Mills & Reeve: Technology Law Update

Four key messages about EU staff and Brexit

The recent vote in the UK House of Commons to reject the EU Withdrawal Agreement may result in additional concern for EU staff and their employers in the tech sector.

Based on our experience of providing support to organisations in this area, including running briefing sessions for EU nationals, we think there are four key messages to get across in this context:

• Reassurance– the Government has confirmed that it will run the Settlement Scheme (the Scheme that will effectively protect the rights of EU nationals currently residing in the UK) for EU nationals and their family members who are residing in the UK on or before 29 March 2019 (ie, Brexit day), even in a no deal scenario. So irrespective of the outcome of the Brexit negotiations, the rights of EU nationals and their family members currently in the UK should be preserved.  The Government has confirmed this week that no fee will be payable for applications under the Settlement Scheme (although a £65 fee will still be payable (to be later reimbursed) for applications made during the current pilot phase which opened on 21 January).   
• Recruitment– the risk of a no-deal Brexit may have increased. It is not clear what immigration system the Government will operate for EU nationals who wish to come into the UK from 30 March 2019 in a no deal scenario, although it is likely that existing rules will apply in the short-term. Importantly, the transition period that would run until 31 December 2020 which has been agreed as part of the Withdrawal Agreement would not apply. Employers who have identified a specific EU national for a role, or who have recruitment processes involving EU nationals underway, should where practicable plan to ensure that EU nationals are appointed and resident in the UK by 29 March 2019, or as soon as possible thereafter, in case of a no-deal Brexit.
• Workforce planning– it is sensible for organisations to identify the areas where they tend to recruit a significant number of EU nationals, the potential risks associated with additional recruitment barriers and costs which may come into play, and actions that can be taken to mitigate these risks.
• Sponsor licence applications and compliance – based on the recent Immigration White Paper, it seems likely that the future immigration system will involve an extension in some form of the current points based system to EU nationals. This would mean that all employers who wish to recruit EU nationals would need to register as sponsors. Getting ahead of the curve and applying now for a sponsor licence may be a prudent step – although there is no guarantee this will be required. Furthermore, the consequences for existing sponsors of having their licence revoked as a result of compliance failures may be prove to be more serious in the post-Brexit world. So ensuring a high level of compliance may be more important than ever.

The Mills & Reeve immigration team can help in advising on Brexit-related immigration issues, providing support for EU staff, and assisting with sponsor licence issues. Please get in touch with Alex Russell if your organisation requires any advice in this area.

Alex Russell, Principal Associate

Welcome changes to the ABC of Entrepreneurs’ Relief

The changes to Entrepreneurs’ Relief announced in the UK Chancellor’s Autumn Budget (discussed here) rang alarm bells for some. So-called “alphabet shares” are often used to provide flexibility on the payment of dividends. The new regime (taking immediate effect on 29 October) had the unwelcome result that ER will not be available where the board has full discretion to allocate dividends between the different share classes.  

A tightening up of the qualifying rules for this important tax relief presented a real problem for those individuals who have shares in a company that has different share classes. In the typical alphabet share approach used to provide flexibility for the payment of dividends between different shareholders, the articles of association will normally give directors discretion on how to allocate dividends. This discretion means the shareholder is not entitled to a dividend and so will not qualify for entrepreneurs’ relief.

Corrections made at this stage could have had knock-on consequences on the shares’ valuation and relating to the employment-related securities rules.

Boards and shareholders alike have welcomed proposals made on 20 December to address the problem. Under the planned changes to the Finance Bill a shareholder will benefit from ER if the shares they hold:

• Represent at least 5% of the ordinary share capital; AND
• Enable them to exercise at least 5% of the voting rights in the company, AND
• Either:
  • Gives them an entitlement to 5% of the distributable reserves and 5% of the assets on a winding up; OR
  • In the event of a disposal of the whole of the ordinary share capital of the company, entitles them to at least 5% of the sale proceeds.

The new alternative (in bold) means that alphabet shares may still be able to qualify for ER, even if they have no entitlement as such to dividends, provided the other conditions are all met for the qualifying period.

Kevin Lowe

Jail for exporter of jet parts to Iran

A retired businessperson has been found guilty of exporting military fighter jet parts to Iran, in breach of export controls. Alexander George, along with two others, Iris and Paul Attwater, were convicted for using deceptive methods to ship the parts to Iran from 2010 to 2016.

Indirect shipping of fighter jet parts

Mr George purchased the fighter jet parts in the USA, and shipped them to his various companies in Malaysia and the United Arab Emirates. These companies then shipped the parts to Iran, which is subject to trade embargoes and sanctions which prohibit the export of military or dual-use items. Dual-use items are those which could have both civilian and military uses.

After becoming concerned about being investigated by the FBI and CIA, Mr George involved Mr and Mrs Attwater in the exportation of the parts through their aviation company. However, by 2010 a number of exports by the Attwaters’ aviation company had been blocked by HMRC. HMRC interviewed Mr George twice over the exports, and all three individuals were warned about exporting the parts without a licence. Despite these warnings, the trio then attempted further concealment of the illegal exportation. They set up a new company in Holland, through which the items were shipped to Malaysia before being sent to Iran.

Tough penalties

Following an investigation and prosecution by HMRC, Mr George received a sentence of two and a half years imprisonment. Mr and Mrs Attwater, who were sentenced in 2016, each received a suspended sentence of six months imprisonment.

It has been estimated by HMRC that Mr George made profits of more than £5 million from evading export controls, and Mr and Mrs Attwater benefited to the tune of £500,000. HMRC intend to undertake proceedings to recover the profits made by the group.

A clear example of the UK’s tough export controls in action

This case highlights that UK export controls apply equally to individuals carrying out activities in the UK, and to UK nationals carrying out activities abroad. Exporters of goods or technology that may have military or internal repression uses should check carefully whether their products are covered by UK or EU export controls.

Simon Elsegood

2018 Autumn Budget - plenty on offer for tech businesses, investors and fund managers

The Autumn Budget brought some welcome news for both technology companies, and investors and fund managers in this space.

• Last year’s Budget announced an action plan to unlock investment in innovative, high-growth businesses. The Budget announced several new initiatives. These will involve the British Business Bank working with pension funds to explore options for pooled investment in patient capital. The FCA will explore ways to support patient capital, with proposals for a new long-term asset fund and to allow unit-linked pension funds to invest. The Department for Work and Pensions will consult on the pensions charge cap to ensure that performance fees are not restricted in a way that hampers investment.
• The Government has earmarked more funding to support its Industrial Strategy objectives. The Industrial Strategy Challenge Fund will receive a £1.1 billion boost. Support Is promised for a range of initiatives across AI, the digital transformation of manufacturing, future mobility, DLT and cryptoassets, quantum computing and cybersecurity.
• We are pleased to see EIS/SEIS remaining safe. Also welcome are plans to launch a new approved EIS fund structure to invest in knowledge-intensive companies (KICs) following a consultation earlier in the year.
• Entrepreneurs’ Relief will be retained, with some changes.
  • An immediate change to ER is the new requirement that shareholders must be entitled to at least 5% of the company’s distributable profits and net assets, as well as holding 5% of the  issued ordinary share capital and voting rights. The introduction of these two new conditions mean that, for the first time, shares need to have real economic rights, preventing managers being bumped up to more than 5% by the issue of voting shares with no additional economic rights. This change will apply to all sales of shares on or after the date of the Budget. However, these additional conditions will not apply on sales of shares acquired by employees on exercise of qualifying EMI share options.
  • Also, for any shares sold after 5 April 2019, ER will only be available if the shares have been held for at least 2 years (up from 12 months).
• The intangible fixed assets regime will be updated following a recent consultation. Targeted relief for the cost of goodwill in the acquisition of businesses with eligible intellectual property is planned as from April 2019. Changes to improve the de-grouping charge rules will take effect from 7 November.
• The Annual Investment Allowance for qualifying plant and machinery will see a temporary increase to £1 million for 2019 and 2020.
• R&D tax relief will be retained with minor changes aimed at preventing abusive claims. These will restrict the tax credit that a qualifying loss-making company can receive in any tax year to three times the company’s total PAYE and NICs liability for that year.

Press comment has focused on the planned new digital services tax. Although headline-grabbing, this is not relevant to smaller businesses, as it will only apply to those with annual global revenues of over £500m. 

Dona Ardeman and Neil Pearson

Why investors and directors in flourishing tech start-ups need insolvency advice

“Financial distress” is often a way of life for tech start-up businesses. The definition of insolvency under English law is where a company is unable to pay its debts when due and/or its liabilities are greater than its assets on its balance sheet. A tech start up carrying any form of debt is likely therefore to be insolvent from the start whist the product it is developing takes shape and creates value.

What are the risks for directors?

It is a common misconception that a company cannot trade whilst insolvent. That is not true. Many companies trade insolvently. What the directors need to be aware of in these circumstances is firstly the duty to act in the best interests of creditors, in priority to, but not at the expense of, the position of shareholders and the other duties set out in the companies legislation.  Breach of this duty can lead to personal liability for the directors.

Secondly, the directors need to be aware of wrongful trading – the trading of a company with no reasonable belief that the company can avoid an insolvency process. Again, falling foul of this provision can result in personal liability for the directors for the loss caused.

Having said all of that, directors can mitigate that risk, in respect of an insolvent company, by taking legal advice, which is what the courts will expect. That advice should obviously be accurate, but most importantly, it should be practical, commercial and proportionate.

Getting the right advice

I have been advising companies in the tech sector in financial distress for over 15 years now. Too often, I see advice given by those who do not have enough industry expertise, knowledge or experience and state black letter law, which provides no flexibility to the directors to do what they do best as entrepreneurs and find solutions to the financial distress that the company is facing.

Last year, I was advising a board on its route to recovery. The company’s bookkeeper introduced an insolvency practitioner to the company who advised, without all the facts, that if the directors continued to trade, they would all lose their houses! 

After having corrected that misinterpretation of the position, I helped the board over the coming weeks with advice that gave them time to find new investment in the best interests of both the creditors and shareholders, leading to the company trading out of its financial distress and enhancing value for its investors.

Investor and lender representatives are most at risk

Claims against directors under the insolvency legislation for breach of their duties and obligations are rare, but as I always say to the boards that I advise, you do not want to be the test case.  If a company goes into an insolvency process, the insolvency practitioner will be looking for the party with the deepest pockets.

This is particularly relevant to investors and lenders who have representatives on the board. In those circumstances, the insolvency practitioner is likely to believe (most probably correctly) that those representatives will have insurance and the financial support of their investor employer. 

This, coupled with the fact that the representative is likely to be experienced in the sector, makes them an immediate target.

It is therefore paramount for investors to ensure that the boards of their portfolio companies, as well as their individual representatives, are getting sound, practical, commercial and proportionate legal advice.

This is to ensure, not only that their employees are protected, but also, in times of financial distress, that the boards of their portfolio companies are given the best chance and the most time to find solutions to the problems they face to protect and enhance value for investors.

Neil Smyth

New EU-wide crowdfunding regime proposed

The EU is planning to put a new structure in place to regulate crowdfunding. The initiative seeks to iron out national rule differences and introduce a single EU-wide regime for many types of crowdfunding.

This makes a lot of sense as crowdfunding is generally run through online platforms, and confining their activity to one country makes little sense in today’s connected world. The resulting fragmentation of the EU market is thought to be holding back the growth of crowdfunding as compared to other major economies. 2016 data from the Cambridge Centre for Alternative Finance valued European crowdfunding at €7bn, compared with over €200bn for the Asia-Pacific region and €35bn for the Americas.

What are the planned changes?

The proposed legislation aims to:

• establish a one-stop-shop access to the EU market;
• provide tailored rules for European crowdfunding services providers covering both investment-based and lending-based business models;
• open up opportunities to European investors while safeguarding a high level of investor protection in relation to crowdfunding services;
• define the requirements crowdfunding service providers have to fulfil in order to achieve authorisation, and provide a single point of entry for authorisation and supervision by a single authority, the European Securities and Markets Authority (ESMA).

What activity is within scope?

The proposals are intended to apply to all crowdfunding services that offer investors a financial return, with debt and equity arrangements both covered. It would not apply to reward or donation based crowdfunding activity, however, as these are viewed as different from financial services. Also excluded is consumer lending as this has its own regulations.

There would a cap on the size of transaction that can use the system. Crowdfunding campaigns to raise a total of €1m within any year would instead fall within the scope of the Prospectus Regulation and The Markets in Financial Instruments Directive (MiFID II) rules.

This proposal forms part of the EU’s Fintech Action Plan. This ambitious project includes a series of initiatives that aim to build on and promote the success of Europe’s growing Fintech sector.

Employer liable for disgruntled employee’s deliberate data breach

WM Morrisons Supermarket plc have been held liable to 5,518 of their employees for a deliberate data breach by a rogue employee, Andrew Skelton.

Skelton had been employed by Morrisons as a senior IT auditor.  In the course of his duties he was required to collate employee data for Morrisons’ external auditors.

Unknown to his employer, Skelton extracted a copy of the data for himself, consisting of the names, addresses, gender, date of birth, phone numbers, national insurance numbers, bank sort codes and bank account numbers of 99,998 Morrisons employees.  He later uploaded this copy data onto a file sharing website.  The data remained public for two months before Morrisons were alerted to the situation and took steps to prevent access to the data.

Skelton was convicted in subsequent criminal proceedings and sentenced to 8 years’ imprisonment for offences under the Computer Misuse Act and the Data Protection Act.  In sentencing, the Crown Court observed that Skelton had uploaded the data owing to a grudge that he bore the company following an earlier disciplinary warning.  The disciplinary warning had been unrelated to data security issues.

The later High Court judgment concerns Morrisons’ civil liability to its employees.

“Primary” liability under the Data Protection Act 1998 (the DPA)

First, the court considered whether Morrisons itself had any “primary liability” to compensate its employees for the data breach under the DPA.  Subject to one exception which was found to be irrelevant to the question of liability, the judge held that Morrisons had operated appropriate control mechanisms for data security under the DPA.

Similarly, having reviewed the evidence, the judge held that no-one else at Morrisons knew or ought to have known prior to the breach that Skelton was not to be trusted with data.

The company therefore had no “primary” liability to its employees for the breach.

 “Vicarious” liability

Once Skelton unlawfully copied the data for his own purposes he became a data controller under the DPA in his own right of the copy data on the memory stick.  He had then breached his own duties under the DPA.  The second aspect of the judgment concerns whether Morrisons were “vicariously” liable for Skelton’s breaches as his employer, despite the company itself not being “at fault”. 

The judge was satisfied that Skelton’s actions were sufficiently closely connected to his employment that the legal tests for vicarious liability were satisfied.  He also held that the DPA did not exclude the possibility of vicarious liability. 

However the judge was most troubled by the argument that in finding Morrisons liable, the court was in effect rendered an accessory to Skelton’s criminal aim of damaging the company.  The judge has granted permission to appeal the finding, and media reports suggest that Morrisons will appeal.

What should organisations do?

Aside from any appeal, the court has not yet ruled on what each employee’s claim is worth.  Organisations should ensure that appropriate data security measures, policies and procedures are in place and followed to help ensure that they have a defence to a primary liability claim. Organisations should also check whether their current insurance arrangements will meet potential compensation claims (for primary and secondary liability) arising from a data breach. The Morrisons claims were advanced both under the DPA and for misuse of private information and breach of confidence.

Class action claims will continue to be a risk for organisations.  By 25 May 2018 the EU General Data Protection Regulation and UK Data Protection Bill will come into effect, replacing the DPA and including measures intended to allow representative bodies (e.g. consumer law organisations) to bring compensation claims on behalf of affected individuals.

Claire Williams

Gig economy reform - how to balance innovation and the protection of workers

The position of workers in the gig economy, those on zero hours contracts and agency workers has been the focus of political attention recently. While these models provide valuable flexibility to businesses, especially those using innovative technology like using an app or a website to hire someone for a particular task, they can leave individuals with insecure incomes and future prospects, and unprotected from exploitative companies. They can also leave the most responsible businesses at a disadvantage. 

A cross-party grouping within the UK Parliament has put forward radical new proposals on employment rights, following on from the Taylor Review published in July 2017 (discussed here and here).

Among the proposed changes are:

Greater rights for workers

• greater clarity on definitions of employment status, emphasising the importance of control and supervision of workers by a company in distinguishing between workers and the genuine self-employed
• a worker by default model. This would apply to all companies who have a self-employed workforce above a certain size
• extending the time allowance for a break in service while still accruing employment rights for continuous service from one week to one month
• all agency workers being entitled to the same treatment as permanent employees once they have completed 12 weeks’ service

More obligations for those hiring

• extending the duty of employers to provide a statement of employment conditions to workers, as well as employees, within seven days of starting a new job

Tougher enforcement

• requiring employment tribunals to consider the increased use of higher, punitive fines and costs orders if an employer has already lost a similar case
• stronger and more deterrent penalties for repeat or serious breaches, including “naming and shaming”
• more proactive enforcement.

While it is unlikely that the Bill as drafted will become law, it does reflect the Prime Minister’s stated ambition of addressing issues of unfairness and injustice in Britain’s labour market.

One small step in that direction was taken in yesterday’s budget, when Chancellor Phillip Hammond announced that the Government would be publishing an “employment status discussion paper”.  But a careful balancing act is needed to prevent exploitative employment practices without stifling innovative business models. According to the Budget policy paper  “the government recognises that this is an important and complex issue, and so will work with stakeholders to ensure that any potential changes are considered carefully.”

Workplace monitoring - how much is too much? Bărbulescu v Romania

We’re all living our lives increasingly online and leaving our digital footprints as we go. And the dividing line between home and work is blurred by remote working and use of employer-issued devices. It is much easier to track and monitor digital communications than the old paper kind. All this means that employers have the ability to see into their employees’ correspondence more than ever before. But how far can employers go in monitoring digital communications without falling foul of the law? A recent ruling of the European Court of Human Rights Grand Chamber looks at this difficult question. It provides guidance on when workplace monitoring is permissible and when it goes too far.

Respect for private correspondence

There has been a lot of comment recently on the changes to privacy law that the General Data Protection Regulation, or GDPR, will introduce next May. But this case looks at employee privacy from a more general human rights perspective. The ECHR Grand Chamber mainly deals with the European Convention on Human Rights, focusing here on Article 8 - the right to respect for private and family life, the home and correspondence. The job of the court was to find the right balance between conflicting interests – the employee’s right to respect for his private correspondence as against the employer’s right to take steps to ensure the smooth running of the business. 

What happened?

Briefly, Mr Bărbulescu had set up a Yahoo messenger account in his employer’s name which he denied using for private purposes. Employees were banned from using workplace equipment for personal purposes, and told that their “activity was under surveillance”. The employer monitored the account for a two week period and produced a transcript of some very personal communications. Mr Bărbulescu ended up being fired.

Getting the balance right

The Grand Chamber concluded that the Romanian courts had fallen short and had not given Mr Bărbulescu the protection he deserved. The case gives guidelines to tip the balance in favour of an employer:

• Give clear notice to employees, in advance, that communications might be monitored and how.
• Take care to limit the extent of monitoring to what is necessary. Differentiate between monitoring the flow of communications and their content. Limit monitoring in time, and limit those who have access to material.
• Think through your reasons for monitoring communications and accessing their content. Are these objectively justifiable to achieve a business purpose? Looking at the content of communications is intrinsically more invasive than monitoring their flow and so requires stronger reasons.
• Use the least intrusive methods necessary to achieve the business aim.
• If the result of the monitoring is serious, such as dismissal, is that fair and has it been made clear to employees?
• Give employees safeguards so that their communications cannot be accessed unless they know that this might happen.

The decision also emphasises the general point that there should be mutual trust between employers and employees.

In the UK, very similar principles are already set out in domestic law and guidance, particularly the Employment Practices Code published by the ICO. But the Grand Chamber concluded that Romanian legislation did not provide a sufficiently robust framework.

This decision reverses a lower level ruling given last year – then the European Court of Human Rights came down on the side of the employer. This just shows how difficult it can be to get the balance right.

Paul Knight

‘Smart’ and autonomous vehicle cyber guidance: Data protection considerations

On 6 August 2017, in advance of proposed legislation, the UK government published 8 ‘Key Principles’ regarding the cyber security of connected and autonomous vehicles. This is the last of a series of 4 blogs regarding those principles.

Vehicles today have multiple microprocessors and sensors that collect location and driver behaviour data (i.e. routes travelled, speed, collision data, wear and tear on components, fuel efficiency, etcetera).  That data can be analysed by smart vehicles in real time, in order that adjustments can be made to improve performance and safety.  In addition, the data can be wirelessly recovered by manufacturers or software providers, and could be used to improve infrastructure, traffic flow and methods to reduce driver error.

While incredibly useful in the world of ‘big data’, it is important to recognise that the information collected results from monitoring the actions of one or more living individuals. Looking at that data, an organisation could identify how many different users a vehicle has, where they live and work, how they drive, whether they are prone to exceeding speed limits, and even their individual entertainment preferences. An ability to ‘identify’ them in this way brings the information collected within the scope of UK data protection legislation.

Key Principle 7 governs the storage and transmission of data amassed by smart and autonomous vehicles: In particular, Key Principle 7.2 requires that “personally identifiable data” is “managed appropriately”, which will necessarily include compliance with applicable data protection law.  Collection, storage, processing and use of the data must comply with 8 Data Protection Principles set out in the Data Protection Act (DPA) 1998, and from May 2018 will need to comply with the requirements of the General Data Protection Regulation (GDPR).  Organisations need to review their data protection procedures and compliance now, to ensure that they are ready for the upcoming changes. 

Key Principle 7.3 requires that “users” must be able to delete “sensitive data” held on systems and connected systems.  Unfortunately, no definition of “user” or “sensitive data” is provided in the guidance, nor context to indicate the scope of “connected system[s]”.  It could be assumed that the guideline intends to refer to “sensitive personal data”, as defined in the DPA, but that raises the question as to why such a common and well-defined term was not used.

Sensitive personal data under the DPA notably includes data showing the “commission or alleged commission by [the data subject] of any offence”, and such information may continue to be one of the “special categories of personal data” under the UK’s implementation of the GDPR.  Assuming “user” means driver, does Key Principle 7.3 envisage a means by which a driver (being the data subject) can, at will, delete journey records showing that s/he committed speeding offences?  Or only in conformity with DPA request mechanisms?  If Key Principle 7.2  necessarily includes compliance with the DPA, Key Principle 7.3 arguably provides some form of additional right on the part of a driver, else it would be extraneous.  Clarification from the Department for Transport is needed as to the scope and intentions behind the wording provided.