1025-00008 · Quorum Insurance Holdings · IP & Derived Data Analysis

memo-sufficient-transformation-critique.docx DOCUMENT M&A / Corporate

40 / 76 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT

MEMORANDUM

TO: Carolyn Whitford, General Counsel & Executive Vice President, Quorum Insurance Holdings Corp. Gregory Stahl, Vice President, Legal Affairs, Quorum Insurance Holdings Corp.

FROM: Wendy Schultz, Associate, intellectual Property, Calderwood & Harkness LLP

CC: Leonard Cross, Partner (Responsible Partner) Patricia Heng, Senior Counsel, Technology Transactions Omar Siddiqui, Associate, intellectual Property

DATE: May 12, 2023

RE: Critique of Meridian Credit intelligence, Inc.'s Proposed "Sufficient Transformation" Standard for Derived Data Commercialization — Master Data License Agreement Negotiation

C&H Matter No.: 1025-00008

Right-click to update Table of Contents

I. Executive Summary

The purpose of this memorandum is to analyze and critique the "sufficient transformation" standard proposed by Meridian Credit intelligence, Inc. ("Meridian") in Article VII of the draft Master Data License Agreement ("MDLA") as a precondition to Quorum Insurance Holdings Corp.'s ("Quorum") ability to commercialize Derived Data to third parties. This analysis is being provided in advance of the next scheduled negotiation session and is intended to equip the Quorum legal and business teams with a comprehensive understanding of the legal, technical, and commercial deficiencies in Meridian's proposal, as well as a set of defensible alternative standards and a recommended negotiation approach.

Under Meridian's proposal, as set forth in Section 7.4(b) of the draft MDLA, Quorum may not sell, sublicense, or otherwise distribute Derived Data to third parties unless the Derived Data has been "sufficiently transformed" such that no Meridian raw data can be reverse-engineered from it — with Meridian retaining sole and absolute discretion to determine whether "sufficient transformation" has been achieved. This standard is paired with a perpetual, royalty-free license-back to Meridian on all Derived Data and a 15% net revenue share payable to Meridian on any approved third-party commercialization.

It is our central conclusion that the "sufficient transformation" standard as proposed is:

(a) Unworkably subjective, offering no defined criteria, timelines, or cure mechanisms by which Quorum can assess whether any particular Derived Data output will satisfy the standard;

(b) Commercially unreasonable in vesting unfettered veto power in Meridian — a counterparty that is both a competitor in the data-analytics market and a party with strong financial incentives (driven by its private-equity sponsor and IPO advisors) to suppress Quorum's third-party commercialization efforts;

(c) Technically impracticable in demanding an absolute impossibility of reverse-engineering — a standard that no commercially available transformation methodology can satisfy and that conflates re-identification risk (a privacy concept) with reverse-engineering of proprietary data (an IP concept);

(d) Inconsistent with market practice for enterprise data-licensing transactions, where derived-data provisions typically rely on objective de-identification standards, independent expert determinations, or categorical safe harbors rather than licensor sole discretion; and

(e) An existential threat to Quorum's QuorumScore™ commercialization strategy and its projected $40–50 million B2B licensing revenue by 2027, effectively granting Meridian a perpetual veto over a core Quorum business line.

This memorandum proposes objective, measurable alternative standards — including aggregation and de-identification thresholds, independent expert certification, categorical safe harbors (with an explicit QuorumScore™ carve-out), and a notification-only regime replacing sole-discretion consent — and recommends a negotiation approach for the upcoming sessions. We further recommend that the 15% net revenue share be rejected outright, as it constitutes double-charging on top of the $60 million license fee and is well above the market range for comparable transactions.

Calderwood & Harkness LLP ("C&H") is prepared to draft revised Article VII language incorporating these alternatives for inclusion in the next round of MDLA markup upon Quorum's approval of this memorandum's recommendations.

II. Background and Procedural Context

A. The Parties and the Transaction

Quorum Insurance Holdings Corp. Quorum is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC, and headquartered at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901. Quorum operates as a multi-line insurance carrier and insurtech platform, offering property and casualty, specialty, and life insurance products through both traditional and technology-enabled distribution channels. For its fiscal year ended December 31, 2022, Quorum reported consolidated revenue of approximately $4.18 billion. Quorum's strategic plan centers on the development and commercialization of proprietary data-driven underwriting models — most prominently, QuorumScore™ — as a source of competitive differentiation and a new B2B licensing revenue line.

Meridian Credit intelligence, Inc. Meridian is a Georgia corporation, privately held, and headquartered at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326. Meridian operates as a consumer and commercial credit bureau and data analytics company, providing credit-scoring, credit-monitoring, and data-licensing services to financial institutions, insurance carriers, and other enterprise customers. For its fiscal year ended December 31, 2022, Meridian reported revenue of approximately $1.42 billion and adjusted EBITDA of approximately $438 million. Meridian is majority-owned (62.5% equity interest) by Breckenridge Capital Partners Fund IV, L.P. ("Breckenridge"), a private equity fund managed by Breckenridge Capital Management LLC. Caleb Rourke, a partner at Breckenridge Capital Management, oversees the Meridian investment and has been involved in certain strategic decisions relating to the MDLA negotiation. Meridian has retained Whitmore Zanthor & Co. ("Whitmore Zanthor"), with Rachel Ng-Castillo, Managing Director, as lead advisor, in connection with a planned initial public offering of Meridian's common stock anticipated for the 2025–2026 timeframe.

The Transaction. The proposed MDLA contemplates a five-year enterprise data-licensing arrangement between Meridian (as Licensor) and Quorum (as Licensee), with a total contract value of $60,000,000. The license fee structure allocates $10.8 million to Year 1 (reflecting a reduced initial-year fee in consideration of implementation costs and ramp-up) and $12.3 million annually for each of Years 2 through 5. The MDLA covers Meridian's three principal data products:

(i) The MCI Consumer Credit File™, comprising approximately 310 million consumer credit records updated on a monthly basis, including tradeline data, payment histories, account balances, public records, and credit inquiries;

(ii) MCI CommercialView™, comprising approximately 42 million commercial and small-business credit records, including business credit profiles, trade payment data, and commercial financial summaries; and

(iii) MCI AltSignal™, comprising approximately 85 million consumer alternative-data records, including utility payment data, rental payment data, employment verification data, and other non-traditional credit indicators.

In the aggregate, the Licensed Data encompasses approximately 437 million records per month across the three data products. Quorum intends to use these data products as inputs to its proprietary underwriting models, risk-segmentation algorithms, and the QuorumScore™ platform, both for internal underwriting purposes and for third-party B2B licensing.

B. Negotiation History Relevant to Derived Data

The negotiation of the MDLA has extended over approximately six months, with the treatment of Derived Data emerging as one of the two most contentious issues (alongside most-favored-nation pricing). The relevant procedural history is as follows:

November 4, 2022: Meridian delivered its form MDLA to Quorum. The draft was prepared by Kessler Pruitt & Ashe LLP ("KP&A"), with Graham Whitley as lead partner. The form MDLA included the "sufficient transformation" standard in Article VII, Section 7.4(b), together with the perpetual license-back and 15% net revenue share provisions.

December 2, 2022: C&H, on behalf of Quorum, delivered a comprehensive redline of the MDLA. The redline included a complete rewrite of Article VII, vesting all intellectual property in Derived Data in Quorum as the creating party, with unrestricted rights to commercialize Derived Data to third parties, subject only to a prohibition on the resale or redistribution of Meridian's raw Licensed Data in unmodified form.

January 18, 2023 — First In-Person Negotiation Session (New York City). Representatives from Quorum (including Gregory Stahl), C&H (including Leonard Cross and the undersigned), Meridian (including Arthur Pennington, General Counsel, and Keith Marlow, Senior Vice President, Data Licensing), and KP&A (including Graham Whitley and Nina Chastain, senior associate) convened at the offices of Calderwood & Harkness in New York. During this session, the parties formally identified Derived Data rights and MFN pricing as the two principal open issues requiring resolution before the MDLA could be finalized. Meridian's team indicated a willingness to discuss objective criteria for the transformation standard but offered no specific alternative language.

March 9, 2023 — Second Negotiation Session (Atlanta, GA). The parties convened at Meridian's headquarters in Atlanta. Derived Data rights remained unresolved. Meridian's team — Mr. Pennington, Mr. Marlow, and KP&A counsel — reiterated the "sufficient transformation" standard with Meridian sole discretion, rejecting Quorum's proposed unrestricted commercialization framework. Mr. Pennington stated that Meridian's board of directors (including Breckenridge-appointed directors) considered unfettered derived-data rights to be a "red line" for the transaction. KP&A counsel suggested that the sole-discretion standard was "standard market practice for credit bureau data licensing," a characterization we dispute, as discussed in Section III.E below.

April 21, 2023: Meridian formally rejected Quorum's proposed most-favored-nation pricing clause via written correspondence from KP&A. In parallel, the derived-data impasse deepened, with no further movement from Meridian's side on the transformation standard. Mr. Whitley communicated by telephone to Mr. Cross that Meridian's position on sole discretion was "firm."

May 15, 2023 (Scheduled): A CEO-to-CEO telephone call between Margaret Tierney, President and Chief Executive Officer of Quorum, and Vincent Halstead, President and Chief Executive Officer of Meridian, has been arranged. The purpose of the call is to take stock of the overall negotiation status and determine whether sufficient common ground exists to justify continued negotiation. We understand from Ms. Tierney's office that the call resulted in an agreement to continue negotiating, but no substantive movement was achieved on the derived-data issue.

It is our assessment that Meridian's position on the "sufficient transformation" standard is heavily influenced by parties beyond Meridian's management team. Specifically, Breckenridge Capital Management LLC (through Caleb Rourke) and Whitmore Zanthor & Co. (through Rachel Ng-Castillo) appear to view any grant of unfettered derived-data commercialization rights to a licensee as a threat to Meridian's data-exclusivity narrative — a narrative that is central to the IPO valuation thesis Whitmore Zanthor is constructing for the anticipated 2025–2026 offering. In other words, the opposition to Quorum's derived-data commercialization is not merely a negotiation tactic but reflects a strategic position driven by Meridian's capital-markets advisors and private equity sponsor.

C. Definition of "Derived Data" at Issue

The MDLA draft defines "Derived Data" as follows:

"Derived Data" means any data, models, scores, indices, analytics outputs, or other information or intellectual property created by or on behalf of Licensee using, incorporating, or based upon the Licensed Data (i.e., the Meridian data feeds) as an input, in whole or in part.

This definition is itself a subject of dispute. As discussed in two prior C&H memoranda — Memorandum re: Derived-Data IP Ownership Under Copyright Law (January 2023, Schultz/Siddiqui) and Memorandum re: Ownership of ML Model Outputs — Copyright & Trade Secret Analysis (January 2023, Schultz/Siddiqui) — the breadth of this definition raises significant concerns. In particular, the phrase "based upon ... as an input, in whole or in part" is potentially expansive enough to capture outputs of machine-learning models that were merely trained on Licensed Data but generate inferences from entirely new, non-Meridian inputs at inference time. The copyright and trade-secret implications of this definitional scope are addressed in those companion memoranda.

However, for purposes of this memorandum, we focus specifically on the "sufficient transformation" gating mechanism for commercialization as set forth in Section 7.4(b), assuming arguendo the definition of "Derived Data" as drafted. Even accepting Meridian's broad definition, the "sufficient transformation" standard independently fails for the reasons set forth in Part III below.

III. Detailed Analysis of Meridian's "Sufficient Transformation" Standard

A. Text of Meridian's Proposed Provision

The operative language of Meridian's proposed provision, as set forth in Section 7.4(b) of the draft MDLA (Meridian/KP&A draft, dated November 4, 2022), reads in full as follows:

Section 7.4(b). Commercialization of Derived Data. Licensee shall not sell, sublicense, distribute, or otherwise make available any Derived Data to any third party unless such Derived Data has been sufficiently transformed such that no Licensed Data can be reverse-engineered, extracted, or otherwise derived therefrom, as determined by Licensor in its sole and absolute discretion.

It is important to note that Meridian proposed Section 7.4(b) in conjunction with two additional provisions that compound its commercial impact:

(i) Section 7.5 — License-Back. The MDLA draft provides that Quorum grants to Meridian a perpetual, irrevocable, non-exclusive, royalty-free, fully paid-up, worldwide license to use, reproduce, modify, display, distribute, and create derivative works of all Derived Data for Meridian's own internal and commercial purposes, including for the benefit of Meridian's other licensees and customers. This license-back survives termination of the MDLA.

(ii) Section 7.6 — Revenue Share. The MDLA draft provides that, with respect to any Derived Data that Meridian has approved for third-party commercialization under Section 7.4(b), Quorum shall pay to Meridian a royalty equal to fifteen percent (15%) of Net Revenues (as defined) derived from such commercialization, payable quarterly in arrears. "Net Revenues" is defined as gross revenues received by Quorum from third-party sublicensees of Derived Data, less only taxes, refunds, and credits — notably excluding any deduction for Quorum's costs of development, marketing, or delivery.

Taken together, Sections 7.4(b), 7.5, and 7.6 create a framework in which Meridian obtains (a) a veto right over Quorum's commercialization of its own derived outputs, (b) a perpetual free license to use those same outputs for its own benefit, and (c) a 15% revenue share on any outputs it deigns to approve for third-party distribution. The combined effect is to allow Meridian to capture the upside of Quorum's data-science investment while contributing only the underlying raw data — for which Quorum is already paying $60 million over five years.

B. Critique: Subjectivity and Veto Power

1. "Sole and Absolute Discretion" Is Commercially Unreasonable

The "sufficient transformation" standard vests in Meridian — the counterparty to the transaction and a competitor in the data-analytics market — an unfettered right to approve or deny Quorum's commercialization of its own derived outputs. The phrase "sole and absolute discretion" is among the broadest formulations of discretionary authority available in contract drafting, signaling an intent to eliminate any objective standard against which Meridian's determinations could be measured or challenged.

Under New York law, which is the governing law specified in the MDLA, "sole discretion" clauses are generally enforceable. However, they are subject to the implied covenant of good faith and fair dealing that inheres in every contract under New York law. In Dalton v. Educational Testing Service, 87 N.Y.2d 384, 389 (1995), the New York Court of Appeals held that even where a contract grants a party "sole discretion" to make a determination, the implied covenant of good faith requires that the discretion be exercised in a manner consistent with the reasonable expectations of the parties and not in bad faith. The Court of Appeals has since confirmed that the implied covenant operates as a gap-filler to ensure that neither party acts to deprive the other of the fruits of the agreement. See also 511 W. 232nd Owners Corp. v. Jennifer Realty Co., 98 N.Y.2d 144, 153 (2002) (implied covenant prevents one party from acting to destroy or injure the right of the other to receive the benefits of the contract).

While the implied covenant of good faith provides some theoretical protection for Quorum, it is an inadequate safeguard in this context for several reasons:

First, proving that Meridian acted in bad faith in denying a transformation determination would place a heavy evidentiary burden on Quorum and would require litigation — likely an arbitration proceeding under the MDLA's dispute-resolution clause. Quorum would need to demonstrate not merely that Meridian's determination was incorrect or unreasonable, but that it was made in bad faith — a subjective standard that is notoriously difficult to satisfy. Courts applying the implied covenant have repeatedly emphasized that it does not provide a basis for rewriting the terms of a contract or overriding an explicitly granted discretionary right. See Koch v. Acker, Merrall & Condit Co., 18 N.Y.3d 940, 941 (2012) (implied covenant cannot be used to create duties inconsistent with express contract terms).

Second, even if Quorum could ultimately prevail in a bad-faith challenge, the time and expense of litigation — and the uncertainty during the pendency of any dispute — would be commercially devastating. QuorumScore™ B2B licensees would require assurance that their supply of QuorumScore outputs is uninterrupted and not subject to a third party's veto. The mere existence of Meridian's discretionary approval right would create a cloud of uncertainty that would deter prospective licensees.

Third, Meridian has an inherent and multi-layered conflict of interest that renders its exercise of sole discretion structurally unreliable:

(a) Meridian competes with Quorum's derived analytics products in the broader data-analytics and risk-scoring market. Meridian offers its own premium analytics products to insurance carriers, financial institutions, and other customers. Approving the commercialization of QuorumScore — a product that may be superior to or competitive with Meridian's own analytics offerings — is directly contrary to Meridian's commercial interests.

(b) Breckenridge Capital Management and Whitmore Zanthor & Co. are motivated to suppress third-party commercialization of data derivatives by Meridian's licensees in order to protect Meridian's "data moat" narrative for purposes of the planned 2025–2026 IPO. A public offering prospectus that discloses that Meridian's licensees have unfettered rights to commercialize derived outputs would undermine the exclusivity premium that Whitmore Zanthor is seeking to embed in the IPO valuation.

(c) The 15% net revenue share payable under Section 7.6 gives Meridian a financial incentive to exercise its approval authority selectively and strategically — withholding approval as leverage to extract concessions on other deal terms, or timing approvals to maximize its own revenue-share receipts. The revenue share creates a perverse dynamic in which Meridian is incentivized to delay or condition approval, not to grant it freely.

In sum, vesting Meridian with sole and absolute discretion over the commercialization of Quorum's Derived Data outputs is the functional equivalent of granting Meridian a veto right over Quorum's business strategy — including the entire QuorumScore™ product line. This is commercially unreasonable and should be rejected unequivocally.

2. No Defined Criteria, Timelines, or Cure Mechanisms

Even setting aside the structural conflict of interest, the "sufficient transformation" standard as drafted suffers from a complete absence of procedural safeguards. Specifically:

No objective criteria. The provision contains no definition of what constitutes "sufficient transformation." It does not specify the methodology, the technical standard, the degree of transformation, or the benchmarks against which sufficiency is to be measured. Quorum's data engineers have no way to design their transformation processes to comply with the standard because the standard itself is undefined — it exists only in the subjective judgment of the opposing party.

No timeline for determination. The provision does not specify any period within which Meridian must render a determination as to whether Derived Data has been sufficiently transformed. Meridian could delay its response indefinitely — whether through deliberate foot-dragging or simple bureaucratic inertia — leaving Quorum unable to proceed with commercialization. In a fast-moving B2B licensing market, even a delay of several weeks could cause Quorum to lose prospective customers.

No appeal or dispute-resolution mechanism. There is no mechanism for Quorum to challenge or appeal a negative determination by Meridian. The general dispute-resolution provisions of the MDLA (Article XII) would presumably apply, but those provisions contemplate escalation to senior management followed by binding arbitration — a process that could take months or years and that would not provide the real-time commercial certainty that Quorum requires.

No cure or remediation path. If Meridian determines that a particular Derived Data output has not been "sufficiently transformed," the provision does not provide for Meridian to specify the deficiencies, recommend remedial measures, or afford Quorum an opportunity to cure. Quorum would be left to guess at what additional transformation would satisfy Meridian — only to submit a revised output for another round of discretionary review.

This drafting stands in stark contrast to well-drafted approval provisions in comparable technology transactions, which typically include:

(i) Objective standards or illustrative examples of what constitutes sufficient transformation;

(ii) A specified review period within which the licensor must render a determination (e.g., 30 business days from receipt of the submission);

(iii) A requirement that any denial be accompanied by detailed written reasons specifying the bases for the denial;

(iv) An independent expert determination mechanism, under which a mutually agreed-upon third-party expert resolves disputes regarding the sufficiency of transformation; and

(v) Deemed-approval provisions under which the licensor's failure to respond within the specified review period constitutes deemed approval of the submission.

Meridian's proposed provision includes none of these safeguards. The absence of procedural protections is not an oversight — it is a feature of a provision designed to maximize Meridian's leverage and minimize Quorum's ability to challenge adverse determinations.

C. Critique: Technical Impracticability

1. The "No Reverse-Engineering" Absolute Standard

The substantive core of Meridian's proposed standard is the requirement that "no Licensed Data can be reverse-engineered, extracted, or otherwise derived" from the Derived Data. This is an absolute impossibility standard — it does not require that reverse-engineering be difficult, impractical, or commercially infeasible, but that it be impossible. No qualified data scientist or information-security professional would certify that any transformation methodology renders reverse-engineering categorically impossible.

From a technical standpoint, it is well established in the data-science and information-security literature that it is often theoretically possible — given sufficient computational resources, background knowledge, and auxiliary data — to partially reconstruct input data from model outputs or enriched datasets. The relevant body of research includes:

Model inversion attacks. Fredrikson et al. (2015) demonstrated that machine-learning models can leak information about their training data, enabling an adversary to partially reconstruct training inputs from model predictions. While the precision of such attacks varies by model architecture and the nature of the training data, the theoretical possibility of partial reconstruction cannot be eliminated.

Membership inference attacks. Shokri et al. (2017) showed that an adversary can determine with non-trivial accuracy whether a particular data record was included in a model's training dataset, based solely on the model's output behavior. This is a form of information leakage from derived outputs to underlying data.

Statistical reconstruction. Dinur and Nissim (2003) proved the "fundamental law of information recovery," demonstrating that any system that answers a sufficient number of statistical queries about a dataset will eventually reveal the underlying data, regardless of the noise or transformation applied to individual query responses.

No commercially available transformation methodology provides an absolute guarantee against reverse-engineering. Even privacy-enhancing technologies that are widely regarded as state-of-the-art, such as differential privacy, provide only probabilistic (not absolute) guarantees. A differentially private mechanism ensures that the probability of any particular output is approximately the same whether or not any individual record is included in the input dataset — but it does not guarantee that no information about the input data can ever be inferred. The guarantee is bounded by the privacy parameter (epsilon), which trades off privacy protection against data utility.

The standard proposed by Meridian thus demands something that no transformation methodology can deliver. Quorum's data engineering team, led by Priya Nair, Director of Data Engineering, has confirmed that QuorumScore™ predictions — while trained in part on Meridian's consumer credit data — are blended with Quorum's own first-party claims data, policy data, and telematics data and processed through multi-layer neural network architectures. Extracting Meridian's raw credit-file data from a QuorumScore output would be computationally infeasible in practice — but no one, including Meridian's own data scientists, can certify that it is theoretically impossible, which is the standard Meridian demands.

Moreover, the standard conflates two analytically distinct concepts: re-identification risk (a privacy concept concerning the ability to identify a specific individual from ostensibly anonymized data) and reverse-engineering of proprietary data (an intellectual-property concept concerning the ability to reconstruct a licensor's proprietary dataset from a licensee's derived outputs). These two risks require fundamentally different analytical frameworks. Re-identification risk is typically assessed using well-established privacy metrics (k-anonymity, l-diversity, t-closeness, differential privacy). Reverse-engineering risk, by contrast, concerns the reconstruction of specific data fields and their values — a task whose feasibility depends on the nature and volume of the derived output, the adversary's background knowledge, the specificity of the output, and the computational resources available. By failing to distinguish between these concepts, Meridian's proposed standard creates a standard that is both technically incoherent and practically unworkable.

2. Ambiguity in What Constitutes Meridian "Raw Data"

The "sufficient transformation" standard prohibits the reverse-engineering of any "Licensed Data" — a defined term that encompasses all three Meridian data products (MCI Consumer Credit File, MCI CommercialView, and MCI AltSignal), comprising in the aggregate approximately 437 million records updated monthly. The standard does not clarify the level of granularity at which the prohibition applies.

Specifically, it is unclear whether the standard requires that no individual data element (e.g., a single tradeline entry for a single consumer, such as "Consumer ID 12345678, Account Type: Revolving, Current Balance: $4,215, Payment Status: Current") can be reconstructed from the Derived Data, or whether it refers to the inability to reconstruct the aggregate dataset or any substantial portion thereof. These are vastly different technical thresholds.

If the standard applies at the individual-data-element level, it is essentially impossible to satisfy for any derived output that reflects, even in aggregate, the statistical characteristics of the underlying data. A risk score that assigns a higher loss probability to consumers with recent delinquencies implicitly "reveals" the fact that consumers with delinquencies in the Licensed Data tend to have higher loss probabilities — and thus allows a trivial inference about the underlying data. This is an inherent characteristic of any analytics process: the purpose of analyzing data is to extract information from it, and the extracted information necessarily reflects the underlying data.

If, on the other hand, the standard applies at the aggregate-dataset level — i.e., it prohibits only the wholesale reconstruction of the Licensed Data — it would be a meaningfully different (and far more reasonable) standard, as wholesale reconstruction from derived analytics outputs is generally infeasible as a practical matter. But the language of Section 7.4(b) does not draw this distinction, and the use of the phrase "no Licensed Data" (with the singular/collective ambiguity inherent in "data") suggests that even partial reconstruction of individual elements would violate the standard.

Statistical aggregates, trend analyses, and risk scores by definition reflect characteristics of the underlying data. The question of how much underlying information can be inferred from a given derived output is one of degree, not kind. Meridian's proposed standard, by imposing an absolute prohibition on any inference of any Licensed Data from any Derived Data, treats the question as one of kind — a binary pass/fail — and thereby fails to account for the reality that all analytics outputs exist on a continuum of information leakage.

D. Critique: Inconsistency with Copyright and IP Law Principles

Meridian's "sufficient transformation" standard implicitly asserts that any Derived Data containing residual traces of factual inputs from the Licensed Data belongs to or is controlled by Meridian — an assertion that overreaches beyond what copyright law supports.

Under the Copyright Act (17 U.S.C. §§ 101 et seq.), a "derivative work" is defined as "a work based upon one or more preexisting works" and must incorporate a "substantial portion" of the preexisting copyrighted work. 17 U.S.C. § 101. The Supreme Court's seminal decision in Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340 (1991), established that facts are not copyrightable — only the original selection, coordination, and arrangement of facts can qualify for copyright protection. The Court held that a telephone directory's white pages, consisting of factual information arranged in alphabetical order, lacked the minimal creativity required for copyright protection. Id. at 362-63.

Credit bureau data consists largely of factual information: tradeline data (account types, balances, credit limits, payment histories), public records (bankruptcies, liens, judgments), and demographic data. These individual data elements are facts — they describe real-world credit relationships and payment behaviors — and are not protectable under copyright law regardless of the effort expended in collecting them. See Feist, 499 U.S. at 353-54 (rejecting the "sweat of the brow" doctrine). Meridian's compilation of these facts may be copyrightable to the extent that its selection and arrangement reflect original creativity — but the individual data elements themselves are not Meridian's intellectual property under copyright law.

The "sufficient transformation" standard, however, implicitly treats any derived output that reflects any factual information from the Licensed Data as Meridian's property — subject to Meridian's sole-discretion veto — regardless of whether the derived output constitutes a "derivative work" within the meaning of the Copyright Act. This is an IP overreach. The mere use of factual data as input to an analytical process does not necessarily create a derivative work, and the outputs of such a process — particularly when they represent original contributions of the creating party (here, Quorum) in the form of novel model architectures, feature engineering, and analytical insights — may be independently copyrightable works owned by Quorum.

We cross-reference the C&H memorandum dated January 2023, Memorandum re: Derived-Data IP Ownership Under Copyright Law (authored by the undersigned and Omar Siddiqui), which concluded that:

(i) Quorum's machine-learning model outputs likely do not constitute "derivative works" of the Licensed Data under 17 U.S.C. § 101, because the model outputs (risk scores, predictions, classifications) are analytically distinct from the underlying factual data and reflect Quorum's original creative contributions in model design, training methodology, feature selection, and architecture;

(ii) The trained model weights and parameters are analytically distinct from the inference outputs generated using new, non-Meridian inputs at prediction time — meaning that even if the training process implicates the Licensed Data, the inference outputs generated by applying the trained model to new data are further removed from the Licensed Data; and

(iii) The factual nature of the Licensed Data significantly weakens any claim by Meridian that downstream analytical outputs are "derivative works" subject to Meridian's copyright interest.

Meridian's "sufficient transformation" standard effectively seeks to obtain through contract what copyright law does not provide — proprietary control over downstream uses of factual information. While parties are, of course, free to allocate rights by contract in ways that differ from the default copyright rules, Quorum should understand that Meridian's claim to control Derived Data is not grounded in any inherent intellectual-property right but rather in contractual draftsmanship. This understanding strengthens Quorum's negotiating position: Meridian is asking for a contractual right that goes well beyond what the law would otherwise give it, and Quorum should demand correspondingly meaningful concessions in return — or, better yet, should resist the overreach entirely.

E. Critique: Inconsistency with Market Practice

The C&H memorandum dated April 2023, Memorandum re: License-Back Provisions in Data Licensing — Market Survey (authored by Omar Siddiqui), surveyed derived-data provisions in comparable enterprise data-licensing transactions in the credit-data and financial-data sectors. That survey was based on a review of publicly available agreements, C&H's proprietary precedent database, and discussions with practitioners at peer firms who regularly represent both licensors and licensees in data-licensing transactions. The survey's principal findings are directly relevant here.

In surveyed comparable transactions, typical derived-data provisions fell into one of three categories:

(i) Full Ownership, No Consent Required. In the most licensee-favorable formulation, the licensee is granted full ownership of all derived outputs, with the right to commercialize such outputs to third parties without the licensor's prior consent. The only restriction is a prohibition on the resale or redistribution of the licensor's raw data in unmodified form. This structure is common in agreements where the license fee is substantial and the licensee's use case involves significant value-added transformation.

(ii) Objective De-identification Standards. In a middle-ground formulation, the licensee may commercialize derived outputs that meet specified objective de-identification or aggregation standards — such as k-anonymity thresholds, minimum cohort sizes, aggregation requirements, or differential privacy budgets. The standards are defined in the agreement itself (or in a technical exhibit) and are testable by the licensee's data-engineering team without requiring the licensor's subjective approval.

(iii) Notice-Only. In a third formulation, the licensee provides the licensor with prior written notice (typically 30 days) of its intended commercialization of derived data, including a description of the transformation methodology. The licensor may object only on specified grounds (e.g., that the derived data contains raw Licensed Data in identifiable form), with disputes resolved by an independent expert. The licensor's failure to object within the notice period constitutes deemed approval.

Critically, no surveyed transaction granted the licensor sole discretion to determine transformation sufficiency. The closest analogue was a provision in a 2019 financial-data licensing agreement between a major U.S. bank and a fintech company, which required "mutual agreement" on transformation adequacy — but even that provision included an independent expert fallback mechanism and a 20-business-day response period.

The 15% net revenue share that Meridian demands on top of the transformation gate is itself significantly above the market range. The C&H market survey found that, where revenue shares on derived-data commercialization exist at all (which is itself uncommon — the majority of surveyed agreements included no revenue-share component), they typically range from 3% to 8% of net revenues. The 15% share proposed by Meridian is nearly double the upper end of this range and is compounded by the fact that "Net Revenues" as defined in Section 7.6 does not permit deductions for Quorum's development, marketing, or delivery costs — only for taxes, refunds, and credits. This results in an effective revenue share that, when measured against Quorum's gross margin on Derived Data licensing, could approach 25–30% or higher.

In summary, Meridian's combined proposal — sole discretion, perpetual license-back, and 15% net revenue share — is a significant outlier relative to market practice and should be characterized as such in negotiations.

IV. Impact on QuorumScore™ and Quorum's Commercial Strategy

A. QuorumScore™ Overview

QuorumScore™ is Quorum's proprietary predictive underwriting model, designed to generate granular, individual-level risk scores for use in property and casualty insurance underwriting, pricing, and portfolio management. A United States Patent and Trademark Office trademark application for "QuorumScore" is pending under Serial Number 97/482,116. Angela Firth, of Caldwell & Strauss LLP, Quorum's longstanding outside intellectual-property counsel (100 Pearl Street, Hartford, Connecticut 06103), has been coordinating with C&H on IP ownership positioning for QuorumScore in the context of the MDLA negotiation.

QuorumScore blends multiple data inputs from diverse sources:

• Meridian's consumer credit data (MCI Consumer Credit File, MCI AltSignal);

• Quorum's own first-party claims history data (approximately 15 years of structured claims records);

• Quorum's first-party policy data (policy characteristics, coverage limits, endorsements, demographic data);

• Quorum's telematics data (from its QuorumDrive™ usage-based insurance program, covering approximately 2.8 million active policies);

• Third-party weather and catastrophe modeling data (from Beaumont Group and Harborline Software); and

• Publicly available macroeconomic and demographic data (from the Bureau of Labor Statistics, Census Bureau, and similar sources).

These inputs are processed through a multi-layer neural network architecture incorporating feature engineering, embedding layers, and ensemble methods developed by Quorum's Data Science team under the direction of Rajesh Anand, Chief Data Officer. The resulting QuorumScore output is a numerical risk score (on a 0–999 scale) together with associated confidence intervals, factor-contribution analyses, and segment assignments.

QuorumScore is central to Quorum's competitive strategy on two fronts:

First, as an internal underwriting tool, QuorumScore enables Quorum to achieve more accurate risk segmentation, leading to better pricing precision, improved loss ratios, and enhanced portfolio profitability. Quorum estimates that QuorumScore deployment has contributed approximately 2.1 percentage points of combined-ratio improvement in the lines where it has been fully deployed.

Second, and critically for purposes of this memorandum, QuorumScore is the foundation of Quorum's planned B2B licensing revenue line. Quorum intends to license QuorumScore outputs to other insurance carriers, reinsurers, and managing general agents ("MGAs") who do not possess comparable in-house data-science capabilities. Quorum's financial projections, as included in the FY 2024–2028 Strategic Plan presented to the Board of Directors on March 15, 2023, project that B2B licensing of QuorumScore will generate $40–50 million in annual revenue by 2027, growing to a potential $70–80 million by 2030. These projections are a material component of Quorum's equity story and have been communicated to analysts and investors in general terms.

B. Risk Analysis

Under Meridian's proposed "sufficient transformation" standard, any third-party commercialization of QuorumScore outputs — including the licensing of QuorumScore risk scores, segment assignments, or analytical reports to other insurance carriers, reinsurers, or MGAs — would require Meridian's prior approval under Section 7.4(b). Because QuorumScore is trained in part on Meridian's consumer credit data, the QuorumScore output falls squarely within the MDLA's definition of "Derived Data," and Meridian would have sole and absolute discretion to determine whether the QuorumScore output has been "sufficiently transformed."

As discussed in Section III.B above, Meridian has no incentive to grant such approval:

(a) Meridian competes directly in the analytics market with its own suite of credit-risk scoring and analytics products offered to insurance carriers and financial institutions. Approving the B2B licensing of QuorumScore — a product that, by design, is intended to provide superior predictive accuracy by blending credit data with insurance-specific data — would directly cannibalize demand for Meridian's own analytics offerings.

(b) Approving the widespread distribution of QuorumScore would undercut the data-exclusivity narrative that Breckenridge Capital Management and Whitmore Zanthor & Co. are constructing for Meridian's planned IPO. If Meridian's prospectus disclosed that a major licensee had unfettered rights to commercialize derived analytics products incorporating Meridian data, prospective IPO investors might discount Meridian's valuation on the theory that its data "moat" is not as impregnable as represented. This concern has been explicitly communicated by Meridian's team during negotiations — Mr. Pennington stated at the March 9 session that "our board is focused on protecting the integrity of our data platform" — and we believe it is the primary driver of Meridian's intransigence on this issue.

(c) Even if Meridian were inclined to approve QuorumScore commercialization in principle, the 15% net revenue share creates an incentive for selective and strategic approval. Meridian could withhold or delay approval as leverage in other aspects of the business relationship, or could condition approval on additional concessions (e.g., expanded license-back rights, most-favored-customer pricing, or exclusive supply commitments).

The practical consequence is stark: Meridian's proposal would effectively kill Quorum's $40–50 million B2B licensing strategy or, at a minimum, subject it to Meridian's perpetual veto and a 15% revenue tax. Even if Meridian were to approve QuorumScore commercialization on a case-by-case basis, the uncertainty inherent in the sole-discretion standard would make it commercially impracticable for Quorum to market QuorumScore to prospective B2B licensees. Prospective licensees would require binding assurances of uninterrupted supply and IP clarity before committing to multi-year licensing arrangements — assurances that Quorum cannot provide if its right to distribute QuorumScore is subject to Meridian's approval at any time.

Furthermore, the license-back provision in Section 7.5 would give Meridian a perpetual, royalty-free right to use QuorumScore and all other Derived Data for Meridian's own purposes, including for the benefit of Meridian's other customers and licensees. Meridian could, in theory, incorporate QuorumScore insights into its own analytics products and offer them to the market — competing with Quorum using Quorum's own intellectual contribution, without paying Quorum any compensation. This creates a perverse dynamic in which Quorum bears all the costs of developing QuorumScore (data-science personnel, computational infrastructure, training data, model validation) while Meridian captures a substantial share of the benefits through the license-back and revenue share.

C. Post-Termination Dimension

The MDLA draft requires Quorum to return or destroy all Licensed Data (i.e., Meridian's raw data feeds) within 90 days following the expiration or termination of the MDLA. This is a standard data-return provision and is not itself objectionable.

However, the treatment of Derived Data post-termination remains a disputed term. Under Meridian's framework, the implications are as follows:

(i) If Quorum's Derived Data (including QuorumScore and its trained model weights) has not been determined by Meridian to be "sufficiently transformed," it would presumably be treated as containing Licensed Data and therefore subject to the same return/destroy obligation. This could result in Quorum being required to destroy its entire QuorumScore model — including the trained neural-network weights, the feature-engineering pipeline, the historical prediction outputs, and all associated intellectual property — upon termination of a five-year license.

(ii) Even if Derived Data that has been approved as "sufficiently transformed" is exempt from the return/destroy obligation, the scope of approved Derived Data would depend entirely on how many transformation determinations Meridian has issued during the term — and, as discussed above, Meridian has every incentive to issue as few approvals as possible.

(iii) The perpetual license-back in Section 7.5 survives termination, meaning that Meridian would retain the right to use all Derived Data (including QuorumScore) even after the MDLA expires, while Quorum might be required to destroy its own copy. This asymmetry is commercially unconscionable.

The combined effect of the "sufficient transformation" standard and the post-termination provisions creates an unacceptable lock-in dynamic and IP forfeiture risk. Quorum would be investing $60 million over five years in a data license and additional millions in developing proprietary analytics capabilities — only to face the risk that all of its derived intellectual property could be subject to forfeiture upon termination, while Meridian retains a perpetual license to the same IP. This structure makes the MDLA less a licensing arrangement and more an IP-capture mechanism.

V. Proposed Objective Alternative Standards

In lieu of Meridian's subjective, sole-discretion standard, we propose the following objective, measurable alternative standards for inclusion in a revised Article VII. These alternatives are designed to be technically defensible, commercially reasonable, consistent with market practice, and responsive to Meridian's legitimate interest in preventing the wholesale redistribution of its raw data.

A. Aggregation and De-identification Threshold

We propose that Derived Data be deemed "sufficiently transformed" — and therefore eligible for third-party commercialization without further licensor approval — if it satisfies both of the following objective criteria:

(i) The Derived Data has been aggregated such that no output pertains to, or is derived from, fewer than a specified minimum number of individual consumer or commercial records from the Licensed Data. We recommend an initial proposal of a minimum cohort size of 1,000 records, subject to negotiation; and

(ii) No individual Meridian data element — defined at the field level (e.g., no individual tradeline entry, no individual account balance, no individual payment-history record) — can be identified from the Derived Data output. This criterion would be assessed based on the format and content of the output itself, not on the theoretical possibility of reverse-engineering given unlimited computational resources.

This standard provides an objective, testable, and commercially reasonable benchmark that Quorum's data-engineering team can design its transformation processes to satisfy. It is consistent with widely accepted privacy best practices, including the principles underlying HIPAA's Safe Harbor de-identification standard (45 C.F.R. § 164.514(b)) and the CCPA's deidentification requirements (Cal. Civ. Code § 1798.140(m)). Importantly, it addresses Meridian's legitimate concern — preventing the wholesale redistribution of identifiable raw data — without imposing an impossible absolute standard.

B. Technical Certification by Independent Expert

As a procedural safeguard to supplement (or, if Meridian insists, replace) the aggregation threshold, we propose that Quorum be permitted to engage an independent, mutually agreed-upon third-party data-science expert to certify that the Derived Data does not permit reconstruction of individual Licensed Data records with a probability exceeding a defined statistical threshold.

(i) The proposed statistical threshold is that the probability of re-identification or reconstruction of any individual Licensed Data record from the Derived Data shall not exceed 5%, using best available methods and commercially reasonable computational resources. This is a well-recognized standard in the privacy and data-science literature and provides a meaningful (but not absolute) guarantee against reverse-engineering.

(ii) The independent expert shall be selected by mutual agreement of the parties from a pre-approved list of qualified data-science firms (to be attached as an exhibit to the MDLA). If the parties cannot agree on an expert, each party shall nominate one candidate, and the two nominees shall select a third, who shall serve as the independent expert.

(iii) The independent expert's determination shall be binding on both parties, subject to a limited right of appeal. If either party disputes the expert's determination, the dispute shall be referred to a panel of three independent experts (one selected by each party and a third selected by the first two), whose majority determination shall be final and binding.

(iv) The cost of the initial independent expert review shall be borne by Quorum; the cost of any appeal shall be borne by the non-prevailing party.

This mechanism replaces Meridian's sole discretion with an objective, independent determination — eliminating the conflict-of-interest problem while still providing assurance that Quorum's Derived Data outputs do not impermissibly expose Meridian's Licensed Data.

C. Categorical Safe Harbors

We further propose that certain categories of Derived Data be categorically deemed "sufficiently transformed" and eligible for third-party commercialization without any further approval, review, or certification. The following categories are proposed:

(i) Aggregate statistical models, indices, and risk scores. This category includes QuorumScore™ outputs and any other predictive model outputs, risk scores, indices, or classification outputs that produce predictions or scores based on the statistical characteristics of individual records but do not output or expose the underlying Licensed Data fields. A QuorumScore risk score of "742" for a given insurance applicant does not reveal the applicant's tradeline data, account balances, or payment history — it reveals only a blended predictive assessment derived from multiple data sources. Such outputs should be categorically exempt from the transformation-approval process.

(ii) Model weights, parameters, and trained algorithms. The weights, parameters, coefficients, and architecture of a trained machine-learning model reflect the statistical patterns learned from the training data but do not contain or reproduce the training data itself. A neural-network weight matrix is not a database of credit records; it is a mathematical abstraction that encodes learned patterns. Model weights and parameters should be categorically exempt regardless of the fact that Licensed Data was used in the training process. This is consistent with the emerging consensus in the data-science and legal communities that trained model parameters are analytically distinct from training data.

(iii) Benchmarking reports, trend analyses, and market studies. Reports, analyses, and studies that contain only aggregate or summary-level statistics (e.g., "the median FICO-equivalent score for consumers in the Southeast region declined by 12 points in Q4 2022") do not expose individual Licensed Data records and should be categorically exempt.

This carve-out approach protects Quorum's core use cases — most importantly, the B2B licensing of QuorumScore outputs — while addressing Meridian's legitimate concern about wholesale redistribution of raw data. The safe harbors are defined by the nature of the output, not by a subjective assessment of its "transformation," and therefore provide the commercial certainty that Quorum and its prospective B2B licensees require.

D. Notification-Only Regime (Alternative to Consent)

For Derived Data that falls outside the categorical safe harbors — e.g., enriched datasets, individual-level analytics outputs that reference specific Licensed Data fields, or novel output formats not contemplated by the safe-harbor categories — we propose a notification-only regime as an alternative to Meridian's consent requirement:

(i) Quorum shall provide Meridian with 30 days' prior written notice of its intended third-party commercialization of such Derived Data, together with a description of the Derived Data, its transformation methodology, and the intended recipient or class of recipients.

(ii) If Meridian objects to the proposed commercialization within the 30-day notice period, it must provide detailed written reasons for its objection, specifically identifying the Licensed Data fields or records that it believes can be reconstructed from the Derived Data and the methodology by which such reconstruction could be achieved.

(iii) Any dispute arising from Meridian's objection shall be resolved by an independent expert under the mechanism described in Section V.B above — not by Meridian's sole discretion.

(iv) If Meridian fails to object within the 30-day notice period, Meridian shall be deemed to have approved the proposed commercialization, and Quorum may proceed without further consent.

This notification-only regime provides Meridian with a meaningful opportunity to raise legitimate concerns about specific Derived Data outputs while ensuring that Meridian cannot exercise an unfettered veto or delay commercialization indefinitely. The deemed-approval mechanism for failure to respond within 30 days provides an essential backstop against bureaucratic inertia or strategic delay.

E. Elimination of Revenue Share

Quorum should firmly and unequivocally resist the 15% net revenue share on Derived Data commercialization. The economic rationale for this position is straightforward:

(i) Quorum is already paying $60 million over five years for the right to use the Licensed Data. The license fee compensates Meridian for the use of its data. Requiring a revenue share on outputs that Quorum creates using that data — outputs that also incorporate Quorum's own first-party data, proprietary algorithms, and substantial R&D investment — amounts to double-charging for the same underlying asset.

(ii) The 15% rate is well above the market range. As noted in the C&H market survey (April 2023, Siddiqui), where revenue shares on derived-data commercialization exist at all (a minority of comparable transactions), they typically range from 3% to 8% of net revenues. The 15% rate proposed by Meridian is nearly double the upper bound of the market range.

(iii) The "Net Revenues" definition in Section 7.6, which does not permit deductions for Quorum's development costs, marketing costs, delivery costs, or any other costs of creating and distributing the Derived Data, makes the effective rate significantly higher than 15% when measured against Quorum's gross margin. Given Quorum's estimated cost structure for QuorumScore B2B licensing (including data-science personnel, computational infrastructure, customer support, and sales and marketing), the effective revenue-share burden on Quorum's gross margin could approach 25–30%.

(iv) The revenue share creates a misaligned incentive structure. Meridian would benefit financially from Quorum's Derived Data commercialization success while simultaneously holding a veto over that commercialization — an inherently conflicted position that invites strategic behavior.

If Meridian insists on some form of financial participation in Derived Data commercialization as a non-negotiable condition for the transaction, Quorum may consider, as a last-resort compromise, a de minimis acknowledgment fee structured as a fixed annual payment capped at $500,000, regardless of Quorum's actual Derived Data revenues. This cap would limit Meridian's financial participation to a nominal amount that does not distort Quorum's B2B licensing economics. However, this compromise should be offered only if (a) the transformation gating standard is replaced with the objective mechanisms described in Sections V.A through V.D, and (b) Quorum retains full ownership of all Derived Data intellectual property, free of any license-back obligation.

VI. Negotiation Recommendations

A. Immediate Actions

Based on the analysis set forth in this memorandum, we recommend the following immediate actions:

1. Reject the "sole and absolute discretion" standard unequivocally. In any written or oral communications with Meridian and KP&A, Quorum's position should be framed in terms of (a) commercial unreasonableness, (b) Meridian's inherent conflict of interest as both counterparty and competitor, and (c) inconsistency with market practice for enterprise data-licensing transactions. The rejection should be firm and clear — this is not a provision that can be "softened" with minor drafting adjustments. The fundamental architecture of Section 7.4(b) — licens

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
MEMORANDUM
TO: Carolyn Whitford, General Counsel & Executive Vice President, Quorum Insurance Holdings Corp. Gregory Stahl, Vice President, Legal Affairs, Quorum Insurance Holdings Corp.
FROM: Wendy Schultz, Associate, intellectual Property, Calderwood & Harkness LLP
CC: Leonard Cross, Partner (Responsible Partner) Patricia Heng, Senior Counsel, Technology Transactions Omar Siddiqui, Associate, intellectual Property
DATE: May 12, 2023
RE: Critique of Meridian Credit intelligence, Inc.'s Proposed "Sufficient Transformation" Standard for Derived Data Commercialization — Master Data License Agreement Negotiation
C&H Matter No.: 1025-00008
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to analyze and critique the "sufficient transformation" standard proposed by Meridian Credit intelligence, Inc. ("Meridian") in Article VII of the draft Master Data License Agreement ("MDLA") as a precondition to Quorum Insurance Holdings Corp.'s ("Quorum") ability to commercialize Derived Data to third parties. This analysis is being provided in advance of the next scheduled negotiation session and is intended to equip the Quorum legal and business teams with a comprehensive understanding of the legal, technical, and commercial deficiencies in Meridian's proposal, as well as a set of defensible alternative standards and a recommended negotiation approach.
Under Meridian's proposal, as set forth in Section 7.4(b) of the draft MDLA, Quorum may not sell, sublicense, or otherwise distribute Derived Data to third parties unless the Derived Data has been "sufficiently transformed" such that no Meridian raw data can be reverse-engineered from it — with Meridian retaining sole and absolute discretion to determine whether "sufficient transformation" has been achieved. This standard is paired with a perpetual, royalty-free license-back to Meridian on all Derived Data and a 15% net revenue share payable to Meridian on any approved third-party commercialization.
It is our central conclusion that the "sufficient transformation" standard as proposed is:
(a) Unworkably subjective, offering no defined criteria, timelines, or cure mechanisms by which Quorum can assess whether any particular Derived Data output will satisfy the standard;
(b) Commercially unreasonable in vesting unfettered veto power in Meridian — a counterparty that is both a competitor in the data-analytics market and a party with strong financial incentives (driven by its private-equity sponsor and IPO advisors) to suppress Quorum's third-party commercialization efforts;
(c) Technically impracticable in demanding an absolute impossibility of reverse-engineering — a standard that no commercially available transformation methodology can satisfy and that conflates re-identification risk (a privacy concept) with reverse-engineering of proprietary data (an IP concept);
(d) Inconsistent with market practice for enterprise data-licensing transactions, where derived-data provisions typically rely on objective de-identification standards, independent expert determinations, or categorical safe harbors rather than licensor sole discretion; and
(e) An existential threat to Quorum's QuorumScore™ commercialization strategy and its projected $40–50 million B2B licensing revenue by 2027, effectively granting Meridian a perpetual veto over a core Quorum business line.
This memorandum proposes objective, measurable alternative standards — including aggregation and de-identification thresholds, independent expert certification, categorical safe harbors (with an explicit QuorumScore™ carve-out), and a notification-only regime replacing sole-discretion consent — and recommends a negotiation approach for the upcoming sessions. We further recommend that the 15% net revenue share be rejected outright, as it constitutes double-charging on top of the $60 million license fee and is well above the market range for comparable transactions.
Calderwood & Harkness LLP ("C&H") is prepared to draft revised Article VII language incorporating these alternatives for inclusion in the next round of MDLA markup upon Quorum's approval of this memorandum's recommendations.
II. Background and Procedural Context
A. The Parties and the Transaction
Quorum Insurance Holdings Corp. Quorum is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC, and headquartered at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901. Quorum operates as a multi-line insurance carrier and insurtech platform, offering property and casualty, specialty, and life insurance products through both traditional and technology-enabled distribution channels. For its fiscal year ended December 31, 2022, Quorum reported consolidated revenue of approximately $4.18 billion. Quorum's strategic plan centers on the development and commercialization of proprietary data-driven underwriting models — most prominently, QuorumScore™ — as a source of competitive differentiation and a new B2B licensing revenue line.
Meridian Credit intelligence, Inc. Meridian is a Georgia corporation, privately held, and headquartered at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326. Meridian operates as a consumer and commercial credit bureau and data analytics company, providing credit-scoring, credit-monitoring, and data-licensing services to financial institutions, insurance carriers, and other enterprise customers. For its fiscal year ended December 31, 2022, Meridian reported revenue of approximately $1.42 billion and adjusted EBITDA of approximately $438 million. Meridian is majority-owned (62.5% equity interest) by Breckenridge Capital Partners Fund IV, L.P. ("Breckenridge"), a private equity fund managed by Breckenridge Capital Management LLC. Caleb Rourke, a partner at Breckenridge Capital Management, oversees the Meridian investment and has been involved in certain strategic decisions relating to the MDLA negotiation. Meridian has retained Whitmore Zanthor & Co. ("Whitmore Zanthor"), with Rachel Ng-Castillo, Managing Director, as lead advisor, in connection with a planned initial public offering of Meridian's common stock anticipated for the 2025–2026 timeframe.
The Transaction. The proposed MDLA contemplates a five-year enterprise data-licensing arrangement between Meridian (as Licensor) and Quorum (as Licensee), with a total contract value of $60,000,000. The license fee structure allocates $10.8 million to Year 1 (reflecting a reduced initial-year fee in consideration of implementation costs and ramp-up) and $12.3 million annually for each of Years 2 through 5. The MDLA covers Meridian's three principal data products:
(i) The MCI Consumer Credit File™, comprising approximately 310 million consumer credit records updated on a monthly basis, including tradeline data, payment histories, account balances, public records, and credit inquiries;
(ii) MCI CommercialView™, comprising approximately 42 million commercial and small-business credit records, including business credit profiles, trade payment data, and commercial financial summaries; and
(iii) MCI AltSignal™, comprising approximately 85 million consumer alternative-data records, including utility payment data, rental payment data, employment verification data, and other non-traditional credit indicators.
In the aggregate, the Licensed Data encompasses approximately 437 million records per month across the three data products. Quorum intends to use these data products as inputs to its proprietary underwriting models, risk-segmentation algorithms, and the QuorumScore™ platform, both for internal underwriting purposes and for third-party B2B licensing.
B. Negotiation History Relevant to Derived Data
The negotiation of the MDLA has extended over approximately six months, with the treatment of Derived Data emerging as one of the two most contentious issues (alongside most-favored-nation pricing). The relevant procedural history is as follows:
November 4, 2022: Meridian delivered its form MDLA to Quorum. The draft was prepared by Kessler Pruitt & Ashe LLP ("KP&A"), with Graham Whitley as lead partner. The form MDLA included the "sufficient transformation" standard in Article VII, Section 7.4(b), together with the perpetual license-back and 15% net revenue share provisions.
December 2, 2022: C&H, on behalf of Quorum, delivered a comprehensive redline of the MDLA. The redline included a complete rewrite of Article VII, vesting all intellectual property in Derived Data in Quorum as the creating party, with unrestricted rights to commercialize Derived Data to third parties, subject only to a prohibition on the resale or redistribution of Meridian's raw Licensed Data in unmodified form.
January 18, 2023 — First In-Person Negotiation Session (New York City). Representatives from Quorum (including Gregory Stahl), C&H (including Leonard Cross and the undersigned), Meridian (including Arthur Pennington, General Counsel, and Keith Marlow, Senior Vice President, Data Licensing), and KP&A (including Graham Whitley and Nina Chastain, senior associate) convened at the offices of Calderwood & Harkness in New York. During this session, the parties formally identified Derived Data rights and MFN pricing as the two principal open issues requiring resolution before the MDLA could be finalized. Meridian's team indicated a willingness to discuss objective criteria for the transformation standard but offered no specific alternative language.
March 9, 2023 — Second Negotiation Session (Atlanta, GA). The parties convened at Meridian's headquarters in Atlanta. Derived Data rights remained unresolved. Meridian's team — Mr. Pennington, Mr. Marlow, and KP&A counsel — reiterated the "sufficient transformation" standard with Meridian sole discretion, rejecting Quorum's proposed unrestricted commercialization framework. Mr. Pennington stated that Meridian's board of directors (including Breckenridge-appointed directors) considered unfettered derived-data rights to be a "red line" for the transaction. KP&A counsel suggested that the sole-discretion standard was "standard market practice for credit bureau data licensing," a characterization we dispute, as discussed in Section III.E below.
April 21, 2023: Meridian formally rejected Quorum's proposed most-favored-nation pricing clause via written correspondence from KP&A. In parallel, the derived-data impasse deepened, with no further movement from Meridian's side on the transformation standard. Mr. Whitley communicated by telephone to Mr. Cross that Meridian's position on sole discretion was "firm."
May 15, 2023 (Scheduled): A CEO-to-CEO telephone call between Margaret Tierney, President and Chief Executive Officer of Quorum, and Vincent Halstead, President and Chief Executive Officer of Meridian, has been arranged. The purpose of the call is to take stock of the overall negotiation status and determine whether sufficient common ground exists to justify continued negotiation. We understand from Ms. Tierney's office that the call resulted in an agreement to continue negotiating, but no substantive movement was achieved on the derived-data issue.
It is our assessment that Meridian's position on the "sufficient transformation" standard is heavily influenced by parties beyond Meridian's management team. Specifically, Breckenridge Capital Management LLC (through Caleb Rourke) and Whitmore Zanthor & Co. (through Rachel Ng-Castillo) appear to view any grant of unfettered derived-data commercialization rights to a licensee as a threat to Meridian's data-exclusivity narrative — a narrative that is central to the IPO valuation thesis Whitmore Zanthor is constructing for the anticipated 2025–2026 offering. In other words, the opposition to Quorum's derived-data commercialization is not merely a negotiation tactic but reflects a strategic position driven by Meridian's capital-markets advisors and private equity sponsor.
C. Definition of "Derived Data" at Issue
The MDLA draft defines "Derived Data" as follows:
"Derived Data" means any data, models, scores, indices, analytics outputs, or other information or intellectual property created by or on behalf of Licensee using, incorporating, or based upon the Licensed Data (i.e., the Meridian data feeds) as an input, in whole or in part.
This definition is itself a subject of dispute. As discussed in two prior C&H memoranda — Memorandum re: Derived-Data IP Ownership Under Copyright Law (January 2023, Schultz/Siddiqui) and Memorandum re: Ownership of ML Model Outputs — Copyright & Trade Secret Analysis (January 2023, Schultz/Siddiqui) — the breadth of this definition raises significant concerns. In particular, the phrase "based upon ... as an input, in whole or in part" is potentially expansive enough to capture outputs of machine-learning models that were merely trained on Licensed Data but generate inferences from entirely new, non-Meridian inputs at inference time. The copyright and trade-secret implications of this definitional scope are addressed in those companion memoranda.
However, for purposes of this memorandum, we focus specifically on the "sufficient transformation" gating mechanism for commercialization as set forth in Section 7.4(b), assuming arguendo the definition of "Derived Data" as drafted. Even accepting Meridian's broad definition, the "sufficient transformation" standard independently fails for the reasons set forth in Part III below.
III. Detailed Analysis of Meridian's "Sufficient Transformation" Standard
A. Text of Meridian's Proposed Provision
The operative language of Meridian's proposed provision, as set forth in Section 7.4(b) of the draft MDLA (Meridian/KP&A draft, dated November 4, 2022), reads in full as follows:
Section 7.4(b). Commercialization of Derived Data. Licensee shall not sell, sublicense, distribute, or otherwise make available any Derived Data to any third party unless such Derived Data has been sufficiently transformed such that no Licensed Data can be reverse-engineered, extracted, or otherwise derived therefrom, as determined by Licensor in its sole and absolute discretion.
It is important to note that Meridian proposed Section 7.4(b) in conjunction with two additional provisions that compound its commercial impact:
(i) Section 7.5 — License-Back. The MDLA draft provides that Quorum grants to Meridian a perpetual, irrevocable, non-exclusive, royalty-free, fully paid-up, worldwide license to use, reproduce, modify, display, distribute, and create derivative works of all Derived Data for Meridian's own internal and commercial purposes, including for the benefit of Meridian's other licensees and customers. This license-back survives termination of the MDLA.
(ii) Section 7.6 — Revenue Share. The MDLA draft provides that, with respect to any Derived Data that Meridian has approved for third-party commercialization under Section 7.4(b), Quorum shall pay to Meridian a royalty equal to fifteen percent (15%) of Net Revenues (as defined) derived from such commercialization, payable quarterly in arrears. "Net Revenues" is defined as gross revenues received by Quorum from third-party sublicensees of Derived Data, less only taxes, refunds, and credits — notably excluding any deduction for Quorum's costs of development, marketing, or delivery.
Taken together, Sections 7.4(b), 7.5, and 7.6 create a framework in which Meridian obtains (a) a veto right over Quorum's commercialization of its own derived outputs, (b) a perpetual free license to use those same outputs for its own benefit, and (c) a 15% revenue share on any outputs it deigns to approve for third-party distribution. The combined effect is to allow Meridian to capture the upside of Quorum's data-science investment while contributing only the underlying raw data — for which Quorum is already paying $60 million over five years.
B. Critique: Subjectivity and Veto Power
1. "Sole and Absolute Discretion" Is Commercially Unreasonable
The "sufficient transformation" standard vests in Meridian — the counterparty to the transaction and a competitor in the data-analytics market — an unfettered right to approve or deny Quorum's commercialization of its own derived outputs. The phrase "sole and absolute discretion" is among the broadest formulations of discretionary authority available in contract drafting, signaling an intent to eliminate any objective standard against which Meridian's determinations could be measured or challenged.
Under New York law, which is the governing law specified in the MDLA, "sole discretion" clauses are generally enforceable. However, they are subject to the implied covenant of good faith and fair dealing that inheres in every contract under New York law. In Dalton v. Educational Testing Service, 87 N.Y.2d 384, 389 (1995), the New York Court of Appeals held that even where a contract grants a party "sole discretion" to make a determination, the implied covenant of good faith requires that the discretion be exercised in a manner consistent with the reasonable expectations of the parties and not in bad faith. The Court of Appeals has since confirmed that the implied covenant operates as a gap-filler to ensure that neither party acts to deprive the other of the fruits of the agreement. See also 511 W. 232nd Owners Corp. v. Jennifer Realty Co., 98 N.Y.2d 144, 153 (2002) (implied covenant prevents one party from acting to destroy or injure the right of the other to receive the benefits of the contract).
While the implied covenant of good faith provides some theoretical protection for Quorum, it is an inadequate safeguard in this context for several reasons:
First, proving that Meridian acted in bad faith in denying a transformation determination would place a heavy evidentiary burden on Quorum and would require litigation — likely an arbitration proceeding under the MDLA's dispute-resolution clause. Quorum would need to demonstrate not merely that Meridian's determination was incorrect or unreasonable, but that it was made in bad faith — a subjective standard that is notoriously difficult to satisfy. Courts applying the implied covenant have repeatedly emphasized that it does not provide a basis for rewriting the terms of a contract or overriding an explicitly granted discretionary right. See Koch v. Acker, Merrall & Condit Co., 18 N.Y.3d 940, 941 (2012) (implied covenant cannot be used to create duties inconsistent with express contract terms).
Second, even if Quorum could ultimately prevail in a bad-faith challenge, the time and expense of litigation — and the uncertainty during the pendency of any dispute — would be commercially devastating. QuorumScore™ B2B licensees would require assurance that their supply of QuorumScore outputs is uninterrupted and not subject to a third party's veto. The mere existence of Meridian's discretionary approval right would create a cloud of uncertainty that would deter prospective licensees.
Third, Meridian has an inherent and multi-layered conflict of interest that renders its exercise of sole discretion structurally unreliable:
(a) Meridian competes with Quorum's derived analytics products in the broader data-analytics and risk-scoring market. Meridian offers its own premium analytics products to insurance carriers, financial institutions, and other customers. Approving the commercialization of QuorumScore — a product that may be superior to or competitive with Meridian's own analytics offerings — is directly contrary to Meridian's commercial interests.
(b) Breckenridge Capital Management and Whitmore Zanthor & Co. are motivated to suppress third-party commercialization of data derivatives by Meridian's licensees in order to protect Meridian's "data moat" narrative for purposes of the planned 2025–2026 IPO. A public offering prospectus that discloses that Meridian's licensees have unfettered rights to commercialize derived outputs would undermine the exclusivity premium that Whitmore Zanthor is seeking to embed in the IPO valuation.
(c) The 15% net revenue share payable under Section 7.6 gives Meridian a financial incentive to exercise its approval authority selectively and strategically — withholding approval as leverage to extract concessions on other deal terms, or timing approvals to maximize its own revenue-share receipts. The revenue share creates a perverse dynamic in which Meridian is incentivized to delay or condition approval, not to grant it freely.
In sum, vesting Meridian with sole and absolute discretion over the commercialization of Quorum's Derived Data outputs is the functional equivalent of granting Meridian a veto right over Quorum's business strategy — including the entire QuorumScore™ product line. This is commercially unreasonable and should be rejected unequivocally.
2. No Defined Criteria, Timelines, or Cure Mechanisms
Even setting aside the structural conflict of interest, the "sufficient transformation" standard as drafted suffers from a complete absence of procedural safeguards. Specifically:
No objective criteria. The provision contains no definition of what constitutes "sufficient transformation." It does not specify the methodology, the technical standard, the degree of transformation, or the benchmarks against which sufficiency is to be measured. Quorum's data engineers have no way to design their transformation processes to comply with the standard because the standard itself is undefined — it exists only in the subjective judgment of the opposing party.
No timeline for determination. The provision does not specify any period within which Meridian must render a determination as to whether Derived Data has been sufficiently transformed. Meridian could delay its response indefinitely — whether through deliberate foot-dragging or simple bureaucratic inertia — leaving Quorum unable to proceed with commercialization. In a fast-moving B2B licensing market, even a delay of several weeks could cause Quorum to lose prospective customers.
No appeal or dispute-resolution mechanism. There is no mechanism for Quorum to challenge or appeal a negative determination by Meridian. The general dispute-resolution provisions of the MDLA (Article XII) would presumably apply, but those provisions contemplate escalation to senior management followed by binding arbitration — a process that could take months or years and that would not provide the real-time commercial certainty that Quorum requires.
No cure or remediation path. If Meridian determines that a particular Derived Data output has not been "sufficiently transformed," the provision does not provide for Meridian to specify the deficiencies, recommend remedial measures, or afford Quorum an opportunity to cure. Quorum would be left to guess at what additional transformation would satisfy Meridian — only to submit a revised output for another round of discretionary review.
This drafting stands in stark contrast to well-drafted approval provisions in comparable technology transactions, which typically include:
(i) Objective standards or illustrative examples of what constitutes sufficient transformation;
(ii) A specified review period within which the licensor must render a determination (e.g., 30 business days from receipt of the submission);
(iii) A requirement that any denial be accompanied by detailed written reasons specifying the bases for the denial;
(iv) An independent expert determination mechanism, under which a mutually agreed-upon third-party expert resolves disputes regarding the sufficiency of transformation; and
(v) Deemed-approval provisions under which the licensor's failure to respond within the specified review period constitutes deemed approval of the submission.
Meridian's proposed provision includes none of these safeguards. The absence of procedural protections is not an oversight — it is a feature of a provision designed to maximize Meridian's leverage and minimize Quorum's ability to challenge adverse determinations.
C. Critique: Technical Impracticability
1. The "No Reverse-Engineering" Absolute Standard
The substantive core of Meridian's proposed standard is the requirement that "no Licensed Data can be reverse-engineered, extracted, or otherwise derived" from the Derived Data. This is an absolute impossibility standard — it does not require that reverse-engineering be difficult, impractical, or commercially infeasible, but that it be impossible. No qualified data scientist or information-security professional would certify that any transformation methodology renders reverse-engineering categorically impossible.
From a technical standpoint, it is well established in the data-science and information-security literature that it is often theoretically possible — given sufficient computational resources, background knowledge, and auxiliary data — to partially reconstruct input data from model outputs or enriched datasets. The relevant body of research includes:
Model inversion attacks. Fredrikson et al. (2015) demonstrated that machine-learning models can leak information about their training data, enabling an adversary to partially reconstruct training inputs from model predictions. While the precision of such attacks varies by model architecture and the nature of the training data, the theoretical possibility of partial reconstruction cannot be eliminated.
Membership inference attacks. Shokri et al. (2017) showed that an adversary can determine with non-trivial accuracy whether a particular data record was included in a model's training dataset, based solely on the model's output behavior. This is a form of information leakage from derived outputs to underlying data.
Statistical reconstruction. Dinur and Nissim (2003) proved the "fundamental law of information recovery," demonstrating that any system that answers a sufficient number of statistical queries about a dataset will eventually reveal the underlying data, regardless of the noise or transformation applied to individual query responses.
No commercially available transformation methodology provides an absolute guarantee against reverse-engineering. Even privacy-enhancing technologies that are widely regarded as state-of-the-art, such as differential privacy, provide only probabilistic (not absolute) guarantees. A differentially private mechanism ensures that the probability of any particular output is approximately the same whether or not any individual record is included in the input dataset — but it does not guarantee that no information about the input data can ever be inferred. The guarantee is bounded by the privacy parameter (epsilon), which trades off privacy protection against data utility.
The standard proposed by Meridian thus demands something that no transformation methodology can deliver. Quorum's data engineering team, led by Priya Nair, Director of Data Engineering, has confirmed that QuorumScore™ predictions — while trained in part on Meridian's consumer credit data — are blended with Quorum's own first-party claims data, policy data, and telematics data and processed through multi-layer neural network architectures. Extracting Meridian's raw credit-file data from a QuorumScore output would be computationally infeasible in practice — but no one, including Meridian's own data scientists, can certify that it is theoretically impossible, which is the standard Meridian demands.
Moreover, the standard conflates two analytically distinct concepts: re-identification risk (a privacy concept concerning the ability to identify a specific individual from ostensibly anonymized data) and reverse-engineering of proprietary data (an intellectual-property concept concerning the ability to reconstruct a licensor's proprietary dataset from a licensee's derived outputs). These two risks require fundamentally different analytical frameworks. Re-identification risk is typically assessed using well-established privacy metrics (k-anonymity, l-diversity, t-closeness, differential privacy). Reverse-engineering risk, by contrast, concerns the reconstruction of specific data fields and their values — a task whose feasibility depends on the nature and volume of the derived output, the adversary's background knowledge, the specificity of the output, and the computational resources available. By failing to distinguish between these concepts, Meridian's proposed standard creates a standard that is both technically incoherent and practically unworkable.
2. Ambiguity in What Constitutes Meridian "Raw Data"
The "sufficient transformation" standard prohibits the reverse-engineering of any "Licensed Data" — a defined term that encompasses all three Meridian data products (MCI Consumer Credit File, MCI CommercialView, and MCI AltSignal), comprising in the aggregate approximately 437 million records updated monthly. The standard does not clarify the level of granularity at which the prohibition applies.
Specifically, it is unclear whether the standard requires that no individual data element (e.g., a single tradeline entry for a single consumer, such as "Consumer ID 12345678, Account Type: Revolving, Current Balance: $4,215, Payment Status: Current") can be reconstructed from the Derived Data, or whether it refers to the inability to reconstruct the aggregate dataset or any substantial portion thereof. These are vastly different technical thresholds.
If the standard applies at the individual-data-element level, it is essentially impossible to satisfy for any derived output that reflects, even in aggregate, the statistical characteristics of the underlying data. A risk score that assigns a higher loss probability to consumers with recent delinquencies implicitly "reveals" the fact that consumers with delinquencies in the Licensed Data tend to have higher loss probabilities — and thus allows a trivial inference about the underlying data. This is an inherent characteristic of any analytics process: the purpose of analyzing data is to extract information from it, and the extracted information necessarily reflects the underlying data.
If, on the other hand, the standard applies at the aggregate-dataset level — i.e., it prohibits only the wholesale reconstruction of the Licensed Data — it would be a meaningfully different (and far more reasonable) standard, as wholesale reconstruction from derived analytics outputs is generally infeasible as a practical matter. But the language of Section 7.4(b) does not draw this distinction, and the use of the phrase "no Licensed Data" (with the singular/collective ambiguity inherent in "data") suggests that even partial reconstruction of individual elements would violate the standard.
Statistical aggregates, trend analyses, and risk scores by definition reflect characteristics of the underlying data. The question of how much underlying information can be inferred from a given derived output is one of degree, not kind. Meridian's proposed standard, by imposing an absolute prohibition on any inference of any Licensed Data from any Derived Data, treats the question as one of kind — a binary pass/fail — and thereby fails to account for the reality that all analytics outputs exist on a continuum of information leakage.
D. Critique: Inconsistency with Copyright and IP Law Principles
Meridian's "sufficient transformation" standard implicitly asserts that any Derived Data containing residual traces of factual inputs from the Licensed Data belongs to or is controlled by Meridian — an assertion that overreaches beyond what copyright law supports.
Under the Copyright Act (17 U.S.C. §§ 101 et seq.), a "derivative work" is defined as "a work based upon one or more preexisting works" and must incorporate a "substantial portion" of the preexisting copyrighted work. 17 U.S.C. § 101. The Supreme Court's seminal decision in Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340 (1991), established that facts are not copyrightable — only the original selection, coordination, and arrangement of facts can qualify for copyright protection. The Court held that a telephone directory's white pages, consisting of factual information arranged in alphabetical order, lacked the minimal creativity required for copyright protection. Id. at 362-63.
Credit bureau data consists largely of factual information: tradeline data (account types, balances, credit limits, payment histories), public records (bankruptcies, liens, judgments), and demographic data. These individual data elements are facts — they describe real-world credit relationships and payment behaviors — and are not protectable under copyright law regardless of the effort expended in collecting them. See Feist, 499 U.S. at 353-54 (rejecting the "sweat of the brow" doctrine). Meridian's compilation of these facts may be copyrightable to the extent that its selection and arrangement reflect original creativity — but the individual data elements themselves are not Meridian's intellectual property under copyright law.
The "sufficient transformation" standard, however, implicitly treats any derived output that reflects any factual information from the Licensed Data as Meridian's property — subject to Meridian's sole-discretion veto — regardless of whether the derived output constitutes a "derivative work" within the meaning of the Copyright Act. This is an IP overreach. The mere use of factual data as input to an analytical process does not necessarily create a derivative work, and the outputs of such a process — particularly when they represent original contributions of the creating party (here, Quorum) in the form of novel model architectures, feature engineering, and analytical insights — may be independently copyrightable works owned by Quorum.
We cross-reference the C&H memorandum dated January 2023, Memorandum re: Derived-Data IP Ownership Under Copyright Law (authored by the undersigned and Omar Siddiqui), which concluded that:
(i) Quorum's machine-learning model outputs likely do not constitute "derivative works" of the Licensed Data under 17 U.S.C. § 101, because the model outputs (risk scores, predictions, classifications) are analytically distinct from the underlying factual data and reflect Quorum's original creative contributions in model design, training methodology, feature selection, and architecture;
(ii) The trained model weights and parameters are analytically distinct from the inference outputs generated using new, non-Meridian inputs at prediction time — meaning that even if the training process implicates the Licensed Data, the inference outputs generated by applying the trained model to new data are further removed from the Licensed Data; and
(iii) The factual nature of the Licensed Data significantly weakens any claim by Meridian that downstream analytical outputs are "derivative works" subject to Meridian's copyright interest.
Meridian's "sufficient transformation" standard effectively seeks to obtain through contract what copyright law does not provide — proprietary control over downstream uses of factual information. While parties are, of course, free to allocate rights by contract in ways that differ from the default copyright rules, Quorum should understand that Meridian's claim to control Derived Data is not grounded in any inherent intellectual-property right but rather in contractual draftsmanship. This understanding strengthens Quorum's negotiating position: Meridian is asking for a contractual right that goes well beyond what the law would otherwise give it, and Quorum should demand correspondingly meaningful concessions in return — or, better yet, should resist the overreach entirely.
E. Critique: Inconsistency with Market Practice
The C&H memorandum dated April 2023, Memorandum re: License-Back Provisions in Data Licensing — Market Survey (authored by Omar Siddiqui), surveyed derived-data provisions in comparable enterprise data-licensing transactions in the credit-data and financial-data sectors. That survey was based on a review of publicly available agreements, C&H's proprietary precedent database, and discussions with practitioners at peer firms who regularly represent both licensors and licensees in data-licensing transactions. The survey's principal findings are directly relevant here.
In surveyed comparable transactions, typical derived-data provisions fell into one of three categories:
(i) Full Ownership, No Consent Required. In the most licensee-favorable formulation, the licensee is granted full ownership of all derived outputs, with the right to commercialize such outputs to third parties without the licensor's prior consent. The only restriction is a prohibition on the resale or redistribution of the licensor's raw data in unmodified form. This structure is common in agreements where the license fee is substantial and the licensee's use case involves significant value-added transformation.
(ii) Objective De-identification Standards. In a middle-ground formulation, the licensee may commercialize derived outputs that meet specified objective de-identification or aggregation standards — such as k-anonymity thresholds, minimum cohort sizes, aggregation requirements, or differential privacy budgets. The standards are defined in the agreement itself (or in a technical exhibit) and are testable by the licensee's data-engineering team without requiring the licensor's subjective approval.
(iii) Notice-Only. In a third formulation, the licensee provides the licensor with prior written notice (typically 30 days) of its intended commercialization of derived data, including a description of the transformation methodology. The licensor may object only on specified grounds (e.g., that the derived data contains raw Licensed Data in identifiable form), with disputes resolved by an independent expert. The licensor's failure to object within the notice period constitutes deemed approval.
Critically, no surveyed transaction granted the licensor sole discretion to determine transformation sufficiency. The closest analogue was a provision in a 2019 financial-data licensing agreement between a major U.S. bank and a fintech company, which required "mutual agreement" on transformation adequacy — but even that provision included an independent expert fallback mechanism and a 20-business-day response period.
The 15% net revenue share that Meridian demands on top of the transformation gate is itself significantly above the market range. The C&H market survey found that, where revenue shares on derived-data commercialization exist at all (which is itself uncommon — the majority of surveyed agreements included no revenue-share component), they typically range from 3% to 8% of net revenues. The 15% share proposed by Meridian is nearly double the upper end of this range and is compounded by the fact that "Net Revenues" as defined in Section 7.6 does not permit deductions for Quorum's development, marketing, or delivery costs — only for taxes, refunds, and credits. This results in an effective revenue share that, when measured against Quorum's gross margin on Derived Data licensing, could approach 25–30% or higher.
In summary, Meridian's combined proposal — sole discretion, perpetual license-back, and 15% net revenue share — is a significant outlier relative to market practice and should be characterized as such in negotiations.
IV. Impact on QuorumScore™ and Quorum's Commercial Strategy
A. QuorumScore™ Overview
QuorumScore™ is Quorum's proprietary predictive underwriting model, designed to generate granular, individual-level risk scores for use in property and casualty insurance underwriting, pricing, and portfolio management. A United States Patent and Trademark Office trademark application for "QuorumScore" is pending under Serial Number 97/482,116. Angela Firth, of Caldwell & Strauss LLP, Quorum's longstanding outside intellectual-property counsel (100 Pearl Street, Hartford, Connecticut 06103), has been coordinating with C&H on IP ownership positioning for QuorumScore in the context of the MDLA negotiation.
QuorumScore blends multiple data inputs from diverse sources:
• Meridian's consumer credit data (MCI Consumer Credit File, MCI AltSignal);
• Quorum's own first-party claims history data (approximately 15 years of structured claims records);
• Quorum's first-party policy data (policy characteristics, coverage limits, endorsements, demographic data);
• Quorum's telematics data (from its QuorumDrive™ usage-based insurance program, covering approximately 2.8 million active policies);
• Third-party weather and catastrophe modeling data (from Beaumont Group and Harborline Software); and
• Publicly available macroeconomic and demographic data (from the Bureau of Labor Statistics, Census Bureau, and similar sources).
These inputs are processed through a multi-layer neural network architecture incorporating feature engineering, embedding layers, and ensemble methods developed by Quorum's Data Science team under the direction of Rajesh Anand, Chief Data Officer. The resulting QuorumScore output is a numerical risk score (on a 0–999 scale) together with associated confidence intervals, factor-contribution analyses, and segment assignments.
QuorumScore is central to Quorum's competitive strategy on two fronts:
First, as an internal underwriting tool, QuorumScore enables Quorum to achieve more accurate risk segmentation, leading to better pricing precision, improved loss ratios, and enhanced portfolio profitability. Quorum estimates that QuorumScore deployment has contributed approximately 2.1 percentage points of combined-ratio improvement in the lines where it has been fully deployed.
Second, and critically for purposes of this memorandum, QuorumScore is the foundation of Quorum's planned B2B licensing revenue line. Quorum intends to license QuorumScore outputs to other insurance carriers, reinsurers, and managing general agents ("MGAs") who do not possess comparable in-house data-science capabilities. Quorum's financial projections, as included in the FY 2024–2028 Strategic Plan presented to the Board of Directors on March 15, 2023, project that B2B licensing of QuorumScore will generate $40–50 million in annual revenue by 2027, growing to a potential $70–80 million by 2030. These projections are a material component of Quorum's equity story and have been communicated to analysts and investors in general terms.
B. Risk Analysis
Under Meridian's proposed "sufficient transformation" standard, any third-party commercialization of QuorumScore outputs — including the licensing of QuorumScore risk scores, segment assignments, or analytical reports to other insurance carriers, reinsurers, or MGAs — would require Meridian's prior approval under Section 7.4(b). Because QuorumScore is trained in part on Meridian's consumer credit data, the QuorumScore output falls squarely within the MDLA's definition of "Derived Data," and Meridian would have sole and absolute discretion to determine whether the QuorumScore output has been "sufficiently transformed."
As discussed in Section III.B above, Meridian has no incentive to grant such approval:
(a) Meridian competes directly in the analytics market with its own suite of credit-risk scoring and analytics products offered to insurance carriers and financial institutions. Approving the B2B licensing of QuorumScore — a product that, by design, is intended to provide superior predictive accuracy by blending credit data with insurance-specific data — would directly cannibalize demand for Meridian's own analytics offerings.
(b) Approving the widespread distribution of QuorumScore would undercut the data-exclusivity narrative that Breckenridge Capital Management and Whitmore Zanthor & Co. are constructing for Meridian's planned IPO. If Meridian's prospectus disclosed that a major licensee had unfettered rights to commercialize derived analytics products incorporating Meridian data, prospective IPO investors might discount Meridian's valuation on the theory that its data "moat" is not as impregnable as represented. This concern has been explicitly communicated by Meridian's team during negotiations — Mr. Pennington stated at the March 9 session that "our board is focused on protecting the integrity of our data platform" — and we believe it is the primary driver of Meridian's intransigence on this issue.
(c) Even if Meridian were inclined to approve QuorumScore commercialization in principle, the 15% net revenue share creates an incentive for selective and strategic approval. Meridian could withhold or delay approval as leverage in other aspects of the business relationship, or could condition approval on additional concessions (e.g., expanded license-back rights, most-favored-customer pricing, or exclusive supply commitments).
The practical consequence is stark: Meridian's proposal would effectively kill Quorum's $40–50 million B2B licensing strategy or, at a minimum, subject it to Meridian's perpetual veto and a 15% revenue tax. Even if Meridian were to approve QuorumScore commercialization on a case-by-case basis, the uncertainty inherent in the sole-discretion standard would make it commercially impracticable for Quorum to market QuorumScore to prospective B2B licensees. Prospective licensees would require binding assurances of uninterrupted supply and IP clarity before committing to multi-year licensing arrangements — assurances that Quorum cannot provide if its right to distribute QuorumScore is subject to Meridian's approval at any time.
Furthermore, the license-back provision in Section 7.5 would give Meridian a perpetual, royalty-free right to use QuorumScore and all other Derived Data for Meridian's own purposes, including for the benefit of Meridian's other customers and licensees. Meridian could, in theory, incorporate QuorumScore insights into its own analytics products and offer them to the market — competing with Quorum using Quorum's own intellectual contribution, without paying Quorum any compensation. This creates a perverse dynamic in which Quorum bears all the costs of developing QuorumScore (data-science personnel, computational infrastructure, training data, model validation) while Meridian captures a substantial share of the benefits through the license-back and revenue share.
C. Post-Termination Dimension
The MDLA draft requires Quorum to return or destroy all Licensed Data (i.e., Meridian's raw data feeds) within 90 days following the expiration or termination of the MDLA. This is a standard data-return provision and is not itself objectionable.
However, the treatment of Derived Data post-termination remains a disputed term. Under Meridian's framework, the implications are as follows:
(i) If Quorum's Derived Data (including QuorumScore and its trained model weights) has not been determined by Meridian to be "sufficiently transformed," it would presumably be treated as containing Licensed Data and therefore subject to the same return/destroy obligation. This could result in Quorum being required to destroy its entire QuorumScore model — including the trained neural-network weights, the feature-engineering pipeline, the historical prediction outputs, and all associated intellectual property — upon termination of a five-year license.
(ii) Even if Derived Data that has been approved as "sufficiently transformed" is exempt from the return/destroy obligation, the scope of approved Derived Data would depend entirely on how many transformation determinations Meridian has issued during the term — and, as discussed above, Meridian has every incentive to issue as few approvals as possible.
(iii) The perpetual license-back in Section 7.5 survives termination, meaning that Meridian would retain the right to use all Derived Data (including QuorumScore) even after the MDLA expires, while Quorum might be required to destroy its own copy. This asymmetry is commercially unconscionable.
The combined effect of the "sufficient transformation" standard and the post-termination provisions creates an unacceptable lock-in dynamic and IP forfeiture risk. Quorum would be investing $60 million over five years in a data license and additional millions in developing proprietary analytics capabilities — only to face the risk that all of its derived intellectual property could be subject to forfeiture upon termination, while Meridian retains a perpetual license to the same IP. This structure makes the MDLA less a licensing arrangement and more an IP-capture mechanism.
V. Proposed Objective Alternative Standards
In lieu of Meridian's subjective, sole-discretion standard, we propose the following objective, measurable alternative standards for inclusion in a revised Article VII. These alternatives are designed to be technically defensible, commercially reasonable, consistent with market practice, and responsive to Meridian's legitimate interest in preventing the wholesale redistribution of its raw data.
A. Aggregation and De-identification Threshold
We propose that Derived Data be deemed "sufficiently transformed" — and therefore eligible for third-party commercialization without further licensor approval — if it satisfies both of the following objective criteria:
(i) The Derived Data has been aggregated such that no output pertains to, or is derived from, fewer than a specified minimum number of individual consumer or commercial records from the Licensed Data. We recommend an initial proposal of a minimum cohort size of 1,000 records, subject to negotiation; and
(ii) No individual Meridian data element — defined at the field level (e.g., no individual tradeline entry, no individual account balance, no individual payment-history record) — can be identified from the Derived Data output. This criterion would be assessed based on the format and content of the output itself, not on the theoretical possibility of reverse-engineering given unlimited computational resources.
This standard provides an objective, testable, and commercially reasonable benchmark that Quorum's data-engineering team can design its transformation processes to satisfy. It is consistent with widely accepted privacy best practices, including the principles underlying HIPAA's Safe Harbor de-identification standard (45 C.F.R. § 164.514(b)) and the CCPA's deidentification requirements (Cal. Civ. Code § 1798.140(m)). Importantly, it addresses Meridian's legitimate concern — preventing the wholesale redistribution of identifiable raw data — without imposing an impossible absolute standard.
B. Technical Certification by Independent Expert
As a procedural safeguard to supplement (or, if Meridian insists, replace) the aggregation threshold, we propose that Quorum be permitted to engage an independent, mutually agreed-upon third-party data-science expert to certify that the Derived Data does not permit reconstruction of individual Licensed Data records with a probability exceeding a defined statistical threshold.
(i) The proposed statistical threshold is that the probability of re-identification or reconstruction of any individual Licensed Data record from the Derived Data shall not exceed 5%, using best available methods and commercially reasonable computational resources. This is a well-recognized standard in the privacy and data-science literature and provides a meaningful (but not absolute) guarantee against reverse-engineering.
(ii) The independent expert shall be selected by mutual agreement of the parties from a pre-approved list of qualified data-science firms (to be attached as an exhibit to the MDLA). If the parties cannot agree on an expert, each party shall nominate one candidate, and the two nominees shall select a third, who shall serve as the independent expert.
(iii) The independent expert's determination shall be binding on both parties, subject to a limited right of appeal. If either party disputes the expert's determination, the dispute shall be referred to a panel of three independent experts (one selected by each party and a third selected by the first two), whose majority determination shall be final and binding.
(iv) The cost of the initial independent expert review shall be borne by Quorum; the cost of any appeal shall be borne by the non-prevailing party.
This mechanism replaces Meridian's sole discretion with an objective, independent determination — eliminating the conflict-of-interest problem while still providing assurance that Quorum's Derived Data outputs do not impermissibly expose Meridian's Licensed Data.
C. Categorical Safe Harbors
We further propose that certain categories of Derived Data be categorically deemed "sufficiently transformed" and eligible for third-party commercialization without any further approval, review, or certification. The following categories are proposed:
(i) Aggregate statistical models, indices, and risk scores. This category includes QuorumScore™ outputs and any other predictive model outputs, risk scores, indices, or classification outputs that produce predictions or scores based on the statistical characteristics of individual records but do not output or expose the underlying Licensed Data fields. A QuorumScore risk score of "742" for a given insurance applicant does not reveal the applicant's tradeline data, account balances, or payment history — it reveals only a blended predictive assessment derived from multiple data sources. Such outputs should be categorically exempt from the transformation-approval process.
(ii) Model weights, parameters, and trained algorithms. The weights, parameters, coefficients, and architecture of a trained machine-learning model reflect the statistical patterns learned from the training data but do not contain or reproduce the training data itself. A neural-network weight matrix is not a database of credit records; it is a mathematical abstraction that encodes learned patterns. Model weights and parameters should be categorically exempt regardless of the fact that Licensed Data was used in the training process. This is consistent with the emerging consensus in the data-science and legal communities that trained model parameters are analytically distinct from training data.
(iii) Benchmarking reports, trend analyses, and market studies. Reports, analyses, and studies that contain only aggregate or summary-level statistics (e.g., "the median FICO-equivalent score for consumers in the Southeast region declined by 12 points in Q4 2022") do not expose individual Licensed Data records and should be categorically exempt.
This carve-out approach protects Quorum's core use cases — most importantly, the B2B licensing of QuorumScore outputs — while addressing Meridian's legitimate concern about wholesale redistribution of raw data. The safe harbors are defined by the nature of the output, not by a subjective assessment of its "transformation," and therefore provide the commercial certainty that Quorum and its prospective B2B licensees require.
D. Notification-Only Regime (Alternative to Consent)
For Derived Data that falls outside the categorical safe harbors — e.g., enriched datasets, individual-level analytics outputs that reference specific Licensed Data fields, or novel output formats not contemplated by the safe-harbor categories — we propose a notification-only regime as an alternative to Meridian's consent requirement:
(i) Quorum shall provide Meridian with 30 days' prior written notice of its intended third-party commercialization of such Derived Data, together with a description of the Derived Data, its transformation methodology, and the intended recipient or class of recipients.
(ii) If Meridian objects to the proposed commercialization within the 30-day notice period, it must provide detailed written reasons for its objection, specifically identifying the Licensed Data fields or records that it believes can be reconstructed from the Derived Data and the methodology by which such reconstruction could be achieved.
(iii) Any dispute arising from Meridian's objection shall be resolved by an independent expert under the mechanism described in Section V.B above — not by Meridian's sole discretion.
(iv) If Meridian fails to object within the 30-day notice period, Meridian shall be deemed to have approved the proposed commercialization, and Quorum may proceed without further consent.
This notification-only regime provides Meridian with a meaningful opportunity to raise legitimate concerns about specific Derived Data outputs while ensuring that Meridian cannot exercise an unfettered veto or delay commercialization indefinitely. The deemed-approval mechanism for failure to respond within 30 days provides an essential backstop against bureaucratic inertia or strategic delay.
E. Elimination of Revenue Share
Quorum should firmly and unequivocally resist the 15% net revenue share on Derived Data commercialization. The economic rationale for this position is straightforward:
(i) Quorum is already paying $60 million over five years for the right to use the Licensed Data. The license fee compensates Meridian for the use of its data. Requiring a revenue share on outputs that Quorum creates using that data — outputs that also incorporate Quorum's own first-party data, proprietary algorithms, and substantial R&D investment — amounts to double-charging for the same underlying asset.
(ii) The 15% rate is well above the market range. As noted in the C&H market survey (April 2023, Siddiqui), where revenue shares on derived-data commercialization exist at all (a minority of comparable transactions), they typically range from 3% to 8% of net revenues. The 15% rate proposed by Meridian is nearly double the upper bound of the market range.
(iii) The "Net Revenues" definition in Section 7.6, which does not permit deductions for Quorum's development costs, marketing costs, delivery costs, or any other costs of creating and distributing the Derived Data, makes the effective rate significantly higher than 15% when measured against Quorum's gross margin. Given Quorum's estimated cost structure for QuorumScore B2B licensing (including data-science personnel, computational infrastructure, customer support, and sales and marketing), the effective revenue-share burden on Quorum's gross margin could approach 25–30%.
(iv) The revenue share creates a misaligned incentive structure. Meridian would benefit financially from Quorum's Derived Data commercialization success while simultaneously holding a veto over that commercialization — an inherently conflicted position that invites strategic behavior.
If Meridian insists on some form of financial participation in Derived Data commercialization as a non-negotiable condition for the transaction, Quorum may consider, as a last-resort compromise, a de minimis acknowledgment fee structured as a fixed annual payment capped at $500,000, regardless of Quorum's actual Derived Data revenues. This cap would limit Meridian's financial participation to a nominal amount that does not distort Quorum's B2B licensing economics. However, this compromise should be offered only if (a) the transformation gating standard is replaced with the objective mechanisms described in Sections V.A through V.D, and (b) Quorum retains full ownership of all Derived Data intellectual property, free of any license-back obligation.
VI. Negotiation Recommendations
A. Immediate Actions
Based on the analysis set forth in this memorandum, we recommend the following immediate actions:
1. Reject the "sole and absolute discretion" standard unequivocally. In any written or oral communications with Meridian and KP&A, Quorum's position should be framed in terms of (a) commercial unreasonableness, (b) Meridian's inherent conflict of interest as both counterparty and competitor, and (c) inconsistency with market practice for enterprise data-licensing transactions. The rejection should be firm and clear — this is not a provision that can be "softened" with minor drafting adjustments. The fundamental architecture of Section 7.4(b) — licens

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts