Legal & Regulatory Bulletin 26 CONTENTS 4 EU General Data Protection Regulation: A Primer for Funds and Portfolio Companies 8 Permanent Capital Vehicles: Dealing with the Liquidity Quandary 11 Trends in Structuring India Focused Funds and LP-GP Negotiations 14 Disputes in Relation to Private Equity FALL 2018 Issue no. 26 | 26 no. Issue EMPEA Legal & Regulatory Bulletin | FALL 2018 1 About EMPEA EMPEA Legal & Regulatory Council EMPEA is the global industry association Mark Kenderdine-Davies (Chair) Gordon Myers for private capital in emerging markets. An CDC Group plc IFC independent, non-profit organization, the Carolyn Campbell Peter O’Driscoll association’s membership comprises 300+ Emerging Capital Partners Orrick, Herrington & Sutcliffe LLP firms representing institutional investors, fund Antonio Felix de Araujo Cintra Chike Obianwu managers and industry advisors who together TozziniFreire Advogados Templars manage more than US$5 trillion in assets across John Daghlian Bayo Odubeko 130 countries. Our members share EMPEA’s belief O’Melveny & Myers Norton Rose Fulbright that private capital is a highly suited investment Mark Davies Paul Owers strategy in emerging markets, delivering attractive King & Spalding Actis long-term investment returns and promoting the sustainable growth of companies and Folake Elias-Adebowale George Springsteen Udo Udoma & Belo-Osagie IFC Asset Management Company economies. We support our members through global authoritative intelligence, conferences, Laura Friedrich Mara Topping Shearman & Sterling LLP White & Case LLP networking, education and advocacy. Geoffrey Kittredge Cindy Valentine For more information, visit empea.org. Debevoise & Plimpton Simmons & Simmons Prakash Mehta Nigel Wellings Akin Gump Strauss Hauer & Feld LLP Clifford Chance Publication Editorial Team Zia Mody Harald Zeiter AZB & Partners Capital Dynamics Ann Marie Plubell Vice President, Regulatory Affairs Production Assistance Ben Pierce Pierce Designers © 2018 EMPEA. All rights reserved. The EMPEA Legal & Regulatory Bulletin is an EMPEA publication. Neither this publication nor any part of it may be reproduced, stored in a retrieval system, or transmitted in any form or by any means—electronic, mechanical, photocopying, recording or otherwise—without the prior permission of EMPEA. EMPEA | The Watergate Office Building | 2600 Virginia Avenue N.W., Suite 500 Washington, D.C. 20037-1905 USA Phone: +1.202.333.8171 | Fax: +1.202.333.3162 | Web: empea.org DISCLAIMER: This material should not be construed as professional legal advice and is intended To learn more about EMPEA or to request solely as commentary on legal and regulatory developments affecting the private equity a membership application, please send an community in emerging markets. The views expressed in this bulletin are those of the authors email to [email protected]. and not necessarily those of their firms. If you would like to republish this bulletin or link to it from your website, please contact Holly Radel at [email protected]. 2 © 2018 EMPEA A Letter from the Council Chair The regulatory environment Topics Covered in this Bulletin: continues to move at a fast EU General Data Protection Regulation—A Primer for Funds and pace. What was previously Portfolio Companies: Data protection is a fundamental right in the EU. This article addresses how private equity funds are addressing the considered market practice new regulations and what are the extraterritorial applications as well as has moved rapidly to become other implications and consequences of compliance failures. negotiable, an array of issues Permanent Capital Vehicles: This article deals with the liquidity are likely to give rise to disputes quandary. Evergreen funds aren’t a new concept, but absent a fixed termination date, what are some innovative approaches investors take in relation to private equity to address liquidity issues these funds raise? investments. Many entities Structuring India Focused Funds: This article highlights rising trends in doing business in the European negotiations among investors and fund managers in India. With overall investments in India gaining, the dialogue around traditionally “market Union have not only updated practice” terms are increasingly open to negotiation. What are some key their procedures in light of fund terms and trends? the General Data Protection Disputes in Relation to Private Equity: With deal activity on the Regulation, but are taking the rise so is the risk of disputes. What are some areas of dispute and recent examples? opportunity to improve the In addition to providing industry resources like the Bulletin, EMPEA way they manage personal data has filled the upcoming calendar with events of particular value to our generally. Increasing interest readers. I look forward to meeting many of you in London on 23 October 2018 at the Sustainable Investing in Emerging Markets Summit and on in evergreen funds invites the 25th at the EMPEA Private Equity Masterclass. novel questions. The current I welcome your thoughts at any time and invite you to share them with me, Legal and Regulatory Bulletin Mark Kenderdine-Davies ([email protected]) and with offers thoughtful discussion Ann Marie Plubell, Vice President, Regulatory Affairs at [email protected]. of aspects of each of these Best wishes, developments. Mark Kenderdine-Davies General Counsel, CDC Group plc Chair, EMPEA, Legal & Regulatory Council EMPEA Legal & Regulatory Bulletin | FALL 2018 3 EU General Data Protection Regulation: A Primer for Funds and Portfolio Companies By Friedrich Popp, Associate, Debevoise & Plimpton LLP Fund managers, investment advisers The Regulation replaces the existing Not only do and portfolio companies doing patchwork of EU data protection rules business in the European Union have with (almost) uniform law across the EU individuals have recently been required to adjust their and restricts member state discretion to several new rights procedures for data handling in light certain limited areas such as employment to put them into of Europe’s new privacy law, the law. Not only do individuals have several control of their General Data Protection Regulation new rights to put them in control of their “ (“GDPR“). While this process has personal data, but the new rules are also personal data, required the investment of significant backed by strong enforcement, including but the new rules resources, many businesses have civil liability. are also backed by taken the opportunity to improve the way they manage personal data Processing of personal data strong enforcement, more generally. The GDPR will apply whenever personal including civil data is processed. Funds process a variety liability. Data protection: a wide of personal information, including data ranging fundamental right relating to its partners, employees, portfolio company management teams The broad definition of personal data Data protection is a fundamental and investors. Portfolio companies also includes any information relating to right in the EU and from May 2018, hold data relating to their customers, an identified or identifiable individual, the GDPR protects the personal employees and other individuals. including their name, address, but also information of individuals in the Some of that data may also come into bank account details or investments EU irrespective of their citizenship. the possession of the fund, including made. Special categories of data, for Importantly, the new rules do not during due diligence on prospective example, health data, enjoy an even protect data relating to legal entities investments, as well as during the life of higher standard of protection. While like corporations or funds. the investment itself. anonymization of data can bring the 4 © 2018 EMPEA processing outside the scope of the law, Data controllers and data consent. Data that is no longer needed breaking the link between the individual must be deleted and data protection and their personal information is in processors authorities expect businesses to have practice not easy. Processing, the second The GDPR imposes obligations on a policy detailing the time limits for element of the trigger, is virtually any both the data controller, the person erasure of different categories of data. use of data, including the collection, responsible for the method and storing, sharing, transfer and erasure. purposes of the data processing Do I need consent? and the data processor, the person The GDPR provides several legal bases In other words, private equity fund who processes data on behalf of the for data processing, including consent sponsors will routinely “process” a wide controller (which would include, for of the individual concerned. However, variety of personal data and, as a first example, the provider of a virtual data consent has to be freely given, specific step, now need to understand what room or a payroll service provider). The and informed by a statement or a they hold and where. controller must enter into a written contract with the processor, specifying clear affirmative action (no pre-ticked boxes) and must not be hidden in While the GDPR was primarily intended certain minimum privacy and security lengthy terms and conditions. Consent to address concerns arising from data requirements. The controller also has can be withdrawn at any time and handling by large internet companies, joint and several liability with the the individual has to be informed the law does not distinguish between processor if the processor infringes