10 things that happened whilst I was on maternity leave (and two that didn’t)
Number 11: The UK didn’t leave the European Union

GDPR principles, obligations and rights should² continue to apply post-Brexit as the government is incorporating them into UK data protection law under the EU (Withdrawal) Act 2018. Amendments are to be made to the GDPR provisions and the UK Data Protection Act 2018 to make sense of them in the context of the UK no longer being within the EU³. For example, provisions relating to the EU one-stop-shop, European Data Protection Board, EU representatives, and data transfers outside the EU, will need to be adapted.

With the GDPR rules continuing to apply, UK organisations who are already complying with the GDPR should not need to undertake a complete overhaul of their data protection practices. However, there are areas where changes may be needed; some significant and some more minor.

A big area of uncertainty, and where significant changes may be needed, is international transfers of personal data.

In relation to transfers from the UK to other countries, the UK intends to permit data transfers to the EEA without additional restrictions, and to recognise as ‘adequate’ under UK law the same countries as our recognised as ‘adequate’ by the EU. The UK government is also making arrangements for a new UK-US Privacy Shield (equivalent to the EU-US Privacy Shield), and intends to recognise EU-approved standard contractual clauses. Therefore, organisations should be able to make transfers of personal data out of the UK in a similar way to their existing arrangements. Though some changes may need to be made, e.g. to check that a US transferee is signed up to the UK-US Privacy Shield, and to ensure data processing terms make sense in the context of the UK not being part of the EU.

In relation to transfers to the UK from other countries, the long term plan is currently for the UK to seek a decision from the EU Commission that the UK is an ‘adequate’ country for the purposes of data transfers to the UK from the European Economic Area (EEA) (similar to, e.g. Switzerland, New Zealand and now Japan – see article number 3 in my series). However, this won’t happen immediately, which may leave organisations in limbo, particularly in a ‘no deal’ scenario.

As well as transfers to the UK from the EEA, there is uncertainty in relation to transfers to the UK from other ‘adequate’ countries outside the EU.

Therefore, measures such as standard contractual clauses may need to be put in place in the short-term, and local laws reviewed in the countries of transfer.

The other commercial terms surrounding transfers of data to or from the UK may also need review with Brexit in mind – see my section below on commercial contracts.

For further reading, there has been guidance on data protection and Brexit from:

• the UK Government here, here and here;
• the UK Information Commissioner’s Office here; and
• the European Data Protection Board here.

Complexities arise with Brexit in relation to EU-wide intellectual property (IP) rights, such as EU Trade Marks and Registered Community Designs. These currently give the owner protection throughout the EU, including the UK. When the UK leaves the EU, unless additional measures are put in place, the owner would no longer have rights within the UK (although would retain the rights across the EU). The UK government therefore intends to create comparable UK trade mark and design rights for all existing owners of EU-wide trade mark and design rights.

In relation to copyright, there are various cross-border mechanisms agreed throughout the EU which will no longer apply after Brexit. This includes, for example, the portability of online content service. Under this mechanism, service providers (such as Netflix) must allow their UK customers to access their UK online content service across the EU. After Brexit, service providers will not be obliged (and may not be able) to facilitate this, and consumers may see restrictions in accessing content within the EU.

There is also uncertainty in relation to exhaustion of IP rights. Currently, once a product protected by IP is put on the market in any country within the European Economic Area (EEA) (with the authorisation of the IP rights holder), it may be re-sold or distributed within any country within the EEA. The rights holder’s rights are said to have been ‘exhausted’ and they may not prevent such further sale or distribution. So, for example, the owner of a trade mark for the brand of a product, or the owner of a patent for a product, would not be able to stop further distribution of the product on the basis of their trade mark or patent rights.

Once the UK leaves the EU and the EEA, if a product is put on the market in the UK, a rights holder may still be able to prevent the product being re-sold or distributed within the EEA. An additional IP licence may therefore need to be obtained in order to do this. The UK has, however, indicated that it will continue to recognise exhaustion in the UK once an IP-protected product is put on the market within the EU. This means that no additional IP licence will be needed to sell that product within the UK.

The UK also intends to negotiate with the EU to find ways to co-operate in relation to UK and EU IP rights.

For further reading, the UK Intellectual Property Office has published some guidance on intellectual property and Brexit here. This includes technical briefings on the impacts of Brexit on trade marks, designs, patents, copyright and exhaustion of rights, and links to new regulations which will amend IP legislation to address changes arising from Brexit.

Brexit is likely to impact a wide range of commercial relationships and contracts. Consider, for example:

• a technology provider in the UK providing services involving the transfer of EU customers’ personal data from the EU to the UK. The GDPR will restrict such transfers post-Brexit (see data protection section above);
• a contract for the export from the UK to the EU of a product already on the market in the UK, where the brand is protected by an EU Trade Mark. Sale in the EU may not be permitted by the trade mark owner (see IP section above);
• a contract for the export or import of goods between the UK and the EU, where new customs tariffs now make the originally-agreed pricing infeasible for one of the parties;
• something as simple as a reference to the European Union (or an EU law) within a contract. What is the intended interpretation of this once the UK is no longer in the EU – still only the EU, or the UK and the EU, or perhaps only the UK? The context in which the term is used, will, of course, be vital in determining this; or
• a choice of law and jurisdiction provision within a contract. The UK and EU courts will need to consider different rules in determining whether to recognise such choices and enforce judgements.

These are all cross-border examples, where concerns are more obviously likely to arise, but UK to UK relationships may also be impacted by changes to the law arising as a result of Brexit.

One or both parties to a contract may therefore wish to terminate or re-negotiate it prior to Brexit. However, as the precise impact of Brexit is at yet unknown, it may difficult to decide now what will be appropriate at that stage (or the parties may not yet realise that Brexit could have any consequences for their relationship). Contracting parties can look to include terms which envisage amendments to be made and/or allow for rights of termination at such time as the position becomes clearer.

For long-term contracts which did not envisage Brexit, without co-operation between the parties, one party may find itself in potential breach of contract when Brexit arrives, or be forced to continue a relationship on very bad terms. It may be possible to argue that Brexit falls within provisions relating to force majeure, or significant or material external changes, or even that it has frustrated the contract. General change control provisions (e.g. which allow cost increases) may also assist. Though it may not be easy to argue the case with these (or such terms may not exist), and a Brexit-specific provision is likely to be preferable.

With the delay to Brexit, organisations may now have more time to ensure new and renewed contracts contain an appropriate Brexit provision.