Business booms for privacy experts as landmark data law looms

SAN FRANCISCO (Reuters) – Business is booming for software and privacy experts as companies across the globe spend millions of dollars to comply with a landmark European data protection law, even as many uncertainties remain about how the rules will be enforced.

The General Data Protection Regulation (GDPR), which goes into effect in May, is the biggest shake-up of personal data privacy rules since the birth of the internet. It is intended to give European citizens more control over their online information and applies to all companies that do business with Europeans.

The industries most deeply affected will be those that collect large amounts of customer data and include technology companies, retailers, healthcare providers, insurers and banks.

The law has a slew of technically complex requirements, and threatens fines of as much as 4 percent of a company’s annual revenue for those who fail to comply. Companies must be able to provide European customers with a copy of their personal data and under some circumstances delete it at their behest. They will also be required to report data breaches within 72 hours.

The cottage industry that’s developed around GDPR includes lawyers who advise on compliance, cyber security consultants, and software developers that help firms conduct painstaking inventories of vast amounts of data to identify and index information so it can be made available to Europeans at their request.

New York legal services firm Axiom, for example, told Reuters it had more than 200 data privacy lawyers working on GDPR projects – about a sixth of all its lawyers.

It said it would hire over 100 more staff this year to deal with GDPR and also create training programs so that more of its lawyers would be qualified to work on those types of projects.

Wim Remes, a cyber security consultant in Brussels, said he was fielding about a dozen GDPR-related calls per week. His clients are based in Europe and the Americas and include retailers and technology firms.

He said American companies had been slower off the mark to respond to GDPR than their European counterparts and were now scrambling to catch up. “In the last two or three months, the demand has mostly been from U.S. organizations,” he added.

COMPANIES SPEND MILLIONS

The costs are substantial: among 300 big companies in the process of becoming GDPR compliant, 40 percent said they had spent more than $10 million, and 88 percent said they had spent more than $1 million, according to a PwC survey of American, British and Japanese executives published in September.

“People really aren’t picking up the phone for less than $1.5 million to $2 million,” Gant Redmon, program director of cyber security and privacy at IBM Resilient, said of legal and software consultancy firms advising on GDPR.

The work will not end on May 25, when GDPR kicks in, as companies will be required to provide regular data audits for EU authorities to prove they are compliant. Companies that handle especially sensitive information will have to hire a data protection officer.

Lingesh Palaniappan, CEO of Grit Software Systems, described the work he’s doing on GDPR compliance for a mid-sized software company as a grueling manual process.

His staff has to go through every software application and database and record details such as the exact type of data they contain – whether it be names and addresses, or more personal information like medical records – and who has access to it. The team builds charts to keep top management informed on how far along the company is in its GDPR compliance process.

“Currently, we are literally taking an Excel sheet, going to the (clients’) teams, filling out the data and then consolidating the data into another Excel sheet,” said Palaniappan, who left Microsoft Corp last year.

The aim is to make personally identifiable data easily available, so these companies can provide copies of the information to customers who request them, or to erase the data when required.

The big worry is that, due to the manual nature of the work, errors that could make companies non-compliant could creep in, added Palaniappan.

“We’re always worried – did we miss anything? Are there any datasets that no one is aware of that we’re still using? That’s a concern.”

‘EVERYONE IS SCRAMBLING’

Still, it’s unclear just how strictly GDPR, which EU nations adopted in 2016, will be enforced at the start.

Many observers expect regulators to take a forgiving approach and give companies time to get their systems in order, reserving harsh penalties for large firms that egregiously fail to comply.

Some also warn that companies need to be careful in their rush to comply with the new rules.

“Everyone is claiming now to be a GDPR expert because they can see that there is very strong demand and everyone is scrambling,” said Paul Lanois, an attorney with a large publicly traded international bank in Europe, adding that he checks consultants’ resumes for experience dealing with European regulators before bringing them on board.

“You have to vet them otherwise you get any Tom, Dick or Harry saying they’re a GDPR expert,” Lanois said.

Once data is properly classified, there is then a great deal of interpretation involved in how the company is required to handle it. The text of the law is replete with words like “reasonable”; one requirement, for example, says that companies take “every reasonable step … to ensure that personal data which are inaccurate are rectified”.

Those steps, however, are not defined. That’s where the lawyers come in.

There is little consensus on whether most companies will be ready by May. Among firms that have begun preparing for GDPR, 78 percent say they are confident they will be fully compliant by the deadline, according to a survey by Microsoft late last year.

But Gartner, the research firm, has a less optimistic forecast, predicting less than half of all companies affected by GDPR will not be in full compliance by the end of 2018.

Lanois said there was an “overwhelming amount” of companies that were completely unprepared for the new regulations.

”They’ve just noticed GDPR and are now freaking out,“ he added. ”Those who are already fully compliant, and there’s a few of them, those are the lucky few.”

GDPR GRAPHIC-How new regulation works: tmsnrt.rs/2DhT0XL

Reporting by Salvador Rodriguez; Editing by Jonathan Weber and Pravin Char

Infrastructure Play Yields 12.2%, 25% Upside, Insiders Buying This MLP

This research report was jointly produced with High Dividend Opportunities co-author Philip Mause.

SunCoke Energy Partners, L.P. (SXCP) closed recently at $19.45 per unit. It currently pays a distribution of $2.376 per unit per annum for an annual yield of 12.2%. At its current price, SXCP is a big bargain in a market in which attractive risk/reward trade offs are becoming more and more difficult to find.

The Businesses – SXCP’s primary business is the production of coke for steelmaking facilities. Coke is produced by “baking” metallurgical coal at high temperatures. SXCP has four large facilities – each of which serves a large steelmaker under a long term take or pay contract. These contracts also provide for the pass through of SXCP’s costs. SXCP’s facilities are the most modern and environmentally advanced in the industry. Most of the industry is still using older facilities which are likely to be scrapped over the next several decades. SXCP’s 4 contracts expire in 2020, 2022, 2025 and 2032. It is important to note that the coke business is not dependent upon the various factors which affect the demand for thermal coal (used primarily to generate electricity). Thus, the long term decline in the use of thermal coal in the United States due to competition from natural gas and renewables has no effect on SXCP’s coke business.

SXCP also has a growing coal logistics business. This business involves the shipping of coal primarily but not exclusively for export markets. Some of SXCP’s facilities can be (and likely will be) used for other dry or wet bulk shipping functions in the future. Since the election of President Trump, coal production has increased somewhat in the United States according to Energy Information Administration (“EIA”) data. However, domestic consumption of coal has not increased. The variable that has increased enormously in 2017 is coal exports. These exports have nearly doubled in one year and the increase for 2017 in comparison with 2016 will probably amount to some 50-60 million tons of coal. President Trump’s commitment to revive the coal industry depends very very heavily on the continued increase in coal exports and SXCP is well positioned to benefit from that development.

Financial Performance – SXCP has consistently performed well financially. Its long term take or pay contracts provide it with revenue stability. That said, it achieved banner results in Q3 2017. 2017 nine month numbers are up sharply from 2016. Revenue is up by 9% and adjusted EBITDA is up by 13% for the first nine months of 2017 compared with the comparable period in 2016. Trailing twelve month (“TTM”) adjusted EBITDA is now $227.2 million and TTM distributable cash flow (DCF) is $126.6 million. SXCP issued guidance for full year 2017 with its third quarter financial report and now guides to adjusted EBITDA of between $210 and $220 million. Guidance DCF for full year 2017 is now between $119 and $130 million. Using TTM DCF, the per unit DCF is $2.74 (SXCP has a very stable unit count of 46.2 million) which – at the current unit price – produces a dirt cheap price/DCF ratio of 7 times for a company with very stable revenue under long term contracts.

Leverage – SXCP has gross debt at $818.9 million and net debt (debt minus cash) of $792.0 million. Using the mid-point of 2017 adjusted EBITDA guidance ($215 million) this produces a debt/adjusted EBITDA ratio of 3.7. Arguably, this should be somewhat offset by an excess of inventory and accounts receivable ($131.3 million) over accounts payable ($69.5 million) but, even without such an adjustment, leverage is not unreasonable for a company with a stable stream of revenue. SXCP has announced a goal of reducing leverage to a ratio of 3.5 but the need to do this is not pressing.

Distributions – SXCP pays distributions of 59.4 cents per quarter or $2.376 per year for a yield of 12.2%. It has paid at this level since June 2016. Given the current DCF level, there shouldn’t be any pressure to cut the distribution but, given the desire to reduce leverage, there probably won’t be any sizable increase in the near term either. Incentive distribution rights for SXCP’s parent, SunCoke Energy (SXC) kick in at 47.4375 cents per quarter (15%) increasing to 25% at 51.5625 cents per quarter and 50% at 61.875 cents per quarter which tends to make a large scale distribution increase from the current level rather expensive.

Unit Ownership – SXCP’s parent, SXC has been acquiring units at a rapid pace. In the one year between 9/30/2016 and 9/30/2017, SXC’s ownership of SXCP units increased from 25.4 million to 27.4 million while the number of publicly owned units declined from 20.8 million to 18.8 million. SXC attempted a merger in the past and may be setting the stage for a consolidation by buying up more and more SXCP units. SXC recently attempted a consolidation which was rejected by SXCP as being insufficiently remunerative to SXCP unit holders. By buying more and more SXCP stock, SXC will be able to offer more attractive terms for the smaller and smaller number of publicly held units. Below is a list of share purchases by parent SXC over the past month. If we go back 1 year, the list is enormous!

Source

We can note that the most recent purchases by SXC were at $17.90/share for each SXCP share. SXC still has unused authorizations to purchase up to $64 million worth of SXCP units (more than 3 million units) and will likely use these authorizations on an opportunistic basis.

Risk Factors – The first major risk is a possible disruptive consolidation attempt. The risk is that when the deal is announced the two stocks could decline in tandem. Part of the reason for this is that it could be too complex for retail investors to determine exactly what the combined entity would be worth in the aggregate as well as on a per-share basis. Furthermore, many income investors could drop the shares of SXCP due to a possibly lower dividend yield for the combined entity.

The other major risk factor is a large scale collapse of the domestic steel industry leading to either defaults on current contracts or much less attractive terms when contracts come up for renewal. Because SXCP’s facilities are the best in the industry they would likely be the last ones to be shut down in a pull back. It would also be a blow to the Trump Administration for the US steel industry to incur a major downturn and public policy will probably be mobilized to prevent this result. Even after Trump leaves office, politicians are now aware of political risks in steel country states (Pennsylvania, Ohio, etc.) and will try to avoid negative outcomes for the industry.

SXCP will be a big beneficiary from new “infrastructure spending”

The domestic steel industry would be a big beneficiary of the activation of the long-awaiting federal “infrastructure” program. Infrastructure investment would involve large scale use of steel in airports, harbors, bridges, and highways. There would almost certainly be provisions designed to assure that domestic steel would be used or at a minimum would receive a preference for use in the infrastructure program.

Bottom Line – Trading at 7 times trailing twelve month DCF, SXCP is a bargain. Its parent has been buying up the stock voraciously. Its sources of revenue are stable and there is reason to believe that there is some growth potential. SXCP is probably disfavored because it is viewed as a “coal stock” by investors who don’t know the difference between coke and thermal coal. The consolidation issue is a real one but it is likely that investors now will wind up in good shape even after a consolidation although it is possible that they may have to endure a temporary dip. SXCP is probably one of the safer double digit yield stocks now available and is a very very strong buy at this price level. A fair price for SXCP should be 9 times TTM DCF or $24.66 (or 26% higher from here); this would produce a still attractive yield of nearly 10%.

Disclosure: I am/we are long SXCP.

I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.