When a company is bought or sold, most people assume the transaction concerns shareholders, executives, and investors. Few stop to consider that one of the most valuable assets changing hands may be the personal information of thousands of customers.
A concerning trend is emerging in Ireland, where companies are being sold, acquired, or absorbed into international partnerships, leaving the personal data of Irish customers to become part of transactions over which those customers have little or no control.
The announcement often arrives after the deal has been agreed, leaving customers with little option but to accept the change or move their services elsewhere.
This raises an uncomfortable question.
If our personal information has become part of a commercial transaction, where exactly do our rights begin and end?
Under current interpretations of GDPR, companies may be permitted to transfer customer information as part of a legitimate business sale. Lawyers and regulators may point to contractual necessity, legitimate interests, and continuity of service. Yet many ordinary customers see something very different.
They see their names, addresses, contact details, payment histories, and account information being transferred between organisations without ever being asked whether they agree.
For many people, that feels fundamentally wrong.
Customers Are Not Corporate Assets
Businesses often speak about customer portfolios and customer databases as assets that add value to a company. Investors examine these assets when determining the worth of a business.
But behind every database record is a real person.
Customers are not inventory.
They are not stock.
They are not commodities to be traded between organisations.
Personal information is not merely data. It is information connected to an individual’s identity, private life, and relationship with a company they chose to trust.
When that information forms part of a financial transaction, there is a legitimate ethical question about whether customers should have greater involvement in the process.
If Customer Data Creates Value, Why Are Customers Excluded From the Value?
Perhaps the most uncomfortable question of all is one that few regulators, politicians, or businesses appear willing to discuss.
If customer data contributes to the value of a company, why do customers receive none of the benefit when that value is realised?
When a hosting company, technology company, or online service is sold, the customer base is often one of the most important assets being acquired. Investors do not simply purchase servers, office furniture, or software. They are purchasing ongoing customer relationships and the valuable information associated with those relationships.
The larger and more established the customer database, the more valuable the company often becomes.
In effect, the personal information and loyalty of customers help generate the purchase price.
Yet the individuals whose data contributes to that value are entirely excluded from the transaction.
They are not consulted.
They are not asked for permission.
They are not given a meaningful opportunity to withdraw.
And they receive no share whatsoever of the financial benefit being created.
This creates an obvious question of fairness.
If companies can derive commercial value from customer information during a corporate sale, should customers not possess some corresponding rights?
Many people would argue that if their personal information is helping to increase the value of a business acquisition, they should at least have the right to decide whether they wish to participate in that transfer.
Others may go further and argue that where customer data forms a material part of the value being sold, individuals should be entitled to some form of compensation, credit, discount, or benefit in recognition of the role their data has played in creating that value.
Whether one agrees with such proposals or not, the fact that they can be seriously discussed demonstrates how far the debate has evolved. Personal data is no longer simply an administrative necessity. It has become an economic asset of enormous value.
The fundamental question is therefore not merely who owns the company.
The question is who owns the value created by personal data.
At present, companies can profit from that value while customers receive little more than an email informing them that ownership has changed.
For many citizens, that no longer feels fair, reasonable, or consistent with the spirit of data protection rights.
The Gap Between GDPR and Public Expectations
GDPR was introduced with ambitious promises.
Citizens were told they would have greater control over their personal information. They were told organisations would be more transparent. They were told privacy rights would be strengthened.
Yet many customers are surprised to discover that they may have little practical control when their service provider is acquired by another company.
The law may permit such transfers under certain circumstances, but public confidence depends on more than legal compliance.
It depends on fairness.
It depends on transparency.
It depends on accountability.
And it depends on respect.
If customers only learn about a transfer after decisions have already been made, many will understandably ask whether their rights are meaningful in practice or merely theoretical.
A Question of Morality and Respect
This issue extends beyond legal technicalities.
A company may have the legal authority to transfer customer data as part of a sale. However, legality does not automatically create legitimacy.
Ethical business conduct requires respect for the people whose information contributes to the value of the organisation.
If customer data helps increase the purchase price of a company, should customers at least be informed before the transaction is completed?
Should they have the opportunity to object?
Should they have the option to remove their information if they no longer wish to continue under new ownership?
These are not unreasonable questions.
In an era where personal data has become one of the world’s most valuable commodities, citizens are entitled to ask whether the balance between corporate interests and individual rights has shifted too far in favour of business convenience.
Privacy Is a Fundamental Right
Within the European Union, privacy and data protection are recognised as fundamental rights.
These rights are not merely technical regulatory requirements. They exist to protect the dignity, autonomy, and freedom of individuals in an increasingly digital society.
If personal data can be transferred as part of a commercial acquisition without the prior knowledge or meaningful involvement of the individuals concerned, there is a legitimate question as to whether the spirit of these fundamental rights is being respected.
Citizens may reasonably ask what practical control they truly possess over their personal information if decisions concerning its transfer are made entirely between corporate entities.
GDPR was introduced to restore trust, strengthen individual rights, and ensure that people remained at the centre of decisions involving their personal data.
However, where customers find themselves transferred between companies as part of a financial transaction, with no advance warning, no opportunity to object, and no meaningful choice regarding the future use of their information, many will perceive a significant gap between the promises of GDPR and their actual experience.
This is not solely a legal matter.
It is also a question of ethics, corporate responsibility, and respect for the individuals whose data creates value for businesses.
A society that values privacy should expect companies to treat customers as participants in the relationship, not merely as assets included within a commercial transaction.
Time for a Public Debate
The issue is not whether companies should be allowed to buy and sell businesses.
The issue is whether customers deserve stronger protections when their personal information forms part of the value being transferred.
Perhaps it is time to consider reforms that would require:
- Advance notification before customer data is transferred as part of a sale.
- Greater transparency regarding who will control the data after acquisition.
- A practical right to object where appropriate.
- A meaningful opportunity to remove personal data before transfer where possible.
- Stronger accountability for organisations that profit from customer information.
- A public discussion on whether customers should share in the value created when their personal data forms part of a commercial transaction.
- A review of whether current protections adequately reflect the expectations of modern citizens.
These proposals may not be easy to implement, but they deserve discussion.
Because at the heart of this issue lies a simple principle:
Our personal information belongs to us.
If GDPR is to maintain public confidence and legitimacy, it must be capable of demonstrating that it provides meaningful protection in situations such as these.
Otherwise, citizens may reasonably question whether their rights exist in practice or only in principle.
The question facing regulators, legislators, and businesses alike is straightforward:
When companies are bought and sold, are customers being treated as valued participants in the relationship, or simply as assets included in the deal?
And if customer data helps generate the financial value of that deal, why are customers the only participants who receive neither a choice nor a share of the benefit?
The answer will determine whether GDPR is remembered as a meaningful protection of individual rights or merely another layer of corporate compliance.
Our Data. Our Rights. Our Choice.
That principle should not end when a company changes hands.
