1.
© Allen & Overy 2016
Employment, data protection, and
data transfers
Sarah Henchoz, Charlotte Mullarkey and Sarah Garvey
November 1, 2016
Brexit Webinar Series
Presented in partnership with
the U.S. Chamber of Commerce

2.
© Allen & Overy 2016 22
Brexit webinar series 2016 – Programme Agenda
1
Brexit: Understanding the context and consequences of the UK
referendum vote
Tuesday, 18
October 2016
2 Trade, tariffs, and taxes
Tuesday, 25
October 2016
3 Employment, data protection, and data transfers
Tuesday, 1
November 2016
4 Antitrust, intellectual property, and environmental regulations
Tuesday, 8
November 2016
5 Commercial contracts
Tuesday, 15
November 2016
6 Securing the best legal framework for your businesses
Thursday, 17
November 2016

3.
© Allen & Overy 2016 3
Employment

4.
© Allen & Overy 2016 4
Where we are now
Nothing has
changed yet
UK must serve formal notice to withdraw from
EU – expected to happen by end March 2017
Notice will trigger 2-year exit negotiation
period (which may be extended)
Purpose is to agree terms of UK’s withdrawal
from, and future relationship with, EU
UK will exit when an agreement is reached or
(if no agreement) at end of 2-year period (in
first quarter 2019)
EU laws/free movement rights continue to
apply until point of exit
BUT Article 50 litigation may affect this
process and timeline

5.
© Allen & Overy 2016 5
Brexit raises inevitable employment concerns

6.
© Allen & Overy 2016 6
But it is still business as usual for employers
No short-term
employment law
changes expected
No immediate action is
required
Wait and see how things
develop
But plan ahead to be
prepared

7.
© Allen & Overy 2016 77
Speak to the business and to employees
Secure an HR place
on your in-house
Brexit team
Engage with employees to reassure
them (if appropriate)
– Consider what you can say in light of
what is known
– Individual v collective communication
– Form of communication (face-to-face,
e-mail, FAQ documents)
There may be separate
legal duties to inform/
consult employee
reps/employees

8.
© Allen & Overy 2016 88
Check who you have where
− When do they end or how can they be terminated?
− Has repatriation been promised and, if so, is there a
home country job to return to?
− Risk exposure in event of early termination?
Audit your European expatriate workforce
Review UK-inbound and outbound expatriate arrangements
Check workers’ current immigration status
Reconsider/delay pending arrangements if in doubt
Include workers in (and from) EEA Member States and Switzerland

9.
© Allen & Overy 2016 99
Take steps to secure workers’ immigration status
The shape of future immigration policy is uncertain
Proposed points-based immigration system apparently rejected
Work permit system is an option being considered
Consider bringing workers to the UK now
Encourage those who are eligible to apply for permanent residence
Applying for citizenship may also be an option for some
Possible exemptions for European bankers and highly-skilled businessmen/women
System will be reciprocal (i.e. corresponding UK/EU and EU/UK controls)

10.
© Allen & Overy 2016 1010
Anticipate skills and service gaps
− Relocation of business
− Downsizing of business
− Reorganisation/efficiency changes
Possible business model changes
Possible employee implications
− Relocation of jobs/repatriation of workers
− Redundancies
− Cost-saving/efficiency measures
− Changes to terms and conditions
− Recruitment to fill gaps
− Incentivising key employees to retain them

11.
© Allen & Overy 2016 1111
EU law is likely to remain influential in the longer
term
Unravelling EU rules from UK
legislation is likely to be a long and
politically-fuelled process
Rights may be contractual – employee
consent may be necessary to
change/remove them
ECJ rulings are already embedded in
UK case law
Government may be reluctant to
change some EU law-derived rights
anyway
UK likely to have to keep similar
employment law standards to maintain
strong EU trading relations

12.
© Allen & Overy 2016 1212
What else does the PM have in mind?
“…we’re going to have not just consumers
represented on company boards, but employees as
well.”
“… I want to make shareholder votes on corporate
pay not just advisory but binding. I want to see more
transparency, including the full disclosure of bonus
targets and the publication of “pay multiple” data: that
is, the ratio between the CEO’s pay and the average
company worker’s pay.”
Theresa May, 11 July 2016

13.
© Allen & Overy 2016 13
Data Protection and data transfers

14.
© Allen & Overy 2016 1414
Data Protection - At a glance
There is no immediate change to either UK (or European) data protection
laws as a result of the UK referendum result
Based on the current timetable, the GDPR will apply for a period before the
UK’s formal exit from the EU
Until we know how Brexit is approached many questions will remain
unanswered…
It is expected the UK will adopt a data protection law which is the same as (or
very close to) the GDPR, to ensure the UK is considered “adequate” for the
purposes of data exports from the EU (or less likely join the EEA )

15.
© Allen & Overy 2016 1515
What is the immediate impact of Brexit?
C
No impact
on data
exports
outside
EU/UK
UK data
protection law
continues to
apply
No impact on
data transfers
within UK/EU
Article 29
Working
Party
Opinions
still apply
Court of Justice
of the EU
decisions still
apply (e.g.
Google Spain)
ICO continues as UK
data protection
regulator
– ICO guidance still
applies

16.
© Allen & Overy 2016 1616
Will the EU’s General Data Protection Regulation still
apply from 2018?
EU General Data Protection
Regulation will apply from 25
May 2018
The UK’s exit from the UK is
expected to take two years
from the start of the process
We don’t expect that process
to start until end March 2017
although timings may change
It seems the GDPR may
apply for a period before the
UK’s exit

17.
© Allen & Overy 2016 1717
Will the EU’s General Data Protection Regulation still
apply from 2018?
– The General Data Protection Regulation, the EU’s new data protection
law, is a Regulation – this means it will be directly applicable in the UK for
so long as the UK remains part of the EU. From the date of the UK’s exit
from the EU, the GDPR will no longer apply in the UK, unless the UK
– joins the EEA; or
– enacts a law similar to the GDPR into UK law.
GDPR will not apply within the UK, unless…
– The Data Protection Act 1998 is a UK Act of Parliament, not an EU law
– It implements an EU Directive (Directive 95/46/EC)
– The Data Protection Act 1998 will continue to apply unless and until
repealed by the UK Parliament

18.
© Allen & Overy 2016 1818
Are there any circumstances in which UK businesses
will be subject to the GDPR?
Offering goods and
services into the EU
GDPR applies
(extra-territorial
effect)
Monitoring
behaviour of data
subjects in the EU

19.
© Allen & Overy 2016 1919
What does this mean in terms of GDPR
implementation across a multinational business?
– GDPR applies to any controller or
processor:
– with an establishment in an EU
Member State; and
– which is processing personal data in
the context of the activities of that
establishment,
regardless of whether that processing
takes place within the EU or not
– For multinationals with establishments
across both the UK and EU member
states, this means the GDPR will still
apply to those establishments.
– In the UK, good practice and ICO
guidance is already aligned with
requirements which are formalised in the
GDPR
– It is likely to make sense to continue to
plan to apply the GDPR across both the
UK and EU.
GDPR will apply to a business established within EU

20.
© Allen & Overy 2016 2020
What will be the status of cross-border data transfers
between the EU and the UK?
European data
protection laws
restrict the transfer
of personal data to
“third countries”
outside the EU/EEA
Unless it joins the EEA,
the UK will become a
“third country” and
transfers of personal
data to the UK will be
restricted
Free flow of
personal data is
critical to trade

21.
© Allen & Overy 2016 2121
What options are open to the UK to avoid restrictions
on transfers of personal data to the UK?
Member
State
EEA state
Seek
adequate
status
Adequate countries:
Andorra, Argentina
Canada, Faroe Islands
Guernsey, Isle of Man
Israel, Jersey
New Zealand
Switzerland, Uruguay
US Privacy Shield?
EEA countries:
Norway
Lichtenstein
Iceland
Model contracts
Consent
Other derogations

22.
© Allen & Overy 2016 2222
What would the UK need to do to achieve “adequate”
status for the purposes of data transfers?
Adequacy –
at discretion of
the European
Commission
CJEU in
Schrems
Adequacy =
equivalence
GDPR
(art. 45)
Take account of
rule of law, data
protection rules,
effective data
subject rights,
cross-border
transfer rules,
effective
authorities, etc.
Directive
(art. 25)
Takes account of
all circumstances,
including rules of
law, professional
rules and security
measures
The bar
has been
raised over
time
Is the UK likely to be considered adequate given the UK’s surveillance laws?

23.
© Allen & Overy 2016 2323
Latest statements from the UK government and ICO
“…We will be members of the EU in 2018 and therefore it
would be expected and quite normal for us to opt into the
GDPR and then look later at how best we might be able to
help British business with data protection while
maintaining high levels of protection for members of the
public..”
The Secretary of State Karen Bradley MP
“I acknowledge that there may still be questions about
how the GDPR would work on the UK leaving the EU but
this should not distract from the important task of
compliance with GDPR by 2018. We’ll be working with
government to stay at the centre of these conversations
about the long term future of UK data protection law and
to provide our advice and counsel where appropriate.”
Elizabeth Denham, UK Information Commissioner, 31 October 2016

24.
© Allen & Overy 2016 2424
Brexit webinar series 2016 – Programme Agenda
1
Brexit: Understanding the context and consequences of the UK
referendum vote
Tuesday, 18
October 2016
2 Trade, tariffs, and taxes
Tuesday, 25
October 2016
3 Employment, data protection, and data transfers
Tuesday, 1
November 2016
4 Antitrust, intellectual property, and environmental regulations
Tuesday, 8
November 2016
5 Commercial contracts
Tuesday, 15
November 2016
6 Securing the best legal framework for your businesses
Thursday, 17
November 2016

25.
© Allen & Overy 2016 2525
Contacts
Sarah Henchoz
Partner
Employment – London
Tel +44 20 3088 4810
Sarah.henchoz@allenovery.com
Sarah has considerable experience advising clients on the full range of both contentious and non-
contentious employment matters. She regularly advises clients on the complex and sensitive
issues arising out of the acquisition of a business and the harmonisation of that business into the
wider corporate structure both locally and cross border. This involves advising on implementing
new service agreements and benefit packages for senior executives, employee and trade union
consultation, and post-completion integration. Sarah also regularly appears in and advises clients
on Employment Tribunal matters, particularly in the areas of discrimination and whistleblowing,
and in respect of bonus claims. She also has significant experience of managing cross-border
projects
Sarah is also a regular contributor to employment journals and is frequently quoted in the press
most recently being interviewed on BBC London News in relation to the Brexit vote.

26.
© Allen & Overy 2016 2626
Contacts
Charlotte Mullarkey
PSL Counsel
Corporate – London
Tel +44 203 088 2404
Charlotte.mullarkey@allenovery.com
Charlotte is a PSL Counsel in Allen & Overy's London TMT group. She has significant
experience in, amongst other things, arrangements for the exploitation of intellectual property,
issues relating to data protection and cyber security, outsourcing and procurement transactions,
IT/technology law, and system build and integration agreements.
Charlotte assists the commercial/outsourcing group with complex research, training (internal
and external) and legal know-how support on transactions. She is a regular speaker on the data
protection conference and roundtable circuit with particular expertise in the GDPR. She writes
many articles and blogs on data protection issues and is currently one of the four IAPP London
KnowledgeNet Chairs.

27.
© Allen & Overy 2016
27
Contacts
Sarah Garvey
Counsel
Litigation – London
Tel +44 (0)20 3088 3710
sarah.garvey@allenovery.com
Sarah is an experienced litigator with particular expertise in conflict of laws, state immunity issues
and EU laws. She regularly advises clients on topics such as governing law, jurisdiction, immunity
and arbitration. Sarah is part of Allen & Overy's core Brexit team and has been heavily involved in
advising clients on the legal implications of Brexit. Sarah is Chair of the Law Society's EU
Committee and sits on the Lord Chancellor's Advisory Committee on Private International Law.
Sarah edits the Forum Chapter of Butterworths' Encyclopaedia of Banking and is secretary to
Allen & Overy's Global Legal Opinions Committee. Sarah is a Board Member of the London
Women's Forum.

28.
© Allen & Overy 2016
Contacts
28
Marjorie Chorlins
Vice President, European Affairs
+1 202-463-5305
mchorlins@uschamber.com
Garrett Workman
Director, European Affairs
+1 202-463-5639
gworkman@uschamber.com
The U.S. Chamber of Commerce's European Affairs team champions a
pro-business agenda across Europe and in Washington to expand
commercial opportunities for members by advancing open and
competitive markets, economic growth, and transatlantic cooperation.

29.
© Allen & Overy 2016 2929
Questions?
These are presentation slides only. The information within these slides does not
constitute definitive advice and should not be used as the basis for giving definitive
advice without checking the primary sources.
Allen & Overy means Allen & Overy LLP and/or its affiliated undertakings. The term
partner is used to refer to a member of Allen & Overy LLP or an employee or consultant
with equivalent standing and qualifications or an individual with equivalent status in one
of Allen & Overy LLP’s affiliated undertakings.