brexit webinar series 3

© Allen & Overy 2016

Employment, data protection, and

data transfers Sarah Henchoz, Charlotte Mullarkey and Sarah Garvey November 1, 2016

Brexit Webinar Series

Presented in partnership with

the U.S. Chamber of Commerce

© Allen & Overy 2016 2 2

Brexit webinar series 2016 – Programme Agenda

1 Brexit: Understanding the context and consequences of the UK

referendum vote

Tuesday, 18

October 2016

2 Trade, tariffs, and taxes Tuesday, 25

October 2016

3 Employment, data protection, and data transfers Tuesday, 1

November 2016

4 Antitrust, intellectual property, and environmental regulations Tuesday, 8

November 2016

5 Commercial contracts Tuesday, 15

November 2016

6 Securing the best legal framework for your businesses Thursday, 17

November 2016

© Allen & Overy 2016 3

Employment


Where we are now

Nothing has

changed yet

UK must serve formal notice to withdraw from

EU – expected to happen by end March 2017

Notice will trigger 2-year exit negotiation

period (which may be extended)

Purpose is to agree terms of UK’s withdrawal

from, and future relationship with, EU

UK will exit when an agreement is reached or

(if no agreement) at end of 2-year period (in

first quarter 2019)

EU laws/free movement rights continue to

apply until point of exit

BUT Article 50 litigation may affect this

process and timeline


Brexit raises inevitable employment concerns


But it is still business as usual for employers

No short-term

employment law

changes expected

No immediate action is

required

Wait and see how things

develop

But plan ahead to be

prepared


Speak to the business and to employees

Secure an HR place

on your in-house

Brexit team

Engage with employees to reassure

them (if appropriate)

– Consider what you can say in light of

what is known

– Individual v collective communication

– Form of communication (face-to-face,

e-mail, FAQ documents)

There may be separate

legal duties to inform/

consult employee

reps/employees


Check who you have where

− When do they end or how can they be terminated?

− Has repatriation been promised and, if so, is there a

home country job to return to?

− Risk exposure in event of early termination?

Audit your European expatriate workforce

Review UK-inbound and outbound expatriate arrangements

Check workers’ current immigration status

Reconsider/delay pending arrangements if in doubt

Include workers in (and from) EEA Member States and Switzerland


Take steps to secure workers’ immigration status

The shape of future immigration policy is uncertain

Proposed points-based immigration system apparently rejected

Work permit system is an option being considered

Consider bringing workers to the UK now

Encourage those who are eligible to apply for permanent residence

Applying for citizenship may also be an option for some

Possible exemptions for European bankers and highly-skilled businessmen/women

System will be reciprocal (i.e. corresponding UK/EU and EU/UK controls)

© Allen & Overy 2016 10 10

Anticipate skills and service gaps

− Relocation of business

− Downsizing of business

− Reorganisation/efficiency changes Possible business model changes

Possible employee implications

− Relocation of jobs/repatriation of workers

− Redundancies

− Cost-saving/efficiency measures

− Changes to terms and conditions

− Recruitment to fill gaps

− Incentivising key employees to retain them

© Allen & Overy 2016 11 11

EU law is likely to remain influential in the longer

term

Unravelling EU rules from UK

legislation is likely to be a long and

politically-fuelled process

Rights may be contractual – employee

consent may be necessary to

change/remove them

ECJ rulings are already embedded in

UK case law

Government may be reluctant to

change some EU law-derived rights

anyway

UK likely to have to keep similar

employment law standards to maintain

strong EU trading relations

© Allen & Overy 2016 12 12

What else does the PM have in mind?

“…we’re going to have not just consumers

represented on company boards, but employees as

well.”

“… I want to make shareholder votes on corporate

pay not just advisory but binding. I want to see more

transparency, including the full disclosure of bonus

targets and the publication of “pay multiple” data: that

is, the ratio between the CEO’s pay and the average

company worker’s pay.”

Theresa May, 11 July 2016


Data Protection and data transfers

© Allen & Overy 2016 14 14

Data Protection - At a glance

There is no immediate change to either UK (or European) data protection

laws as a result of the UK referendum result

Based on the current timetable, the GDPR will apply for a period before the

UK’s formal exit from the EU

Until we know how Brexit is approached many questions will remain

unanswered…

It is expected the UK will adopt a data protection law which is the same as (or

very close to) the GDPR, to ensure the UK is considered “adequate” for the

purposes of data exports from the EU (or less likely join the EEA )

© Allen & Overy 2016 15 15

What is the immediate impact of Brexit?

C

No impact

on data

exports

outside

EU/UK

UK data

protection law

continues to

apply

No impact on

data transfers

within UK/EU

Article 29

Working

Party

Opinions

still apply

Court of Justice

of the EU

decisions still

apply (e.g.

Google Spain)

ICO continues as UK

data protection

regulator

– ICO guidance still

applies

© Allen & Overy 2016 16 16

Will the EU’s General Data Protection Regulation still

apply from 2018?

EU General Data Protection

Regulation will apply from 25

May 2018

The UK’s exit from the UK is

expected to take two years

from the start of the process

We don’t expect that process

to start until end March 2017

although timings may change

It seems the GDPR may

apply for a period before the

UK’s exit

© Allen & Overy 2016 17 17

Will the EU’s General Data Protection Regulation still

apply from 2018?

– The General Data Protection Regulation, the EU’s new data protection

law, is a Regulation – this means it will be directly applicable in the UK for

so long as the UK remains part of the EU. From the date of the UK’s exit

from the EU, the GDPR will no longer apply in the UK, unless the UK

– joins the EEA; or

– enacts a law similar to the GDPR into UK law.

GDPR will not apply within the UK, unless…

– The Data Protection Act 1998 is a UK Act of Parliament, not an EU law

– It implements an EU Directive (Directive 95/46/EC)

– The Data Protection Act 1998 will continue to apply unless and until

repealed by the UK Parliament

© Allen & Overy 2016 18 18

Are there any circumstances in which UK businesses

will be subject to the GDPR?

Offering goods and

services into the EU

GDPR applies

(extra-territorial

effect)

Monitoring

behaviour of data

subjects in the EU

© Allen & Overy 2016 19 19

What does this mean in terms of GDPR

implementation across a multinational business?

– GDPR applies to any controller or

processor:

– with an establishment in an EU

Member State; and

– which is processing personal data in

the context of the activities of that

establishment,

regardless of whether that processing

takes place within the EU or not

– For multinationals with establishments

across both the UK and EU member

states, this means the GDPR will still

apply to those establishments.

– In the UK, good practice and ICO

guidance is already aligned with

requirements which are formalised in the

GDPR

– It is likely to make sense to continue to

plan to apply the GDPR across both the

UK and EU.

GDPR will apply to a business established within EU

© Allen & Overy 2016 20 20

What will be the status of cross-border data transfers

between the EU and the UK?

European data

protection laws

restrict the transfer

of personal data to

“third countries”

outside the EU/EEA

Unless it joins the EEA,

the UK will become a

“third country” and

transfers of personal

data to the UK will be

restricted

Free flow of

personal data is

critical to trade

© Allen & Overy 2016 21 21

What options are open to the UK to avoid restrictions

on transfers of personal data to the UK?

Member

State

EEA state

Seek

adequate

status

Adequate countries:

Andorra, Argentina

Canada, Faroe Islands

Guernsey, Isle of Man

Israel, Jersey

New Zealand

Switzerland, Uruguay

US Privacy Shield?

EEA countries:

Norway

Lichtenstein

Iceland

Model contracts

Consent

Other derogations

© Allen & Overy 2016 22 22

What would the UK need to do to achieve “adequate”

status for the purposes of data transfers?

Adequacy – at discretion of

the European

Commission

CJEU in

Schrems

Adequacy =

equivalence

GDPR

(art. 45)

Take account of

rule of law, data

protection rules,

effective data

subject rights,

cross-border

transfer rules,

effective

authorities, etc.

Directive

(art. 25)

Takes account of

all circumstances,

including rules of

law, professional

rules and security

measures

The bar

has been

raised over

time

Is the UK likely to be considered adequate given the UK’s surveillance laws?

© Allen & Overy 2016 23 23

Latest statements from the UK government and ICO

“…We will be members of the EU in 2018 and therefore it

would be expected and quite normal for us to opt into the

GDPR and then look later at how best we might be able to

help British business with data protection while

maintaining high levels of protection for members of the

public..”

The Secretary of State Karen Bradley MP

“I acknowledge that there may still be questions about

how the GDPR would work on the UK leaving the EU but

this should not distract from the important task of

compliance with GDPR by 2018. We’ll be working with

government to stay at the centre of these conversations

about the long term future of UK data protection law and

to provide our advice and counsel where appropriate.”

Elizabeth Denham, UK Information Commissioner, 31 October 2016

© Allen & Overy 2016 24 24

Brexit webinar series 2016 – Programme Agenda

1 Brexit: Understanding the context and consequences of the UK

referendum vote

Tuesday, 18

October 2016

2 Trade, tariffs, and taxes Tuesday, 25

October 2016

3 Employment, data protection, and data transfers Tuesday, 1

November 2016

4 Antitrust, intellectual property, and environmental regulations Tuesday, 8

November 2016

5 Commercial contracts Tuesday, 15

November 2016

6 Securing the best legal framework for your businesses Thursday, 17

November 2016

© Allen & Overy 2016 25 25

Contacts

Sarah Henchoz

Partner

Employment – London

Tel +44 20 3088 4810

[email protected]

Sarah has considerable experience advising clients on the full range of both contentious and non-

contentious employment matters. She regularly advises clients on the complex and sensitive

issues arising out of the acquisition of a business and the harmonisation of that business into the

wider corporate structure both locally and cross border. This involves advising on implementing

new service agreements and benefit packages for senior executives, employee and trade union

consultation, and post-completion integration. Sarah also regularly appears in and advises clients

on Employment Tribunal matters, particularly in the areas of discrimination and whistleblowing,

and in respect of bonus claims. She also has significant experience of managing cross-border

projects

Sarah is also a regular contributor to employment journals and is frequently quoted in the press

most recently being interviewed on BBC London News in relation to the Brexit vote.

© Allen & Overy 2016 26 26

Contacts

Charlotte Mullarkey

PSL Counsel

Corporate – London

Tel +44 203 088 2404

[email protected]

Charlotte is a PSL Counsel in Allen & Overy's London TMT group. She has significant

experience in, amongst other things, arrangements for the exploitation of intellectual property,

issues relating to data protection and cyber security, outsourcing and procurement transactions,

IT/technology law, and system build and integration agreements.

Charlotte assists the commercial/outsourcing group with complex research, training (internal

and external) and legal know-how support on transactions. She is a regular speaker on the data

protection conference and roundtable circuit with particular expertise in the GDPR. She writes

many articles and blogs on data protection issues and is currently one of the four IAPP London

KnowledgeNet Chairs.


27

Contacts

Sarah Garvey

Counsel

Litigation – London

Tel +44 (0)20 3088 3710

[email protected]

Sarah is an experienced litigator with particular expertise in conflict of laws, state immunity issues

and EU laws. She regularly advises clients on topics such as governing law, jurisdiction, immunity

and arbitration. Sarah is part of Allen & Overy's core Brexit team and has been heavily involved in

advising clients on the legal implications of Brexit. Sarah is Chair of the Law Society's EU

Committee and sits on the Lord Chancellor's Advisory Committee on Private International Law.

Sarah edits the Forum Chapter of Butterworths' Encyclopaedia of Banking and is secretary to

Allen & Overy's Global Legal Opinions Committee. Sarah is a Board Member of the London

Women's Forum.


Contacts

28

Marjorie Chorlins

Vice President, European Affairs

+1 202-463-5305

[email protected]

Garrett Workman

Director, European Affairs

+1 202-463-5639

[email protected]

The U.S. Chamber of Commerce's European Affairs team champions a

pro-business agenda across Europe and in Washington to expand

commercial opportunities for members by advancing open and

competitive markets, economic growth, and transatlantic cooperation.

© Allen & Overy 2016 29 29

Questions?

These are presentation slides only. The information within these slides does not

constitute definitive advice and should not be used as the basis for giving definitive

advice without checking the primary sources.

Allen & Overy means Allen & Overy LLP and/or its affiliated undertakings. The term

partner is used to refer to a member of Allen & Overy LLP or an employee or consultant

with equivalent standing and qualifications or an individual with equivalent status in one

of Allen & Overy LLP’s affiliated undertakings.

brexit webinar series 3

Business