Top Tips: Preparing Technology Arrangements For Brexit - Data Protection

The ultimate form of the UK's exit from the European Union remains a hotly debated topic. Unless some form of extension of the period of notice served by the UK is agreed in the next few weeks or the notice is withdrawn, the UK will leave the European Union on 29 March 2019. In January, the UK Parliament will be faced with a choice of accepting the Draft Withdrawal Agreement produced by the negotiating teams of the UK and the EU as at November 2018 or leaving the EU without a finalised transition agreement, the so-called "No Deal" scenario.

The Draft Withdrawal Agreement covers a number of issues of direct relevance to technology arrangements. The purpose of this alert is to highlight some key risks of either the No Deal scenario or a deal on the terms of the Draft Withdrawal Agreement which relate specifically to technology arrangements and to steps to mitigate these risks.

1. Personal data issues

The General Data Protection Regulation ("GDPR") implemented in 2018 updated the law relating to the treatment of personal data within the European Union. The UK also passed UK specific domestic legislation–The Data Protection Act 2108–which will ensure that post departure from the European Union the UK will treat personal data in exactly the same way as it is treated today under the GDPR; so Brexit is not going to mean a further wholesale revision of data protection policies and procedures for UK businesses.

UK businesses will nevertheless need to consider the basis upon which personal data can be transferred internationally. The UK government has indicated that it will (continue to) treat the remaining EU countries as having adequate data protection regimes, so no additional steps will need to be taken to transfer personal data to the remaining EU countries.

What is currently less clear is whether transfers of personal data from the remaining EU countries to the UK will be permitted on the basis that the UK is deemed to (continue to) have an adequate data protection regime. In the absence of an adequency finding in relation to UK data protection laws an alternative basis will have to be relied upon to enable personal data to be transferred from the remaining EU countries to the UK.

The Draft Withdrawal Agreement provides that the UK will continue to apply Union law in the United Kingdom in respect of processing of personal data of data subjects outside the United Kingdom provided that personal data is covered by the Draft Withdrawal Agreement- in broad terms, the personal data relates to EU residents. This should make it likely that the UK will be seen by the other EU countries to have an adequate regime post Brexit if the Draft Withdrawal Agreement comes into effect. If the UK leaves on a No Deal basis then it is far from clear that the remaining EU countries will see the UK as having an adequate data protection regime.

Businesses transferring personal data between the remaining EU countries and the UK should be considering alternative bases for transferring personal data from the remaining EU countries to the UK as a result of Brexit. The simplest solution for most businesses is likely to be putting in place the EU approved Standard Contractual Clauses.

Businesses exporting personal data from the UK to third countries will also have to ensure that they comply with the UK specific rules on export of personal data from the UK to third countries. A particular point to look out for is whether all the countries which the EU has accepted as having an adequate data protection regime will be regarded by the UK as also having an adequate data protection regime. The risk of the UK taking a different position to the EU in relation to existing adequacy decisions seems extremely low.

2. Protection of Databases

Most Intellectual Property rights exist independently of the treaties between Members of the EU and the existence of these rights will not be affected by the UK's departure from the EU. There is, however, a specific EU right that protects databases – the so-called Sui Generis right which was created by the EU Database Directive in 1996, which may be significant for some technology arrangements.

When the UK leaves the EU, the Directive will cease to apply to the UK. Under the Draft Withdrawal Agreement, a database will continue to be protected where it is created by UK nationals, natural persons with habitual residence in the UK or businesses established in the UK. In the No Deal scenario, the ironic position will be that EU nationals, residents and businesses in the UK will acquire the Sui Generis right when they develop databases in the UK but UK nationals, residents and businesses will not. The UK Intellectual Property Office is alive to this concern and will push for reform of UK law to give UK nationals, residents and businesses equal protection under a domestic Sui Generis right (which, in fact, existed in the UK prior to the EU Database Directive in any event). Without agreement with the remaining EU countries the UK domestic right will not give rights which extend to the remaining EU countries.

It is unclear just how significant the Sui Generis right is in practice, but UK domestic businesses can minimise the risk of losing protection for databases developed in the UK by involving developers with an EU connection. Also, the database would be protected internationally through the copyright system if sufficient creativity can be established for the database to be protected as a copyright work. Careful records should be maintained showing the development process and it is possible that copyright protection may be available.

3. Free movement of goods

Many businesses have been concerned about fractured supply chains if the UK leaves the EU in a No Deal scenario. Similar concerns will apply for technology arrangements where continued access to hardware and consumables will be required. In the Draft Withdrawal Agreement scenario goods first lawfully put on the market in the EU or in the UK prior to the end of the transition period can circulate between the two markets before they reach the end user. In the Draft Withdrawal Agreement scenario, there should therefore be minimal disruption to international shipments between the remaining countries in the EU and the UK for a period of time. To prepare for the No Deal scenario businesses should, however, be revisiting their supply chains and inventory to ensure that the impact of delays in customs processes etc. are minimised.

4. Free movement of people

In order to assess fully the potential HR implications of Brexit, whether under the Draft Withdrawal Agreement or in a No Deal scenario, businesses should carry out a 'people audit'. This should map out the locations of the direct workforce and, for outsourced arrangements, those of its third party suppliers. Specifically, how many UK nationals are working in the EU and how many EU nationals are working in the UK. This will highlight the potential implications of a change in immigration requirements as a result of Brexit.

The UK Government has made clear that, regardless of the outcome of the EU negotiations, it will proceed with its settlement scheme which will allow EU nationals to apply for settled status, provided they have arrived in the UK by the end of 2020. The government has indicated that the scheme for EU nationals to apply for settled status will open fully by March 2019. Businesses should consider helping those who qualify for the scheme to take advantage of it, particularly if they are in key roles. After 2020, the UK is likely to have a new post-Brexit immigration system. The current Government proposal is for a single, unified system which offers no preference for EU workers ahead of non-EU workers, but provides priority instead to highly-skilled workers.

In relation to UK nationals based in the EU, some EU governments—for example the Netherlands— have made welcoming noises, promising measures to allow such individuals to remain there after March 2019 in the event of a No Deal scenario. Using the results of the people audit, businesses should focus on those EU countries that are most relevant to its workforce and monitor developments of any such legislation. They may also consider whether UK nationals working in the EU are able to apply for a right to remain there based on residency, marriage or ancestry

5. Review technology supply agreements

For all material technology arrangements contractual frameworks should be reviewed in the context of Brexit. Pan-European arrangements should be an area of particular focus.

Key contractual provisions to review will include:

Territorial scope of licences
Location of Personal Data
Rights in Databases
Currency/inflation indices
Compliance with laws obligations
TUPE/ARD on termination

Visit us at mayerbrown.com

Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.