The UK is set to leave the EU on 31 January 2020 with an agreement that provides for a transition period until 31 December 2020 during which negotiations to establish a future relationship with the UK will take place.
During the transition period the UK will continue to be treated as if it were an EU Member State and most EU law will continue to apply. Although the transition period is extendable by one or two years by mutual agreement, an extension currently seems unlikely. The British Prime Minister has stated he will not sanction one and this is written into the legislation enshrining the withdrawal agreement in domestic law. If the negotiations during the transition period fail to produce a new trade agreement and no extension is granted, a ‘no trade deal Brexit’ is possible at the end of 2020. Until a free trade agreement is ratified by the UK and EU, all future trade would take place on World Trade Organisation (WTO) terms.
Businesses need to prepare for the end of the transition period and this note outlines the key steps businesses should take with regard to their cross-border contracts and data flows with UK parties.
Both overseas and UK businesses (which may include UK subsidiaries of multinationals) should review their key cross-border contracts. Such contracts may, for example, be affected if the consequences of Brexit result in a significant increase in costs due to new tariffs, trade barriers or currency fluctuations. Contracts that depend on a regime that may no longer apply after the end of the transition period, such as free movement of people, may also need to be amended or renegotiated.
In response to the uncertainty surrounding Brexit and, in particular, the possibility of a ‘no trade deal Brexit’ after the end of the transition period, parties are increasingly seeking to include bespoke ‘Brexit clauses’ in their contracts. Such clauses trigger some change in the parties’ rights and obligations because of a defined Brexit event in order to provide some protection against Brexit-related risks. Brexit clauses can take various forms and may not be appropriate in all circumstances. For example, a Brexit clause may not be needed where the parties can terminate without penalty on short notice or in short-term contracts.
Some options that could be considered for a Brexit clause include:
Alternatively, the clause could provide that the agreement will continue unless there is an urgent need to terminate for licensing or another regulatory reason following Brexit. This approach may be appropriate if the parties not only wish to include a Brexit clause but also want to limit the circumstances in which it can be invoked as far as possible.
Brexit clauses are similar to the types of clauses already often deployed by contracting parties to deal with unexpected adverse events. For example:
It is debatable whether or not either clause in its standard form would allow a party any respite from its obligations because of Brexit. In any event, for contracts entered into since the referendum vote in June 2016, it will be difficult to argue that the adverse effects of Brexit were unforeseen. Indeed, since the Brexit vote in 2016 some parties have been seeking to exclude Brexit expressly from the definition of a force majeure event.
Under English contract law, a contract is ‘frustrated’ if an event occurs which the parties could not have foreseen when contemplating the contract that radically alters the parties' performance of the contract such that it would be unjust for them to continue. Since the effect of frustration is to release the parties from further contractual performance, the bar for a finding of frustration is set high by the courts.
The issue of whether Brexit can constitute a frustrating event was considered by the English High Court last year in the case of Canary Wharf v European Medicines Agency . In this case the European Medicines Agency (EMA) - the EU agency responsible for the approval of medicines - argued that its 25-year lease on premises in London, granted in 2014 and worth a reported £500 million, with the Canary Wharf Group was ‘frustrated’ by Brexit.
Unfortunately for the EMA, the High Court held that, in this case, the lease had not been frustrated by Brexit. Consequently, the EMA remained liable not only to pay rent but also to perform its other contractual obligations for the remainder of the term. The EMA was given permission to appeal to the Court of Appeal but this appeal was withdrawn following a settlement reached between the parties in July 2019.
The EMA case affirms that the English common law doctrine of frustration is unlikely to save contracting parties from contracts entered into that have since turned out to be a bad deal because of Brexit.
In addition to considering whether to include a specific Brexit clause in a contract, assess what amendments might be needed to existing contracts or included in future contracts. For example:
However, during the transition period, the UK and the EU will need to agree the framework for their ongoing future co-operation following the expiry of the transition period. The UK has outlined its proposals for this in a position paper which includes seeking a bespoke agreement that closely reflects the current reciprocal EU rules on jurisdiction agreements as found in the Recast Brussels Regulation.
It remains to be seen whether such an arrangement could be agreed. It may, for example, be scuppered by the UK’s desire to bring an end to the direct jurisdiction of the European Court of Justice.
If no further agreement is reached following the transition period, the existing EU rules on jurisdiction agreements will cease to apply. You may therefore need to take local advice from lawyers in the relevant member state as to what the approach to English jurisdiction clauses and judgements would be under local laws.
The UK has also taken steps to enter into the Hague Convention on Choice of Court Agreements in its own right. This would require contracting states to recognise exclusive jurisdiction clauses in favour of the English courts and enforce any judgements arising out of them.
The Convention only applies where there is an exclusive jurisdiction clause in favour of a contracting state's court and only where the clause was entered into after 1 October 2015. The Convention also does not apply to consumer or employment contracts or to certain other matters such as those relating to land or certain intellectual property rights.
If enforcement in a particular EU member state is important to a party because, for example, key assets are located there, check with local lawyers in that member state whether its courts are likely to enforce an English judgement under their local law.
There are also a number of practical steps businesses should take to ensure that their business partners and contacts in the EU will be able to continue to share personal data with them following the end of the transition period when the UK will become a third country from an EU perspective. GDPR requirements for transferring data to third countries will apply and will require that personal data transferred to the UK from the EU have adequate levels of protection. For example:
The UK government is planning on seeking an adequacy decision from the European Commission for the UK. This means that the UK’s data protection regime would be recognised by the European Commission as ‘essentially equivalent’ to those in the EU. As a result, data will be able to flow from the EEA without the need for businesses to adopt any other specific measures to allow the international transfer of personal data.
The EU Commission has stated that it will start its adequacy assessments as soon as possible after 31 January 2020 and will endeavour to adopt a decision by 31 December 2020 if the applicable conditions are met. Since there is no guarantee that an adequacy decision in favour of the UK will be in place by the end of the year, UK businesses that want to receive personal data from businesses established in the EU should work with their EU partners now to identify a legal basis for those transfers (such as the BCRs and SCCs mentioned above) that can be ready to be put in place at the end of the year if required.
For most businesses, the most relevant alternative legal basis is likely to be the SCCs. While this mechanism would allow UK-based businesses to continue to receive personal data from the EU, it will not be sufficient to allow UK businesses to transfer EU personal data to a third country that does not have an EU adequacy decision without further measures being put in place. However, transfers of personal data from countries outside the EU to the UK are likely to remain the same.
Transfers of personal data from the UK to the EU/EEA will not be restricted. In addition, transfers of personal data from the UK to countries outside the EEA are likely to remain similar to the pre-Brexit position. This is because the UK government has confirmed that there will be transitional arrangements to recognise most existing EU adequacy decisions, the SCCs and the BCRs.
If an organisation is relying on BCRs, they will need to be updated to reflect that the UK is a third country and, if such BCRs have been authorised by the UK Information Commissioner’s Office (ICO), they will need a new Lead Supervisory Authority (LSA) within the EU/EEA.
The UK Information Commissioner is preserving the availability of the Privacy Shield for UK personal data flows to the US. However, to take advantage of this, Privacy Shield-certified companies will need to state expressly in their Privacy Shield policies their commitment to applying the Privacy Shield principles to UK personal data. They will also need to make this commitment clear in their human resources (HR) privacy policies if importing HR data from the UK.
After the UK has left the EU, businesses that do not have a presence in the EU or the UK but intend to offer goods and services and/or monitor individuals located in the UK and the EU/EEA may require both a UK representative under the UK GDPR and an EU/EEA representative under EU GDPR.
For example, a company in India which has no EU offices currently has to have an EU representative if it intends to sell goods to individuals located in the EU. After the end of the transition period, this Indian company would need to have both an EU and a UK representative if it wishes to continue to sell goods to individuals in the EU and the UK.
UK businesses with customers or operations in the EU will need to consider their place of EU main establishment and should update their data protection policies and plans accordingly. In particular, businesses will need to be clear in their data breach response plans which authorities need to be notified in the event of a data breach.
In summary, it is clear that there is no ‘one size fits all solution’ when it comes to contracts and Brexit. Businesses should review their key contracts with UK counterparties and consider how these and future contracts are likely to be affected by Brexit. Businesses should consider if any of their existing contracts need to be amended or renegotiated in light of Brexit. Businesses should also review their data flows and transfer mechanisms and take steps to ensure that they will be able to maintain the free flow of personal data from the EU/EEA to the UK following the end of the transition period.