Implications of Brexit for tech sector employers

Following the Brexit vote on 23 June, there is uncertainty as to what comes next. Adam Hartley, UK head of employment for law firm DLA Piper explains what firms need to consider now

Following the Brexit vote on 23 June, there is uncertainty as to what comes next. Much depends on the government's Brexit strategy and the EU's approach to negotiations with the UK.

Although there are no immediate changes to employment or immigration law because of the referendum, organisations should take steps to facilitate changes that may become necessary in the longer term.

For tech sector employers, two areas likely to be of concern are first, what the new UK/EU immigration rules will be and second, what will happen to data protection rules.

Immigration
UK tech businesses have benefited from the free movement of workers across the EU which has allowed them access to a wide pool of skills, talent and experience. Brexit could well diminish access to this pool if, for example, new visa requirements make it difficult to recruit EU nationals and because individuals will prefer to work in mainland Europe, where their movement will be unrestricted.

As immigration was a hot topic during the Brexit debate, freedom of movement is likely to be central to UK/EU negotiations. What the outcome of the immigration negotiations will be is the million dollar question. Although the answer cannot be predicted, there are three options which will almost certainly be discussed, each with a different consequence for the future of UK immigration:

• UK leaves the EU but remains in the EEA or EFTA - here the UK would probably have to allow EU nationals to work in the UK because EEA/EFTA membership is likely to require free movement.

• UK leaves EU but applies an amnesty for EU nationals currently in the UK - the amnesty may allow permanent residence to all EU nationals currently in the UK, or only to those who have been resident for a certain length of time.

• UK leaves EU and operates a points-based system for EU citizens - individuals would require sponsorship by a UK employer and have to meet certain criteria to be allowed to work in the UK.

Although it will be some time before final UK/EU immigration rules are set, there are steps employers can take now to prepare for change:

• Evaluate the workforce to ensure the business has a clear picture of the immigration status of its workforce. Areas relying heavily on migrant workers can be identified and contingencies can be swiftly implemented once the new rules are clear.

• Apply for a sponsor licence or extend an existing licence. Currently licenced UK employers can sponsor skilled non-EU workers, subject to meeting certain criteria. Businesses should review existing sponsorship arrangements and consider seeking a new or amended licence in anticipation of the licence system applying to EU nationals.

• Review the status of existing EU employees. EU nationals may be eligible to apply for British citizenship or leave to remain. Employers should discuss this with key employees who may be able to secure their immigration status under existing rules.

Data protection
Compliance with data protection rules is a significant concern in the technology sector. Avoiding regulatory breaches in relation to customer data is often the focus of compliance activity, but businesses must recognise that the regime also requires protection of employee data.

Before 23 June, the new EU General Data Protection (GDPR) was big news, heralding a new dawn in data protection, with far-reaching consequences for businesses including in their role as employers. The referendum means that the UK will ultimately need to consider the effect on the GDPR. However, businesses should assume that compliance will still be required and plan according.

This is because (i) GDPR comes into force in May 2018, when the UK will probably still be an EU member; (ii) if the UK joins the EEA, GDPR compliance will be required; (iii) even outside the EEA, substantial compliance with GDPR principles will be required if UK businesses do EU/EU data transfers.

Steps to plan for this new data protection regime include implementing an effective governance function; auditing data flows to be clear about the purposes and legal basis for data processing; and implementing organisation-wide training so all staff are aware of good practice requirements in relation to business data.

In summary, although the landscape is currently uncertain, there are steps that can be taken to prepare for the UK leaving the EU. In addition, a watching brief should be kept on Brexit developments and the business impact so plans can be implemented and adapted.

Adam Hartley is UK head of employment at law firm DLA Piper