Brexit, data protection and regulation: after a period of shock, how about some reflection and a moment to catch our breath

27 June 2016 – Sitting in the “hot seat” in Brussels this past week and weekend, I have been privy to some interesting conversations about Brexit.  Diplomats have not held back on their criticism of David Cameron’s catastrophic decision to ignore their warnings and go ahead with a referendum on Britain’s EU membership. According to sources in the cabinet of EU Commission President Jean-Claude Juncker, Cameron had told Cameron at a G20 summit that he could win a referendum “by a margin of 70 to 30”. Juncker replied that even Luxembourg would not vote to stay in the EU by such a big majority.

And I could only chuckle (and cry) at Alex Massie’s blog over the weekend:

And Brussels insiders are livid:

• They are frustrated and angry that Cameron did not use the UK reform deal – painstakingly agreed by all EU member states in February – to defend the EU during the campaign. “You don’t reverse a perception between 19 February and 23 June that you have created,” one diplomat said.
• The Commission must now devote resources, people and money … in short supply due to a basket of problems the EU faces … to work on the UK divorce.
• Some of this work will need to be done by the very people now renegotiating bits of the Privacy Shield … to the delight of the U.S. negotiation team.  The U.S. team has … as always … pressed every advantage in these negotiations.  Now, they have time pressure to play.  As one U.S. participant told me “we have them by the balls”

One envisions a cycle of disintegration.

This morning Germany ruled out any possibility of informal talks on Britain leaving the EU before it files formal notice under Article 50 of its intention to go (more on Article 50 below) which dealt a major blow to the Brexit campaign’s leaders. Merkel’s spokesman, Steffen Seibert, said:

Said one diplomat:  “If they treat their referendum as a non-event, we will also treat their referendum as a non-event.”

And good old Boris Johnson has said there is no rush to trigger Article 50. And nobody in London has so far shown any sign of wanting to launch formal exit proceedings, with the prime minister, David Cameron, who resigned on Friday, leaving the task to his successor, and leading Brexit campaigners including Boris Johnson demanding informal withdrawal talks before locking Britain into the two-year timeframe laid down in the Article 50 process (though subject to extension, by the way, so it is not a strict two years).  FAIL!!

For a review of his pathetic response to the vote read Boris Johnson’s Telegraph column on Brexit is made of half-truths, magical thinking, and outright lies.

A crucial two-day EU summit on this issue starts tomorrow, Tuesday, 28 June. Three fundamental issues arise:

Probably the most interesting long-term issue, which I noted in a post last week is that of regulation. The United Kingdom has generally been a proponent for a lighter touch generally, particularly in the case of tech companies, while Germany and especially France have been much more outspoken about the need for regulation, with the primary target being U.S. tech giants. For now, this vote will almost certainly make the situation worse: for at least two years the UK will be governed by EU regulations, even as the UK’s influence on the EU will be dramatically weakened. Eventually, I think it’s reasonable to expect an independent UK to be more hospitable to U.S. tech companies, but again that’s in the longer term.

And even before the voted to leave the EU, the UK government was plotting to water down far-reaching data protection regulations from Brussels.  The General Data Protection Regulation (GDPR) was due to come into place by 2018 and have been described as the biggest shake-up of EU data protection laws in decades. Among other things they included tougher penalties for companies in breach of EU data protection law, with fines of up to four per cent of global turnover.

But as was well known by GDPR negotiation teams, UK mandarins had already been moving to minimize the impact on the regulations – mainly to enable civil servants to more freely share citizens’ data. In a series of emails released by the “Edward Snowden of GDPR”, data protection officials in the UK HMRC said the department was hoping to put in place “exemptions” from the GDPR:

In other words, how it could get round the regulations and push ahead with its own data sharing plans. UK government plans to increase the sharing of citizen data have already been heavily criticized – particularly in light of the ongoing Care.data controversy.

And so the inevitable quandary: if the UK is not part of the EU, then upcoming EU reforms to data protection law would not directly apply to the UK. But if the UK wants to trade with the Single Market on equal terms it would have to prove “adequacy” – in other words UK data protection standards would have to be equivalent to the EU’s General Data Protection Regulation framework starting in 2018. With so many businesses and services operating across borders, international consistency around data protection laws and rights is crucial both to businesses and organizations and to consumers and citizens.

“New national IT infrastructure may be required to ringfence systems”. So said Inder Singh over the weekend, head of strategy and marketing at Unisys, an IT services company whose UK customers include the Metropolitan Police and Lloyds Bank. He said the UK’s exit from the EU will create the need for a new national IT infrastructure as the country turns its back on the dream of a more integrated European data economy.

U.S. companies are salivating. They already have their eyes on the work. The new facilities will include new data centres and border controls to enhance security and ringfence national data. However, building a secure island of IT will weaken some of the benefits promised by cloud computing and that ugly concept we thought was dead is back – the Balkanization of data flows.

And the abandonment of EU privacy rules and other regulations for data will inevitably force British companies to store and process information locally, according to tech experts. Financial institutions will be affected – they will be looking to migrate their infrastructure onshore to the UK rather than spread it across Europe. To the extent you’re creating extra borders within Europe, you’ll only see that trend accelerating.

One tech chap I spoke with said the Balkanization of the European tech infrastructure would mean UK companies would not see the full benefits of cloud computing, which stem from the huge economies of scale and “frictionless” movement of data that come from a borderless approach to IT: “If companies start pulling data within their borders, companies like ours are well-positioned. We wouldn’t recommend it, this could have a chilling effect on cloud technologies, but we’re well positioned for it.”

Ringfencing data in national borders will add to overall tech costs and favor established IT companies at the expense of start-ups. It makes it very expensive because of the tech architecture you have to implement. Said Aaron Levie, chief executive of Box, a US cloud storage company with operations in Europe: “we have already reconfigured our systems to take account of a growing data isolation that has been required as countries such as Germany seek to ensure the privacy of their citizens. It becomes harder if you’re a start-up that hasn’t addressed that challenge.”

Quoting Eduardo Ustaran, a partner at law firm Hogan Lovells: “The risk is that the UK government might say: forget the EU, let’s go it alone on data protection. The issue is that you automatically put yourself outside the group of countries that are not regarded as adequate, like the US.”

And on the long-term business side, creating smaller national IT markets rather than a single regional infrastructure would also make it difficult to build European tech companies capable of matching the US and emerging Chinese giants. Cloud service providers would not be able to reach the scale needed to compete with global rivals, instead forcing them to rely on local data centres run by Amazon Web Services and Microsoft, which already operate at an order of magnitude, this person said.  And we have been moving to the duopoly of AWS and Microsoft for a long time.

And a big winner? Tech companies that develop border controls, which now rely on many advanced scanning and other technologies. You can only see that demand growing – you can see increased borders between Europe and the UK, and more controls to handle inbound traffic.

The Max Planck Institute Luxembourg for Procedural Law will shortly run a program on the adverse legal consequences in the transitional period of two years foreseen by Article 50 of the EU Treaty. So I do not wish to take their thunder but herein a few points in their post over the weekend:

1. Regarding private international and procedural law, all EU instruments on common rules for jurisdiction, parallel proceedings and cross-border enforcement will cease to exist after the transitional period, not only in areas such as insolvency and family matters, but also in the core areas of civil and commercial matters. Judgments given by English courts will no longer profit from the free movement of judgments. Their recognition and enforcement will depend on (outdated) bilateral agreements which were concluded between the 1930 and 1960s. As there are only six bilateral agreements, the autonomous, piecemeal provisions of EU Member States’ regimes regarding the recognition of the judgments of third States will apply. Of course, there might be negotiations on a specific regime between the Union and the United Kingdom, but the EU Commission might be well advised to tackle the more pressing problems of the Union (i.e. the refugee crisis where no solidarity is to be expected from the UK) instead of losing time and strength in bilateral negotiations.

2. From the European perspective, there is now a need to carefully evaluate the benefits of a bilateral agreement with the United Kingdom on issues of private international law. The main interest of the Union won’t be to maintain or to strengthen London’s dominant position in the European judicial market: EU Member States might equally provide for modern and highly-qualified legal services ready to attract commercial litigants and high-value litigation & arbitration. Examples in this respect are The Netherlands and Sweden. In addition, there is a genuine interest of the Union to see mandatory EU law applied in disputes related to the Internal Market by courts operating within its regulatory framework. A perfect example in this respect, as pointed out by Dr. Matteo Gargantini, – former senior research fellow at the MPI Luxembourg – is provided by the EU legal text concerning the financial markets. Here, the so-called MiFIR provides for a dense regulatory framework where a clear distinction is made between EU Member States and third States. In the future, the United Kingdom will qualify a third State in this respect. This entails that jurisdiction and arbitration clauses providing for the jurisdiction of English courts and/or for London as a seat of arbitration cannot be agreed.

3. Jurisdiction and arbitration clauses in contracts will apply to future controversies, and as such, their validity will be scrutinized at the moment when a dispute arises. An agreement made today to establish London as the place of dispute resolution will no longer guarantee the validity of that respective clause in two years’ time. In other words, law firms would be well advised to no longer agree to these clauses as their validity will be challenged in every civil court within the European Union.

The official process is set out in Article 50 of the Treaty of European Union. Steve Peers has two brilliant blogs about that process, one in detail here , and a shorter version here.

It would also be possible to leave the EU by amending the Treaties, although it is hard to see why that would be an attractive option to the UK, since it would require long ratification periods and unanimous voting on the EU side.

Some on the Leave side have hinted that they think there is some alternative “mystery process” to leave, although they have not defined why they think this or what that would entail. The likelihood is therefore that Article 50 will be used. Any alternative approach would likely face a successful legal challenge.

Basically, the UK notifies a withdrawal decision to the EU. That triggers a two-year period at the end of which the UK is no longer an EU member. That time can be shorter (if an EU/UK withdrawal treaty provides for this). It could also be longer if all Member States and the UK agree.

It is up to the UK when exactly to notify the withdrawal decision. It could delay making the notification, although a very long delay could possibly increase economic uncertainty and fuel distrust by Leave voters.

The negotiation concerns a withdrawal agreement. It is not clear if this is a technical agreement limited to the fiddly details of the UK leaving, or whether it would also govern the EU-UK future relationship. The point is relevant since otherwise the EU-UK relationship would have to be negotiated separately, and different rules would apply. While the withdrawal agreement is subject to majority voting among the remaining EU Member States, it is more likely that a separate deal would be subject to unanimous voting and national ratification.

It is also not clear if a notification to leave the EU can be withdrawn after it is made. That would be relevant if the plan were to negotiate the future UK/EU relationship, then ask the public in another referendum whether they wanted to leave on those terms or not.

Can the UK change its law to contradict EU law – repealing the European Communities Act, restricting the entry of EU citizens – while still an EU member? As a matter of domestic law, the answer is yes: the UK courts will accept and apply any Act of Parliament as the law of the land, regardless of whether it contradicts EU or other international law.

However, this approach would indeed contradict EU and international law, as Professor Kenneth Armstrong has pointed out here. The question is whether that might prompt a retaliatory response from the rest of the EU as regards EU business, or complicate the withdrawal negotiations.

The most attractive option is, for at least a temporary period, for the UK to continue with the “Norway option”, which means continuing to remain part of the European Economic Area (EEA), the association agreement between the EU, Norway, Iceland and Liechtenstein.

There are a number of reasons to prefer this approach. It would provide legal security for exports of most goods and all services exports from the UK to the EU (and vice versa). A deal on this could be done quickly, thus reducing the damaging effects of uncertainty about the UK and EU economies, since the UK is already a part of the EEA, and so arguably does not need to go through any process to join it. (There could be a legal dispute on this point, though, since there is no express rule in the EEA treaty on what happens if the UK leaves the EEA: see the comments on this blog post). The EEA option is clearly the simplest way to leave the EU sooner, rather than later – which should appeal to opponents of the EU.

EEA membership would leave the UK free to sign its own trade deals with other countries. The UK would not be bound by the EU’s fisheries or agriculture or VAT policy, so could change its law in those areas too. The EEA doesn’t cover foreign policy or criminal law or policing issues, although the UK could seek to negotiate a separate deal with the EU on those issues (on this aspect of Brexit, again, see Steve Peers discussion here).

The EEA does cover most EU laws on workers’ rights and the environment – so signing up to the EEA would guarantee the continued application of those laws in the UK. That’s a big advantage for those who support such laws.

There are limitations to the EEA option, although they could be addressed. First of all, staying in the EEA does entail continued free movement of people, and that is one of the key reasons for the Leave vote. However, unlike between EU members there is a special safeguard. A Member State can disapply part of the EEA ‘If serious economic, societal or environmental difficulties of a sectorial or regional nature liable to persist are arising.’

This decision is unilateral, although an arbitrator can rule on the ‘scope and duration’ of the safeguard. Also, the EEA specifies remaining EU could retaliate against any such UK decision (limiting UK car exports or financial services exports), although again an arbitrator can rule on the scope of this retaliation.

In short, the UK could invoke a safeguard clause to limit the free movement of persons under the EEA – but it would not be cost-free. Having said that the EEA option would probably only be politically viable in the UK if the government announced its immediate intention to trigger immediately the safeguard clause as regards free movement of people.

Another limitation of the EEA is that the UK would no longer have a vote on EU laws as the EU adopted them. Those laws would in principle still have to be applied in the UK despite the absence of a vote. Two points on this though. First of all, the UK would not be subject to as many EU laws as is now – since agriculture, fisheries, tax and non-EU trade are not within the scope of the EEA. Secondly, for any EU law to apply to the non-EU members of the EEA it must be approved by those non-EU members. So the UK could veto the application of that new EU law to the UK at this stage – although again, the EEA provides for possible retaliation by the EU if it does so.

In human terms, the biggest issue for Brexit is what happens to EU citizens in the UK , and what happens to UK citizens in the EU (both explained in the links).

There’s also the question of whether the legal position of all such persons is protected by the principle of “acquired rights”, as referred to in the Vienna Convention on the Law of Treaties. The Leave side argued that it was, but others (for instance, Professor Sionadh Douglas-Scott ) have argued that it was not.

The better view is that the EU/UK withdrawal treaty should contain a specific clause on this, which is legally binding in itself, defines the exact scope of the rule, can be supplemented by further measures, and must be fully applied in national law. It could read something like this:

1. Any citizens of the UK residing in the EU as of [Brexit Day], and any EU citizens residing in the UK as of that date, shall retain any rights which they acquired pursuant to EU free movement law before that date. They shall also continue to acquire rights which were in the process of acquisition as of that date.
2. The parties shall give full effect to this principle in EU or national law, as the case may be.
3. The EU/UK Joint Committee may adopt further measures to implement this rule.

It should be noted that his issue would be irrelevant if the UK retains its participation in the EEA, as discussed above.

Some argue that people cannot be ‘deprived’ of their EU citizenship by a Member State leaving the EU. In my view, that’s untenable. The Treaties define citizens of the Union as being nationals of Member States. If a country ceases to be a Member State of the European Union, then obviously its nationals therefore cease to be citizens of the Union.