WithSecure – Sale of open source data collection product and business

WithSecure – Sale of open source data collection product and business

With EU member states implementing and expanding their foreign direct investment regimes and increasingly scrutinising reviews of foreign investments in critical sectors, the regulatory environment for cross-border investments and other change of ownership arrangements is more complex than ever before.

In many corporate transactions, it is necessary to consider whether the transaction could impact the national interests of Finland or another country and therefore require a regulatory filing with the authorities in one or more jurisdictions. As foreign direct investments (FDI) and cross-border corporate transactions more often require regulatory filings under different regulatory regimes and jurisdictions, it is increasingly important to carefully assess the implications of possible FDI regulatory filings on deal certainty and transaction timeline. It is also advisable to carefully plan the filing process and to customise the relevant deal terms appropriately.

Our experienced FDI regulation experts regularly perform FDI reviews and advise clients in authority proceedings related to investments and other ownership arrangements. We evaluate the applicability of the regulatory filing requirements as well as the likelihood of success and the potential risks of contemplated investments for our clients in the Finnish regulatory framework and determine how the filing requirements should be taken into consideration in the timeline and conditions of the transaction.

We know the changing FDI regulatory environment thoroughly. As our client, you will benefit from our extensive service offering, successful project management and recognised ability to execute complex transactions. In international regulatory matters, your project is supported by our unique global network of law firms.

Our clients include international corporations as well as private equity funds and other investors acquiring or establishing businesses in Finland or carrying out corporate transactions that directly or indirectly affect the ownership of a Finnish business. Through our international partner network, we also advise Finnish clients in their corporate and ownership arrangements that may require an analysis of FDI issues in jurisdictions outside Finland.

Our services include

  • Strategic advice related to the FDI approval process
  • Analysing the need for application and/or notification under Finnish FDI regulation in relation to agreements, investments and other transactions
  • Coordinating the work of foreign counsel with regard to the FDI analysis in other jurisdictions
  • Drafting and submitting the applications and notifications
  • Advice during the proceedings and project management of the FDI notification process as a whole

Latest references

We advised WithSecure Corporation in the sale of its cybersecurity consulting business to Neqst. WithSecure is a global cyber security company (listed on NASDAQ OMX Helsinki). Neqst is a Swedish investment firm, focusing on technology companies. The closing of the transaction remains subject to customary conditions and regulatory approvals.
Case published 24.1.2025
We assisted Smarter Contracts Ltd in the process where the Finnish Transport and Communications Agency Traficom confirmed it to be an EU-recognised data intermediation service. Non-EU companies must have a legal representative in some EU country so that they can offer data intermediation services in accordance with the Data Governance Act. Smarter Contracts is based in Great Britain and selected Finland for the task. Smarter Contracts is the first non-EU data intermediation service registered by Traficom. Wayne Lloyd, Founder & CEO of Smarter Contracts, remarked:  The support from the Castrén team was exceptional from start to finish. Pioneering new territory is never without its challenges, and as the first non-EU data intermediation service provider, we faced significant legal uncertainties. Despite these complexities, the Castrén team expertly guided us through each step with remarkable efficiency, providing the certainty we needed. Smarter Contracts leverages its proprietary Pulse Permissions Protocol® to deliver advanced consent and access rights management services. This milestone highlights Castrén & Snellman’s proficiency in navigating intricate regulatory landscapes, whilst recognising the relevance of Smarter Contracts’ innovative approach to secure, compliant data management.
Case published 11.12.2024
We assisted Pharmaca Health Intelligence in its acquisition of Mediaattori Ltd’s PODIUM Connect® and PODIUM Visits businesses. Through the acquisition, Pharmaca Health Intelligence strengthens its extensive service offerings in medical information, data-driven management, and education for both healthcare and pharmaceutical companies. Pharmaca Health Intelligence is a pioneer in digital medical information and a reliable partner for wellbeing services counties, the private healthcare sector and pharmacies. The company invests in the development of technology and service solutions related to pharmaceutical information, also on an international scale.
Case published 5.12.2024
The Finnish Supreme Administrative Court has handed down decision KHO 2024:115 on balancing data protection and national security interests in cyber security incidents. We acted for the Finnish Ministry of Foreign Affairs in this precedent setting case, in which the Supreme Administrative Court agreed with our client’ core submissions and decided to overturn key parts of a data protection authority decision against our client. The court held that the Ministry had acted lawfully when taking a bit of time between discovering information about a cyber incident concerning certain diplomats and notifying all potentially affected people. The key point of principle for our client was the extent to which Article 34 of the GDPR requires such (essentially public) notifications when foreign policy and national security might require a more discrete initial approach. The court’s reasoning is important: since Finland has voluntarily, but not unreservedly, extended the scope of the GDPR to also cover foreign policy and national security, the primacy of EU law does not apply in that extended context. Thus, more specific local Finnish rules on freedom of information/confidentiality in these areas override the general Article 34 notification obligation (under the classic lex specialis derogat legi generali rule), even absent express statutory carve-outs to Article 34. Had Article 34 applied as a matter of EU law, the outcome could have been different, since the GDPR, under primacy, would override all local Finnish rules, irrespective of whether they are lex specialis or not. It’s important to understand why, and on what basis, an EU law applies to any given situation, since this could affect the principles of interpretation so much that the outcome changes significantly. The court did, however, hold that the Ministry will need to notify the DPA itself within the customary deadlines, since the DPA under Finnish law has the right to receive information confidentiality rules notwithstanding. We hope this outcome will contribute to authorities dealing with foreign policy and national security being able to balance all relevant interests going forward. Read the decision in Finnish or in Swedish .
Case published 15.11.2024