Call us free on
0800 032 7005

Law firms ignoring client confidentiality during M&As

6th May 2016

Law firms are showing an “alarming level of ignorance” by not keeping client information confidential when buying and selling other legal businesses, according to a consultant lawyer.

Citadel Law, a consulting law firm which specialises in personal injury work, argues that a purchasing firm accessing client files in order to complete a merger or acquisition (M&A) would be a breach of client confidentiality.

Ethical guidance issued by the Solicitors Regulation Authority (SRA) in January 2015 recommended that firms should take sufficient steps during M&A negotiations to protect confidential client information and, where appropriate, seek client consent before any disclosures are made.

Lesley Graves, Citadel Law’s managing director, said that some solicitors were unaware of the SRA guidance while others have chosen to ignore it.

“Many law firms, and those advising them, are operating under the misapprehension that it is necessary to allow access to client files in order to complete deals, this just isn’t true,” she said.

Graves suggested that firms are approaching due diligence in the wrong way, noting that “They should be focused on the firm’s financial situation and records, talking to fee-earners and reviewing operations, technical ability and governance, rather than delving into confidential client files.”

“We find that working within SRA guidelines to be a far better approach as it puts the focus on operational issues as a whole rather than individual files – which is hit and miss, costly, and breaches SRA guidelines,” she continued to say.

Firms who engage in the unethical practices also flout the Data Protection Act 1988, advised Graves. She also warned M&A practitioners to pay close attention to the EU General Data Protection Regulation.

In April 2016, the European Parliament approved the new regime, which seeks to hold data holders to greater account and give citizens greater control over their data. The new regulation will apply across the EU from May 2018.