly, CCPA also creates a new private right of action for consumers affected by data security breaches, which compounds the risks that may arise from acquiring a target company that, knowingly or unknowingly, has experienced a data security breach. CCPA takes effect on January 1, 2020, and has MORRISON & FOERSTER 2018 M&A ANNUAL REVIEW 4