Law & Finance Series- The Evercore Breach: A Case Study on the Importance of Scrutinising Confidentiality Provisions

Hi everyone,

Here’s a fun fact to kick off today’s post: I’m on a mission to cut out carbonated drinks from my life. As you would imagine, this often means not just avoiding the fizzy stuff itself, but steering clear of any digital or physical content that even remotely touches on it.

Yet, when I stumbled upon the news that AriZona Beverages (longtime maker of 99 cents beverages in the US) had accused Evercore (a prominent global independent investment banking advisory firm) of a confidentiality breach, I couldn’t resist the urge to dig further into a case that so beautifully intersects Law and Investment Banking.

A can of AriZona sitting pretty.

Let’s get right into it.

What happens when an investment bank, with the sole consent of its client, uploads a Supply Agreement between that client and a third-party to a Virtual Data Room (VDR). The third-party then claims that this upload is a breach of confidentiality, arguing that the agreement contains sensitive business secrets and that it should never have been published (used loosely) without the third party’s explicit consent? 

Here’s the deal (pun unintended— okay, maybe intended just a lil)

1. Vobev, a company in the market for a buyer (i.e., it’s looking to be acquired), appoints Evercore, the investment bank to facilitate the sale. Keep in mind that Vobev is a can manufacturer. This tiny piece of information will find relevance as we proceed. 

2. As part of the transaction marketing process, Evercore sets up a Virtual Data Room, uploading critical documents to help potential bidders conduct due diligence and make informed decisions about Vobev.

3. Among these documents is a supposed top-secret Supply Agreement between Vobev and, of course, AriZona Beverages (“AriZona”). Let’s get into this a bit more to understand the relationship between these two. AriZona has been in the beverage business for a really long time— as long as I’ve been alive. Through the torrents of a global financial crisis, a pandemic, high inflation etc, AriZona has continued to sell its trademark canned beverages at the sweet price of 99 cents. As you’d expect, it has become a market favourite. Vobev, on the other hand, has played an instrumental role in this, supplying AriZona with cans at competitive prices. This top secret Supply Agreement between them apparently houses the intricacies of their business relationship and the mechanisms by which AriZona is able to maintain its affordable price.

4. Surprisingly, AriZona gets wind of Evercore’s upload of the Supply Agreement to the VDR and promptly contacts Vobev’s CEO and General Counsel, alleging that doing so exposes vital business secrets.

Sidebar: I  still am trying to understand how a transaction shrouded in (presumed) secrecy made its way into AriZona’s hands, but let’s not get carried away. 

This claim of confidentiality breach eventually escalates into a lawsuit, with AriZona (the third party) arguing that the supply of cans by Vobev at favourable pricing is so crucial that it should not have been disclosed by uploading the Supply Agreement to the VDR.

5. The trial court agrees with AriZona and orders Evercore, a middleman caught in all this, to turn over records to AriZona, detailing which parties accessed the data room and, by extension, the agreement.

Interesting, right? This case raises several important points that anyone involved in similar transactions should consider:

1. NDAs Aren’t Bulletproof: Even after an investor or bidder signs a binding NDA, its ability to access certain documents housed in the VDR can still be fraught with confidentiality complications. NDAs might seem like a protective shield, but they’re not always the bulletproof vest one might hope for. These agreements typically dictate that disclosed information is to be used strictly for the purpose of bidding and making informed decisions to that end, and, logically, not for any other purpose. This should, in theory, offer a reasonable level of certainty. However, this isn’t always the case. Take the example of the potential bidders for Vobev’s acquisition. Despite having signed an NDA, which legally binds them to maintain confidentiality of the Supply Agreement’s terms, AriZona decided to still pull the plug on their access. On the surface, it might seem overly cautious, but consider this: NDAs usually have a definite term—unless it's a perpetual NDA, which, in itself, isn’t very common. 

Typically, once the term of the NDA expires, the receiving party could potentially (heavy on the potentially) do whatever it pleases with the information. Moreover, NDAs often contain exceptions that can be exploited. So, perhaps AriZona’s wariness isn’t so far-fetched, especially when you consider that one potential bidder for Vobev- Ball Corporation (“Ball”)—a company in the can manufacturing business—has had prior dealings with AriZona. Access to the Supply Agreement could give Ball significant transactional edge and access to key details that facilitate AriZona’s pricing strategy which can then be used to entice AriZona’s competitors. 

2. Agreements Deserve Extra Scrutiny Before Uploading to the VDR: My opinion only so please don’t come for me. I believe that it’s no longer sufficient to merely categorize contracts as material or otherwise when determining which agreements should make it to the VDR. Equally important is identifying which of these (material) agreements contain third-party confidentiality and notification clauses, and ensuring that the necessary consents are obtained from these third-parties before sharing them. A misstep here could lead to more than just a legal headache. 

A  similar headache could also make its way in seeking third-party consent while ensuring that existing confidentiality agreements are not breached while at it. I’ll explain. In seeking consent, how do you ensure not to breach confidentiality terms bearing on the current transaction? How much information, on a no-name basis, does this third-party need to know to enable it to provide its consent? How do you disclose what’s needed without revealing too much to the extent of a confidentiality breach? School me. 

3. Responsibility Matters: The foregoing point naturally raises the question: Who’s responsible for cross-checking the confidentiality provisions in these agreements before uploading them to the VDR? Is it the in-house legal team, external solicitors (if they’ve been engaged), the investment bank, or all of the above? The answer might seem straightforward, and it is: Leave it to the legal experts! ALWAYS leave it to the legal experts. 

However, when things go south—as they did in the AriZona, Vobev, and Evercore case—who ends up taking responsibility? If the Supply Agreement between Vobev and AriZona included confidentiality terms binding just both parties (i.e., Vobev and AriZona and not Evercore) why was the legal action directed at Evercore? Why didn’t AriZona target Vobev, its counterparty, directly in its claim so that the latter could compel Evercore, the investment bank/its agent, to delete the agreement from the VDR and disclose who had accessed it? Of course, I do understand that courts typically prefer to direct orders to the party responsible especially where direct action is practicable AND possible. So there’s that. 

4. The Fine Line: How much information is too much when sharing with potential investors? There’s a delicate balancing act to be considered between providing enough details to give bidders confidence, on the one hand, and revealing proprietary business practices on the other—especially when such disclosures could adversely impact other stakeholders. Navigating this fine line is crucial to maintaining trust and protecting business interests.

5. The Confidentiality Agreement Between Vobev and Evercore: Here’s a bonus point I’m including only because I find it interesting. Evercore and its client, Vobev, would have also entered into an NDA with each other. Now, Vobev finds itself in the position of needing to breach this NDA to share information with AriZona, a third party in this context. Well, not exactly a breach since it was compelled to do so. This leads to my point: It’s really interesting to see a typical key exception to the confidentiality clause in action. NDAs most often include provisions allowing either party to disclose information when compelled by a competent court of law to do so. In this case, it’s interesting to witness a court exercising its power to compel disclosure. It’s an important reminder that even the best confidentiality clauses can be torn to pieces at the court’s behest—which circles back to my previous point— no NDA is ever fully “bulletproof.” 

Final Words

What happens next? We don’t know yet what AriZona plans to do with the  list of people who’ve accessed the VDR Evercore is now legally obligated to avail it of. But one can reasonably assume that AriZona will assess the extent of the breach and consider whether further action is necessary. I’ll continue to monitor developments as much as I can.

I’ve enjoyed studying this case and love how it serves as an important reminder of the complexities involved in managing confidential information during the M&A lifecycle. It’s a lesson in the importance of diligence, not just in due diligence but in every step of the transaction.  

Thanks for reading & hope you enjoyed! 

Warm wishes,

AJ

Disclaimer: The opinions shared in this post are solely mine and do not represent the views of any company with which I have been or am currently affiliated or associated, whether by employment or any other relationship. Additionally, this content does not constitute legal advice, nor does it reflect the specifics of Nigerian law; it is provided solely for informational purposes.