London law firm Mishcon de Reya has issued a notice to its online gambling partners highlighting further Brexit concerns on data protection rights, staff employment and services contracts impacting the industry.
Online gambling has faced less friction than other sectors (travel, exports, entertainment) when adapting to the UK’s post-EU future, as the majority of operators undertook significant operational changes during the Brexit transition period.
Although the UK and EU have agreed on the terms of a ‘Trade and Cooperation Agreement’ (TCA), gambling businesses are still facing unknown outcomes for their future business relationship between the UK and Europe.
Of utmost concern, the UK and EU are yet to settle on a final ‘post-Brexit data protection regime’ – a key arrangement that governs all data transfers involved in digital trade.
At present, UK businesses have been granted a four month ‘bridging period’ – which is extendable by two months – with the EU Commission set to undertake an ‘adequacy decision’ with regards to the UK’s future technical arrangement on data transfers.
Mishcon de Reya said: “If, however, the EU does not accept that the UK’s data protection regime is adequate following the bridging period, contracts which involve the transfer of personal data from the EU to the UK may need to be revisited – to reflect the guidance issued by the European Data Protection Board, after the Schrems II decision, in relation to international data transfers.”
The London law firm upholds the recent industry warning issued by EU trade body the European Gaming & Betting Association (EGBA) which stated that the lack of a long-term agreement relating to data transfers between the UK and the EU is the ‘most concerning outstanding issue with Brexit’.
Noting potential business interruptions, Mishcon warned gambling partners to carry out an individual assessment of their ‘intra-group and external contracts’ and how they would be impacted should the EU deem the UK’s data protection regime as inadequate.
“Businesses should also consider the extent to which they will continue to transfer personal data across UK and EU borders,” it said. “If processing operations in relation to a customer take place in both the EU and the UK/Gibraltar, there is a risk that any data protection breach could result in overlapping investigations, and two sets of fines.”
Despite the UK securing a TCA with the EU, which ensures ongoing tariff-free trade on goods, Mishcon underlined that gambling businesses must understand that the UK will be treated as a third country outside of EU member state arrangements.
Mishcon advised its partners to ensure that they safeguard employment contracts, as operators should be prepared for the “fact that employees may not be able to relocate across the EU border without encountering some degree of friction”.
Echoing wider business concerns, Mishcon stated that operators should revise their existing professional service contracts which cover the EU, as the ‘TCA is largely silent on services’.
Although a number of professional services arrangements are still subject to ongoing UK and EU negotiations, future outcomes may be determined by each individual state in how they choose to accommodate UK business.
Mishcon closed its statement by encouraging partners to make themselves aware of potential changes to business ‘tax residency rules’, as member states will likely argue that “a business with a majority of directors in a particular EU state is tax resident in that state”.