Anonymised, illustrative composite. A media company wanted a defunct competitor's 340,000-name subscriber list, not its assets or its staff. That is the one transaction PIPEDA's business-transaction exemption expressly does not cover.
At a glance
A digital media publisher approached a competitor that had wound down its editorial operation but retained an email subscriber list of 340,000 names built over a decade. The competitor had no ad sales team left, no content production, and effectively no ongoing business — what it had was the list, and a modest amount of legacy domain and brand value.
Counsel on both sides reached, reflexively, for the same structure every other customer-data transfer in this cluster of case files uses: an asset purchase agreement with a business-transaction confidentiality and use agreement satisfying PIPEDA s.7.2(1), moving the list to the buyer without going back to each subscriber for consent.
The instinct did not survive a close read of the section it was relying on. s.7.2(1) and (2) exist to let ordinary M&A proceed without turning every customer relationship into a fresh consent exercise — but the premise is that personal information is moving as an incident of a business changing hands, not as the entire point of the transaction. Strip away the list, and this deal had almost nothing left to acquire.
Of the $210,000 purchase price, the parties’ own allocation memo attributed $185,000 — 88% — to the subscriber list, with the balance split between the domain name and a handful of legacy contracts. Open-rate data showed the list was still live: roughly 22% average engagement on the last campaigns the vendor had run, which is what made it worth acquiring in the first place rather than simply approaching the same readership through the buyer’s own marketing.
On any test that looks at the deal’s actual object rather than its label, the transaction was a purchase of personal information with some incidental assets attached, not the reverse.
Read the unit. The carve-out in s.7.2(4) does not turn on the paperwork used; it turns on what the deal is actually for. The subsection states plainly: “Subsections (1) and (2) do not apply to a business transaction of which the primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information.” An asset purchase agreement dressed the transaction in the same form as an ordinary business sale, but form is not what the test asks about — purpose and result are.
On the numbers the parties had themselves put on paper, the primary purpose of this deal was squarely the acquisition of the subscriber list. That finding does not merely weaken the exemption — it removes it entirely. s.7.2(4) is not a proportionality test that reduces how much data can move; it switches off s.7.2(1) and (2) altogether for the whole transaction once the primary-purpose test is met, leaving the parties back at PIPEDA’s ordinary consent requirement for every one of the 340,000 records.
British Columbia and Alberta build the same idea differently. BC’s Personal Information Protection Act asks, at s.20(7), whether the transaction “does not involve substantial assets of the organization other than this personal information” — a test about what else is in the deal, rather than PIPEDA’s test about the deal’s primary purpose or result. On a file with almost nothing else of value in it, both formulations reach the same answer, but a deal that fails one test on its wording could in principle pass the other, which is a reason to check the applicable provincial statute independently rather than assume PIPEDA’s test travels unchanged.
The parties abandoned the business-transaction exemption for this deal and went back to the list with an opt-in consent campaign: each subscriber was emailed and asked to confirm they wanted to continue receiving communications from the acquiring publisher, using the vendor’s own sending domain so the request looked like a message from a source they had actually subscribed to. Just under 140,000 of the 340,000 subscribers opted in — a list less than half the original size, but one the buyer could lawfully use, and the purchase price was renegotiated downward to reflect a confirmed rather than a nominal subscriber count.
Had the parties closed on the exemption as originally planned, every one of the 340,000 records would have moved and been used without a valid statutory basis, exposing the buyer to a PIPEDA complaint on the entire acquired list — not a subset, because s.7.2(4) does not partially disqualify a transaction. It disqualifies the whole exemption once the primary-purpose test is met.
Ask what the deal is actually buying, in dollar terms, before assuming the business-transaction exemption applies. A purchase-price allocation memo that puts the overwhelming majority of value on a customer or subscriber list, with little else changing hands, is the s.7.2(4) tell — the paperwork can be styled as an ordinary asset purchase and the exemption can still be unavailable.
A 30-minute call is enough to tell you whether AI pays for itself here.
Canadian small-business transaction data is not published anywhere, so most valuations in this country quote an American benchmark. The Deavo–Treadstone Acquisition Index is a daily record of Canadian listings built to replace that: asking-price distributions by province and city are published now, and days on market, departure rates and asking-to-sale spreads follow as the series lengthens. Leave an email and we will tell you as each measure lands.
No pitch, no listings. One email when the first report lands.
