Two major events are slowly playing out in Europe. Each will have a major effect on the future of law and business there, and companies on both sides of the Atlantic are scrambling to adjust. MCC spoke with Davina Garrod and Jasper Helder, partners at Akin Gump Strauss Hauer & Feld LLP in London, to find out what they are advising clients about the United Kingdom’s impending exit from the European Union and about the rollout of the EU General Data Protection Regulation (GDPR). The interview has been edited for style and length.
MCC: Davina, what is the current state of negotiations between the EU and the U.K. for Brexit?
Garrod: Well, formal negotiations between the EU and the U.K. have yet to start. On the 29th of April of this year, the General Secretariat of the Council in Brussels published guidelines on the negotiations, and these define the framework for negotiations under Article 50 of the Treaty on the Functioning of the European Union (TFEU). As you know, Article 50 is the TFEU provision, pursuant to which the U.K. has given notice that it’s going to be exiting the EU. In reality, negotiations won't formally start in earnest much before the German general election is held on the 24th of September. This is because Germany is the largest European economy and one of the founding members of the EU.
Those are negotiations in terms of the withdrawal agreement for the U.K., which the EU has stated needs to include money, a plan for how to sensibly address the border issues between Northern Ireland (part of the U.K.) and the Republic of Ireland (a separate and remaining EU member state) and protections for EU citizens who will be living in the U.K. There will be a separate set of negotiations on trade. The U.K. has yet to formally decide on what kind of trade agreement they're pushing for. My hunch is that it's probably going to be a comprehensive fair trade agreement with the EU. The EU is being very, very strict on sequencing, and they're saying that they're not even going to enter into a discussion about trade until the withdrawal agreement – or “divorce settlement” – has been decided. And of particular importance is the divorce lump-sum payment that the EU is pushing, which, depending on which newspapers you read, could be anything from 40 billion euros to 100 billion euros.
MCC: Wow. That's serious money. Jasper, how can companies prepare their operations and business dealings for the U.K.'s departure from the EU?
Helder: At present the framework of the arrangement between Europe and the U.K. in respect to many things – like the movement of people, the movement of services, the movement of goods, the movement of capital – is not laid out yet. There is a lot of political posturing on the European side, on the English side, ahead of the actual negotiations. We need to see what the details are going to look like. But that said, there are a couple things that you can do. And I'm an international trade and customs lawyer, so my focus is on the movement of goods. There is a whole financial services chapter to Brexit, London being the major capital market for all of Europe. But that is a very different and very specialized area.
When it comes to goods, if I were a company with business operations on both sides of the channel, I would start looking at what my supply chain actually looks like. Where am I sourcing my products from globally? Where do I bring those materials to, where are my production locations? And which markets do those production locations serve? Because if I am, say, a U.S.-based company, and I have a production and sales operation that is located in the U.K. that also services the European continental market, that is a point of risk for me. Because the continued access of those products from the U.K. into the continental European market is really contingent and dependent on the agreement that the U.K. and the EU are going to strike.
Now, there is a lot of speculation around this, but the fallback position, if there is no such agreement, is the World Trade Organization framework. And the U.K. has made concessions about import tariffs that it would maintain in a WTO context. But nobody really wants to go there, because these tariffs are relatively high in comparison to what the European Union now has in its single customs tariff. And another factor that I would want to take into account is what red-tape documentation – formal processes – there are if I'm going to cross the channel with goods destined for the European market. So these are things that I would look at. And if you want to be completely independent from the agreement that is struck, and not find yourself between the European Union and the U.K., you would want to maintain a footprint on both sides of the channel. Whether that is viable from a cost and business perspective, that's another question.
MCC: How will Brexit impact trade within the region? Are there other risk areas, as you identify them, for companies to be thinking about at this early stage?
Helder: I think there are. If you picture the scenario where you have a production plant in the U.K. that is sourcing its materials from all over the world: At this moment the U.K. as part of the European Union is a party to free trade agreements with many third countries outside the EU. For example, Mexico and other areas throughout the world. Now if the U.K. were to leave the European Union and had no free trade agreements in place with all of the places that you are sourcing your materials from, that means that the free trade as facilitated by the current European trade agreements from which the U.K. benefits no longer applies. That is also why the British government is seeking to pursue negotiating free trade agreements with third countries as quickly as possible. The dialogue between May and Trump is definitely going to be impacting. Another issue that is immediately relevant is that the U.K. will no longer be part of the customs union if there is an all-out hard Brexit. So that means when you cross the channel with products, you need to follow full customs formalities. That could potentially delay transit. It also means more work.
MCC: How will Brexit affect U.S.-based companies with offices in the U.K. that may be staffed in part by non-Brits from the EU? And what other employment issues is Brexit likely to create for U.S.-based companies?
Helder: As you have probably read in the media, there has been quite some discussion about May not wanting to guarantee European Union workers rights in the U.K. up front. And from the U.K. perspective, that is like keeping a trading card up your sleeve with a view to the negotiations that are going to start soon. However, if you realize that one of the political drivers behind the Brexit vote was the immigration question, I think it's also something that is a sensitive issue. That being said, the U.K. to a large extent depends on the European Union. So again, a hard Brexit without any arrangements simply means that there are no guarantees for non-U.K. nationals – other than those they would acquire under U.K. immigration law. So for a U.S.-headquartered company with a significant operation in the U.K., employing many continental European nationals, this definitely is an issue to watch. And it is also one of the major issues that the EU and U.K. have already identified to hash out.
So it's immigration, residency status as one aspect. Another is one of professional qualifications. If I take, for example, the legal profession, at this moment a lawyer who is admitted to the bar in a European country can move to London. That's what I did myself. And you register with the London regulatory authority, and you are allowed to practice in the U.K. as a registered foreign lawyer. All of that is based on European directives. Now if these fall away, then the question is (and not just for the legal profession but for other regulated professions as well, like accounting): How is the equivalence of U.K. versus European admission dealt with? So if you are a U.S. company and you have an operation in the U.K. employing many of these regulated professions, I think that is another issue you might want to look into very carefully.
MCC: Davina, let’s move on to how Brexit will impact corporate M&A and other transactions in the U.K.
Garrod: At the moment, pre-Brexit, M&A activity, which in part involves U.K. companies, has actually been quite strong. We're finding that there are a lot more deals around now, and as sterling's value has been impacted (it has reduced), you're seeing a lot more U.K. corporate targets. We've been involved in a number of deals involving U.K. corporate targets. Akzo, for example, is known as a Dutch company, but it has a substantial U.K. presence – it purchased a very large U.K. company a few years ago – and it remains a target.
Immediately after the referendum, though, if you're somebody who just works on U.K. domestic deals, then your practice would have been heavily impacted, and a number of U.K. clients put their M&A on hold. Fortunately, Akin Gump is a very international and cross-border firm, and so our M&A practice has boomed. Indeed, there was a Trump bounce and a lot more deals involving our U.S. clients, and European (including U.K.) targets abounded. We continue to be very busy.
From an antitrust perspective, once the U.K. comes out of the EU, then all deals involving U.K. companies will need to be considered from a U.K. merger control perspective as well as from an EU merger control perspective. The EU Merger Control Regulation provides a one-stop shop for merger reviews within the EU28. But post-March 2019, the U.K. will be outside of the EU, and the U.K. merger control provisions in the U.K. Enterprise Act will apply in full force. Then, from a dispute resolution perspective, there could be changes to the enforceability of English judgments in EU member states (and vice versa) in the M&A context, and there might be a greater use of arbitration.
In terms of public takeovers in the M&A context, there's been no sign so far that the U.K. Takeover Code will be changed. Indeed, the U.K. takeover rules give effect to the EU Directive on Takeover Bids. Furthermore, the takeover regime in the U.K. was established in its current form prior to the directive, so we're unlikely to see many changes here. It is worth noting, however, that – as with the U.S. – economic protectionism continues to sweep across Europe, and the U.K. government is re-thinking its industrial strategy and whether further scrutiny should be applied to foreign acquirers of strategic U.K. assets.
MCC: Moving to a different subject that also has the attention of a lot of general counsel, what exactly is the EU General Data Protection Regulation (GDPR), and who does it impact?
Garrod: The GDPR is a regulation that EU member states – including the U.K. – must be fully compliant with by the 25th of May, 2018. The GDPR replaces the Data Protection Directive from way back in the 1990s. For many years we've had a bit of a patchwork quilt of privacy rules around the EU. At one end of the spectrum you have the German regime, which is very strict and rather formalistic compared to the more permissive U.K. regime, which is principles-based. The EU, over the last few years, realized that it needed a harmonizing legislation that would strengthen and unify the different countries’ regimes to ensure that European and non-European companies, such as big U.S. tech companies, would only have to deal with one set of data protection laws – rather than having to spend a lot of money and time figuring out what the different privacy laws are in France, Germany, Italy and elsewhere in the EU28.
The GDPR is supposed to be a good thing, and broadly speaking, I think it is a very good piece of legislation. It beefs up privacy laws so that, from May 2018, if a company breaches certain of its provisions, then it could get fined as much as 20 million euros, or up to 4 percent of its global revenue, whichever is the greater. If you think about how large some of these U.S. tech companies are in terms of revenues, we're talking about incredibly large fines.
MCC: Well, you've always had much stricter privacy regulations than we have over here on the other side of the pond. So what steps do U.S.-based companies need to take to achieve compliance with the GDPR, and what challenges can they expect?
Garrod: Initially you need to obtain management buy-in within the company because, particularly for U.S. companies, privacy in the EU hasn't necessarily been first on their list of things to worry about. As an internal compliance person in a U.S. company, you need to get a budget from the company in order to be able to provide a road map for compliance and execute on this plan, thereby ensuring compliance. More specifically, you need to set individual milestones for compliance and agree on the timing of essential deliverables. This would include identifying current and new types of personally identifiable information – not just things like people's names and dates of birth and email addresses, but also other types of personally identifiable information, including digital photographs. You also need to determine the legal basis for each type of data processing activity that your company will be doing, and document this. The act of “processing,” for example, has a very wide definition. It could be something as basic as just opening an email and seeing somebody's date of birth. Furthermore, specific consents from data subjects will need to be obtained for specific acts of processing. Authorities are due to publish guidance on how this expanded consent regime will work in practice.
MCC: Were the fines that you mentioned designed to make it very clear to the general counsel that this is serious, and to give those attorneys exactly the kind of message they need to deliver to the CEO to obtain the buy-in that you mentioned?
Garrod: Yes. I think this huge increase in fines is really important. I think it is already acting as a deterrent – ensuring that senior management in companies take notice and dedicate sufficient resources to ensure that there are no privacy violations. Questions have been raised, though, as to how aggressive particular data protection authorities in certain EU countries will be when it comes to enforcing the GDPR. We already know that Germany has a very strong history of aggressive enforcement of privacy laws, and so we expect the federal regulator in Germany, and the individual privacy regulators in the individual states in Germany, to continue to be strict enforcers. However, there are other countries in the EU that are not as interested in data privacy, and they may not enforce some of these rules particularly strongly.
One of the decisions for companies is: Who will be your primary data privacy authority? Because, you know, some companies are active across the EU, but there's usually going to be a lead authority that will be your key authority that you liaise with. I know some clients who are seriously considering moving a lot of their personal data from Germany into a EU country with a more permissive enforcement regime. They are currently figuring out whether they can possibly do this from a commercial perspective.
MCC: Interesting. There’s also the question of how the GDPR will affect the U.K. after Brexit.
Garrod: So far the GDPR is in the category of rules to which the U.K. government probably isn't going to be making too many changes. There are laws that the U.K. government, broadly speaking, is OK with. There might be elements of the GDPR that they might want to tweak, but because a lot of the existing U.K. privacy law is already in the GDPR, we don't expect too many changes.
The realistic thing to bear in mind is that many U.K. companies will still be subject to the GDPR post-Brexit, because the GDPR has a very wide reach. More specifically, the GDPR will apply to companies outside of the EU that target, by way of online marketing, for example, EU citizens. Even if a company is based in the U.K., the fact that it’s marketing to EU citizens means that it’s going to be subject to the GDPR in any event. I think the U.K. government is cognizant of that. We're telling our U.K. clients that they still need to ensure compliance to the GDPR by May 2018, just as we're telling our U.S. clients.
Another important element to all this is that transferring personal data from the EU, which includes the U.K. at this point in time, to jurisdictions outside the EU, like, for example, the U.S., is already heavily regulated. This is because of the disparity between data protection rules in the EU and certain more permissive regimes, like the U.S. Indeed, there has been ground-breaking litigation in this area, and transferring data from the EU to the U.S. without the correct model contract clauses in place (or binding corporate rules) can give rise to privacy violations.
The Privacy Shield regime (or Safe Harbor II, as it is also known) came into effect last year. Some companies have signed up, whereas other companies don't feel that it's actually worth making that kind of investment, and so they're continuing down the binding corporate rules/model contract clauses avenue. We're advising our clients on both of these avenues.
MCC: It's a pretty complicated time we're living in, isn't it?
Garrod: It really is. We could have done without Brexit, for sure. But, you know, we can't be too negative about it. There are potential opportunities for the U.K., and upsides for U.K. investors and for U.K. companies. I think the next 18 months are going to be crucial for the U.K. If you listen to some of the Greeks who had to negotiate with the EU in the context of the Greek financial crisis and bailout, the one message that they have for Theresa May is, “Don't bend over backward and try and concede too quickly. The EU plays a very hard and aggressive game of poker, and if you concede too quickly on any point, then you've lost.” We could have a real face-off until the bitter end, where it's only on the verge of a hard Brexit that the EU and the U.K. can come to some compromise. There is no doubt that the EU has the advantage of scale in these negotiations, and continued goodwill and strong negotiating skills will be essential if the U.K. is to get the best possible deal for its economy and citizens. Fortunately, there appears to be an appetite on both sides for a transitional period of at least five years, which would prevent both sides from “falling off a Brexit cliff.” The EU – including the U.K. – has a long history of finding pragmatic solutions for intractable problems. At least these negotiations will be conducted against the backdrop of a peaceful and relatively prosperous Europe.
Published June 28, 2017.
