COMPLIANCE
Brexit Checklist for U.S. Technology Companies By ROGER BICKERSTAFF, YUICHI SEKINE, ELIZABETH UPTON, SALLY SHORTHOSE, NICK ARIES AND BRYONY HURST
new immigration rules that will apply. Applications can now be made for the new Skilled Worker and Intra-company Transfer visa. For technology companies in the UK, the message is clear. Whilst freedom of movement for EU nationals to the UK has ceased, most work visa restrictions have been removed. It will be much easier to sponsor non-UK nationals as new hires.
DATA PROTECTION
T
he United Kingdom exited the European Union on January 31, 2020, and the Brexit transition period ended on December 31, 2020. The EU-UK Trade and Cooperation Agreement has been in effect since January 1, 2021. U.S. technology companies need to be aware of the key implications for their businesses arising from the UK’s new status as a “third country” outside the EU.
PEOPLE There is no longer free movement of people between the EU and the UK. The Trade and Cooperation
16
Agreement includes a framework for new mobility routes for business travelers but does not confer any new residence rights. EU nationals who were lawfully resident in the UK at the end of the transition period and wish to stay must register to preserve their rights under UK law. British citizen employees residing and working in an EU member state must comply with national requirements to protect their continued right to reside and work in that state after the end of the transition period. For people moving to the UK after the end of the transition period, there are
TODAYSGENERALCOUNSEL.COM FEB/MAR 202 1
EU to UK data transfers: Transfers of personal data from the EU to the UK now constitute a transfer of personal data to a third country. As the UK does not yet have an adequacy decision, the EU-UK Trade and Cooperation Agreement includes a temporary arrangement allowing personal data transfers for four months, extendable up to six months. During this period, alternative safeguards such as standard contractual clauses are not required. Data transfers from the UK: The UK will continue to treat EU countries’ laws as adequate. On this basis, transfer adequacy mechanisms are not needed for UK to EU data transfers. Personal data transfers to other jurisdictions will be as per the pre-Brexit position. EU adequacy decisions and alternative safeguards are recognized for these transfers. Lead supervisory authority and representative issues: The General Data Protection Regulation “one-stop shop” no longer applies in the UK for investigations that have a multicountry dimension. Organizations could face distinct investigations and BACK TO CONTENTS
