L4PV Briefing Paper 2: Business and No Deal
This briefing examines how a No Deal exit from the EU would unravel a successful European-wide data regulatory framework. At a stroke it would remove the legal framework for complex supply chains and wider commercial contracts to the detriment of businesses, consumers and the national economy.
By focusing on the transfer of data, supply chains and commercial contracts, this briefing will provide a detailed analysis of some of the impacts of a No Deal departure which would plunge UK businesses into commercial uncertainty and legal limbo.
1. Data flows and the UK economy
The economic consequences of a No Deal Brexit do not just signify the end of mutual recognition of the regulatory standards that have enabled frictionless trade, the imposition of billions of pounds of tariffs on British goods and services, and the severe disruption of supply chains.
A No Deal Brexit also has the potential to make ‘doing business’ for anyone who moves data between the UK and the EU, and vice versa, extremely difficult, costly, and time-consuming.
Under the terms of the UK’s EU membership, the UK is part of the bloc’s privacy regulatory regime. In effect, this means that anyone can move data freely between the UK and the EU. The free and unencumbered movement of data underpins the UK’s economy, particularly its service sector. Since 2017, service industries have accounted for 79% of the UK’s total economic output.
In a No Deal scenario this free and unencumbered movement is ‘turned off’. Although, the UK government has said that it will allow data to continue to move from its end, the EU has said that businesses will not be able to move data from the EU to the UK unless special mechanisms are in place. This is because, as a third country, the UK would no longer meet EU data protection standards until a complex and lengthy assessment of the UK's data protection regime had been carried out.
2. The EU regime
In a cliff-edge No Deal Brexit, data transfers under the General Data Protection Regulation (GDPR) from the EEA to the UK will be classified as ‘restricted’ transfers. This means that the transfer will only be possible if it is covered by either an ‘adequacy decision’, or an ‘appropriate safeguard’, or an ‘exception’.
Adequacy decisions are made by the European Commission and they confirm that a particular country/territory’s data protection regime is adequate. The European Data Protection Board issues binding data protection decisions and guidelines on behalf of the Commission.
If there is no adequacy decision, the list of appropriate safeguards includes ‘standard contractual clauses’, which are recognized by the Commission as a means to keep data flows going. Finally, there are exceptions in certain situations listed in the GDPR itself, which may apply to a given data transfer, negating the need for an adequacy decision or appropriate safeguard.
Under the current framework, there are no adequacy decisions issued by the Commission in relation to the UK, as it still an EU member state. An adequacy decision will require a lengthy assessment during which time EU businesses will be unable to transfer data except in the case of an EEA sender transferring personal data to a British business (an ‘exception’). However, according to the European Data Protection Board, such a derogation must be interpreted restrictively and only relates to occasional and non-repetitive transfers of data.
The Commission has said it cannot start such an assessment until after the exit date, as while the UK is still a member state it continues to be a part of the EU's data protection regime. Without an adequacy decision and where, realistically, the invocation of the exception could not be justified, companies would have to rely on the appropriate safeguard in the form of standard contractual clauses. These mechanisms would also not be workable where companies or UK regulatory bodies need to obtain data directly from EU institutions.
Such a scenario could occur where, for example, the Home Office makes an inquiry to an EU member state counterpart about the good standing of a character who has moved to the UK. EU institutions cannot enter into contracts and therefore such vital data transfers could not occur until the adequacy decision had been made by the Commission.
If No Deal occurs on 31st October, it its likely to be too late for companies who have not yet negotiated such contractual clauses with all the entities to which they transfer data, to do so. These standard contractual clauses concerning the transfer of data are currently used to transfer data between the EU and third-party countries by companies, in the absence of an adequacy decision. However, the legality of these contractual clauses is currently under question in a case pending before the European Court of Justice.
The case brought before the ECJ by the privacy activist, Max Schrems, relates to how Facebook moves data from the EU to the US and in what way this could be illegal. A decision in the ECJ case is expected next year. If the ECJ's decision is that the contractual mechanisms are illegal and where this decision is made prior to the Commission's adequacy decision, then UK businesses will be in legal limbo.
Therefore, companies could find themselves in a position whereby the Commission has not yet made an adequacy decision regarding the UK and it could have the other mechanism for moving data from the UK to the EEA declared illegal. Certain businesses that rely on the international transfer of data will be unable to operate within the UK.
3. Why the Commission's adequacy decision will not be a mere formality
There is a common misconception that because EU and UK data protection laws are so similar, data flows could just continue as normal in the event of a No Deal Brexit. But when the UK leaves it becomes a third country for the purposes of the EU’s data protection regime.
When conducting its adequacy assessment, the Commission will take a more detailed look at the UK’s crime and national security legislation during its assessment, in particular the controversial Investigatory Powers Act 2016.
This has been criticised by the European Court of Human Rights for giving too much power to security and intelligence services possibly violating individual privacy.
As an EU member state, the UK was able to avoid this deeper scrutiny, because under EU law national security is a member state competence. And as a member state, the UK had to comply with EU data protection rules. However, an adequacy decision is a much more rigorous process and does not rely on a presumption of compliance, which is the case for member states.
Legal challenges to any adequacy decision made by the Commission relating to the UK are likely. Such challenges will arise because privacy advocates such as Max Schrems, will argue that the UK's Investigatory Powers Act would not guarantee the safety of EU data from expansive data collection and retention powers.
Data is the lifeblood of the economy. This is not only because of its importance for tech or finances sectors, but also because almost all small to medium sized businesses are increasingly using cloud storage systems. These mechanisms rely on data centres often located in the EU.
The chances of even small companies which only transfer data nationally, storing data through data centres in an EU member state is quite high. Post a No Deal Brexit, these companies will not be able to make further use of their cloud storage systems if they rely on a data centre located in an EU member state without breaching EU data protection rules.
Many small businesses may not even be aware of this possibility and may open themselves up to litigation and fines they can ill afford.
A No Deal scenario will create significant roadblocks to data transfers. This will, in turn, have knock-on effects for vital sectors in the UK economy, including tech, finance and professional services. Far from No Deal restoring sovereignty, every aspect of the UK’s future, including vital data flows, will be decided in the UK's absence by EU institutions, with the UK's ability to influence outcomes considerably diminished.
4. Supply chains and the UK economy
A No Deal Brexit represents the biggest logistical challenge for the UK since World War II, with one vital difference - it is self-inflicted. Once the UK leaves the EU, it will be treated as a ‘third country’ and UK-based businesses will need to comply with new rules to trade into and out of the EU.
For instance, businesses will need to get an Economic Operator Registration and Identification (EORI) number to trade goods with the EU. They will need to arrange for customs declarations for imports and exports and they will need to register for transitional simplified procedures in order to simplify customs processes when importing goods from the EU. Current evidence suggests that businesses are not yet ready for a no-deal Brexit. Figures from HMRC show that by May, only 69,000 out of an estimated 240,000 firms which need to register for EORI numbers had done so. Moreover, less than 10 per cent of these 240,000 firms had applied for transitional simplified procedures.
5. The consequences of No Deal for supply chains
In the event of a No Deal exit, the firms which have not secured EORI numbers, customs declarations for imports and exports and transitional simplified procedures, will be unable to import and export between the UK and the EU. The lack of certainty and inability on the part of the business community (for reasons for which they cannot be held responsible) to prepare for a No Deal Brexit will affect certain economic sectors and arrangements particularly acutely. Moreover, the implications of a shift in regulatory alignment go far beyond economic shock and are illustrated by the following three case studies.
6. Case study 1: medicines
For certain medicines such as insulin, the UK relies almost entirely on EU countries for its supply. Currently the free movement of goods within the EU facilitates the smooth trade of medicine products between the UK and other European countries.
The end of regulatory alignment and mutual recognition will disrupt the flow of vital medicines into the UK. Delays will particularly affect drugs which need to be stored along a ‘cold chain’ (a temperature-controlled supply chain) and those with a limited shelf-life. The disruption of medical supply chains is the key reason why the UK government cannot guarantee that there will be no deaths as a result of a No Deal Brexit.
7. Case study 2: chemicals
As a member of the EU, the UK has participated in REACH, the EU’s system for registering, evaluating, authorising and restricting chemical substances. The European Chemicals Agency (ECHA) plays a critical role in implementing REACH. Companies manufacturing or importing chemical substances into the EU must register these substances with ECHA, which in turn evaluates registrations and lists substances of very high concern. The European Commission, with the advice of ECHA committees, makes decisions on whether substances should be restricted on the basis that they pose an unacceptable risk to human health or the environment.
A No Deal Brexit would see an immediate UK exit from REACH. UK businesses which are registered with ECHA would have their registrations removed from the database. The business of companies which are part of joint UK and continental supply chains would be disrupted as goods would not be able to flow freely across borders.
The UK would have to create its own version of REACH from scratch, without access to the data (and data flows) on which its operation depends. The result will damage UK businesses and expose consumers to harmful goods - goods which are currently prevented from harming UK consumers by EU market regulators.
8. Case study 3: electricity
The UK currently gets approximately 6 to 9 per cent of its electricity supply from other parts of Europe. European energy markets are closely integrated through trading arrangements known as ‘market coupling’. For example, the Republic of Ireland and Northern Ireland together participate in a single wholesale electricity market, called the Integrated Single Electricity Market. In a No Deal scenario, the UK would exit the EU’s internal energy market and cease to be part of such market coupling arrangements
There is thus a heightened risk of breakdown and blackouts in an already over-stretched national electricity grid, which will adversely affect consumers and commercial and industrial productivity.
9. The impact on commercial contracts
The climate of legal uncertainty and the instantaneous change in legal regime brought about by a No Deal Brexit risks unravelling the contracts on which supply chains depend. A No Deal Brexit will immediately affect contracts which run beyond the date of Brexit and those which cross the UK-EU border in some way.
If a contract states, for example, that data will not be transferred outside the EU, UK operations would no longer be covered by these terms of the contract once the UK has left the EU.
This could lead to companies arguing that they do not need to fulfill their contractual obligations following No Deal. The resultant risk of contracts being violated will bring about litigation, lessen commercial certainty and make the UK a less attractive destination for international investments.
Further legal uncertainty for businesses arises where contracts refer to a choice of law and dispute resolution agreements. After the Brexit date, contracts may be found to specify the jurisdiction of a particular court or law that may no longer be appropriate or desirous for the parties. By the date of Brexit, the UK will not have replaced EU dispute resolution bodies with its own equivalents. UK companies risk legal limbo and being involved in protracted litigation before courts in EU member states, when UK courts may be better able to adjudicate a given case.
The conversion of EU law into UK law, via the Withdrawal Act, is a patchwork process and it is not clear what rules will be transferred and when. Where contracts specify obligations and restrictions imposed by EU-derived legislation, this could also prove disastrous for legal certainty, in situations where EU legislation is replaced by alternatives not specified in a given contract.
Many contracts also contain clauses which allow a given party to withdraw from a contract where unforeseen events have had a serious effect on the operation of the contract. Parties could then try to rely on such a clause to avoid liability for non-performance of the contract. The presence of this uncertainty will impinge on the abilities of companies to plan ahead to meet commercial challenges and also reduce investor confidence.
Companies may also attempt to argue that in event of No Deal, a contract could be ‘frustrated’ on the basis of an unforeseen event that made performance of the contract radically different from what was initially intended. No Deal almost certainty constitutes such an unforeseen event, since it creates obligations impossible for either party to observe and is not the result of the action of either party.
An example of where 'frustration' could be used to set aside a contract is where the contract depends on EU regulatory regimes, such as passporting, without which the contract becomes difficult, or impossible to execute. Whether a contract is ‘frustrated’ is a legal question, which requires the involvement of the courts. Once again, the risk is that protracted litigation will create further uncertainty.
Where contracts concern supply chains which rely on goods or services being delivered in a timely manner, the unravelling of longstanding commercial contracts could disrupt entire systems. The courts may themselves find it difficult to create order from this uncertainty. For example, a No Deal Brexit takes the UK out of the body of EU law that determines jurisdiction and applicable law in contractual disputes between businesses.
In instances where contracts do not specify a choice of law or jurisdiction, disputes may result in irreconcilable judgements. The presence of multiple judgements contradicting one another would result in a further decline in legal and commercial certainty which would be to the detriment of UK businesses, consumers and the economy as a whole.