Brexit Checklist for Technology & Communications Businesses

The EU and the UK agreed a detailed Trade and Cooperation Agreement which came in to effect on 1st January 2021.  

Technology and Communications businesses need to be aware of the implications for their businesses arising from the UK’s status as a “third country” outside the EU. 

The following areas are outlined in this note:

• People
• Data protection
• Trade, tax and tariffs
• Contracts
• Online Tech Services - Regulatory Compliance (eCommerce Directive)
• Trade marks and other IP Protection
• Software export controls
• Conformity Assessments (CE marks)
• Geo-blocking; and
• Competition

This Checklist is an update to the Checklists previously issued by Bird & Bird in 2018 and 2019.

People

Since March 2019, the UK Government has committed to protect the rights of EU nationals and their family members who wish to stay in the UK. The EU Settlement Scheme ("Scheme"), which required EU nationals to register in order to preserve their rights under UK law (including rights to work, pensions, healthcare and other benefits) has now come to an end (except to the extent that it applies to eligible dependents of EU nationals).

Organisations with EU nationals working in the UK should be aware of the new right to work check rules and ensure their EU national employees are on-boarded correctly in order to avoid business interruption and immigration compliance issues. 

Businesses with British Citizen employees residing and working in EU Member States should already have confirmed that affected individuals have complied with national requirements to protect their continued right to reside and work in that Member State after the end of the transition period.  In particular, cross-border workers based in the UK (who are British Citizens) but who work in multiple EU Member States will need to carefully plan their future activities following the cessation of freedom of movement on 31 December 2020.  They will most likely need to obtain multiple work permits, visas and/or residence permits in order to work at client sites in EU Member States.

The UK Government has implemented a new set of Immigration Rules which apply to all non-UK nationals. We have seen a significant rise in the uptake of employers sponsoring skilled migrants after the lifting of COVID-19 measures in the UK. There is also a strong interest from employers seeking to apply for a sponsor licence, which is a prerequisite when sponsoring non-UK nationals.

For employers, the overall message is clear. The Home Office has effectively rolled back most of the restrictions placed on work visas since April 2011 and it has become much easier to sponsor non-UK nationals as new hires from January 2021. Whilst the work visa threshold has been lowered, employers should carefully consider the disproportionate financial cost and increased compliance burden following the introduction of the new Immigration Rules. 

For more information click here. 

Data protection

EU to UK data transfers:

The departure of the UK from the EU on 31 January 2020 did not lead to dramatic immediate changes in UK data protection law.  The GDPR has been enacted into UK law as the UK GDPR and continues to sit alongside the Data Protection Act 2018. However, the EU GDPR continues to apply to UK organisations which trade in the EU to the extent any of their processing activities are caught by the extra-territorial provisions set out therein.

Transfers of personal data from the EU to the UK now constitute a transfer of personal data to a "third country".  However, following on from interim data transfer arrangements under the EU-UK Trade agreement, on 28 June 2021, the European Commission adopted two adequacy decisions for the UK (one under the GDPR and the other under the Law Enforcement Directive) meaning that personal data can continue to flow freely from the EU to the UK without the need for additional safeguards such as Standard Contractual Clauses. However, these adequacy decisions include strong provisions to protect against future divergence of UK laws such as a “sunset” clause which limits the duration of the adequacy to four years. 

Data transfers from the UK:

The UK continues to treat EU countries' laws as adequate for the purposes of the UK GDPR and the Data Protection Act 2018. On this basis, transfer adequacy mechanisms are not needed for UK to EU data transfers.

Personal data transfers to other jurisdictions need to comply with the UK GDPR and Data Protection Act 2018 obligations. Essentially these are as per the pre-Brexit position and the UK Government has confirmed that EU adequacy decisions, approved EU Standard Contractual Clauses and Binding Corporate Rules are recognised in the UK to legitimise data transfers to non-adequate countries. Transfers to Gibraltar are also allowed to continue. 

Organisations which prior to Brexit had relied upon Binding Corporate Rules for their data transfers should also now have updated these documents so that they meet both EEA and UK requirements. New applications for UK BCRs must be submitted to the ICO using the new UK BCR application forms and referential tables available here.

Lead supervisory authority and representative issues:

The GDPR "one stop shop" no longer applies in the UK for investigations that have a multi country dimension. EU regulators will no longer be bound to act through the Information Commissioner, even when a business has its overall European headquarters in the UK. Conversely, for organisations with their "main establishment" in an EU country, the Information Commissioner will no longer be bound by the GDPR's consistency mechanism. In either case, this means that organisations could face distinct investigations and sanctions in the UK and the EU. In a large-scale data breach, for instance, both the Information Commissioner and at least one EU regulator may need to be notified with details of the breach, and each could follow up with distinct investigations and sanctions (such as fines). 

The situation is more problematical for EU-active, UK-headquartered businesses unless they can position one of their other (non-UK) EU presences as their "main establishment" in the EU. For offshore (i.e. non-EU) businesses without a "main establishment" in the EU, the EU GDPR's "consistency" rules do not apply; so in a data breach scenario, the UK-headquartered business might have to notify (and then cooperate with investigations by) regulators in every relevant EU / EEA country (plus the UK, if the UK is relevant).

To avoid that worst-case outcome, many UK-headquartered multinationals are therefore looking at how best they can position a subsidiary in the EU as their "main establishment" in the EU; for efficiency, businesses might even decide to shift control of data protection matters entirely out of the UK, rather than split control between the UK and the EU.

UK businesses without an EU presence but which process the data of EU-based individuals (e.g. their online customers) need to consider the EU GDPR's requirements to appoint an EU representative, including so that the representative can deal with regulators on their behalf. The same is also true of EU businesses which process the personal data of UK-based individuals but don't have a UK presence; they need to appoint a UK representative under the UK GDPR.

It is also worth noting that whilst the European Commission adopted new Standard Contractual Clauses for data transfers subject to the EU GDPR on 7 June 2021, these Clauses don’t cover transfers of personal data to which the UK version of the GDPR applies. This is because post-Brexit UK data protection legislation only references the standard contractual clauses which were approved as at 31 December 2020 (i.e. the 2001, 2004 and 2010 versions of the EU SCCs). Click here for more detail on these new EU Standard Contractual Clauses.

However, the UK Information Commissioner has recently run a consultation on data transfers looking at whether it would be helpful for the Information Commissioner to approve an addendum allowing the EU Standard Contractual Clauses to be used for transfers of personal data from the UK. In addition, the consultation considered whether to terminate the current temporary approval of the older EU SCCs and whether to approve a new UK specific international data transfer agreement and accompanying transfer risk assessment. Changes to the existing UK guidance on data transfers also formed part of the consultation.  The consultation closed on 7 October 2021 and at the time of writing, we are waiting for the final proposals. For more information on the consultation please see our recent article: UK Information Commissioner consults on data transfers – including approach to EU Standard Contractual Clauses (twobirds.com).

In addition, it is worth noting that the UK’s Department for Digital, Culture, Media & Sport has also released a consultation document (consultation now closed) about the future of data protection law in the UK. Some changes being proposed are small clarification changes intended to resolve uncertainties in the GDPR’s drafting but others are fundamental reforms to the operation of the UK’s data protection laws and the obligations and protections they bring. All organisations operating in the UK should be interested in potential changes to:

• Data subject rights (to make them less burdensome)
• Accountability (potentially burdensome)
• Data transfers (significantly more flexibility)
• E-privacy (possibly helpful, although proposals not clearly articulated)

There are also proposals of significant interest to those involved in research and AI, and reforms on the powers and governance of the Information Commissioner. For more details, please see: Changing direction? UK consults reforms to its data protection law (twobirds.com).

Export controls apply generally to items that are specially designed or modified for military use and to items designed for civilian use which have potential military uses ("dual-use" items). Some software is subject to EU export control as dual use items, including many commonly used encryption protocols, unless the products are specifically excluded (such as smart cards and smart card reader/writers and mobile telephones for civil usage) or are excluded as being generally available to the public at retail selling points. 

The EU Dual Use Regulation has been incorporated into UK law. However, the UK is now regarded by the EU as being a third country for the purposes of EU export control. The EU General Export Authorisation (GEA) for the export of all dual use items (including encryption software) has been amended to include exports from the EU to the UK. Exporters of dual use software from the EU to the GB (that is not exempted) must notify the relevant national competent authorities of the first use of the GEA and EU Member States may require registration prior to first use of the GEA.

The EU Dual Use Regulation has been revised (with effect from 9 September 2021) The revised Regulation includes a new EU GEA for the export of encryption software to a wide variety of countries outside the EU.  The EU GEA does not apply to exports from the UK.  The UK has introduced an Open General Export Licence for Cryptographic Developments with a similar scope and coverage.

For transfers from GB to the EU, the UK has issued an Open General Export Licence (OGEL) to cover the export of dual use items (including encryption software) from the UK to the EU. The OGEL has conditions and does not apply if the exporter is aware that the dual use item is intended to be used in certain weapons systems. Companies need to pre-register with the Department of International Trade for each product for which the OGEL is relied on and must comply with the terms of the OGEL, including a requirement to include a note on official export documentation that the items are exported under the OGEL.

Importers must:

• Mark the product with their name and address;
• Understand and check the markings, declarations and technical file;
• Satisfy themselves that the CE or UKCA marking process is complete;
• Be the primary point of contact for the EU or UK authorities; and 
• Be prepared to cooperate with the authorities if there is a product recall or similar.

Geo-blocking

As a result, companies are not prohibited from discriminating in the UK between EU customers and UK customers in their on-line businesses. Within the EU27 the EU Regulation will continue to apply to UK businesses, meaning that UK companies will not be able to discriminate between customers in different EU Member States.

Competition

Companies operating in the UK and the EU should consider potential exposure to parallel investigations by the European Commission and UK Competition and Markets Authority (CMA) and the need to safeguard their position under both the UK and EU regimes.
 
They should re-assess territorial restrictions in agreements, as between the UK and the EU, under the anti-trust rules as from Brexit. More generally, companies should be aware that the Competition (Amendment etc.) (EU Exit) Regulations 2019 will adapt EU competition regulations and have become a set of domestic regulations.

If you are planning a large-scale merger or acquisition, consider whether it will be subject to merger control scrutiny by both the UK CMA and the European Commission, as the Commission will no longer be a "one stop shop" for large mergers affecting the UK, as from Brexit.

Read more on the competition law implications here.