Brexit: implications for IP and Privacy
At 11pm on Friday 31 January 2020, the UK will exit the EU. Not much will change immediately. From then until the end of 2020, we will be in a transition period, with most of the obligations and benefits of EU membership continuing to apply. In particular, most EU law will continue to apply in the UK - including the provisions relating to intellectual property law and data protection.
In this blog post, we consider the implications of Brexit on IP and data protection during the transition period and beyond.
The UK formally exits the EU at 11pm (UK time) on 31 January 2020. At that point, the transition period commences and continues until 11pm (UK time) on 31 December 2020. The transition period operates effectively as a standstill period: the UK will have left the EU, but, for most purposes, will continue to be treated as if it were a member of the EU. The main exception is that the UK will not have representation or voting rights in EU decision making and institutional processes.
During the transition period, the UK will be treated as a member of the EU single market and customs union. EU law will continue to apply to the UK and businesses and individuals can continue to operate, work and travel between the EU and the UK just as before exit. The UK will be subject to new EU laws that come into force and apply before 31 December 2020. Decisions of the CJEU during the transition period will still bind the UK. The UK will also continue to be bound by the EU’s international agreements and the EU will notify other parties to such agreements that the UK is to be treated as a member state for the purposes of those agreements during the transition period – although this is not binding on third countries.
The transition period can be extended by agreement between the EU and UK, provided that the decision to do so is made before 1 July 2020. However, UK Prime Minister Boris Johnson has repeatedly promised not to extend, as this would delay the practical effects of Brexit. For political reasons therefore, this seems unlikely.
From 1 January 2021, the relationship between the EU and UK will be governed by whatever trade and/or other agreements can be negotiated in the meantime.
Patents and SPCs
Little will change when it comes to patents, even after the transition period. National UK patents and European patents designating the UK will still be available in the current manner (membership of the European Patent Convention is not conditional on membership of the EU) and neither system will be significantly affected.
The current regime for supplementary protection certificates (SPCs) will continue largely unchanged until the end of the transition period. After that, on 1 January 2021, marketing authorisations granted by the European Medicines Agency will be automatically converted into UK equivalents. SPCs granted in the UK before the end of the transition period will be unaffected. The EU SPCs Regulation will be retained in UK domestic law, but with references to EU agencies replaced by UK equivalents. Pending and future applications for UK SPCs will be dealt with under this equivalent domestic regime: so, pending applications will not need to be re-filed and the process for obtaining UK SPCs will stay largely the same (although a UK marketing authorisation will be required for an application for a UK SPC). The UK will also retain the EU’s recently introduced SPCs manufacturing waiver which permits, among other things, the manufacture of medicines protected by SPCs for export to countries where no parallel protection exists.
The fate of Europe’s unitary patent court (UPC) and unitary patent system remains uncertain, not only due to Brexit, but also an ongoing challenge to its legitimacy on constitutional grounds brought before the German courts. Regardless, the UK’s continued participation requires both an amendment to the UPC Agreement (to permit a non-EU member to participate) and the UK’s submission to the jurisdiction of the CJEU for the purposes of the unitary patent. For political reasons therefore, the UK’s continued participation seems unlikely. See our dedicated microsite here for further details on this topic.
As with other areas of law, the status quo for copyright law will be maintained during the transition period. After that, little will change immediately. While copyright is only partially harmonised in the EU, most harmonisation initiatives have been achieved by way of EU Directives, and as such have already been implemented directly into UK domestic law. However, from January 2021, the UK’s copyright laws will start to diverge from the EU’s. By way of example, the UK has already confirmed that it will not implement the EU’s controversial new Directive on Copyright in the Digital Single Market (in respect of which see our blog post here), as the implementation deadline falls after 31 December 2020 and “any future changes to the UK copyright framework will be considered as part of the usual domestic policy process”.
The position regarding the sui generis database right (which protects databases in respect of which there has been a significant investment in maintaining, verifying or presenting the contents) will change after the transition period. From the end of the transition period onwards, UK businesses and individuals will not qualify for database right protection in the EEA – and will need to rely on their other intellectual property rights (e.g. copyrights and/or rights in confidential information) or contractual rights to protect their databases in the EEA instead. However, the UK will continue to provide equivalent protection in the UK for the databases of UK businesses and individuals.
Moreover, the UK has agreed that database rights that existed in the UK prior to the end of the transition period and that are owned by EEA businesses or individuals will continue to exist in the UK for the remainder of their duration, i.e. fifteen years from the completion of the database (effectively fifteen years from the end of the transition period for databases that are continuously updated). After that, EEA businesses and individuals will not qualify for database right protection in the UK.
Trade marks and designs
During the transition period, the status quo will be maintained for trade marks, both UK national trade marks and EU trade marks (EUTMs).
After that, there will be no immediate impact on the UK national trade mark system, although the UK’s trade mark laws may start to diverge from the EU’s.
However, from 1 January 2021, EUTMs will no longer protect trade marks in the UK (although they will still be available to UK individuals and businesses). Consequently, on that date, the UK will create a comparable UK trade mark for all registered EUTMs. This comparable UK mark will effectively be a clone of the EUTM, for the same sign and the same goods and services as covered by the EUTM and with the same filing and priority/seniority dates. This cloning process will happen automatically and for free, although there will be an “opt-out”. The comparable UK mark will be treated as if it had been applied for and granted under UK law.
If an application for an EUTM is pending on exit day, the applicant will have a period of 9 months (i.e. until the end of September 2021) in which to re-file for the same mark for some or all of the same goods and services, in which case they will be entitled to the same filing and priority dates as the EUTM application. The usual UK fees (£170 for marks applied for in one class, plus an extra £50 for each additional class) will apply.
UK trade marks can be revoked after an uninterrupted period of five years’ non-use in the UK. For comparable UK marks, where the five-year period includes time before 1 January 2021, use in the EU (and the UK) will be considered. Where the five-year period includes any time after 1 January 2021, only use in the UK will be taken into account. A similar system applies for the assessment of the reputation of the relevant mark: for any period before 1 January 2021, reputation of the corresponding EUTM in the EU (and the UK) will be considered.
References to existing EUTMs in any document made before the end of the transition period shall be read as including the comparable UK mark, unless there is evidence that the document was not intended to have effect in the UK.
Licences and security interests recorded against an EUTM will not automatically appear against the comparable UK mark on the UK register of trade marks but will need to be separately registered. However, the proprietor of the comparable UK mark will have 12 months, i.e. until the end of 2021, to register before any consequences of failure to register (e.g. the transaction being ineffective against third parties) will apply.
Broadly the same system applies to Registered Community Designs, as well as to International trade marks and International design registration designating the UK.
Finally, the UK will create a new UK unregistered design right called the “supplementary unregistered design”, which will mirror the scope of protection of the existing unregistered community design right. The supplementary unregistered design will be established by first disclosure in the UK, and first disclosure in the EU may be novelty destroying in the UK. Designers should therefore carefully consider the location of the first public disclosures of their designs and the impact that that might have on their design right protection.
Exhaustion of IP rights
Within the EEA, free movement of goods is achieved in respect of goods that are protected by IP rights by the doctrine of exhaustion of rights, i.e. if products are placed on market in one Member State by the IP rights holder or with its consent, the rights holder cannot use its IP rights to prevent those goods being further bought or sold within the EEA. This regime will continue for the transition period.
After the transition period, IP rights that were exhausted in both the EU and the UK before the end of the transition period will remain exhausted. However, in respect of other goods, the position will be asymmetrical. Owners of EEA IP rights could use those rights to block unauthorised imports from the UK into the EEA. However, the UK currently intends to unilaterally continue to recognise the EEA’s regional exhaustion regime, meaning that parallel imports from the EEA into the UK can continue. It remains to be seen whether this position will change following trade agreement negotiations with the EU over the course of 2020.
Data protection laws in the UK will not change substantially in the transition period as UK’s data protection laws originate from the EU under the General Data Protection Regulation (“GDPR”), as supplemented by the Data Protection Act 2018.
The European Union (Withdrawal Agreement) Act and Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“DP Exit Regulations”) incorporate the GDPR into UK law as the 'UK GDPR', with only minimal changes needed to ensure the framework functions correctly after Brexit. This means that general data protection laws will remain largely the same both in the transition period, and after it.
In contrast, there could be divergence on ePrivacy laws. The proposed Regulation on Electronic Privacy still has not been adopted and might never be incorporated into UK law.
The following most significant changes will take place post the end of the transition period:
Transfer of personal data
The transfer of personal data between the UK and the EU will experience a shift. There are two kinds of transfers which need to be examined in detail. First, the transfer of personal data outwards from the UK. The DP Exit Regulations state that the transfer to EU/EEA and Gibraltar are permitted, although this will be kept under review. The DP Exit Regulations also state that the non-EEA countries which have been granted an adequacy status by the European Commission before the exit day will be deemed adequate by the UK. Data transfers between the UK and the US can continue as long as the relevant US organisation has updated its public commitment to comply with the EU/US Privacy Shield.
However, the transfer of personal data from the EU to the UK may not be as smooth after the end of the transition period. The GDPR contains a restriction on the transfer of personal data to third countries that do not have adequate data protection laws. The UK will become a third country post the transition period, and it is not clear whether UK will be deemed to have adequate protection. The process of reaching an adequacy decision is likely to take some time (it has historically taken around at least 18 months) and it is likely that the question of adequacy will be used as a bargaining chip in wider political negotiations. It is possible that the state surveillance regime in the UK, as set out in the Investigatory Powers Act 2016, may be used as a basis for withholding adequacy, despite the very clear similarities in the protections offered by GDPR and ‘UK GDPR’.
If there is no adequacy finding, other mechanisms will be needed to transfer personal data from the EU to the UK, which are either entering into Standard Contractual Clauses or Binding Corporate Rules.
Standard contractual clauses
Entering into Standard Contractual Clauses is an administrative burden, albeit not an insurmountable one. If quick and easy processes for entry into them are not implemented, they might deter EU companies from dealing with UK companies. However, these are not unfamiliar instruments and such clauses are now broadly accepted across different industries, even if their terms (and the third-party rights conferred by them) look odd to non-EU eyes. Companies will need to think about the logistics of putting these contracts in place, e.g. use of an umbrella intra-group agreement where there are multiple dataflows between entities within global groups. The UK Information Commissioner has a Standard Contractual Clause contract builder to help automate this process.
In addition, the CJEU will rule on the validity of the Standard Contractual Clauses in 2020. If they find the Standard Contractual Clauses are not valid (contrary to the Advocate General’s opinion), it is likely that the EU Commission will issue “Standard Contractual Clauses version 2.0”. Repapering existing transfers with the new clauses will be time-consuming. The new clauses may also contain burdensome new provisions.
Binding Corporate Rules
The use of Binding Corporate Rules is one alternative to the use of Standard Contractual Clauses. However, Binding Corporate Rules only apply to intra-group transfers and getting them approved is an expensive and time-consuming business. Organisations that have a UK headquarters and rely on these rules will also need to consider the impact of Brexit.
There are a limited set of exemptions to the transfer of personal data to a third country, which include consent, performance of a contractual obligation for an occasional transfer which is necessary, public interest, establishment of a legal claim, and protection of the vital interests of an individual. However, these cover a very narrow set of circumstances and will not cover routine or commercial transfer of personal data.
Additionally, another hurdle to the free flow of personal data from the EU to the UK are several data localisation laws in Member States that require non-personal data to be kept within the EU (e.g. Belgian or Italian tax laws). The EU has adopted a Regulation on Free Flow of Non-Personal Data which allows the free flow of non-personal data in the EU. This will cease to apply to the UK after Brexit.
One-Stop Shop regulatory oversight and Data protection representatives
Post-Brexit, where a UK company offers products or services, or monitors, individuals in the EU after Brexit, it may become directly subject to the GDPR in the EU (in addition to the UK version of the GDPR). This may mean the UK company will have to appoint a representative in the EU. Similarly, where an EU company offers products or services, or monitors, individuals in the UK after Brexit, it may become directly subject to the UK version of the GDPR and will need to appoint a representative in the UK.
Moreover, since the ICO will no longer be an EU supervisory authority, UK companies will lose the benefit of the one-stop-shop which allows most data protection matters to be coordinated through a single EU regulator.
Where there are cross-border data issues affecting both the EU and the UK, it will be possible for the EU and UK regulators to issue separate and significant fines in respect of the same conduct.
See here for our article on the impact of Brexit on commercial contracts between businesses, in particular, how it might affect their ability to perform a contract, and how Brexit may give rise to issues to do with the interpretation and enforcement of contracts.
See here for our article on applicable law, jurisdiction and recognition of judgments in the UK during the transition period and beyond.
Should you have any questions regarding Brexit and its implications for IP and data protection, please contact your usual Linklaters contact.
By Kathy Berry, Pete Church and Gargi Rohi