1025-00008 · Quorum Insurance Holdings · Transaction Documents/MDLA

memo-key-issues-meridian-form-mdla.docx DOCUMENT M&A / Corporate

66 / 76 ← → ✕

MEMORANDUM

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION

TO: Carolyn Whitford, General Counsel & Executive Vice President, Quorum Insurance Holdings Corp. Gregory Stahl, Vice President, Legal Affairs, Quorum Insurance Holdings Corp.

FROM: Wendy Schultz, Associate, intellectual Property, Calderwood & Harkness LLP Patricia Heng, Senior Counsel, Technology Transactions, Calderwood & Harkness LLP

DATE: November 10, 2022

RE: Key Issues in Meridian Credit intelligence, Inc.'s Form Master Data License Agreement (delivered November 4, 2022)

C&H Matter No.: 1025-00008

This memorandum is a privileged and confidential attorney-client communication prepared by Calderwood & Harkness LLP for the exclusive use of Quorum Insurance Holdings Corp. It contains legal advice and work product and is not intended for disclosure to any third party. Any inadvertent disclosure does not constitute a waiver of the attorney-client privilege or work-product protection.

Right-click to update Table of Contents

I. Executive Summary

This memorandum provides a comprehensive analysis of the material provisions and critical issues identified in Meridian Credit intelligence, Inc.'s ("Meridian") form Master Data License Agreement (the "MDLA"), drafted by Meridian's outside counsel, Kessler Pruitt & Ashe LLP, and delivered to Calderwood & Harkness LLP ("C&H") on November 4, 2022. The purpose of this memorandum is to identify and assess each provision of the MDLA that presents commercial risk, legal exposure, or drafting deficiency from the perspective of Quorum Insurance Holdings Corp. ("Quorum"), and to recommend a negotiating strategy and specific redline positions for each such provision.

The MDLA is the central agreement governing a proposed five-year enterprise data-licensing arrangement between Quorum and Meridian, valued at $60,000,000 in aggregate license fees ($10,800,000 in Year 1 and $12,300,000 per year in Years 2 through 5), plus a one-time implementation and integration fee of $1,500,000. The transaction is of critical strategic importance to Quorum, as the Licensed Data will serve as a foundational input to Quorum's automated underwriting models, claims-fraud detection algorithms, and customer propensity scoring across its property and casualty, life, and specialty insurance lines of business.

This memorandum is organized by issue severity. We identify twelve (12) principal categories of concern, encompassing numerous sub-issues, ranging from deal-breaking provisions that fundamentally threaten Quorum's commercial objectives to provisions requiring meaningful revision but amenable to negotiation through the redline process. The issues are further classified into three priority tiers to guide the negotiating team's allocation of time and attention.

In our assessment, the three most critical issues in the Meridian form MDLA are as follows:

1. intellectual Property Ownership of Derived Data (Article VII). The MDLA's treatment of Derived Data — broadly defined to include any data, models, scores, or analytics outputs created by Quorum using Meridian data as an input — is fundamentally adverse to Quorum's interests. Meridian asserts ongoing IP rights in all Derived Data, demands a perpetual royalty-free license-back on all such data, imposes a 15% revenue share on any commercialization of Derived Data, and reserves sole discretion to determine whether Derived Data has been "sufficiently transformed" for third-party distribution. This framework would directly threaten Quorum's proprietary QuorumScore™ predictive underwriting model and its projected $40–50 million B2B licensing revenue line by 2027.

2. Absence of Most Favored Nation Pricing Protection. The Meridian form MDLA contains no most favored nation ("MFN") pricing clause, despite Quorum's explicit proposal of a broad MFN in its counter-term sheet. Given the scale of the financial commitment ($60 million over five years) and the competitive dynamics of the insurance data-licensing market, the absence of any pricing protection mechanism is a critical gap.

3. Meridian's License-Back and Revenue-Sharing Mechanisms on Derived Data Commercialization. Even apart from the IP ownership question, Meridian's demand for a perpetual, sublicensable license-back on all Derived Data, combined with the 15% revenue share and sole-discretion transformation standard, creates a comprehensive economic claim by Meridian on Quorum's downstream analytics business that is commercially unacceptable.

We note that this analysis is coordinated with David Cartwright and Lisa Johannsen, who are addressing data privacy and security matters in a separate memorandum, and with Marcus Weill, who is analyzing the corporate and covenant implications of the transaction, including the lender consent requirements under Quorum's existing credit facility. Those memoranda should be read in conjunction with this one.

Our recommendation is that Calderwood & Harkness prepare a comprehensive redline of the Meridian form MDLA, targeting delivery to Kessler Pruitt & Ashe LLP by early December 2022. The redline should address each of the issues identified in this memorandum, with the Priority 1 issues treated as threshold matters that must be resolved before the parties proceed to negotiate the balance of the agreement.

II. Background and Context

A. The Transaction

Quorum Insurance Holdings Corp. is a Delaware corporation listed on the Nasdaq Stock Market (ticker: QIHC), with its principal executive offices located at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901. Quorum is a diversified insurance holding company operating through subsidiaries in the property and casualty, life, and specialty insurance segments, with approximately $4.18 billion in annual gross written premiums across its consolidated operations.

Quorum proposes to license consumer credit-file data, commercial credit data, and alternative-data feeds from Meridian Credit intelligence, Inc. for use in automated underwriting models, claims-fraud detection algorithms, and customer propensity scoring across all of Quorum's insurance lines of business. The data-licensing arrangement contemplated by the MDLA is intended to serve as a foundational data infrastructure investment, enabling Quorum to enhance underwriting precision, reduce loss ratios, improve customer acquisition targeting, and strengthen fraud-detection capabilities across its operating subsidiaries.

Meridian Credit intelligence, Inc. is a Georgia corporation headquartered at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326. Meridian is one of the leading providers of consumer and commercial credit data and alternative-data products in the United States, maintaining databases encompassing approximately 310 million consumer credit records, 42 million commercial business records, and 85 million consumer alternative-data records (including utility, telecommunications, and rental payment data).

Meridian is privately held. The majority ownership interest in Meridian — 62.5% of issued and outstanding equity — is held by Breckenridge Capital Partners Fund IV, L.P., a private equity fund managed by Breckenridge Capital Management LLC. Breckenridge Capital Management is located at 600 Lexington Avenue, 28th Floor, New York, New York 10022. The managing partner of Breckenridge is Elaine Drummond, and the partner overseeing the Meridian investment is Caleb Rourke.

Importantly, Meridian is advised by Whitmore Zanthor & Co. (investment bank; managing director Rachel Ng-Castillo) in connection with a planned initial public offering currently targeted for the 2025–2026 timeframe. This planned IPO materially influences Meridian's negotiating posture on several key provisions of the MDLA, including pricing and data-exclusivity terms, as Meridian and its sponsors have a strong incentive to protect revenue margins, avoid pricing commitments that could compress margins ahead of the offering, and minimize public disclosure of contractual disputes that could complicate the IPO process. We have been mindful of these dynamics throughout our analysis.

B. Licensed Data Products

The MDLA contemplates the licensing of three distinct data products, each delivered through specified channels:

1. MCI Consumer Credit File™: This product encompasses approximately 310 million consumer credit records, including traditional credit bureau data (trade lines, payment histories, public records, credit inquiries, and credit scores). Delivery is available via daily batch processing through Secure File Transfer Protocol ("SFTP") and in real time through a REST API interface. This is the largest and most commercially significant of the three data products.

2. MCI CommercialView™: This product encompasses approximately 42 million business entity records, including commercial credit profiles, payment behavior data, financial statement data, and business demographic information. Delivery is available via weekly batch processing through SFTP. Quorum intends to use this product primarily in connection with its commercial lines underwriting and its specialty insurance operations.

3. MCI AltSignal™: This product encompasses approximately 85 million consumer alternative-data records, including utility payment histories, telecommunications payment data, and rental payment information. This alternative data is intended to supplement traditional credit file data and is particularly valuable for underwriting applicants with thin credit files. Delivery is available via daily batch processing through SFTP.

The total estimated monthly volume across all three data products is approximately 437 million records per month. This volume represents approximately 87.4% of the 500 million records per month base tier established under the MDLA's pricing framework, as discussed further in Section III.D below.

C. Procedural History

The following timeline summarizes the key procedural milestones leading to the delivery of the Meridian form MDLA:

• August 8, 2022: Calderwood & Harkness engagement opened (C&H Matter No. 1025-00008).

• August 15, 2022: Mutual Non-Disclosure Agreement executed between Quorum and Meridian (reference: NDA-QIH-MCI-2022-001).

• September 12, 2022: Meridian delivered its initial term sheet to Quorum, outlining proposed commercial terms for the data-licensing arrangement.

• September 30, 2022: Quorum delivered a counter-term sheet, reflecting Quorum's preferred positions on pricing, IP ownership, MFN protections, dispute resolution, and other key terms.

• October 17, 2022: The parties exchanged initial drafts of the MDLA. Quorum's initial draft was prepared by Calderwood & Harkness based on Quorum's standard data-licensing template, while Meridian's initial draft was prepared by Kessler Pruitt & Ashe LLP based on Meridian's standard form.

• November 4, 2022: Kessler Pruitt & Ashe LLP delivered Meridian's form MDLA — the version that is the subject of this memorandum.

The current expectation is that Calderwood & Harkness will prepare and deliver a comprehensive redline of the Meridian form MDLA by early December 2022, following which the parties will engage in iterative negotiation sessions with the objective of reaching agreement on definitive documentation by the first quarter of 2023.

D. Quorum's Key Business Objectives

Based on our discussions with Quorum's management team and in-house legal department, we understand that Quorum's key business objectives for this transaction are as follows:

1. Full Ownership of Derived Data. Quorum seeks to own all intellectual property rights in Derived Data — that is, blended risk scores, propensity models, enriched datasets, and other analytics outputs — created by Quorum or on its behalf using Meridian data as one of multiple inputs. Quorum views this as a foundational requirement, without which the transaction does not achieve its strategic purpose.

2. Protection of QuorumScore™. Quorum has developed QuorumScore™, a proprietary predictive underwriting model that incorporates machine-learning algorithms trained on multiple data sources, including (but not limited to) Meridian consumer credit data. A United States Patent and Trademark Office application for QuorumScore™ is pending (Serial No. 97/482,116). Quorum projects that B2B licensing of QuorumScore™ and related analytics products will generate $40–50 million in annual revenue by 2027. Quorum cannot accept any contractual framework that would give Meridian ownership of, a license-back to, or a revenue share in QuorumScore™ outputs.

3. Most Favored Nation Pricing Protection. Given the magnitude of the financial commitment ($60 million over five years), Quorum seeks assurance that it will not pay more, on a per-record or aggregate basis, than competing insurance-industry licensees of comparable scale. Quorum's counter-term sheet proposed a broad MFN covering all U.S.-domiciled insurance carriers, managing general agents, and insurtech firms with annual premiums written of $500 million or more.

4. Court Jurisdiction for Dispute Resolution. Quorum prefers to resolve disputes in court rather than through binding arbitration, for reasons discussed in detail in Section XI below.

These objectives have guided our analysis throughout this memorandum and will inform the positions taken in Quorum's redline.

III. Deal Economics — Pricing and Payment Terms

A. License Fee Structure (Article III of MDLA)

Article III of the Meridian form MDLA sets forth the license fee structure for the five-year initial term. The total aggregate consideration recited in the MDLA is $60,000,000, allocated as follows:

• Year 1: $10,800,000 annual license fee, payable in equal quarterly installments of $2,700,000 (equivalent to $900,000 per month). The reduced Year 1 fee reflects the six-month implementation and ramp period during which Quorum will be integrating the data feeds into its existing systems and is not expected to achieve full data consumption volumes.

• Years 2 through 5: $12,300,000 annual license fee per year, payable in equal quarterly installments of $3,075,000 (equivalent to $1,025,000 per month). This represents the steady-state annual fee following completion of the implementation period.

As a reconciliation check: $10,800,000 + ($12,300,000 × 4) = $10,800,000 + $49,200,000 = $60,000,000. This figure is confirmed as consistent with the total consideration stated in the recitals and in the commercial summary attached as Schedule A to the MDLA.

Regarding payment terms, the Meridian form MDLA specifies that quarterly installments are payable in advance, with payment due within fifteen (15) days of the date of Meridian's invoice. Quorum's counter-term sheet proposed net thirty (30) day payment terms, consistent with Quorum's standard vendor payment cycle and internal accounts payable processing timelines. This fifteen-day gap needs to be reconciled in the redline. We note that fifteen-day payment terms are unusual for an enterprise data-licensing arrangement of this scale and would likely require Quorum to establish special payment processing procedures outside its standard AP workflow.

B. One-Time Implementation Fee

In addition to the $60,000,000 in aggregate license fees, the MDLA provides for a one-time implementation and integration fee of $1,500,000, payable upon execution of the MDLA. This fee covers Meridian's costs associated with configuring data feeds, establishing API connectivity, provisioning SFTP access, conducting data mapping and schema alignment, and supporting Quorum's integration testing.

The implementation fee is stated to be "in addition to and separate from" the aggregate license fees. However, we have identified an ambiguity in the drafting: while the implementation fee is described as separate from the $60,000,000 license value in the body of Article III, several other provisions of the MDLA calculate obligations by reference to "total fees paid under this Agreement" or "aggregate consideration payable hereunder" without clearly specifying whether the implementation fee is included in or excluded from those calculations. This lack of clarity affects the computation of:

• Data-volume overage thresholds (Section 3.4);

• Service level agreement credits (Schedule C);

• Early termination fees (Section 11.5); and

• The limitation of liability cap (Section 10.1).

We recommend that the redline include a clear definitional provision specifying that the implementation fee is not included in the calculation of any fee-based thresholds, credits, or caps, unless expressly stated otherwise.

C. Late Payment Interest

Section 3.6 of the Meridian form MDLA provides that any amounts not paid when due shall accrue interest at a rate of 1.5% per month (equivalent to 18% per annum), compounding monthly. This interest begins to accrue on the day following the applicable due date and continues until full payment is received.

This rate is aggressive and exceeds the prevailing market standard for enterprise data-licensing and technology transactions, where the typical late payment interest rate is the lesser of 1.0% per month (12% per annum) or the maximum rate permitted by applicable law. Additionally, the compounding feature amplifies the effective rate over time. While New York law generally does not impose a statutory usury limit on obligations between business entities of this nature (under New York General Obligations Law § 5-501 and Banking Law § 14-a, the civil usury limit of 16% per annum applies to certain loan transactions but may not apply to commercial contract interest provisions), the 18% rate is nonetheless above the civil usury threshold and could raise questions in certain circumstances.

We recommend that Quorum seek to reduce the late payment interest rate to the lesser of 1.0% per month (simple, not compounding) or the maximum rate permitted by applicable law. In the alternative, Quorum should propose that interest accrue only after a grace period of ten (10) business days following written notice of non-payment, to account for administrative delays and invoice disputes.

D. Data-Volume Tiers and Overages

Section 3.4 of the MDLA establishes a tiered pricing structure based on monthly data-consumption volume:

• Base Tier: Up to 500 million records per month (consumer, commercial, and alternative-data records combined). The base tier license fees are included in the annual license fee amounts set forth in Section 3.1.

• Overage Rate: For each record consumed in excess of the 500 million base tier threshold in any given month, Quorum is required to pay an additional per-record fee of $0.003.

Based on Quorum's current data-consumption estimates, the anticipated monthly volume across all three data products is approximately 437 million records per month, representing approximately 87.4% of the base tier. This provides reasonable headroom at the outset of the arrangement. However, we note several concerns:

First, Quorum's data-science and analytics teams project significant volume growth over the five-year term as Quorum expands its use cases, onboards additional insurance lines, and increases API query frequency. Under certain growth scenarios modeled by Priya Nair's data engineering team, Quorum's monthly consumption could approach or exceed the 500 million record threshold by Year 3 and could reach 650–700 million records per month by Year 5. At the $0.003 per-record overage rate, consumption of 700 million records per month would result in overage charges of approximately $600,000 per month ($7.2 million annualized), representing a 58.5% increase over the annual license fee.

Second, the MDLA does not provide for any periodic adjustment of the base tier threshold to reflect anticipated growth, nor does it offer volume discounts as Quorum's consumption scales. This is a significant omission for a five-year arrangement. We recommend inserting an annual true-up mechanism under which the base tier threshold increases by a specified percentage each year (e.g., 10% per year) or is recalibrated annually based on the prior year's average monthly consumption plus a buffer. Additionally, the per-record overage rate should decline as consumption increases, following a standard volume-discount schedule.

Third, the MDLA does not clearly define what constitutes a "record" for purposes of volume measurement. A single consumer credit file pull could generate multiple sub-records depending on the number of trade lines, inquiries, and public records associated with that consumer. Quorum should seek a clear definition of "record" that aligns with its internal data architecture and avoids double-counting or inflated volume measurements.

E. Absence of Most Favored Nation Pricing

The Meridian form MDLA contains no most favored nation pricing clause. This is one of the three most critical issues in the agreement and represents a significant departure from Quorum's negotiating position.

Quorum's counter-term sheet, delivered on September 30, 2022, proposed a broad MFN provision covering all U.S.-domiciled insurance carriers, managing general agents, and insurtech firms with annual premiums written of $500 million or more. The proposed MFN would require automatic price adjustment — applicable to per-record pricing, volume discounts, base tier thresholds, and aggregate fee terms — to match any more favorable terms offered by Meridian to a Comparable Licensee (as defined in the counter-term sheet) during the term of the MDLA. The adjustment would be retroactive to the date on which the more favorable terms were first offered to the Comparable Licensee, with a true-up credit applied to Quorum's account within thirty (30) days of Quorum's notification of the more favorable terms.

Meridian's complete omission of any MFN provision from its form MDLA was not unexpected but is nonetheless a critical gap that must be addressed in Quorum's redline. Based on the term sheet exchange and preliminary discussions between counsel, we understand that Meridian's resistance to the MFN is grounded in several arguments:

1. Confidentiality obligations. Meridian asserts that disclosing pricing terms offered to other licensees would breach confidentiality provisions in those agreements.

2. Bespoke data packages. Meridian contends that each licensee's data package is customized in terms of product mix, delivery frequency, volume, and integration support, making apples-to-apples pricing comparisons impractical.

3. IPO-related margin concerns. Breckenridge Capital and Whitmore Zanthor have expressed concern that an MFN obligation could compress Meridian's margins on future deals, adversely affecting Meridian's financial profile ahead of the planned 2025–2026 IPO.

4. Antitrust sensitivities. Meridian has raised the possibility that MFN provisions in credit-data markets could attract antitrust scrutiny, particularly given the concentrated nature of the credit-data industry.

We have considered each of these arguments and believe they are either manageable or unpersuasive. The confidentiality concern can be addressed through a pricing audit mechanism (discussed below). The bespoke-package argument, while factually accurate, does not preclude a per-record rate comparison on a normalized basis. The IPO-margin concern is Meridian's internal business issue and does not justify exposing Quorum to pricing discrimination. And the antitrust concern, while worth monitoring, is unlikely to present a material risk for a single-customer MFN clause in a bilateral negotiation.

Recommendation: Insert the full MFN clause as drafted in the counter-term sheet as Quorum's primary position. Separately, we recommend that the team prepare a fallback "pricing audit right" provision as an alternative to the full MFN, to be offered in the event that Meridian categorically refuses the MFN. Under this fallback, Quorum would have the right to engage an independent third-party auditor — selected from a mutually agreed list of accounting firms — to conduct a confidential pricing review once per contract year. The auditor would verify that Quorum's effective per-record rate (calculated on a normalized basis across all data products) does not exceed 110% of the lowest comparable per-record rate offered by Meridian to any Comparable Licensee. If the audit reveals a rate disparity exceeding the 110% threshold, Quorum would be entitled to a retroactive credit and prospective rate adjustment. The auditor's findings would be delivered to both parties in summary form, without disclosing the identity or specific pricing of any other licensee.

We understand that Pinnacle Ridge Advisory LLC (Franklin Osei, engagement lead) has been retained to prepare a pricing benchmark study comparing Meridian's proposed pricing to prevailing market rates for comparable data-licensing arrangements. That study is expected to be completed by February 2023 and will provide valuable support for Quorum's MFN negotiating position.

IV. Intellectual Property Ownership — Derived Data (Article VII)

A. Overview of Meridian's Proposed Framework

Article VII of the Meridian form MDLA is, in our assessment, the most commercially significant and problematic provision in the entire agreement. It governs the creation, ownership, and exploitation of "Derived Data," a term defined in Section 7.1 and discussed in detail below. The economic and strategic implications of Article VII pervade the entire commercial relationship and directly affect Quorum's ability to realize the full value of its investment in this data-licensing arrangement.

Meridian's proposed framework rests on the fundamental premise that all Derived Data that "incorporates, is based on, or is traceable to" Meridian's raw Licensed Data constitutes a "derivative work" within the meaning of the Copyright Act, 17 U.S.C. § 101, and accordingly remains subject to Meridian's underlying intellectual property rights. From this premise, Meridian derives three interconnected rights: (1) a perpetual license-back on all Derived Data; (2) a veto power over third-party commercialization of Derived Data; and (3) a 15% revenue share on approved commercialization.

We disagree with Meridian's legal premise. The characterization of aggregated analytics outputs, machine-learning model parameters, and blended risk scores as "derivative works" of raw data inputs is not well-supported by case law and reflects an overbroad application of derivative-work doctrine. As the Second Circuit recognized in Nihon Keizai Shimbun, Inc. v. Comline Business Data, Inc., 166 F.3d 65 (2d Cir. 1999), the derivative-work concept requires a close nexus between the original work and the putative derivative — mere use of factual data as an input to an independent analytical process does not create a derivative work. Moreover, to the extent Meridian's raw data consists of factual information (credit scores, payment histories, business records), that data is not protectable under copyright at all. See Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340 (1991).

Regardless of the legal merits of Meridian's position, the contractual provisions as drafted in Article VII would, if accepted, create binding obligations that govern the parties' rights without regard to the underlying copyright analysis. For this reason, it is essential that Article VII be fundamentally rewritten in Quorum's redline to reflect Quorum's commercial position and to avoid accepting, even implicitly, Meridian's characterization of Derived Data as derivative works.

B. License-Back Provision (Section 7.3)

Section 7.3 of the Meridian form MDLA provides that Quorum "hereby grants to Meridian a perpetual, royalty-free, fully paid-up, irrevocable, worldwide, sublicensable license to access, use, reproduce, distribute, display, perform, create derivative works of, and otherwise exploit all Derived Data for Meridian's internal business purposes and for commercial purposes, including without limitation the right to incorporate Derived Data into Meridian's products and services offered to third parties."

This provision is a highly atypical and commercially unacceptable license-back grant that would effectively give Meridian unrestricted access to the outputs of Quorum's proprietary analytics platform. Several specific concerns merit emphasis:

First, the license-back is perpetual and irrevocable. It is not conditioned on the continuation of the MDLA; rather, it takes effect upon the creation of any Derived Data and survives termination or expiration of the MDLA indefinitely. This means that even if Quorum terminates the MDLA, Meridian would retain a perpetual right to use and commercialize all Derived Data created during the term.

Second, the license-back is sublicensable. Meridian would have the right to sublicense Quorum's Derived Data to any third party, including Quorum's competitors in the insurance industry. There is no restriction on the identity of sublicensees, no requirement for notice to Quorum, and no sharing of sublicensing revenue with Quorum.

Third, the license-back encompasses the right to "create derivative works of" Derived Data. This means Meridian could take Quorum's analytics outputs, modify them, and incorporate them into Meridian's own commercial products — effectively free-riding on Quorum's substantial investment in data science, model development, and analytics infrastructure.

Fourth, and most critically, the license-back would encompass outputs generated by Quorum's QuorumScore™ model. Because QuorumScore™ is trained in part on Meridian credit data, the scores and predictions generated by QuorumScore™ would fall within the broad definition of "Derived Data" and would therefore be subject to the license-back. This would give Meridian access to the proprietary outputs of a model in which Quorum has invested tens of millions of dollars, and which Quorum projects will generate $40–50 million in annual B2B licensing revenue by 2027.

Our preliminary market survey — to be detailed in a separate memorandum by Omar Siddiqui, covering comparable enterprise data-licensing transactions in the financial services and insurance sectors — indicates that perpetual, royalty-free license-back provisions of this scope and breadth are outside prevailing market norms. While it is not uncommon for data licensors to reserve limited rights in Derived Data (e.g., the right to receive aggregated, anonymized usage statistics for product-improvement purposes), a full commercial license-back of the type proposed by Meridian is extraordinary and would represent a significant departure from the bargain contemplated by the term sheet exchange.

C. Restriction on Third-Party Commercialization (Section 7.4)

Section 7.4 of the MDLA provides that Quorum "shall not sell, sublicense, distribute, or otherwise make available any Derived Data to any third party" unless the Derived Data has been "sufficiently transformed" such that "no Licensed Data can be identified, extracted, reverse-engineered, or otherwise derived from such Derived Data."

While a restriction on redistribution of Meridian's raw data is reasonable and expected, the application of this restriction to all Derived Data — rather than solely to Licensed Data in its original or substantially similar form — is overbroad. More significantly, the MDLA vests in Meridian the sole and exclusive discretion to determine whether Derived Data has been "sufficiently transformed" to permit third-party distribution. Section 7.4(b) provides that Quorum must submit a written request to Meridian's Chief Data Officer, accompanied by a detailed technical description of the Derived Data and the transformation methodology, and that Meridian shall have sixty (60) days to review and approve or reject the request. Meridian's determination is stated to be "final and binding" and is not subject to any appeal, mediation, or dispute-resolution process.

This framework has several critical defects from Quorum's perspective:

1. No objective standard. The term "sufficiently transformed" is not defined with any precision. There is no quantitative threshold (e.g., minimum k-anonymity level, minimum differential privacy epsilon, or minimum number of independent data sources blended), no reference to industry-accepted de-identification standards (e.g., HIPAA Safe Harbor, NIST guidelines), and no technical criteria against which Meridian's determination can be measured or challenged.

2. Meridian sole discretion. By vesting sole discretion in Meridian, the provision effectively gives Meridian an absolute veto over Quorum's ability to commercialize any Derived Data. This veto is unconstrained: Meridian need not act reasonably, in good faith, or in accordance with any articulated standard. Meridian's commercial incentives are directly adverse to Quorum's — Meridian has every reason to deny approval, as approval would enable Quorum to compete with Meridian's own data products.

3. No time limit on restriction. The restriction applies for the duration of the MDLA and, by implication under the survival provisions, in perpetuity after termination.

4. Direct impact on QuorumScore™. As noted above, the broad definition of Derived Data would encompass QuorumScore™ outputs. Quorum's planned B2B licensing of QuorumScore™ would therefore require Meridian's advance approval under Section 7.4 — approval that Meridian has no obligation to grant and every incentive to withhold.

This provision, if accepted as drafted, would directly impede Quorum's planned B2B licensing of QuorumScore™ and related analytics products. It is, in our view, a deal-breaking provision that must be fundamentally revised.

D. Revenue-Sharing Arrangement (Section 7.5)

Even in the event that Meridian approves the commercialization of Derived Data as "sufficiently transformed" under Section 7.4, Section 7.5 provides that Meridian shall receive 15% of "net revenues" attributable to such Derived Data.

The revenue-sharing provision raises several significant concerns:

First, the 15% revenue share is calculated on "net revenues," but the MDLA provides only a skeletal definition of that term. Section 7.5(a) defines "net revenues" as "gross revenues received by Licensee from the sale, sublicense, or distribution of Derived Data, less only direct third-party costs of distribution." This definition does not adequately address several common scenarios:

• Bundled products. Where Derived Data is sold as a component of a bundled analytics product that also incorporates non-Meridian-sourced data, proprietary algorithms, and Quorum's own intellectual property, how should revenue be allocated between the Meridian-derived component and the non-Meridian components? The MDLA is silent on allocation methodology.

• Deductible costs. The definition permits deduction only of "direct third-party costs of distribution," a narrow category that would exclude Quorum's substantial internal costs of model development, data engineering, quality assurance, customer support, and sales and marketing. Quorum's margin on the relevant revenue would be significantly compressed.

• Indirect revenue attributions. In many cases, Derived Data will contribute indirectly to revenue generation — for example, by improving underwriting accuracy and thereby increasing policy retention or reducing loss ratios — without generating separately identifiable "sales" of Derived Data. The MDLA does not address whether such indirect revenue effects trigger the revenue-sharing obligation.

Second, the 15% rate itself is economically significant. On Quorum's projected $40–50 million QuorumScore™ B2B licensing revenue by 2027, a 15% revenue share would represent $6.0–7.5 million annually — a substantial and ongoing payment to Meridian in addition to the $12.3 million annual license fee.

Third, the revenue share, combined with the license-back (Section 7.3) and the sole-discretion transformation standard (Section 7.4), creates a comprehensive economic claim by Meridian on Quorum's downstream analytics business. The cumulative effect of these three provisions is to ensure that Meridian participates in the upside of Quorum's analytics operations while bearing none of the investment costs, development risks, or operational expenses associated with those operations. This is a fundamentally imbalanced arrangement.

E. ML Model Outputs — Definitional Ambiguity (Section 7.1)

The definition of "Derived Data" in Section 7.1 is drafted broadly enough to capture not only datasets blended with Meridian data but also any model, score, or analytical output that was created "using, incorporating, referencing, or based upon" Licensed Data. This breadth creates a significant definitional ambiguity with respect to machine-learning model outputs.

Quorum's data-science team trains machine-learning models on datasets that include, among many other inputs, Meridian consumer credit data. The training process involves feeding large volumes of historical data — including Meridian data alongside data from multiple other sources — into algorithms that learn statistical patterns and relationships. The output of the training process is a set of model weights and parameters that encode these learned patterns. Once trained, the model generates predictions (inferences) by applying the learned weights to new input data at inference time.

The key technical and legal dispute is whether live predictions generated by the trained model — using new, non-Meridian inputs at the time of inference — constitute "Derived Data" within the meaning of Section 7.1. Quorum's position is as follows:

• The trained model weights and parameters could arguably be characterized as "based upon" or "derived from" the training data, including Meridian data, though even this characterization is legally and technically debatable. The weights represent statistical abstractions of patterns observed across the entire training dataset, not copies or representations of any individual data point.

• However, inference outputs — i.e., the predictions, scores, and classifications generated by the model when applied to new, non-Meridian input data — are independent analytical outputs that are not "derived from" the Meridian training data in any meaningful sense. The inference inputs are new data; the inference outputs are new predictions. The fact that the model was trained on a dataset that included Meridian data does not make every subsequent output of that model a "derivative" of Meridian's data.

The Meridian form MDLA does not draw any distinction between model training artifacts and inference outputs. Both are swept into the broad definition of "Derived Data" by virtue of the phrase "created, generated, or derived in whole or in part by or on behalf of Licensee using, incorporating, referencing, or based upon the Licensed Data." Under this definition, every QuorumScore™ prediction — even one generated using exclusively non-Meridian inputs — would constitute Derived Data and would be subject to the license-back, commercialization restrictions, and revenue share.

This result is commercially untenable and must be corrected in the redline. We recommend a clear definitional carve-out establishing that (a) inference outputs generated by a model using non-Meridian inputs are not Derived Data, and (b) trained model weights and parameters are not Derived Data to the extent they do not contain, reproduce, or enable the extraction of any identifiable Licensed Data.

F. Recommendation. Article VII must be fundamentally rewritten in Quorum's redline. Our proposed approach addresses each of the issues identified above:

1. Narrow the definition of "Derived Data." The definition should be revised to exclude (a) machine-learning model weights and parameters that do not contain or reproduce identifiable Licensed Data; (b) inference outputs generated by models using non-Meridian inputs; and (c) any data, score, or output that does not contain, reproduce, or enable the identification or extraction of Licensed Data in its original or a substantially similar form.

2. Vest all IP ownership of Derived Data in Quorum. The MDLA should provide an express, unambiguous assignment of all intellectual property rights in Derived Data to Quorum, with Meridian disclaiming any right, title, or interest therein.

3. Eliminate the license-back provision entirely. The perpetual, royalty-free, sublicensable license-back in Section 7.3 should be deleted in its entirety. Quorum may consider, as a concession, granting Meridian a limited right to receive aggregated, anonymized, non-reverse-engineerable usage statistics for product-improvement purposes only, but any such grant should be narrowly scoped and non-sublicensable.

4. Eliminate the 15% revenue share. The revenue-sharing provision in Section 7.5 should be deleted in its entirety. Meridian's compensation for the Licensed Data is the $60 million license fee; it should not receive additional compensation for Quorum's independent creation of value using that data.

5. Permit Quorum to commercialize Derived Data without Meridian's consent. Section 7.4's sole-discretion approval mechanism should be replaced with an objective de-identification and non-reverse-engineering standard. We recommend a standard based on accepted data-anonymization methodologies (e.g., requiring that Derived Data made available to third parties be processed such that Licensed Data cannot be identified or reconstructed using commercially reasonable means), with compliance determined by reference to an objective technical standard rather than Meridian's subjective judgment.

6. Include a specific carve-out protecting QuorumScore™. Given the strategic importance of QuorumScore™, the MDLA should include an express provision confirming that QuorumScore™ and all outputs thereof are the exclusive property of Quorum, are not Derived Data, and are not subject to any of Meridian's rights under Article VII.

V. Grant of License and Scope (Article II)

A. License Grant

Article II of the Meridian form MDLA grants Quorum "a non-exclusive, non-transferable, non-sublicensable license to access and use the Licensed Data solely for Licensee's internal business purposes during the Term." While the non-exclusive nature of the license is appropriate and consistent with Quorum's expectations, the restrictions embedded in the license grant raise two significant issues.

Internal business purposes limitation. The restriction to "internal business purposes" is too narrow to accommodate Quorum's intended use of the Licensed Data. As discussed with the Quorum business team, the Licensed Data will be used not only within Quorum's own operations but also in connection with products and analytics offered to Quorum's affiliates, subsidiaries, reinsurance counterparties, and certain B2B analytics customers. The "internal business purposes" limitation would preclude these uses absent a broader license scope.

We recommend that the license grant be revised to permit use of the Licensed Data within Quorum's corporate group, defined to include Quorum and all of its direct and indirect subsidiaries and affiliates (i.e., entities controlled by, controlling, or under common control with Quorum). In addition, the license should expressly permit use of the Licensed Data in connection with Quorum's insurance and analytics business operations, including use in models and products that may be provided to third parties, subject to the Derived Data provisions as revised per our recommendations in Section IV above.

Non-sublicensable restriction. The non-sublicensable restriction may conflict with Quorum's operational requirements. Quorum relies on range third-party vendors, cloud hosting providers (including Ridgeway Industries and Crestline Systems), managed service providers, and outsourced IT service partners that need to process, store, and transmit Meridian data on Quorum's behalf in order to support Quorum's data infrastructure. Under the current drafting, any such processing by a third-party service provider could be characterized as an unauthorized sublicense, exposing Quorum to breach claims.

We recommend inserting a carve-out permitting Quorum to grant access to Licensed Data to third-party service providers, subcontractors, and vendors that are acting under Quorum's direction and on Quorum's behalf, subject to the conditions that (a) such third parties are bound by written agreements containing confidentiality and data-security obligations at least as protective as those set forth in the MDLA, (b) Quorum remains fully liable for any acts or omissions of such third parties, and (c) Quorum provides prior written notice to Meridian of any such access grants (or, alternatively, maintains a list of approved service providers that is updated annually and made available to Meridian upon request).

B. Permitted Use Restrictions

Section 2.2 of the MDLA restricts Quorum's use of the Licensed Data to the following three categories: (a) underwriting, (b) policy administration, and (c) claims management. While these three categories cover a portion of Quorum's intended use cases, they do not encompass the full range of purposes for which Quorum intends to use the Licensed Data. Specifically, the following use cases are omitted from the permitted use definitions:

• Fraud detection. Quorum intends to use Meridian data, particularly the MCI Consumer Credit File™ and MCI AltSignal™ products, as key inputs to its claims-fraud detection algorithms. Fraud detection is distinct from "claims management" and is not clearly encompassed within that term as used in the MDLA.

• Marketing and propensity scoring. Quorum intends to use Meridian data to develop and refine customer propensity models for marketing, cross-selling, and customer-retention purposes. This use case is not within the scope of "underwriting," "policy administration," or "claims management."

• Regulatory compliance. Quorum intends to use Meridian data in connection with regulatory compliance activities, including fair-lending analysis, disparate-impact testing, and regulatory reporting. These are compliance functions that do not fit neatly within the three enumerated categories.

• Reinsurance support. Quorum intends to provide analytics outputs — derived in part from Meridian data — to its reinsurance counterparties in connection with reinsurance treaty placements and bordereau reporting. This use is not clearly authorized by the "internal business purposes" limitation.

Recommendation: Expand the permitted use definitions in Section 2.2 to encompass all of Quorum's identified use cases. We recommend replacing the three-category enumeration with a broader formulation permitting use "in connection with Licensee's insurance, reinsurance, analytics, regulatory compliance, fraud prevention, and related business operations," followed by a non-exhaustive list of specific permitted uses including automated underwriting, claims-fraud detection, customer propensity scoring, regulatory compliance and reporting, actuarial analysis, risk modeling, reinsurance support, and product development.

C. Exclusivity. The license is non-exclusive, which is appropriate and consistent with Quorum's expectations. Quorum does not seek exclusivity in the Licensed Data and does not wish to restrict Meridian's ability to license data to other parties. No revision is needed on this point.

VI. Representations and Warranties (Article IV)

A. Meridian's Representations

Article IV of the Meridian form MDLA contains several representations made by Meridian, which we address in turn.

Right to license. Meridian represents that it has the right, power, and authority to grant the license set forth in the MDLA and to make the Licensed Data available to Quorum in accordance with the terms of the agreement. This representation is fundamental and appropriate.

Compliance with applicable law. Meridian represents that the Licensed Data "is collected and processed in compliance with applicable law." While this representation is directionally appropriate, it is insufficiently specific. Notably, Meridian does not expressly represent compliance with the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681 et seq.; the Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. § 6801 et seq.; or the numerous state consumer-protection and data-privacy laws that govern the collection, processing, and distribution of consumer credit information. Given the regulatory sensitivity of consumer credit data — and the substantial penalties and liability exposure associated with non-compliance — Quorum should insist on express representations that Meridian's data collection, processing, and licensing practices comply with all applicable federal and state privacy and consumer-protection laws, including without limitation the FCRA, GLBA, state mini-FCRA statutes, and the California Consumer Privacy Act ("CCPA"), Cal. Civ. Code § 1798.100 et seq.

Non-infringement. Meridian represents that the Licensed Data "does not, to Meridian's knowledge, infringe the intellectual property rights of any third party." The knowledge qualifier weakens this representation significantly. For a $60 million data license, Quorum should seek to remove the knowledge qualifier or, at minimum, expand it from actual knowledge to "knowledge after reasonable inquiry."

Data accuracy. This is the most significant gap in Meridian's representations. The MDLA provides that the Licensed Data is furnished "AS IS," and Meridian expressly disclaims "all warranties, whether express, implied, or statutory, including without limitation any warranties of accuracy, completeness, merchantability, fitness for a particular purpose, or non-infringement." This blanket disclaimer is problematic. Quorum is committing $60 million over five years for data that will serve as a foundational input to automated underwriting decisions affecting a $4.18 billion insurance business. If the data is materially inaccurate, incomplete, or stale, the consequences for Quorum could be severe — ranging from underwriting losses to regulatory enforcement actions to consumer litigation.

We recommend that Quorum insist on meaningful data-quality warranties, including:

• A minimum accuracy rate for consumer credit file data (e.g., 97% accuracy at the field level, measured against a statistically significant sample);

• A minimum completeness threshold (e.g., 95% of records containing all required core data fields);

• A maximum data-staleness standard (e.g., consumer credit file data updated at least monthly; commercial credit data updated at least quarterly);

• Remediation obligations requiring Meridian to investigate and correct identified data-quality deficiencies within specified timeframes; and

• Service credits or fee adjustments in the event that data quality falls below the agreed thresholds for a sustained period.

These warranties should be backstopped by the indemnification provisions discussed in Section VIII below.

B. Quorum's Representations

Quorum is asked to make two principal representations under Article IV:

FCRA permissible purpose. Quorum represents that it holds all required FCRA permissible purposes for accessing consumer credit information and that it will use the Licensed Data only for such permissible purposes. This representation is appropriate and is consistent with Quorum's obligations as a user of consumer credit data under the FCRA. However, Quorum should ensure that its FCRA Permissible Purpose Certification — which is a separate schedule to the MDLA currently under development — accurately and comprehensively reflects all of its intended use cases, including those discussed in Section V.B above (fraud detection, propensity scoring, regulatory compliance, etc.). Each use case may implicate a different FCRA permissible purpose (e.g., § 1681b(a)(3)(A) for insurance underwriting; § 1681b(a)(3)(D) for account review), and the certification should be drafted with appropriate specificity. We recommend coordinating with Claudia Reeves (VP, Regulatory & Compliance) on this point.

Regulatory licenses and approvals. Quorum is also asked to represent that it maintains all regulatory licenses and approvals required for its operations. This is a standard representation and is generally acceptable, though Quorum should confirm through its regulatory compliance team that the representation is accurate as of the expected execution date and that no pending regulatory actions or license renewals could affect the accuracy of this representation.

VII. Data Security Obligations (Article V)

This section is addressed in substantially greater detail in a forthcoming memorandum from David Cartwright and Lisa Johannsen, who are leading the data privacy and security workstream for this engagement. The observations provided below are summary-level only and are intended to flag the key issues for the attention of the commercial negotiating team. Quorum's full data-security negotiating position will be set forth in the Data Security Addendum ("DSA") that our privacy team is currently drafting.

Quorum's obligations under the form MDLA:

• Quorum is required to maintain SOC 2 Type II certification. Quorum's current SOC 2 Type II report was issued by Felton Thorpe & Co. LLP, covering the audit period ending December 31, 2023. This requirement is standard and should not present a compliance issue.

• Quorum is required to comply with all applicable cybersecurity regulations, including specifically 23 NYCRR 500, the New York Department of Financial Services Cybersecurity Regulation. As a regulated insurance holding company, Quorum is already subject to 23 NYCRR 500 and this requirement is consistent with existing obligations.

• Quorum is required to maintain cyber liability insurance with an aggregate policy limit of at least $50,000,000. Quorum's current cyber liability policy meets this threshold. See Section XII below for further discussion of insurance requirements.

Meridian's obligations under the form MDLA:

• Meridian certifies SOC 2 Type II and ISO 27001 compliance. Meridian's SOC 2 Type II report was issued by Galloway Nash LLP, covering the audit period ending March 31, 2023. ISO 27001 certification was issued by an unspecified certification body (to be confirmed).

• Meridian is required to maintain cyber/technology E&O insurance with an aggregate policy limit of at least $25,000,000. As discussed in Section XII below, the disparity between Quorum's $50 million and Meridian's $25 million insurance requirements warrants further consideration.

Data-breach notification: Both parties are required to notify the other within forty-eight (48) hours of the discovery of any data breach or security incident affecting Licensed Data. The forty-eight-hour notification window is aggressive but within the range of accepted market practice and is consistent with certain regulatory notification requirements.

Key gaps identified in the form MDLA:

The form MDLA lacks adequate detail in several critical areas related to data security:

• Incident response procedures. The form does not specify the procedures to be followed in the event of a data breach, including the appointment of an incident response coordinator, the establishment of a joint incident response team, or the specific steps to be taken to contain and remediate the breach.

• Forensic investigation rights. The form does not grant either party the right to conduct or commission an independent forensic investigation of a data breach affecting the other party's systems.

• Indemnification for breach-related costs. The form does not address indemnification for costs arising from a data breach, including notification costs, credit-monitoring expenses, regulatory fines, and litigation defense costs.

• Coordination obligations. The form does not establish coordination obligations between the parties in connection with regulatory notifications, consumer notifications, or public communications relating to a data breach.

These gaps will be addressed in the DSA being drafted by our privacy team. We recommend that the DSA be attached to the MDLA as a mandatory exhibit and that the MDLA's data-security provisions be revised to reference and incorporate the DSA.

VIII. Indemnification (Article IX)

A. Meridian's Indemnification Obligations

Section 9.1 of the Meridian form MDLA provides that Meridian shall indemnify, defend, and hold harmless Quorum and its officers, directors, employees, and agents from and against any third-party claims, damages, losses, and expenses (including reasonable attorneys' fees) arising from claims that Quorum's use of the Licensed Data in accordance with the terms of the MDLA infringes or misappropriates any third-party intellectual property rights.

While this intellectual property indemnification is appropriate in concept, it is subject to several carve-outs that, in practice, substantially eliminate Meridian's indemnification exposure for the most likely risk scenarios:

1. Modification carve-out. Meridian excludes indemnification for any claims arising from Quorum's "modification, alteration, enhancement, or transformation" of Licensed Data. Given that virtually all of Quorum's intended uses involve processing, blending, and analyzing Licensed Data in combination with other data sources — all of which could be characterized as "modification" or "transformation" — this carve-out would effectively eliminate indemnification for the vast majority of potential infringement claims.

2. Combination carve-out. Meridian excludes indemnification for any claims arising from the "combination of Licensed Data with data, software, systems, or materials not provided by Meridian." Since Quorum's core use case involves combining Meridian data with data from multiple other sources (internal policyholder data, third-party data feeds, public records, etc.), this carve-out would exclude indemnification for claims arising from Quorum's most fundamental use of the Licensed Data.

3. Regulatory enforcement carve-out. Meridian excludes indemnification for any claims arising from "regulatory investigations, enforcement actions, or proceedings brought by any governmental authority." This carve-out is particularly problematic given the regulatory sensitivity of consumer credit data. If Meridian's data-collection practices are found to violate the FCRA, GLBA, or state consumer-protection laws, and Quorum faces regulatory action as a downstream user of non-compliant data, Meridian would bear no indemnification obligation.

The cumulative effect of these three carve-outs is to limit Meridian's indemnification to a narrow category of direct, unmodified, standalone use of Licensed Data — a scenario that is unlikely to arise in practice given Quorum's intended data-processing and analytics activities.

Recommendation: Quorum should seek to narrow these carve-outs in several ways. First, the modification carve-out should be limited to claims arising solely from Quorum's modification of Licensed Data (i.e., claims that would not have arisen but for the modification). Second, the combination carve-out should be similarly limited to claims arising solely from the combination (not claims arising from the Licensed Data itself when used in combination). Third, the regulatory enforcement carve-out should be revised to preserve Meridian's indemnification obligation for regulatory actions attributable to defects in Meridian's data-collection, data-processing, or data-licensing practices. Fourth, Quorum should add an affirmative indemnification obligation requiring Meridian to indemnify Quorum for third-party claims and regulatory actions arising from Meridian's violation of applicable privacy and consumer-protection laws in connection with the collection, processing, and licensing of the Licensed Data.

B. Quorum's Indemnification Obligations

Secti

MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
TO: Carolyn Whitford, General Counsel & Executive Vice President, Quorum Insurance Holdings Corp. Gregory Stahl, Vice President, Legal Affairs, Quorum Insurance Holdings Corp.
FROM: Wendy Schultz, Associate, intellectual Property, Calderwood & Harkness LLP Patricia Heng, Senior Counsel, Technology Transactions, Calderwood & Harkness LLP
DATE: November 10, 2022
RE: Key Issues in Meridian Credit intelligence, Inc.'s Form Master Data License Agreement (delivered November 4, 2022)
C&H Matter No.: 1025-00008
This memorandum is a privileged and confidential attorney-client communication prepared by Calderwood & Harkness LLP for the exclusive use of Quorum Insurance Holdings Corp. It contains legal advice and work product and is not intended for disclosure to any third party. Any inadvertent disclosure does not constitute a waiver of the attorney-client privilege or work-product protection.
Right-click to update Table of Contents
I. Executive Summary
This memorandum provides a comprehensive analysis of the material provisions and critical issues identified in Meridian Credit intelligence, Inc.'s ("Meridian") form Master Data License Agreement (the "MDLA"), drafted by Meridian's outside counsel, Kessler Pruitt & Ashe LLP, and delivered to Calderwood & Harkness LLP ("C&H") on November 4, 2022. The purpose of this memorandum is to identify and assess each provision of the MDLA that presents commercial risk, legal exposure, or drafting deficiency from the perspective of Quorum Insurance Holdings Corp. ("Quorum"), and to recommend a negotiating strategy and specific redline positions for each such provision.
The MDLA is the central agreement governing a proposed five-year enterprise data-licensing arrangement between Quorum and Meridian, valued at $60,000,000 in aggregate license fees ($10,800,000 in Year 1 and $12,300,000 per year in Years 2 through 5), plus a one-time implementation and integration fee of $1,500,000. The transaction is of critical strategic importance to Quorum, as the Licensed Data will serve as a foundational input to Quorum's automated underwriting models, claims-fraud detection algorithms, and customer propensity scoring across its property and casualty, life, and specialty insurance lines of business.
This memorandum is organized by issue severity. We identify twelve (12) principal categories of concern, encompassing numerous sub-issues, ranging from deal-breaking provisions that fundamentally threaten Quorum's commercial objectives to provisions requiring meaningful revision but amenable to negotiation through the redline process. The issues are further classified into three priority tiers to guide the negotiating team's allocation of time and attention.
In our assessment, the three most critical issues in the Meridian form MDLA are as follows:
1. intellectual Property Ownership of Derived Data (Article VII). The MDLA's treatment of Derived Data — broadly defined to include any data, models, scores, or analytics outputs created by Quorum using Meridian data as an input — is fundamentally adverse to Quorum's interests. Meridian asserts ongoing IP rights in all Derived Data, demands a perpetual royalty-free license-back on all such data, imposes a 15% revenue share on any commercialization of Derived Data, and reserves sole discretion to determine whether Derived Data has been "sufficiently transformed" for third-party distribution. This framework would directly threaten Quorum's proprietary QuorumScore™ predictive underwriting model and its projected $40–50 million B2B licensing revenue line by 2027.
2. Absence of Most Favored Nation Pricing Protection. The Meridian form MDLA contains no most favored nation ("MFN") pricing clause, despite Quorum's explicit proposal of a broad MFN in its counter-term sheet. Given the scale of the financial commitment ($60 million over five years) and the competitive dynamics of the insurance data-licensing market, the absence of any pricing protection mechanism is a critical gap.
3. Meridian's License-Back and Revenue-Sharing Mechanisms on Derived Data Commercialization. Even apart from the IP ownership question, Meridian's demand for a perpetual, sublicensable license-back on all Derived Data, combined with the 15% revenue share and sole-discretion transformation standard, creates a comprehensive economic claim by Meridian on Quorum's downstream analytics business that is commercially unacceptable.
We note that this analysis is coordinated with David Cartwright and Lisa Johannsen, who are addressing data privacy and security matters in a separate memorandum, and with Marcus Weill, who is analyzing the corporate and covenant implications of the transaction, including the lender consent requirements under Quorum's existing credit facility. Those memoranda should be read in conjunction with this one.
Our recommendation is that Calderwood & Harkness prepare a comprehensive redline of the Meridian form MDLA, targeting delivery to Kessler Pruitt & Ashe LLP by early December 2022. The redline should address each of the issues identified in this memorandum, with the Priority 1 issues treated as threshold matters that must be resolved before the parties proceed to negotiate the balance of the agreement.
II. Background and Context
A. The Transaction
Quorum Insurance Holdings Corp. is a Delaware corporation listed on the Nasdaq Stock Market (ticker: QIHC), with its principal executive offices located at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901. Quorum is a diversified insurance holding company operating through subsidiaries in the property and casualty, life, and specialty insurance segments, with approximately $4.18 billion in annual gross written premiums across its consolidated operations.
Quorum proposes to license consumer credit-file data, commercial credit data, and alternative-data feeds from Meridian Credit intelligence, Inc. for use in automated underwriting models, claims-fraud detection algorithms, and customer propensity scoring across all of Quorum's insurance lines of business. The data-licensing arrangement contemplated by the MDLA is intended to serve as a foundational data infrastructure investment, enabling Quorum to enhance underwriting precision, reduce loss ratios, improve customer acquisition targeting, and strengthen fraud-detection capabilities across its operating subsidiaries.
Meridian Credit intelligence, Inc. is a Georgia corporation headquartered at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326. Meridian is one of the leading providers of consumer and commercial credit data and alternative-data products in the United States, maintaining databases encompassing approximately 310 million consumer credit records, 42 million commercial business records, and 85 million consumer alternative-data records (including utility, telecommunications, and rental payment data).
Meridian is privately held. The majority ownership interest in Meridian — 62.5% of issued and outstanding equity — is held by Breckenridge Capital Partners Fund IV, L.P., a private equity fund managed by Breckenridge Capital Management LLC. Breckenridge Capital Management is located at 600 Lexington Avenue, 28th Floor, New York, New York 10022. The managing partner of Breckenridge is Elaine Drummond, and the partner overseeing the Meridian investment is Caleb Rourke.
Importantly, Meridian is advised by Whitmore Zanthor & Co. (investment bank; managing director Rachel Ng-Castillo) in connection with a planned initial public offering currently targeted for the 2025–2026 timeframe. This planned IPO materially influences Meridian's negotiating posture on several key provisions of the MDLA, including pricing and data-exclusivity terms, as Meridian and its sponsors have a strong incentive to protect revenue margins, avoid pricing commitments that could compress margins ahead of the offering, and minimize public disclosure of contractual disputes that could complicate the IPO process. We have been mindful of these dynamics throughout our analysis.
B. Licensed Data Products
The MDLA contemplates the licensing of three distinct data products, each delivered through specified channels:
1. MCI Consumer Credit File™: This product encompasses approximately 310 million consumer credit records, including traditional credit bureau data (trade lines, payment histories, public records, credit inquiries, and credit scores). Delivery is available via daily batch processing through Secure File Transfer Protocol ("SFTP") and in real time through a REST API interface. This is the largest and most commercially significant of the three data products.
2. MCI CommercialView™: This product encompasses approximately 42 million business entity records, including commercial credit profiles, payment behavior data, financial statement data, and business demographic information. Delivery is available via weekly batch processing through SFTP. Quorum intends to use this product primarily in connection with its commercial lines underwriting and its specialty insurance operations.
3. MCI AltSignal™: This product encompasses approximately 85 million consumer alternative-data records, including utility payment histories, telecommunications payment data, and rental payment information. This alternative data is intended to supplement traditional credit file data and is particularly valuable for underwriting applicants with thin credit files. Delivery is available via daily batch processing through SFTP.
The total estimated monthly volume across all three data products is approximately 437 million records per month. This volume represents approximately 87.4% of the 500 million records per month base tier established under the MDLA's pricing framework, as discussed further in Section III.D below.
C. Procedural History
The following timeline summarizes the key procedural milestones leading to the delivery of the Meridian form MDLA:
• August 8, 2022: Calderwood & Harkness engagement opened (C&H Matter No. 1025-00008).
• August 15, 2022: Mutual Non-Disclosure Agreement executed between Quorum and Meridian (reference: NDA-QIH-MCI-2022-001).
• September 12, 2022: Meridian delivered its initial term sheet to Quorum, outlining proposed commercial terms for the data-licensing arrangement.
• September 30, 2022: Quorum delivered a counter-term sheet, reflecting Quorum's preferred positions on pricing, IP ownership, MFN protections, dispute resolution, and other key terms.
• October 17, 2022: The parties exchanged initial drafts of the MDLA. Quorum's initial draft was prepared by Calderwood & Harkness based on Quorum's standard data-licensing template, while Meridian's initial draft was prepared by Kessler Pruitt & Ashe LLP based on Meridian's standard form.
• November 4, 2022: Kessler Pruitt & Ashe LLP delivered Meridian's form MDLA — the version that is the subject of this memorandum.
The current expectation is that Calderwood & Harkness will prepare and deliver a comprehensive redline of the Meridian form MDLA by early December 2022, following which the parties will engage in iterative negotiation sessions with the objective of reaching agreement on definitive documentation by the first quarter of 2023.
D. Quorum's Key Business Objectives
Based on our discussions with Quorum's management team and in-house legal department, we understand that Quorum's key business objectives for this transaction are as follows:
1. Full Ownership of Derived Data. Quorum seeks to own all intellectual property rights in Derived Data — that is, blended risk scores, propensity models, enriched datasets, and other analytics outputs — created by Quorum or on its behalf using Meridian data as one of multiple inputs. Quorum views this as a foundational requirement, without which the transaction does not achieve its strategic purpose.
2. Protection of QuorumScore™. Quorum has developed QuorumScore™, a proprietary predictive underwriting model that incorporates machine-learning algorithms trained on multiple data sources, including (but not limited to) Meridian consumer credit data. A United States Patent and Trademark Office application for QuorumScore™ is pending (Serial No. 97/482,116). Quorum projects that B2B licensing of QuorumScore™ and related analytics products will generate $40–50 million in annual revenue by 2027. Quorum cannot accept any contractual framework that would give Meridian ownership of, a license-back to, or a revenue share in QuorumScore™ outputs.
3. Most Favored Nation Pricing Protection. Given the magnitude of the financial commitment ($60 million over five years), Quorum seeks assurance that it will not pay more, on a per-record or aggregate basis, than competing insurance-industry licensees of comparable scale. Quorum's counter-term sheet proposed a broad MFN covering all U.S.-domiciled insurance carriers, managing general agents, and insurtech firms with annual premiums written of $500 million or more.
4. Court Jurisdiction for Dispute Resolution. Quorum prefers to resolve disputes in court rather than through binding arbitration, for reasons discussed in detail in Section XI below.
These objectives have guided our analysis throughout this memorandum and will inform the positions taken in Quorum's redline.
III. Deal Economics — Pricing and Payment Terms
A. License Fee Structure (Article III of MDLA)
Article III of the Meridian form MDLA sets forth the license fee structure for the five-year initial term. The total aggregate consideration recited in the MDLA is $60,000,000, allocated as follows:
• Year 1: $10,800,000 annual license fee, payable in equal quarterly installments of $2,700,000 (equivalent to $900,000 per month). The reduced Year 1 fee reflects the six-month implementation and ramp period during which Quorum will be integrating the data feeds into its existing systems and is not expected to achieve full data consumption volumes.
• Years 2 through 5: $12,300,000 annual license fee per year, payable in equal quarterly installments of $3,075,000 (equivalent to $1,025,000 per month). This represents the steady-state annual fee following completion of the implementation period.
As a reconciliation check: $10,800,000 + ($12,300,000 × 4) = $10,800,000 + $49,200,000 = $60,000,000. This figure is confirmed as consistent with the total consideration stated in the recitals and in the commercial summary attached as Schedule A to the MDLA.
Regarding payment terms, the Meridian form MDLA specifies that quarterly installments are payable in advance, with payment due within fifteen (15) days of the date of Meridian's invoice. Quorum's counter-term sheet proposed net thirty (30) day payment terms, consistent with Quorum's standard vendor payment cycle and internal accounts payable processing timelines. This fifteen-day gap needs to be reconciled in the redline. We note that fifteen-day payment terms are unusual for an enterprise data-licensing arrangement of this scale and would likely require Quorum to establish special payment processing procedures outside its standard AP workflow.
B. One-Time Implementation Fee
In addition to the $60,000,000 in aggregate license fees, the MDLA provides for a one-time implementation and integration fee of $1,500,000, payable upon execution of the MDLA. This fee covers Meridian's costs associated with configuring data feeds, establishing API connectivity, provisioning SFTP access, conducting data mapping and schema alignment, and supporting Quorum's integration testing.
The implementation fee is stated to be "in addition to and separate from" the aggregate license fees. However, we have identified an ambiguity in the drafting: while the implementation fee is described as separate from the $60,000,000 license value in the body of Article III, several other provisions of the MDLA calculate obligations by reference to "total fees paid under this Agreement" or "aggregate consideration payable hereunder" without clearly specifying whether the implementation fee is included in or excluded from those calculations. This lack of clarity affects the computation of:
• Data-volume overage thresholds (Section 3.4);
• Service level agreement credits (Schedule C);
• Early termination fees (Section 11.5); and
• The limitation of liability cap (Section 10.1).
We recommend that the redline include a clear definitional provision specifying that the implementation fee is not included in the calculation of any fee-based thresholds, credits, or caps, unless expressly stated otherwise.
C. Late Payment Interest
Section 3.6 of the Meridian form MDLA provides that any amounts not paid when due shall accrue interest at a rate of 1.5% per month (equivalent to 18% per annum), compounding monthly. This interest begins to accrue on the day following the applicable due date and continues until full payment is received.
This rate is aggressive and exceeds the prevailing market standard for enterprise data-licensing and technology transactions, where the typical late payment interest rate is the lesser of 1.0% per month (12% per annum) or the maximum rate permitted by applicable law. Additionally, the compounding feature amplifies the effective rate over time. While New York law generally does not impose a statutory usury limit on obligations between business entities of this nature (under New York General Obligations Law § 5-501 and Banking Law § 14-a, the civil usury limit of 16% per annum applies to certain loan transactions but may not apply to commercial contract interest provisions), the 18% rate is nonetheless above the civil usury threshold and could raise questions in certain circumstances.
We recommend that Quorum seek to reduce the late payment interest rate to the lesser of 1.0% per month (simple, not compounding) or the maximum rate permitted by applicable law. In the alternative, Quorum should propose that interest accrue only after a grace period of ten (10) business days following written notice of non-payment, to account for administrative delays and invoice disputes.
D. Data-Volume Tiers and Overages
Section 3.4 of the MDLA establishes a tiered pricing structure based on monthly data-consumption volume:
• Base Tier: Up to 500 million records per month (consumer, commercial, and alternative-data records combined). The base tier license fees are included in the annual license fee amounts set forth in Section 3.1.
• Overage Rate: For each record consumed in excess of the 500 million base tier threshold in any given month, Quorum is required to pay an additional per-record fee of $0.003.
Based on Quorum's current data-consumption estimates, the anticipated monthly volume across all three data products is approximately 437 million records per month, representing approximately 87.4% of the base tier. This provides reasonable headroom at the outset of the arrangement. However, we note several concerns:
First, Quorum's data-science and analytics teams project significant volume growth over the five-year term as Quorum expands its use cases, onboards additional insurance lines, and increases API query frequency. Under certain growth scenarios modeled by Priya Nair's data engineering team, Quorum's monthly consumption could approach or exceed the 500 million record threshold by Year 3 and could reach 650–700 million records per month by Year 5. At the $0.003 per-record overage rate, consumption of 700 million records per month would result in overage charges of approximately $600,000 per month ($7.2 million annualized), representing a 58.5% increase over the annual license fee.
Second, the MDLA does not provide for any periodic adjustment of the base tier threshold to reflect anticipated growth, nor does it offer volume discounts as Quorum's consumption scales. This is a significant omission for a five-year arrangement. We recommend inserting an annual true-up mechanism under which the base tier threshold increases by a specified percentage each year (e.g., 10% per year) or is recalibrated annually based on the prior year's average monthly consumption plus a buffer. Additionally, the per-record overage rate should decline as consumption increases, following a standard volume-discount schedule.
Third, the MDLA does not clearly define what constitutes a "record" for purposes of volume measurement. A single consumer credit file pull could generate multiple sub-records depending on the number of trade lines, inquiries, and public records associated with that consumer. Quorum should seek a clear definition of "record" that aligns with its internal data architecture and avoids double-counting or inflated volume measurements.
E. Absence of Most Favored Nation Pricing
The Meridian form MDLA contains no most favored nation pricing clause. This is one of the three most critical issues in the agreement and represents a significant departure from Quorum's negotiating position.
Quorum's counter-term sheet, delivered on September 30, 2022, proposed a broad MFN provision covering all U.S.-domiciled insurance carriers, managing general agents, and insurtech firms with annual premiums written of $500 million or more. The proposed MFN would require automatic price adjustment — applicable to per-record pricing, volume discounts, base tier thresholds, and aggregate fee terms — to match any more favorable terms offered by Meridian to a Comparable Licensee (as defined in the counter-term sheet) during the term of the MDLA. The adjustment would be retroactive to the date on which the more favorable terms were first offered to the Comparable Licensee, with a true-up credit applied to Quorum's account within thirty (30) days of Quorum's notification of the more favorable terms.
Meridian's complete omission of any MFN provision from its form MDLA was not unexpected but is nonetheless a critical gap that must be addressed in Quorum's redline. Based on the term sheet exchange and preliminary discussions between counsel, we understand that Meridian's resistance to the MFN is grounded in several arguments:
1. Confidentiality obligations. Meridian asserts that disclosing pricing terms offered to other licensees would breach confidentiality provisions in those agreements.
2. Bespoke data packages. Meridian contends that each licensee's data package is customized in terms of product mix, delivery frequency, volume, and integration support, making apples-to-apples pricing comparisons impractical.
3. IPO-related margin concerns. Breckenridge Capital and Whitmore Zanthor have expressed concern that an MFN obligation could compress Meridian's margins on future deals, adversely affecting Meridian's financial profile ahead of the planned 2025–2026 IPO.
4. Antitrust sensitivities. Meridian has raised the possibility that MFN provisions in credit-data markets could attract antitrust scrutiny, particularly given the concentrated nature of the credit-data industry.
We have considered each of these arguments and believe they are either manageable or unpersuasive. The confidentiality concern can be addressed through a pricing audit mechanism (discussed below). The bespoke-package argument, while factually accurate, does not preclude a per-record rate comparison on a normalized basis. The IPO-margin concern is Meridian's internal business issue and does not justify exposing Quorum to pricing discrimination. And the antitrust concern, while worth monitoring, is unlikely to present a material risk for a single-customer MFN clause in a bilateral negotiation.
Recommendation: Insert the full MFN clause as drafted in the counter-term sheet as Quorum's primary position. Separately, we recommend that the team prepare a fallback "pricing audit right" provision as an alternative to the full MFN, to be offered in the event that Meridian categorically refuses the MFN. Under this fallback, Quorum would have the right to engage an independent third-party auditor — selected from a mutually agreed list of accounting firms — to conduct a confidential pricing review once per contract year. The auditor would verify that Quorum's effective per-record rate (calculated on a normalized basis across all data products) does not exceed 110% of the lowest comparable per-record rate offered by Meridian to any Comparable Licensee. If the audit reveals a rate disparity exceeding the 110% threshold, Quorum would be entitled to a retroactive credit and prospective rate adjustment. The auditor's findings would be delivered to both parties in summary form, without disclosing the identity or specific pricing of any other licensee.
We understand that Pinnacle Ridge Advisory LLC (Franklin Osei, engagement lead) has been retained to prepare a pricing benchmark study comparing Meridian's proposed pricing to prevailing market rates for comparable data-licensing arrangements. That study is expected to be completed by February 2023 and will provide valuable support for Quorum's MFN negotiating position.
IV. Intellectual Property Ownership — Derived Data (Article VII)
A. Overview of Meridian's Proposed Framework
Article VII of the Meridian form MDLA is, in our assessment, the most commercially significant and problematic provision in the entire agreement. It governs the creation, ownership, and exploitation of "Derived Data," a term defined in Section 7.1 and discussed in detail below. The economic and strategic implications of Article VII pervade the entire commercial relationship and directly affect Quorum's ability to realize the full value of its investment in this data-licensing arrangement.
Meridian's proposed framework rests on the fundamental premise that all Derived Data that "incorporates, is based on, or is traceable to" Meridian's raw Licensed Data constitutes a "derivative work" within the meaning of the Copyright Act, 17 U.S.C. § 101, and accordingly remains subject to Meridian's underlying intellectual property rights. From this premise, Meridian derives three interconnected rights: (1) a perpetual license-back on all Derived Data; (2) a veto power over third-party commercialization of Derived Data; and (3) a 15% revenue share on approved commercialization.
We disagree with Meridian's legal premise. The characterization of aggregated analytics outputs, machine-learning model parameters, and blended risk scores as "derivative works" of raw data inputs is not well-supported by case law and reflects an overbroad application of derivative-work doctrine. As the Second Circuit recognized in Nihon Keizai Shimbun, Inc. v. Comline Business Data, Inc., 166 F.3d 65 (2d Cir. 1999), the derivative-work concept requires a close nexus between the original work and the putative derivative — mere use of factual data as an input to an independent analytical process does not create a derivative work. Moreover, to the extent Meridian's raw data consists of factual information (credit scores, payment histories, business records), that data is not protectable under copyright at all. See Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340 (1991).
Regardless of the legal merits of Meridian's position, the contractual provisions as drafted in Article VII would, if accepted, create binding obligations that govern the parties' rights without regard to the underlying copyright analysis. For this reason, it is essential that Article VII be fundamentally rewritten in Quorum's redline to reflect Quorum's commercial position and to avoid accepting, even implicitly, Meridian's characterization of Derived Data as derivative works.
B. License-Back Provision (Section 7.3)
Section 7.3 of the Meridian form MDLA provides that Quorum "hereby grants to Meridian a perpetual, royalty-free, fully paid-up, irrevocable, worldwide, sublicensable license to access, use, reproduce, distribute, display, perform, create derivative works of, and otherwise exploit all Derived Data for Meridian's internal business purposes and for commercial purposes, including without limitation the right to incorporate Derived Data into Meridian's products and services offered to third parties."
This provision is a highly atypical and commercially unacceptable license-back grant that would effectively give Meridian unrestricted access to the outputs of Quorum's proprietary analytics platform. Several specific concerns merit emphasis:
First, the license-back is perpetual and irrevocable. It is not conditioned on the continuation of the MDLA; rather, it takes effect upon the creation of any Derived Data and survives termination or expiration of the MDLA indefinitely. This means that even if Quorum terminates the MDLA, Meridian would retain a perpetual right to use and commercialize all Derived Data created during the term.
Second, the license-back is sublicensable. Meridian would have the right to sublicense Quorum's Derived Data to any third party, including Quorum's competitors in the insurance industry. There is no restriction on the identity of sublicensees, no requirement for notice to Quorum, and no sharing of sublicensing revenue with Quorum.
Third, the license-back encompasses the right to "create derivative works of" Derived Data. This means Meridian could take Quorum's analytics outputs, modify them, and incorporate them into Meridian's own commercial products — effectively free-riding on Quorum's substantial investment in data science, model development, and analytics infrastructure.
Fourth, and most critically, the license-back would encompass outputs generated by Quorum's QuorumScore™ model. Because QuorumScore™ is trained in part on Meridian credit data, the scores and predictions generated by QuorumScore™ would fall within the broad definition of "Derived Data" and would therefore be subject to the license-back. This would give Meridian access to the proprietary outputs of a model in which Quorum has invested tens of millions of dollars, and which Quorum projects will generate $40–50 million in annual B2B licensing revenue by 2027.
Our preliminary market survey — to be detailed in a separate memorandum by Omar Siddiqui, covering comparable enterprise data-licensing transactions in the financial services and insurance sectors — indicates that perpetual, royalty-free license-back provisions of this scope and breadth are outside prevailing market norms. While it is not uncommon for data licensors to reserve limited rights in Derived Data (e.g., the right to receive aggregated, anonymized usage statistics for product-improvement purposes), a full commercial license-back of the type proposed by Meridian is extraordinary and would represent a significant departure from the bargain contemplated by the term sheet exchange.
C. Restriction on Third-Party Commercialization (Section 7.4)
Section 7.4 of the MDLA provides that Quorum "shall not sell, sublicense, distribute, or otherwise make available any Derived Data to any third party" unless the Derived Data has been "sufficiently transformed" such that "no Licensed Data can be identified, extracted, reverse-engineered, or otherwise derived from such Derived Data."
While a restriction on redistribution of Meridian's raw data is reasonable and expected, the application of this restriction to all Derived Data — rather than solely to Licensed Data in its original or substantially similar form — is overbroad. More significantly, the MDLA vests in Meridian the sole and exclusive discretion to determine whether Derived Data has been "sufficiently transformed" to permit third-party distribution. Section 7.4(b) provides that Quorum must submit a written request to Meridian's Chief Data Officer, accompanied by a detailed technical description of the Derived Data and the transformation methodology, and that Meridian shall have sixty (60) days to review and approve or reject the request. Meridian's determination is stated to be "final and binding" and is not subject to any appeal, mediation, or dispute-resolution process.
This framework has several critical defects from Quorum's perspective:
1. No objective standard. The term "sufficiently transformed" is not defined with any precision. There is no quantitative threshold (e.g., minimum k-anonymity level, minimum differential privacy epsilon, or minimum number of independent data sources blended), no reference to industry-accepted de-identification standards (e.g., HIPAA Safe Harbor, NIST guidelines), and no technical criteria against which Meridian's determination can be measured or challenged.
2. Meridian sole discretion. By vesting sole discretion in Meridian, the provision effectively gives Meridian an absolute veto over Quorum's ability to commercialize any Derived Data. This veto is unconstrained: Meridian need not act reasonably, in good faith, or in accordance with any articulated standard. Meridian's commercial incentives are directly adverse to Quorum's — Meridian has every reason to deny approval, as approval would enable Quorum to compete with Meridian's own data products.
3. No time limit on restriction. The restriction applies for the duration of the MDLA and, by implication under the survival provisions, in perpetuity after termination.
4. Direct impact on QuorumScore™. As noted above, the broad definition of Derived Data would encompass QuorumScore™ outputs. Quorum's planned B2B licensing of QuorumScore™ would therefore require Meridian's advance approval under Section 7.4 — approval that Meridian has no obligation to grant and every incentive to withhold.
This provision, if accepted as drafted, would directly impede Quorum's planned B2B licensing of QuorumScore™ and related analytics products. It is, in our view, a deal-breaking provision that must be fundamentally revised.
D. Revenue-Sharing Arrangement (Section 7.5)
Even in the event that Meridian approves the commercialization of Derived Data as "sufficiently transformed" under Section 7.4, Section 7.5 provides that Meridian shall receive 15% of "net revenues" attributable to such Derived Data.
The revenue-sharing provision raises several significant concerns:
First, the 15% revenue share is calculated on "net revenues," but the MDLA provides only a skeletal definition of that term. Section 7.5(a) defines "net revenues" as "gross revenues received by Licensee from the sale, sublicense, or distribution of Derived Data, less only direct third-party costs of distribution." This definition does not adequately address several common scenarios:
• Bundled products. Where Derived Data is sold as a component of a bundled analytics product that also incorporates non-Meridian-sourced data, proprietary algorithms, and Quorum's own intellectual property, how should revenue be allocated between the Meridian-derived component and the non-Meridian components? The MDLA is silent on allocation methodology.
• Deductible costs. The definition permits deduction only of "direct third-party costs of distribution," a narrow category that would exclude Quorum's substantial internal costs of model development, data engineering, quality assurance, customer support, and sales and marketing. Quorum's margin on the relevant revenue would be significantly compressed.
• Indirect revenue attributions. In many cases, Derived Data will contribute indirectly to revenue generation — for example, by improving underwriting accuracy and thereby increasing policy retention or reducing loss ratios — without generating separately identifiable "sales" of Derived Data. The MDLA does not address whether such indirect revenue effects trigger the revenue-sharing obligation.
Second, the 15% rate itself is economically significant. On Quorum's projected $40–50 million QuorumScore™ B2B licensing revenue by 2027, a 15% revenue share would represent $6.0–7.5 million annually — a substantial and ongoing payment to Meridian in addition to the $12.3 million annual license fee.
Third, the revenue share, combined with the license-back (Section 7.3) and the sole-discretion transformation standard (Section 7.4), creates a comprehensive economic claim by Meridian on Quorum's downstream analytics business. The cumulative effect of these three provisions is to ensure that Meridian participates in the upside of Quorum's analytics operations while bearing none of the investment costs, development risks, or operational expenses associated with those operations. This is a fundamentally imbalanced arrangement.
E. ML Model Outputs — Definitional Ambiguity (Section 7.1)
The definition of "Derived Data" in Section 7.1 is drafted broadly enough to capture not only datasets blended with Meridian data but also any model, score, or analytical output that was created "using, incorporating, referencing, or based upon" Licensed Data. This breadth creates a significant definitional ambiguity with respect to machine-learning model outputs.
Quorum's data-science team trains machine-learning models on datasets that include, among many other inputs, Meridian consumer credit data. The training process involves feeding large volumes of historical data — including Meridian data alongside data from multiple other sources — into algorithms that learn statistical patterns and relationships. The output of the training process is a set of model weights and parameters that encode these learned patterns. Once trained, the model generates predictions (inferences) by applying the learned weights to new input data at inference time.
The key technical and legal dispute is whether live predictions generated by the trained model — using new, non-Meridian inputs at the time of inference — constitute "Derived Data" within the meaning of Section 7.1. Quorum's position is as follows:
• The trained model weights and parameters could arguably be characterized as "based upon" or "derived from" the training data, including Meridian data, though even this characterization is legally and technically debatable. The weights represent statistical abstractions of patterns observed across the entire training dataset, not copies or representations of any individual data point.
• However, inference outputs — i.e., the predictions, scores, and classifications generated by the model when applied to new, non-Meridian input data — are independent analytical outputs that are not "derived from" the Meridian training data in any meaningful sense. The inference inputs are new data; the inference outputs are new predictions. The fact that the model was trained on a dataset that included Meridian data does not make every subsequent output of that model a "derivative" of Meridian's data.
The Meridian form MDLA does not draw any distinction between model training artifacts and inference outputs. Both are swept into the broad definition of "Derived Data" by virtue of the phrase "created, generated, or derived in whole or in part by or on behalf of Licensee using, incorporating, referencing, or based upon the Licensed Data." Under this definition, every QuorumScore™ prediction — even one generated using exclusively non-Meridian inputs — would constitute Derived Data and would be subject to the license-back, commercialization restrictions, and revenue share.
This result is commercially untenable and must be corrected in the redline. We recommend a clear definitional carve-out establishing that (a) inference outputs generated by a model using non-Meridian inputs are not Derived Data, and (b) trained model weights and parameters are not Derived Data to the extent they do not contain, reproduce, or enable the extraction of any identifiable Licensed Data.
F. Recommendation. Article VII must be fundamentally rewritten in Quorum's redline. Our proposed approach addresses each of the issues identified above:
1. Narrow the definition of "Derived Data." The definition should be revised to exclude (a) machine-learning model weights and parameters that do not contain or reproduce identifiable Licensed Data; (b) inference outputs generated by models using non-Meridian inputs; and (c) any data, score, or output that does not contain, reproduce, or enable the identification or extraction of Licensed Data in its original or a substantially similar form.
2. Vest all IP ownership of Derived Data in Quorum. The MDLA should provide an express, unambiguous assignment of all intellectual property rights in Derived Data to Quorum, with Meridian disclaiming any right, title, or interest therein.
3. Eliminate the license-back provision entirely. The perpetual, royalty-free, sublicensable license-back in Section 7.3 should be deleted in its entirety. Quorum may consider, as a concession, granting Meridian a limited right to receive aggregated, anonymized, non-reverse-engineerable usage statistics for product-improvement purposes only, but any such grant should be narrowly scoped and non-sublicensable.
4. Eliminate the 15% revenue share. The revenue-sharing provision in Section 7.5 should be deleted in its entirety. Meridian's compensation for the Licensed Data is the $60 million license fee; it should not receive additional compensation for Quorum's independent creation of value using that data.
5. Permit Quorum to commercialize Derived Data without Meridian's consent. Section 7.4's sole-discretion approval mechanism should be replaced with an objective de-identification and non-reverse-engineering standard. We recommend a standard based on accepted data-anonymization methodologies (e.g., requiring that Derived Data made available to third parties be processed such that Licensed Data cannot be identified or reconstructed using commercially reasonable means), with compliance determined by reference to an objective technical standard rather than Meridian's subjective judgment.
6. Include a specific carve-out protecting QuorumScore™. Given the strategic importance of QuorumScore™, the MDLA should include an express provision confirming that QuorumScore™ and all outputs thereof are the exclusive property of Quorum, are not Derived Data, and are not subject to any of Meridian's rights under Article VII.
V. Grant of License and Scope (Article II)
A. License Grant
Article II of the Meridian form MDLA grants Quorum "a non-exclusive, non-transferable, non-sublicensable license to access and use the Licensed Data solely for Licensee's internal business purposes during the Term." While the non-exclusive nature of the license is appropriate and consistent with Quorum's expectations, the restrictions embedded in the license grant raise two significant issues.
Internal business purposes limitation. The restriction to "internal business purposes" is too narrow to accommodate Quorum's intended use of the Licensed Data. As discussed with the Quorum business team, the Licensed Data will be used not only within Quorum's own operations but also in connection with products and analytics offered to Quorum's affiliates, subsidiaries, reinsurance counterparties, and certain B2B analytics customers. The "internal business purposes" limitation would preclude these uses absent a broader license scope.
We recommend that the license grant be revised to permit use of the Licensed Data within Quorum's corporate group, defined to include Quorum and all of its direct and indirect subsidiaries and affiliates (i.e., entities controlled by, controlling, or under common control with Quorum). In addition, the license should expressly permit use of the Licensed Data in connection with Quorum's insurance and analytics business operations, including use in models and products that may be provided to third parties, subject to the Derived Data provisions as revised per our recommendations in Section IV above.
Non-sublicensable restriction. The non-sublicensable restriction may conflict with Quorum's operational requirements. Quorum relies on range third-party vendors, cloud hosting providers (including Ridgeway Industries and Crestline Systems), managed service providers, and outsourced IT service partners that need to process, store, and transmit Meridian data on Quorum's behalf in order to support Quorum's data infrastructure. Under the current drafting, any such processing by a third-party service provider could be characterized as an unauthorized sublicense, exposing Quorum to breach claims.
We recommend inserting a carve-out permitting Quorum to grant access to Licensed Data to third-party service providers, subcontractors, and vendors that are acting under Quorum's direction and on Quorum's behalf, subject to the conditions that (a) such third parties are bound by written agreements containing confidentiality and data-security obligations at least as protective as those set forth in the MDLA, (b) Quorum remains fully liable for any acts or omissions of such third parties, and (c) Quorum provides prior written notice to Meridian of any such access grants (or, alternatively, maintains a list of approved service providers that is updated annually and made available to Meridian upon request).
B. Permitted Use Restrictions
Section 2.2 of the MDLA restricts Quorum's use of the Licensed Data to the following three categories: (a) underwriting, (b) policy administration, and (c) claims management. While these three categories cover a portion of Quorum's intended use cases, they do not encompass the full range of purposes for which Quorum intends to use the Licensed Data. Specifically, the following use cases are omitted from the permitted use definitions:
• Fraud detection. Quorum intends to use Meridian data, particularly the MCI Consumer Credit File™ and MCI AltSignal™ products, as key inputs to its claims-fraud detection algorithms. Fraud detection is distinct from "claims management" and is not clearly encompassed within that term as used in the MDLA.
• Marketing and propensity scoring. Quorum intends to use Meridian data to develop and refine customer propensity models for marketing, cross-selling, and customer-retention purposes. This use case is not within the scope of "underwriting," "policy administration," or "claims management."
• Regulatory compliance. Quorum intends to use Meridian data in connection with regulatory compliance activities, including fair-lending analysis, disparate-impact testing, and regulatory reporting. These are compliance functions that do not fit neatly within the three enumerated categories.
• Reinsurance support. Quorum intends to provide analytics outputs — derived in part from Meridian data — to its reinsurance counterparties in connection with reinsurance treaty placements and bordereau reporting. This use is not clearly authorized by the "internal business purposes" limitation.
Recommendation: Expand the permitted use definitions in Section 2.2 to encompass all of Quorum's identified use cases. We recommend replacing the three-category enumeration with a broader formulation permitting use "in connection with Licensee's insurance, reinsurance, analytics, regulatory compliance, fraud prevention, and related business operations," followed by a non-exhaustive list of specific permitted uses including automated underwriting, claims-fraud detection, customer propensity scoring, regulatory compliance and reporting, actuarial analysis, risk modeling, reinsurance support, and product development.
C. Exclusivity. The license is non-exclusive, which is appropriate and consistent with Quorum's expectations. Quorum does not seek exclusivity in the Licensed Data and does not wish to restrict Meridian's ability to license data to other parties. No revision is needed on this point.
VI. Representations and Warranties (Article IV)
A. Meridian's Representations
Article IV of the Meridian form MDLA contains several representations made by Meridian, which we address in turn.
Right to license. Meridian represents that it has the right, power, and authority to grant the license set forth in the MDLA and to make the Licensed Data available to Quorum in accordance with the terms of the agreement. This representation is fundamental and appropriate.
Compliance with applicable law. Meridian represents that the Licensed Data "is collected and processed in compliance with applicable law." While this representation is directionally appropriate, it is insufficiently specific. Notably, Meridian does not expressly represent compliance with the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681 et seq.; the Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. § 6801 et seq.; or the numerous state consumer-protection and data-privacy laws that govern the collection, processing, and distribution of consumer credit information. Given the regulatory sensitivity of consumer credit data — and the substantial penalties and liability exposure associated with non-compliance — Quorum should insist on express representations that Meridian's data collection, processing, and licensing practices comply with all applicable federal and state privacy and consumer-protection laws, including without limitation the FCRA, GLBA, state mini-FCRA statutes, and the California Consumer Privacy Act ("CCPA"), Cal. Civ. Code § 1798.100 et seq.
Non-infringement. Meridian represents that the Licensed Data "does not, to Meridian's knowledge, infringe the intellectual property rights of any third party." The knowledge qualifier weakens this representation significantly. For a $60 million data license, Quorum should seek to remove the knowledge qualifier or, at minimum, expand it from actual knowledge to "knowledge after reasonable inquiry."
Data accuracy. This is the most significant gap in Meridian's representations. The MDLA provides that the Licensed Data is furnished "AS IS," and Meridian expressly disclaims "all warranties, whether express, implied, or statutory, including without limitation any warranties of accuracy, completeness, merchantability, fitness for a particular purpose, or non-infringement." This blanket disclaimer is problematic. Quorum is committing $60 million over five years for data that will serve as a foundational input to automated underwriting decisions affecting a $4.18 billion insurance business. If the data is materially inaccurate, incomplete, or stale, the consequences for Quorum could be severe — ranging from underwriting losses to regulatory enforcement actions to consumer litigation.
We recommend that Quorum insist on meaningful data-quality warranties, including:
• A minimum accuracy rate for consumer credit file data (e.g., 97% accuracy at the field level, measured against a statistically significant sample);
• A minimum completeness threshold (e.g., 95% of records containing all required core data fields);
• A maximum data-staleness standard (e.g., consumer credit file data updated at least monthly; commercial credit data updated at least quarterly);
• Remediation obligations requiring Meridian to investigate and correct identified data-quality deficiencies within specified timeframes; and
• Service credits or fee adjustments in the event that data quality falls below the agreed thresholds for a sustained period.
These warranties should be backstopped by the indemnification provisions discussed in Section VIII below.
B. Quorum's Representations
Quorum is asked to make two principal representations under Article IV:
FCRA permissible purpose. Quorum represents that it holds all required FCRA permissible purposes for accessing consumer credit information and that it will use the Licensed Data only for such permissible purposes. This representation is appropriate and is consistent with Quorum's obligations as a user of consumer credit data under the FCRA. However, Quorum should ensure that its FCRA Permissible Purpose Certification — which is a separate schedule to the MDLA currently under development — accurately and comprehensively reflects all of its intended use cases, including those discussed in Section V.B above (fraud detection, propensity scoring, regulatory compliance, etc.). Each use case may implicate a different FCRA permissible purpose (e.g., § 1681b(a)(3)(A) for insurance underwriting; § 1681b(a)(3)(D) for account review), and the certification should be drafted with appropriate specificity. We recommend coordinating with Claudia Reeves (VP, Regulatory & Compliance) on this point.
Regulatory licenses and approvals. Quorum is also asked to represent that it maintains all regulatory licenses and approvals required for its operations. This is a standard representation and is generally acceptable, though Quorum should confirm through its regulatory compliance team that the representation is accurate as of the expected execution date and that no pending regulatory actions or license renewals could affect the accuracy of this representation.
VII. Data Security Obligations (Article V)
This section is addressed in substantially greater detail in a forthcoming memorandum from David Cartwright and Lisa Johannsen, who are leading the data privacy and security workstream for this engagement. The observations provided below are summary-level only and are intended to flag the key issues for the attention of the commercial negotiating team. Quorum's full data-security negotiating position will be set forth in the Data Security Addendum ("DSA") that our privacy team is currently drafting.
Quorum's obligations under the form MDLA:
• Quorum is required to maintain SOC 2 Type II certification. Quorum's current SOC 2 Type II report was issued by Felton Thorpe & Co. LLP, covering the audit period ending December 31, 2023. This requirement is standard and should not present a compliance issue.
• Quorum is required to comply with all applicable cybersecurity regulations, including specifically 23 NYCRR 500, the New York Department of Financial Services Cybersecurity Regulation. As a regulated insurance holding company, Quorum is already subject to 23 NYCRR 500 and this requirement is consistent with existing obligations.
• Quorum is required to maintain cyber liability insurance with an aggregate policy limit of at least $50,000,000. Quorum's current cyber liability policy meets this threshold. See Section XII below for further discussion of insurance requirements.
Meridian's obligations under the form MDLA:
• Meridian certifies SOC 2 Type II and ISO 27001 compliance. Meridian's SOC 2 Type II report was issued by Galloway Nash LLP, covering the audit period ending March 31, 2023. ISO 27001 certification was issued by an unspecified certification body (to be confirmed).
• Meridian is required to maintain cyber/technology E&O insurance with an aggregate policy limit of at least $25,000,000. As discussed in Section XII below, the disparity between Quorum's $50 million and Meridian's $25 million insurance requirements warrants further consideration.
Data-breach notification: Both parties are required to notify the other within forty-eight (48) hours of the discovery of any data breach or security incident affecting Licensed Data. The forty-eight-hour notification window is aggressive but within the range of accepted market practice and is consistent with certain regulatory notification requirements.
Key gaps identified in the form MDLA:
The form MDLA lacks adequate detail in several critical areas related to data security:
• Incident response procedures. The form does not specify the procedures to be followed in the event of a data breach, including the appointment of an incident response coordinator, the establishment of a joint incident response team, or the specific steps to be taken to contain and remediate the breach.
• Forensic investigation rights. The form does not grant either party the right to conduct or commission an independent forensic investigation of a data breach affecting the other party's systems.
• Indemnification for breach-related costs. The form does not address indemnification for costs arising from a data breach, including notification costs, credit-monitoring expenses, regulatory fines, and litigation defense costs.
• Coordination obligations. The form does not establish coordination obligations between the parties in connection with regulatory notifications, consumer notifications, or public communications relating to a data breach.
These gaps will be addressed in the DSA being drafted by our privacy team. We recommend that the DSA be attached to the MDLA as a mandatory exhibit and that the MDLA's data-security provisions be revised to reference and incorporate the DSA.
VIII. Indemnification (Article IX)
A. Meridian's Indemnification Obligations
Section 9.1 of the Meridian form MDLA provides that Meridian shall indemnify, defend, and hold harmless Quorum and its officers, directors, employees, and agents from and against any third-party claims, damages, losses, and expenses (including reasonable attorneys' fees) arising from claims that Quorum's use of the Licensed Data in accordance with the terms of the MDLA infringes or misappropriates any third-party intellectual property rights.
While this intellectual property indemnification is appropriate in concept, it is subject to several carve-outs that, in practice, substantially eliminate Meridian's indemnification exposure for the most likely risk scenarios:
1. Modification carve-out. Meridian excludes indemnification for any claims arising from Quorum's "modification, alteration, enhancement, or transformation" of Licensed Data. Given that virtually all of Quorum's intended uses involve processing, blending, and analyzing Licensed Data in combination with other data sources — all of which could be characterized as "modification" or "transformation" — this carve-out would effectively eliminate indemnification for the vast majority of potential infringement claims.
2. Combination carve-out. Meridian excludes indemnification for any claims arising from the "combination of Licensed Data with data, software, systems, or materials not provided by Meridian." Since Quorum's core use case involves combining Meridian data with data from multiple other sources (internal policyholder data, third-party data feeds, public records, etc.), this carve-out would exclude indemnification for claims arising from Quorum's most fundamental use of the Licensed Data.
3. Regulatory enforcement carve-out. Meridian excludes indemnification for any claims arising from "regulatory investigations, enforcement actions, or proceedings brought by any governmental authority." This carve-out is particularly problematic given the regulatory sensitivity of consumer credit data. If Meridian's data-collection practices are found to violate the FCRA, GLBA, or state consumer-protection laws, and Quorum faces regulatory action as a downstream user of non-compliant data, Meridian would bear no indemnification obligation.
The cumulative effect of these three carve-outs is to limit Meridian's indemnification to a narrow category of direct, unmodified, standalone use of Licensed Data — a scenario that is unlikely to arise in practice given Quorum's intended data-processing and analytics activities.
Recommendation: Quorum should seek to narrow these carve-outs in several ways. First, the modification carve-out should be limited to claims arising solely from Quorum's modification of Licensed Data (i.e., claims that would not have arisen but for the modification). Second, the combination carve-out should be similarly limited to claims arising solely from the combination (not claims arising from the Licensed Data itself when used in combination). Third, the regulatory enforcement carve-out should be revised to preserve Meridian's indemnification obligation for regulatory actions attributable to defects in Meridian's data-collection, data-processing, or data-licensing practices. Fourth, Quorum should add an affirmative indemnification obligation requiring Meridian to indemnify Quorum for third-party claims and regulatory actions arising from Meridian's violation of applicable privacy and consumer-protection laws in connection with the collection, processing, and licensing of the Licensed Data.
B. Quorum's Indemnification Obligations
Secti

MEMORANDUM

Record

Parties

Dates

Amounts