Legal Headwinds: Quarterly Report Q2 2020...Legal Headwinds: Quarterly Report – Q2 2020 Headwind topic Region Principal issue This quarter Looking ahead Relevant to Relevant Subsector

Legal Headwinds: Quarterly Report – Q2 2020

Legal Headwinds focuses on key legal and regulatory developments relevant to clients operating in the asset management sector in the UK and Ireland. We also cover significant developments more generally within the EU.

Rather than being a retrospective analysis, the report looks at future developments this quarter and beyond (based on information available as at 31 March 2020) and it is not intended to be exhaustive.

This document (and any information accessed through links in this document) is provided for information purposes only and does not constitute legal advice in any of the jurisdictions covered. Professional legal advice should be obtained before taking or refraining from any action as a result of the contents of this document.

This document has been created using the following criteria: Priority: Red; Amber and Green. Region: UK; EU; Ireland and Global Relevant Sectors: Asset Managers. Relevant Subsectors: Asset Managers: Hedge funds; Institutional managers; Private equity; Sovereign wealth; Service Providers and Private Clients.

Headwind topic Region Principal issue This quarter Looking ahead Relevant to Relevant Subsector

Priority

AIFMD

Imposes EU wide regime for oversight of alternative investment funds and managers

Annex IV reporting period for quarterly reporting AIFMs with information to report ended on 31 March 2020 - reports must be submitted to regulators by 30 April 2020

01 April 2020 - Delegated Regulation amending safe keeping duties of depositaries of AIFs and UCITS to apply

Asset managers

All

G

AIFMD

Cross border distribution of collective investment funds

ESMA to open consultations on Level 2 and Level 3 measures under Cross-border Distribution Regulation

02 August 2021 - new legislation on cross-border distribution of collective investment funds to apply

Asset managers

All

A

//180-40/AM05 JOPO(LDNL38083) 1 STANDARDS:5005v11

http://www.elexica.com/en/Resources/Microsite/AIFMD-toolkithttp://www.elexica.com/en/Resources/Microsite/AIFMD-toolkit

Legal Headwinds: Quarterly Report – Q2 2020 Headwind topic Region Principal issue This quarter Looking ahead Relevant to Relevant

Subsector Priority

AIFMD

Integrating sustainability risks and factors

European Commission to continue consideration of ESMA Final Report on technical advice in respect of integration of sustainability risks and sustainability factors in UCITS Directive and AIFMD

European Commission to adopt measures in due course in light of ESMA advice

Financial institutions

Asset managers

Wholesale banks

Retail banks and other consumer credit providers

Hedge funds

Institutional managers

Service providers

A

AIFMD

Liquidity stress testing 30 September 2020 – ESMA guidelines on liquidity stress testing in UCITS and AIFs to apply


Asset managers

Wholesale banks


Hedge funds


Service providers

A

AIFMD

Review of working of AIFMD Late Q3 or early Q4 2020 - European Commission report and consultation on review of AIFMD expected to be published – delayed as result of COVID-19 pandemic


Asset managers

Wholesale banks


Hedge funds

Institutional

managers

Service

providers

A


http://www.elexica.com/en/Resources/Microsite/AIFMD-toolkithttps://www.esma.europa.eu/sites/default/files/library/esma34-45-688_final_report_on_integrating_sustainability_risks_and_factors_in_the_ucits_directive_and_the_aifmd.pdfhttp://www.elexica.com/en/Resources/Microsite/AIFMD-toolkithttp://www.elexica.com/en/Resources/Microsite/AIFMD-toolkit


Subsector Priority

AML Directives 4+5

Irish implementation of the AMLD4’s requirements on beneficial owners of corporate entities

Central Register of Beneficial Ownership of Companies and Industrial and Provident Societies (the “RBO”) is open

By 10 March 2021 - central registers of Member States required by AMLD5 to be interconnected

All All

R

AML Directives 4+5

Irish implementation of the AMLD4’s requirements on beneficial owners of trusts

Irish trustees to put procedures in place to collect beneficial ownership information.

Central register of beneficial ownership for trusts to be set up by 10 March 2020, but this has been delayed

By 10 March 2021 - Member States’ registers required to be interconnected

All All

R

Anti-Money laundering

Fifth Money Laundering Directive (5MLD)

Following publication of final text in Official Journal on 19 June 2018, European governments to start preparations for implementation

By 10 January 2020 - EU Member States to have implemented 5MLD

All All

R


Sixth Money Laundering Directive (6MLD)

Directive 2018/1673 (6MLD) was published in the Official Journal of the EU on 12 November 2018

Following publication, 6MLD came into force on 2 December 2018

EU Member States to start preparations for implementation of 6MLD

By 3 December 2020 - EU Member States to have implemented 6MLD

All All

G


COVID-19 risks Authorities emphasising need to be vigilant of new AML risks. The European Banking Authority has issued Guidance on mitigating financial crime risks during the pandemic.

Financial Institutions, Asset Managers

Financial Institutions, Wholesale Banks, Retail Banks, Fintech, Institutional Managers, Service providers and

R


http://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/01-money-launderinghttp://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/01-money-launderinghttp://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/080118-cfi-fifth-money-laundering-directivehttp://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/080118-cfi-fifth-money-laundering-directivehttps://ec.europa.eu/home-affairs/sites/homeaffairs/files/what-we-do/policies/european-agenda-security/20180417_directive-proposal-facilitating-use-information-prevention-detection-investigation-prosecution-criminal-offences_en.pdfhttp://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/01-money-launderinghttp://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/01-money-launderinghttp://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/01-money-launderinghttp://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/01-money-launderinghttps://eba.europa.eu/sites/default/documents/files/document_library/News%20and%20Press/Press%20Room/Press%20Releases/2020/EBA%20provides%20additional%20clarity%20on%20measures%20to%20mitigate%20the%20impact%20of%20COVID-19%20on%20the%20EU%20banking%20sector/Statement%20on%20actions%20to%20mitigate%20financial%20crime%20risks%20in%20the%20COVID-19%20pandemic.pdfhttps://eba.europa.eu/sites/default/documents/files/document_library/News%20and%20Press/Press%20Room/Press%20Releases/2020/EBA%20provides%20additional%20clarity%20on%20measures%20to%20mitigate%20the%20impact%20of%20COVID-19%20on%20the%20EU%20banking%20sector/Statement%20on%20actions%20to%20mitigate%20financial%20crime%20risks%20in%20the%20COVID-19%20pandemic.pdfhttps://eba.europa.eu/sites/default/documents/files/document_library/News%20and%20Press/Press%20Room/Press%20Releases/2020/EBA%20provides%20additional%20clarity%20on%20measures%20to%20mitigate%20the%20impact%20of%20COVID-19%20on%20the%20EU%20banking%20sector/Statement%20on%20actions%20to%20mitigate%20financial%20crime%20risks%20in%20the%20COVID-19%20pandemic.pdf


Subsector Priority

Anti-Money Law Commission Consultation Government to consider recommendations Current SARS regime likely to be overhauled to All All laundering on the SARS regime made by Law Commission eliminate over-defensive reporting, reduce

number of reports and increase their usefulness to law enforcement agencies

A Law Commission recommends creation of Advisory Board including private sector

representatives to create standard form SAR and monitor effectiveness

Benchmarks

EU Benchmarks Regulation Financial Wholesale

Regulation following LIBOR rate-setting revelations

establishing legislative framework regulating production and use of indices serving as benchmarks

Institutions Banks Retail Banks and other consumer credit providers

Insurance G

Asset managers

Hedge funds


Service providers


http://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/01-money-launderinghttps://www.lawcom.gov.uk/document/anti-money-laundering-the-sars-regime/http://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/190619-suspicious-activity-reports-law-commission-publishes-reporthttp://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/01-money-launderinghttps://www.lawcom.gov.uk/document/anti-money-laundering-the-sars-regime/http://www.elexica.com/en/legal-topics/crime-fraud-and-investigations/190619-suspicious-activity-reports-law-commission-publishes-reporthttp://www.elexica.com/~/media/Files/Articles/2015/Asset%20management/Legislative%20trackers/Benchmark%20Legislative%20Tracker.pdfhttp://www.elexica.com/~/media/Files/Articles/2015/Asset%20management/Legislative%20trackers/Benchmark%20Legislative%20Tracker.pdfhttp://www.elexica.com/~/media/Files/Articles/2015/Asset%20management/Legislative%20trackers/Benchmark%20Legislative%20Tracker.pdfhttp://www.elexica.com/~/media/Files/Articles/2015/Asset%20management/Legislative%20trackers/Benchmark%20Legislative%20Tracker.pdfhttp://www.elexica.com/~/media/Files/Articles/2015/Asset%20management/Legislative%20trackers/Benchmark%20Legislative%20Tracker.pdf



Priority

Benchmarks Regulation of benchmarks in UK 01 May 2020 - Benchmarks Regulations 2018 By end-Q3 2020 –issuance of cash products linked Asset Hedge funds Regulation following LIBOR misconduct transition period ends: (i) Article 63S RAO to sterling LIBOR to cease managers Institutional following LIBOR investigation activity to become only regulated activity relating managers rate-setting to benchmarks; (ii) Articles 63O to 63R of 07 December 2020 – SMCR to apply to Service revelations Regulated Activities Order (current regulated

activities relating to benchmarks) to be revoked; and (iii) Section 22(1A)(b) and (6) of FSMA to be repealed

benchmark administrators

2020 –steps to be taken to demonstrate that compounded SONIA is easily accessible and usable

providers

By Q1 2021 – framework to be established for transition of legacy LIBOR products, to significantly reduce stock of LIBOR referencing contracts

G

To end of 2021 - LIBOR to be sustained

By 01 January 2022 – third country benchmark administrators need to be approved through recognition/ endorsement regimes, where

Benchmark Regulation equivalence decision does not apply to them

Capital Markets

Prospectus Regulation (EU) Q2 2020 – final version of ESMA guidelines on Financial All

Union 2017/1129 a new Regulation to modernise and overhaul

disclosure requirements expected Institutions

Prospectus regime – applies from 21 July 2019

Asset Managers

All

All issuers of, investors in and other market participants in relation to capital markets products, in particular equities, corporate bonds and securitisation s

A


http://www.elexica.com/~/media/Files/Articles/2015/Asset%20management/Legislative%20trackers/Benchmark%20Legislative%20Tracker.pdfhttp://www.elexica.com/~/media/Files/Articles/2015/Asset%20management/Legislative%20trackers/Benchmark%20Legislative%20Tracker.pdfhttp://www.elexica.com/~/media/Files/Articles/2015/Asset%20management/Legislative%20trackers/Benchmark%20Legislative%20Tracker.pdfhttp://www.elexica.com/~/media/Files/Articles/2015/Asset%20management/Legislative%20trackers/Benchmark%20Legislative%20Tracker.pdfhttp://www.elexica.com/~/media/Files/Articles/2015/Asset%20management/Legislative%20trackers/Benchmark%20Legislative%20Tracker.pdfhttp://www.elexica.com/en/legal-topics/capital-markets/03-capital-markets-union-knowledge-centrehttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R1129&from=ENhttp://www.elexica.com/en/legal-topics/capital-markets/03-capital-markets-union-knowledge-centrehttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R1129&from=EN



Priority

Capital Markets Union

Amendments to UK legislation to reflect the implementation of the new Prospectus Regulation (EU)

Financial Institutions

All

2017/1129 Asset All Managers 21 July 2018 - The Financial Services and Markets Act 2000 (Prospectus and Markets in Financial Instruments) Regulations 2018 entered

into force

G 21 July 2019: The Financial

Services and Markets Act 2000 (Prospectus) Regulations 2019

enter into force

The Official Listing of Securities, Prospectus and Transparency

(Amendment etc) (EU Exit) Regulations 2019 (SI 2019/707) Capital Markets

Securitisation Regulation (EU) 13 April 2020 – ESMA consultation period ends Level 2 measures continue to be developed Financial Wholesale

Union 2017/2402 introduces a single on guidelines on securitisation repository data Institutions Banks uniform regulatory framework

for securitisation and also creates a new class of simple, transparent and standardised (STS) securitisation

completeness and consistency thresholds Q1 2021: Joint Committee of ESAs to publish report on a) implementation of STS requirements (b) actions that Competent Authorities have undertaken (c) functioning of due diligence and transparency requirements and level of transparency of securitisation market in European

Retail Banks and other consumer credit providers Fin-tech

Securitisation Regulation (EU) Union, and (d) risk retention requirements Wealth 2017/2402 of 12 December 2017 apply from 01 January 2019 (SR) Asset All R Managers Capital Requirements Amending Regulation (CRR Amending

Regulation) (EU) 2017/2401 recalibrates calculation of risk weights for securitisation positions and introduces lower risk weights for STS securitisations

CRR Amending Regulation (EU) 2017/2401 of 12 December 2017

All originators and sponsors of, investors in and other market participants in relation to securitisation


http://www.elexica.com/en/legal-topics/capital-markets/03-capital-markets-union-knowledge-centrehttp://www.elexica.com/en/legal-topics/capital-markets/03-capital-markets-union-knowledge-centrehttp://www.legislation.gov.uk/uksi/2018/786/contents/madehttp://www.legislation.gov.uk/uksi/2018/786/contents/madehttp://www.legislation.gov.uk/uksi/2018/786/contents/madehttp://www.legislation.gov.uk/uksi/2018/786/contents/madehttp://www.legislation.gov.uk/uksi/2018/786/contents/madehttp://www.legislation.gov.uk/uksi/2019/1043/contents/madehttp://www.legislation.gov.uk/uksi/2019/1043/contents/madehttp://www.legislation.gov.uk/uksi/2019/1043/contents/madehttp://www.legislation.gov.uk/uksi/2019/707/contents/madehttp://www.legislation.gov.uk/uksi/2019/707/contents/madehttp://www.legislation.gov.uk/uksi/2019/707/contents/madehttp://www.legislation.gov.uk/uksi/2019/707/contents/madehttp://www.elexica.com/en/legal-topics/capital-markets/03-capital-markets-union-knowledge-centrehttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R2402&from=ENhttps://www.esma.europa.eu/sites/default/files/library/esma33-128-827_cp-guidelines_on_securitisation_repository_data_completeness_and_consistency_thresholds.pdfhttp://www.elexica.com/en/legal-topics/capital-markets/03-capital-markets-union-knowledge-centrehttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R2402&from=ENhttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R2401&from=ENhttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R2401&from=ENhttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R2401&from=EN



Priority

apply from 01 January 2019 s CCP - Central Counterparty Clearing Houses - Recovery and Resolution Regulation

In November 2016, the European Commission adopted a proposal for new rules for Central Clearing Counterparties (CCPs) Recovery & Resolution

The European Parliament has adopted a first reading position and on 27 November 2019 Council adopted a political compromise text for a mandate to commence negotiations with the European Parliament

Trilogues expected to take place Trilogues to continue but date of application currently unclear


Asset Managers

All

All

G

Central Securities Depositories

Regulation on improving securities settlement and regulating central securities depositories (CSDR)

CSDR officially entered into force on 17 September 2014

Level 2 measures for CSD requirements (except technical standards on settlement discipline) published in Official Journal and apply from 30 March 2017

ESMA has published a proposal to delay the date of entry into force of Commission Delegated Regulation (EU) 2018/1229 on settlement discipline to 01 February 2021 (currently 13 September 2020)

01 January 2023 - Article 3(1) of Regulation, under which relevant issuers must arrange for relevant securities to be represented in book-entry form, to apply to transferable securities issued after that date

01 January 2025 – Article 3(1) to apply to all other transferable securities


Asset Managers

All

All

All

Issuers of, holders of, and those entering into transactions regarding, securities held in settlement systems

G


http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//NONSGML+TA+P8-TA-2019-0300+0+DOC+PDF+V0//ENhttps://www.consilium.europa.eu/media/41614/st14540-ad01-en19.pdfhttps://www.consilium.europa.eu/media/41614/st14540-ad01-en19.pdfhttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32014R0909&from=ENhttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32014R0909&from=ENhttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32014R0909&from=ENhttp://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32014R0909&from=ENhttps://www.esma.europa.eu/sites/default/files/library/esma70-151-2895_final_report_-rts_settlement_discipline_postponement.pdfhttps://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32018R1229&from=ENhttps://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32018R1229&from=EN



Priority

Central Securities Depositories

Amendments to domestic legislation through the Central Securities Depositories Regulations 2014 (SI 2014/2879)

28 November 2017 - The Central Securities Depositories Regulations 2017 (SI 2017/1064) entered into force

The Central Securities Depositories (Amendment) (EU Exit) Regulations 2018 (SI 2018/1320)

03 April 2020 - Closing date for responses to Bank of England's consultation setting out proposals for an operational resilience framework for CSDs


Asset Managers

All

All

CSDs, CCPs, trading venues and any entities that provide internalised settlement

R

CMA - bond market investigation

CMA investigating four banks in relation to suspected cartel in bond-trading market

CMA has not yet reached a view as to whether there is sufficient evidence of an infringement of competition law for it to issue a statement of objections to any of the parties under investigation

CMA to decide whether there are sufficient grounds to issue statement of objections


Asset Managers

All

R

Competition - Market study into audit sector

CMA launched a market study into the statutory audit sector in October 2018. CMA published final report in April 2019, which identified significant shortcomings in audit quality and issues with market entry. CMA recommends to government that it make significant changes, including mandatory joint audit requirements and operational splits between the Big Four

Department of Business Energy & Industrial Strategy (BEIS) launched an initial consultation on recommendations by CMA in July 2019, which closed on 13 September 2019

BEIS to consider CMA’s recommendations and enact new legislation or regulation if appropriate

Plans to reform the audit sector by introducing joint audits look increasingly likely to be scrapped as incumbent Conservative party believed to be abandoning its support


Asset Managers

All

R


http://www.legislation.gov.uk/uksi/2014/2879/contents/madehttp://www.legislation.gov.uk/uksi/2014/2879/contents/madehttp://www.legislation.gov.uk/uksi/2014/2879/contents/madehttp://www.legislation.gov.uk/uksi/2017/1064/pdfs/uksi_20171064_en.pdfhttp://www.legislation.gov.uk/uksi/2017/1064/pdfs/uksi_20171064_en.pdfhttp://www.legislation.gov.uk/uksi/2017/1064/pdfs/uksi_20171064_en.pdfhttp://www.legislation.gov.uk/uksi/2018/1320/introduction/madehttp://www.legislation.gov.uk/uksi/2018/1320/introduction/madehttp://www.legislation.gov.uk/uksi/2018/1320/introduction/madehttp://www.legislation.gov.uk/uksi/2018/1320/introduction/madehttps://www.bankofengland.co.uk/-/media/boe/files/paper/2019/operational-resilience-central-securities-depositories.pdf?la=en&hash=9DF4590296B1475E4F03CEB3C8D186F51889C1DE


Subsector Priority

Competition - Market study into investment platforms

FCA published its Investment Platforms Market Study final report and accompanying Consultation Paper 19/12 on 14 March 2019

Report set out FCA’s findings and package of measures to help consumers who invest through investment platforms more easily find and switch to the right one for them

FCA to consider responses to consultation and may issue formal consultation later this quarter

FCA issued Policy Statement on simpler transfers. Rules become effective 31 July 2020

Asset Managers

All

R

Consumer credit Regulatory responsibility for consumer credit was transferred to FCA in April 2014. Consumer Credit Act provisions were repealed, and others replaced by FCA rules. Current review is aimed at simplifying the regime

Spring 2020 - Interim Report following MS19/1: Credit Information Market Study due to be published

6 April 2020 - new rules on publication of pricing information under the Overdraft Pricing and Competition Remedies (PS19/25) come into force

6 April 2020 – pricing rules under High-cost Credit Review: Overdrafts (PS19/16) come into force

H1 2020 – FCA to publish response to GC19/3


Asset Managers

All

All

R

Consumer credit Consumer Credit (Temporary Covid-19 Support Measures) Order 2020

Firms are expected to offer a temporary freeze of payment for up to three months on loans, credit cards, a 0% interest rate on overdrafts up to £500 and to ensure that the credit rating of consumers, using these services, is not affected

Q2 2020 - FCA measures to support consumer credit products under financial stress due to the COVID-19 pandemic to take effect

Relief measures to be withdrawn as COVID-19 related financial issues overcome


Asset Managers

All

All

R


https://www.fca.org.uk/publication/market-studies/ms19-1-1.pdfhttps://www.fca.org.uk/publication/market-studies/ms19-1-1.pdfhttps://www.fca.org.uk/news/press-releases/fca-proposes-temporary-financial-relief-customers-impacted-coronavirushttps://www.fca.org.uk/publication/policy/ps19-16.pdfhttps://www.fca.org.uk/publication/guidance-consultation/gc19-03.pdfhttps://www.fca.org.uk/publication/guidance-consultation/coronavirus-covid-19-credit-card-instrument-2020.pdf


Subsector Priority

Consumer protection

Fitness Check of six major EU consumer protection laws, including Unfair Terms Directive and Unfair Commercial Practices Directive

The review found the Directives fit for purpose overall, but that they should also be better applied

On 11 April 2018, European Commission adopted New Deal for Consumers package, including two Proposals for Directives

17 January 2020 - Regulation on cooperation between national authorities responsible for enforcement of consumer protection laws to apply

Trilogue negotiations for Directive on collective redress to take place

28 November 2021 – Deadline for EU member states to adopt measures complying with Enforcement and Modernisation Directive

28 May 2022 – Deadline for application of measures implementing Enforcement and Modernisation Directive


Asset Managers

All

All

A

Consumer protection

Department for Business, Energy and Industrial Strategy (BEIS) review of terms and conditions, including civil fining powers for unfair terms


Asset Managers

All

G

Corporate governance

Women on Boards Draft Directive

European Commission proposal for draft directive on gender equality on boards of listed companies in EU, published on 14 November 2012

Timetable unknown All All

EU listed companies G


http://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reforms



Priority


Directive which amends EU Shareholder Rights Directive (SRDII)

4 September 2018, European Commission published final implementing regulation on minimum requirements and standardised formats to be used when an issuer asks for information to identify its shareholders and for sending information between issuer and its shareholders through intermediaries, with a view to harmonising practices across Member States

Member States to implement most provisions of SRDII into national law by 10 June 2019

See UK implementation and Narrative reporting below

10 September 2020 - SRD II provisions on identification of shareholders and communication with shareholders to apply

3 September 2020 - Implementing regulation to apply

All All

R


UK Implementation of SRD II.

Some of the changes applied from 10 June 2019 and some for the financial year beginning on or after 10 June 2019. See:

“SRD2 - are you ready?” for the new obligations on, among others, MiFID firms, AIFMs, UCITS ManCos and self-managed UCITS.

“SRD II: UK implementation: new related party transaction regime” for an overview of the new related party transaction regime.

“SRD II: UK implementation of remuneration changes” for the directors’ remuneration changes.

All All

R


General meetings and board meetings

Companies need to consider how they can hold general meetings given the requirement to social

All All R


http://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/legal-topics/corporate-governance-and-compliance/280219-lets-get-more-engagedhttp://www.elexica.com/en/legal-topics/corporate-governance-and-compliance/280219-lets-get-more-engagedhttp://www.elexica.com/en/legal-topics/corporate-governance-and-compliance/280219-lets-get-more-engagedhttp://www.elexica.com/en/legal-topics/corporate-governance-and-compliance/280219-lets-get-more-engagedhttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttps://www.simmons-simmons.com/en/publications/ck0b4gb5tnw2w0b36rbdon4o8/050619-srd2-are-you-readyhttps://www.simmons-simmons.com/en/publications/ck0beoja47hva0b947yei58qm/050619-srd-ii-uk-implementation-new-related-party-transaction-regimehttps://www.simmons-simmons.com/en/publications/ck0a24c1gmx930b36ywwgyl1e/030719-srd-ii-uk-implementation-of-remuneration-changeshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reforms



Priority

distance 28 March 2020, UK Government

announced that it intends to introduce legislation to ensure that companies that are required by law to hold AGMs, will be able to do so safely and in a way which is consistent with the restrictions on movement and gatherings that have been introduced to address the spread of COVID-19.

Legislation to introduce these changes will be introduced in Parliament at the earliest opportunity and provisions will be included to enable the changes to be extended if necessary

Companies should also refer to ICSA’s Guidance about AGMs and impact of COVID-19 and its supplemental guidance here

Companies will also temporarily be extended greater flexibility, including in relation to holding

AGMs online or postponing meetings

28 March 2020, ICSA published

Guidance on good practice in the conduct of virtual board and committee meetings


New corporate governance reporting rules.

17 July 2018, UK Government published new corporate governance reporting requirements (Companies (Miscellaneous Reporting) Regulations 2018) to implement its well-publicised corporate governance reforms to

New regulations apply to financial years beginning on or after 1 January 2019 and companies will have to report on these regulations in 2020. One exception is that the requirement for companies to illustrate impact of share price increases on executive pay outcomes applies to any new remuneration policy introduced from 1 January 2019.

New regulations require disclosure of::

All All

make directors more accountable

UK Government has also published guidance on these regulations in the form of Q&A which were updated in November 2018

UK incorporated quoted companies with more than 250 UK employees - ratio of CEO’s total remuneration to median (50th), 25th and 75th percentile of full time equivalent remuneration of company’s UK employees, together with certain supporting information

R

22 October 2018, GC100 published guidance on directors’ duties under section 172 Companies Act 2006 and stakeholder consideration

All UK incorporated quoted companies - effect of future share price growth on executive pay outcomes


https://www.icsa.org.uk/knowledge/resources/agms-and-impact-of-covid-19https://www.icsa.org.uk/knowledge/resources/agms-and-impact-of-covid-19https://www.icsa.org.uk/knowledge/resources/agms-and-impact-of-covid-19https://www.icsa.org.uk/knowledge/resources/agms-and-impact-of-covid-19https://gbr01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flinks.fromcounsel.com%2Fls%2Fclick%3Fupn%3DbQ7ncU6cLD7mn-2B3PJhYqgLmOMBe-2B-2BCIltyT3MZ1lyGov0DZ6g7PsXmkI6mdZKWFLhYmlJXu4zuqwzuB8l6rPI4lp4hec3Ye4TJJa-2BTkuFcp2JBJTuMWlZ-2By7yViZb3Gj78Rc-2BlzRtULCzOtCvJLmmfTGph3gZGXFLaaRH9B24SWxC4OjBnPjFuDLxuG7i3dHDcMk7xZbVbygIHrdHO4Rfg-3D-3DhbSv_vse59GTSsAiBPQlQLah5EnMt5GjQLK4-2BSMvLdCTd3GP9Gzy-2FvM-2FOqQtEQHvUmOTxHL01mqygJXA31icMuLGjKjjNBROv1xgMKu-2FglEdVcIQrlyIkeLcl7XAbw0sR22oJYWm-2FQ4mAoq3wybKb-2F1tjyTxL5DTN9KDC82DSJAD9JAFR5WeRvNtoHCXk40KeQ9oyIbtRM0wt5zUI2vwXh7HyVfg3WytuV6yYGkuLT3z4Ba84ZBhR5QIJ7A1FjASP6yWi&data=02%7C01%7Cjo.weston%40simmons-simmons.com%7C3eb97300ec4043b9688b08d7d4673ed2%7C9c0035ef4799443f8b14c5d60303e8cd%7C0%7C0%7C637211412211542512&sdata=1EG4FHAOYZociwXiRC4MDmegut6W%2Fjo4XHqyvEeGNFo%3D&reserved=0http://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reforms



Priority

7 December 2018, GC100 and Investor Group published an updated version of the Directors’

Large companies – (i) statement explaining how directors have complied with duty to have regard to matters in s.172(1)(a) to (f) Companies Act

Remuneration Reporting Regulations Guidance to reflect these regulations. A further revised version was published on 22 July

2006 and (ii) statement summarising (in more detail) how directors had regard to need to foster business relationships with suppliers, customers and others.

2019 that replaces the 2018 version

UK incorporated companies with more than 250

UK employees - summary of how directors have engaged with employees.

Corporate Revised UK Corporate Governance 2018 Code applies to financial years beginning FRC expected to update Guidance on Audit All All governance Code

16 July 2018, revised UK Corporate Governance Code and FRC Guidance on Board Effectiveness published

27 November 2018, FRC published

on or after 01 January 2019 so first reporting against revised Code in 2020 unless adopted earlier or one of provisions companies were expected to follow in 2019. (The FRC expected companies to follow the new provisions on explanations during 2019 where significant votes were cast against resolutions and to develop future remuneration policies and changes to existing ones by reference to new version of the

Committees to reflect 2018 Code in due course. FRC will also make consequential changes to Guidance on Risk Management and Internal Control and Related and Financial Business Reporting and will consider whether further changes are needed in light of various investigations following Carillion’s collapse

Main Market companies

FAQs on the 2018 Code Code and the Guidance on Board Effectiveness)

9 January 2020, FRC published its annual review of the Code which assesses reporting against the 2016 UK Corporate Governance

Code as well as early adoption of the 2018 Code. FRC is expecting:

i. companies to be clearer about their R

‘purpose’ and to consider it alongside culture and strategy;

ii. more details on how companies have assessed and monitored culture;

iii. information on the methods used to understand the views of the workforce and how companies have considered and, if appropriate, taken forward matters raised by the workforce;

iv. the section 172(1) statement to cover the concerns raised by stakeholders, how companies understood their issues and how they thought about the impact on the long-term success of the company;

v. for board re-elections, the reasons why


http://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttps://www.frc.org.uk/getattachment/53799a2d-824e-4e15-9325-33eb6a30f063/Annual-Review-of-the-UK-Corporate-Governance-Code,-Jan-2020_Final.pdfhttps://www.frc.org.uk/getattachment/53799a2d-824e-4e15-9325-33eb6a30f063/Annual-Review-of-the-UK-Corporate-Governance-Code,-Jan-2020_Final.pdf



Priority

the director’s contribution is, and continues to be, important to the longterm success of the company;

vi. more detailed commentary on all aspects of diversity (not just women);

vii. more detail on how the remuneration committee have engaged with the workforce and the effect of that engagement; and

viii. how companies are aligning existing directors’ pension contributions with those of the workforce.


Insolvency and corporate governance.

Further consultation awaited All All

26 August 2018, Government response to its consultation paper setting out proposals to improve corporate governance of firms in or approaching insolvency published

Legislation for these changes will be introduced in Parliament at the earliest opportunity and provisions will be included to enable the changes to be extended if necessary

See Changes to UK insolvency law to protect companies impacted by COVID-19

4 November 2019, the House of Commons' Business, Energy and Industrial Strategy (BEIS) Committee published a letter to the Secretary of State for the Department of BEIS setting out a

series of recommendations concerning, among other things, corporate governance, audit reform and executive pay and bonuses following its inquiry into the collapse of Thomas Cook

A

28 March 2020, the Secretary of

State for Business, Energy and Industrial Strategy announced

measures to support businesses following the coronavirus outbreak which include proposed changes to the insolvency rules


http://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttps://www.simmons-simmons.com/en/publications/ck8ehngyu0ye7091490jya4b8/changes-to-uk-insolvency-law-to-protect-companies-impacted-by-covid-19https://www.simmons-simmons.com/en/publications/ck8ehngyu0ye7091490jya4b8/changes-to-uk-insolvency-law-to-protect-companies-impacted-by-covid-19



Priority


Dividend payments.

25 May 2019, IA published a report on the extent to which UK listed companies seek shareholder approval for dividend payments (“Shareholder Votes on Dividend Distributions in UK Listed Companies: The case for a Distribution Policy”). As a result of its findings (which showed that more than 22% did not hold annual votes on payment of dividends) the IA recommends that all listed companies should publish a ‘distribution policy’ to enable shareholders to engage on their approach. This policy should set out their long-term approach to returns to shareholders, including dividends, share buybacks and other capital distributions

IA to establish a working group to develop best practice guidance on this distribution policy, which had been expected to be published in Autumn 2019

All All

A


Board evaluations 5 July 2019 - The Chartered Governance Institute consultation on the effectiveness of the independent board evaluation process closed. This review is being carried out at BEIS’ request following its response to its consultation on insolvency and corporate governance referred to above. Response awaited

All All

A


http://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reforms



Priority


Corporate governance for large private companies

New corporate governance reporting regulations (see above) require certain large private companies to state:

i. which corporate governance code (if any) they have applied in a relevant financial year

ii. how they applied it; and

iii. any aspects they departed from and the reasons for doing so.

If no corporate governance code has been applied for the financial year, then the company must instead explain the reasons for that decision and what corporate governance arrangements were applied

10 December 2018, The Wates Corporate Governance Principles for Large Private Companies published (following consultation in June 2018). The Wates Principles can be applied to meet this requirement

Regulations apply to financial years beginning on or after 1 January 2019 so first reporting in 2020

All All

Large private companies

R


IA Public Register

The 2018 Corporate Governance Code provides that, when 20% or more of votes are cast against the board recommendation for a resolution, a company should:

i. when announcing results, explain what actions it intends to take to consult shareholders to understand reasons for result;

Register to be updated on ongoing basis throughout year

All All

Listed companies

R





Priority

ii. publish an update on views received from shareholders and actions taken no later than six months after vote;

iii. provide final summary in annual report, or explanatory notes to resolutions, on whether the board has taken any action or proposed new resolutions as a result of feedback.

The IA, which maintains public register, has published guidance setting out what investors expect to see in any update statement


Kingman Review.

18 December 2018, BEIS published final report of independent review of FRC led by

5 February 2020, FRC published a draft plan and budget for 2020-2021 for consultation (with a deadline for comments of 28 February 2020). Response awaited

All All

Sir John Kingman

11 March 2019, BEIS published a press release and initial consultation on recommendations in the Kingman review report. As recommended, the government proposed replacing the FRC with a new independent regulator, the

The draft plan sets out the FRC's initial response to the Kingman review and the transitional steps it is taking before the Kingman recommendations come into effect

A Audit, Reporting and Governance Authority (ARGA) with stronger

powers

18 December 2019, the Kingman

Review final report was published. It includes 83 recommendations,

including that the FRC be replaced as soon as possible with a new independent regulator, the Audit, Reporting and Governance

Authority that would be accountable to Parliament





Priority

19 December 2019, the Queen’s speech set out the government’s proposals to develop a stronger regulator with powers to reform corporate reporting and audit sector


Executive Remuneration.

In 2019, IA expecting pension contributions to current directors to be reduced over time to equal rate that workforce receive; and investors to “red top” companies who pay new directors pension contributions not in line with

The letter highlights the areas of focus for 2020 AGMs: alternative remuneration structures, discretion on vesting outcomes, pensions, post- employment shareholding requirements, levels of remuneration and pay for performance.

For companies with financial year that end on or after 31 December 2019, IA’s IVIS will from start of 2020 AGM season:

By end of 2022 - IA members expect remuneration committees to set out a credible action plan to reduce pension contributions of all executive directors to same level of contributions as majority of workforce receive

All All

contributions to majority of company’s employees

1 November 2019, the Investment Association (IA) published updated Principles of Remuneration and a letter to the remuneration committee chairs of FTSE 350 companies

The Principles have been updated to reflect current best practice and evolving views of IA members including the impact of remuneration on wider stakeholders, approach to leavers, long term incentives and alignment of performance conditions with the company strategy

i. ‘amber top’ any company when an existing director has a pension contribution of 25% of salary or more provided there is a credible plan;

ii. ‘red top’ any company with an existing director who has pension contribution of 25% of salary or more, and there is no credible plan;

iii. ‘red top’ any company who appoints a new executive director or a director changes role with pension contribution out of line with majority of workforce, or seeks approval for new remuneration policy which does not explicitly state that any new director will have their pension contribution set in line with majority of workforce.

Companies are also expected to disclose, in their remuneration report, the pension contribution rate that they consider is given to the majority of the workforce

R





Priority


Executive Remuneration New requirement for certain companies to report ratio of CEO’s remuneration to UK employees’ remuneration applies to financial years beginning on or after 1 January 2019 so reporting in 2020. (See New corporate governance reporting regulations above.)

All All

R


Executive Remuneration – share buybacks

19 July 2019, the UK Government published a research paper (Share repurchases, Executive Pay and Investment), prepared by PwC, on the findings of the buyback review that it had been asked to carry out. The research looked at any connections between executive pay incentives and share buybacks, and between share buybacks and investment levels. The research found no significant relationship between share repurchases and either the existence of an EPS condition or the proportion of an incentive award linked to that condition within executive pay incentives and share repurchases. It also did not find a systematic relationship between share repurchases and corporate investment

Report will now be followed by research into the potential for a direct link (rather than through the use of buybacks) between the existence of executive pay targets and investment levels in companies. This research will investigate the extent to which pay incentives and performance targets can result in short-termist executive decision-making. Research awaited

All All

A


UK Stewardship Code

24 October 2019, 2020 Stewardship Code published. Key changes for asset managers are:

i. a clear benchmark for stewardship - stewardship is now defined as “the responsible allocation, management and oversight of capital to create long- term value for clients and

The 2020 Code takes effect on 01 January 2020 and applies to reporting years beginning on or after 01 January 2020. The Code continues to be voluntary and asset managers and asset owners wanting to be signatories must publish their first Stewardship Report by 31 March 2021. (The FRC has removed the requirement for a Policy and Practice Statement on signing up to the 2020 Code.)

Read Stewardship & Sustainability: the revised UK Stewardship Code for more information

All All

R


http://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttps://www.simmons-simmons.com/en/publications/ck2m5eymbwcry0b71b2g972ze/stewardship-sustainability-the-revised-uk-stewardship-codehttps://www.simmons-simmons.com/en/publications/ck2m5eymbwcry0b71b2g972ze/stewardship-sustainability-the-revised-uk-stewardship-code


Subsector Priority

beneficiaries leading to sustainable benefits for the economy, the environment and society”

ii. extended scope – the 2020 Code now covers asset

owners (such as pension funds and insurance companies) and service providers as well as asset managers

iii. annual reporting – asset managers will have to report annually on their stewardship activities in the previous year and what the outcome was, including how they engaged with the assets they invested in

(Stewardship Report) iv. ESG factors (including

climate change) – environmental, social and governance factors must be taken into account in all stewardship activities and signatories must ensure their investment decisions are aligned with the needs of their clients

v. stewardship across all asset classes – signatories are now expected to explain how they exercised stewardship across all asset classes (not just listed equity). Other asset classes include fixed income, private equity and infrastructure and investments outside the UK

vi. organisation’s purpose, investment beliefs,




Priority

strategy and culture required – signatories are required to explain what these are and how their governance, resourcing and staff incentives help with them. This aligns the 2020 Code with the UK Corporate Governance Code.


FCA/FRC stewardship discussion paper

Feedback Statement (FS19/7) published in response to the FCA and FRC discussion paper (DP19/1)

All All

A


Stakeholder engagement

21 February 2020, PLSA published its Stewardship Guide and Voting Guidelines 2020

19 November 2019, Institutional Shareholder Services (ISS) published its updated UK and Ireland Voting Guidelines for the 2020 proxy season, which apply to shareholder meetings on or after 01 February 2020

PIRC has also published its UK Shareowner Voting Guidelines 2020 which apply now.

All All

R


Corporate directors

Provisions on prohibition of corporate directors under Small Business, Enterprise and Employment Act 2015

Provisions originally expected to come into effect in October 2016 - implementation delayed and timing unknown

All All

G


http://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reformshttp://www.elexica.com/en/resources/microsite/corporate-governance/uk-corporate-governance-reforms



Priority


Transparency

2 August 2019, UK Government published a research paper on the review of the implementation of the PSC register. The research paper explores the costs, benefits, and overall effectiveness of the PSC register in promoting transparency. It was commissioned to inform the government’s post-implementation review of the PSC regulations

30 October 2019, UK Government published its report on post-implementation review of the PSC regulations. The report concludes that the PSC register is meeting its objectives and that the costs to business have been proportionate and in line with the original estimates. The register is widely used, has a positive economic effect and contributes to the fight against criminal use of companies

The report notes the importance of ensuring the reliability of the PSC Register information. This is being considered and will be addressed as part of the wider review of the corporate transparency and register reform

The PSC Regulations will, therefore, remain in their current form and the next statutory post-implementation review will be carried out within the next 5 years

Response awaited to BEIS consultation on proposals to reform company law to increase the accuracy and usefulness of information available at Companies House

Most measures will need primary legislation and significant changes to systems and processes at Companies House so will take several years to deliver

All All

G





Priority


Board diversity Investment Association has published its Shareholder Priorities for 2020. The four areas of particular importance for this year, as they are considered to be key drivers to long term value, are responding to climate change, audit quality, stakeholder engagement and employee voice and diversity

On diversity it says that IVIS will red top any FTSE 350 company where:

i. women represent 20% or less of the board;

ii. there is one or less women on the board (unless the one third target is achieved ie a board of three directors); or

iii. women represent 20% or less of the Executive Committees and their direct reports.

For FTSE Small Cap companies, IVIS will amber top any company where women represent 25% or less of the Board; there is one or less women on the Board (unless the one third target is achieved); or women represent 25% or less of the Executive Committees and their direct reports

All All

R


Board diversity: Hampton Alexander annual Review.

21 February 2019, IA announce that IVIS will (i) ‘red top’ FTSE 350 companies that have no women or a single woman on their board; and (ii) ‘amber top’ FTSE 350 companies not on course to meet Hampton-Alexander review requirements by 2020.

15 March 2019, IA and Hampton- Alexander Review press release announces that they have written to 69 FTSE 350 companies which have no women on their board

Recommendations of Hampton-Alexander third report (November 2018) to be followed now

Recommendations are that FTSE 350 companies’ targets are:

33% of board positions to be held by women by end of 2020, and;

33% of women on FTSE 350 executive committees and direct reports to executive committees by 2020

FTSE 350 to increase number of women in role of chair, senior independent director and executive positions on board by 2020

All All

R




Subsector Priority

asking them to outline the action they are taking to ensure they meet the Hampton-Alexander targets by

2020

13 November 2019, the fourth report into progress with the

Hampton Alexander Review’s recommendations was published

8 February 2020, government announced that 33% of all FTSE

100 board members are now women, up from 12.5% less than a decade ago and meaning that a key target of the Hampton

Alexander review has been met. But the announcement also notes

that further work is needed for many FTSE 100 companies individually, and for the FTSE 250 overall to meet the 33% target, as it currently sits at 29.5%

FRC, in its response to this announcement, notes that, as part of the strengthened UK Corporate

Governance Code,,FRC expects companies to clearly set out how they plan to develop their diversity pipeline with much improved reporting, including progress towards any measurable targets. It states that its "recent review of early adopters reporting against the

Code found far too many had limited reporting on diversity, which included how they plan to tackle the lack of women in senior leadership positions. Those companies that did report well had clear plans to meet diversity targets

- beyond just gender - and understood the long-term value diversity brings




Priority


Board diversity. Parker Review encourages FTSE 350 companies to adopt the recommendations on a voluntary basis

5 February 2020, Parker Review Committee published an updated report (Ethnic Diversity Enriching Business Leadership) which includes detailed data both on the current profile of FTSE 350 boards and on ethnic diversity reporting.

The recommendations in the first report remain the key targets

The report also includes 'Questions for Directors' and 'The Directors’ Resource Toolkit' to assist boards

Recommendations are: FTSE 100 to have at least one director of colour by 2021 and FTSE 250 by 2024

All All

A




Subsector Priority

Cross-border

Following its Consumer Financial 19 April 2020 – providers of currency conversion In context of review of Payment Accounts Financial All

payments - regulation

Services Action Plan, in March 2018, the European Commission adopted a proposed Regulation amending the Cross-border Payments Regulation to reduce charges for cross-border transactions in Member States..

services at ATMs and point of sale to disclose information about cost of transaction and offer customer choice of paying in the payee's currency

Directive:

European Commission to analyse behavioural, legal, and commercial obstacles preventing consumers from switching providers

Institutions

Asset Managers

All

The Regulation was published in the OJ on 29 March 2019 and applied from 15 December 2019

19 April 2021 – card issuers to send electronic messages to payers informing them of currency conversion charges

19 April 2021 – payment service providers to inform payer about cost of currency conversions in connection with online-initiated credit transfers

19 April 2022 – European Commission to submit to the European Parliament, the Council, the ECB and the European Economic and Social

G

Committee a report on the application and impact of the Regulation

In context of review of Cross-border Payments

Regulation: European Commission to consider: i. extending the equal charge rule to all Union

currencies;

ii. improving transparency and comparability of currency conversion charges; and

iii. disabling and enabling the option of accepting currency conversion by parties other than the payer's payment service provider

Cybersecurity

"Directive on Security of Network and Information Systems" ("NIS

UK Government guidance issued for DSPs indicates that in a “no deal” Brexit scenario EU’s

All All

Directive") entered into force on 08 NIS Directive would continue to apply post-Brexit August 2016

In the UK, the Directive has been implemented via the Network and

(including the NIS Regulations in UK) and advises DSPs to prepare for eventuality that they may be required to designate representatives in EU Member States where they offer services

G

Information Systems Regulations 2018 (the “NIS Regulations”) which

came into force on 10 May 2018


http://www.elexica.com/en/legal-topics/data-protection-and-privacy/01-cybersecurity


Subsector Priority

NIS Regulations apply to critical organisations within society

(Operators of Essential Services (“OESs”)) as well as online

marketplaces, online search engines and cloud computing services (Digital Service Providers,

“DSPs”). The NIS Regulations are designed to ensure the availability of systems and networks for such organisations

NIS Regulations describe OESs as providers of essential services only in the following subsectors: electricity, oil, gas, air transport, water transport, road transport, healthcare, drinking water supply and distribution, and digital infrastructure. Threshold requirements further limit the entities that are likely to be in scope of the NIS Regulations to only the most significant service providers in those sectors

Main points for UK organisations to consider are as follows:

(i) Overlap with the EU’s General

Data Protection Regulation – Notification requirements,

provisions on security and data protection responsibilities of OESs and DSP’s.

(ii) Security provisions that a

DSP must have in place when interacting with any organisations ranging from business continuity, audit provisions and incident handling processes



Subsector Priority

(iii) Incident notification

requirements for DSPs where interruption exceeds set thresholds. All incident reports should be submitted to the relevant Competent Authority within 72 hours

(iv) Under NIS Regulations penalties of up to £17 million could be imposed for non-compliance relating to security and incident reporting requirements

ICO (the designated relevant

Competent Authority for DSPs) has generally limited its approach to post-incident oversight and attempted to ensure that there is no “double jeopardy” in relation to acts that may also lead to a fine under GDPR

ICO Guidance states that ICO does regulate OESs and DPSs, but only in the context of data protection law where they are acting as data controllers (under GDPR)

ICO has clarified that as the NIS and GDPR are separate laws it is possible to be fined twice for regulatory action under both.

However, ICO states that any action it takes will be proportionate and in line with sentiment of avoiding “double jeopardy” where possible

Political Declaration on UK’s withdrawal from the EU (published on 22 November 2018) provides for




Priority

thematic co-operation with EU in areas of cyber-security, but is subject to ratification by the UK

Parliament and any conclusion of a withdrawal agreement between the

UK and the EU (a “deal” Brexit) Data protection -

EU General Data Protection UK and other EU businesses to seek to follow Businesses should continue to assess and All All

GDPR Regulation (“GDPR”) came into force on 25 May 2018. On the same day, the Data Protection Act 2018 (“DPA 2018”) also came into force in the UK. DPA 2018 supplements the GDPR in the UK, adding some exemptions to rights of data subjects, and additional lawful bases for processing special categories of personal data

In November 2018, Information Commissioner’s Office (“ICO”) issued guidance on encryption to provide further understanding of its approach towards assessing interpretation of appropriate technical and organisational measures to protect personal data that is held by data processors or controllers. As well as summarising different forms of encryption currently available, guidance outlines possible risks, and details some recommendations for storing and transmitting personal data

local data protection guidance (either via national implementing laws or guidance issued by national data protection supervisory authorities) in relation to implementation of GDPR within different EU Member States

evaluate their data processing activities to ensure compliance with the principles set out within the GDPR, in particular including those that relate to the lawful processing of personal data, data minimization and fair processing information requirements

Businesses should also consider relevant enforcement action taken under the GDPR by their “lead supervisory authority” or data protection regulators within the EU that are relevant to their business to ensure that they adequately assess the risk of enforcement in relation to specific data processing activities

R

In December 2018, ICO published further guidance including:

(i) Updated guidance on some of the basic concepts forming the foundations of the GDPR (e.g. transparency and implementing “privacy by design”)


http://www.elexica.com/en/legal-topics/data-protection-and-privacy/01-data-protection



Priority

(ii) How the DPA 2018 works (iii) Which regime within the DPA 2018 applies (i.e. the

provisions relating to all data controllers and/or processors or those relating exclusively to law enforcement processing)

In January 2019, ICO published updated guidance on data protection impact assessments

(“DPIAs”). Guidance sets out the circumstances in which a DPIA is mandatory and confirmed that, when determining whether there is a high risk in relation to processing, the controller should carry out a

DPIA if it is in any doubt about level of risk. In March 2019, ICO also updated its guidance on the “right to be informed” (i.e. the right to receive certain “fair processing information” set out under Articles

13 and 14 GDPR)

ICO also expanded its guidance on contracts, controllers and processors and contracts and liabilities

Data protection -

In a “no deal” Brexit scenario, the The UK withdrew from the EU on 31 January Businesses should continue to monitor Brexit All All

Brexit UK Government has clarified that it will continue to allow the free flow of personal data in “outbound” transfers from the UK to the EEA

2020. There is now a transition period until 31 December 2020 while the UK and EU negotiate additional arrangements. During this period EU law will continue to apply to and within the UK

developments up to the end of the transition period in order to assess and manage any uncertainties contemplated by a “no deal” Brexit scenario

(or any other country that has already received a European Commission “adequacy” decision)

On Brexit, “inbound” personal data transfers from the EEA-UK will trigger the GDPR’s requirement to provide “adequate safeguards” when transferring personal data to

UK/EU businesses should continue to monitor developments of negotiations on the UK’s withdrawal from the EU in relation to the regulation of EU-UK personal data transfers following 31 December 2020, when UK will become a “third country” for purposes of personal data transfers under GDPR

At present, there is no indication of any potential extension to the transition period as a result of the current COVID-19 situation, but businesses are well-advised to continue to monitor announcements from both the UK Government and the EU Commission on this point

R




Subsector Priority

a third country outside the EEA. In practice, these can be secured by the entry into European

Commission approved standard contractual clauses

European Commission approved standard contractual clauses for transfers by a processor to a controller do not currently exist. As such, how transfers from an EEA processor to a UK controller can be legally secured following a “no deal” Brexit is a key area of ongoing uncertainty

Existing Binding Corporate Rules

(“BCRs”) authorised by the ICO will continue to be recognised in UK domestic law, but the ICO will no longer have a role in the EU BCR community. Once the UK leaves the European Union, the ICO will continue to be able to authorise new BCRs under UK domestic law, but UK entities may need to identify an alternative EU supervisory authority to authorise the use of

BCRs within the EU

In a “deal” Brexit scenario, the UK will be treated as part of the EU for data protection purposes until, at the earliest, 31 December 2020 (unless the transition period as agreed within the withdrawal agreement is extended any further than currently envisaged, given that the negotiation timetable has been extended). The Political

Declaration (published 22 November 2018) issued as part of

the proposed negotiated withdrawal agreement between the

UK and the EU states that the



Subsector Priority

parties are committed to ensuring a high level of personal data protection to facilitate the flow of information between them. It suggests:

i. UK will be establishing its own international transfer regime;

ii. European Commission is due to start the adequacy assessment as soon as possible after the UK’s withdrawal; and

iii. both parties will endeavour to complete these activities by 2020.

EDPB Guidance has been issued in February 2019 in relation to the regulation of non-EEA data transfers in a “no deal” Brexit scenario. Guidance notes that EU

Commission approved standard contractual clauses will remain a valid method of transfer from EEA to the UK once UK becomes a

“third country” post-Brexit. Such clauses should not be modified, and where any “tailored” standard contractual clauses are used, these must be authorised by a competent national authority, following an opinion of the EDPB. The guidance also reconfirms the UK government’s approach in continuing to permit the free flow of personal data from the UK to the

EEA post-Brexit Data protection The Online Harms White Paper,

published in April 2019, sets out the UK government’s plans for a world-leading package of online safety measures

Businesses should continue to monitor developments of this consultation. The UK Government intends to publish the full response to the consultation in spring 2020. In the meantime, it intends to publish interim codes of

All All

R




Subsector Priority

practice over the coming months on tackling The White Paper proposes online terrorist and child sexual exploitation and establishing in law a new duty of abuse. These codes will be voluntary and are care towards users, which will be intended to bridge the gap until the new overseen by an independent

regulator. UK businesses will be held to account for tackling a comprehensive set of online harms, ranging from illegal activity and content to behaviours which are harmful but not necessarily illegal

regulatory framework becomes operational

The White Paper aims to set clear expectations of businesses and particularly, social media companies. The new regulatory framework that the Paper describes will set clear standards to help organisations ensure safety of users while protecting freedom of expression, especially in context of harmful content or activity that can be particularly damaging to children and other vulnerable users. Businesses will be encouraged to develop and share new technological solutions rather than complying with minimum requirements

It proposes that the regulatory framework should apply to businesses that allow users to share or discover user-generated content or interact with each other online. This encompasses a wide range of companies of all sizes.

Every organisation within the scope will be required to:

i. fulfil their duty of care; iv. comply with information

requests from the regulator;



Subsector Priority

and iii. where appropriate establish

and maintain a complaints and appeals function which meets the requirements set out by the regulator.

A consultation, which ran from 8

April 2019 to 1 July 2019, aimed to gather views on various aspects of government’s plans for regulation and tackling online harms, including:

i. the online services in scope of the regulatory framework;

ii. options for appointing an independent regulatory body to implement, oversee and enforce the new regulatory framework;

iii. the enforcement powers of an independent regulatory body;

iv. potential redress mechanisms for online users; and

v. measures to ensure regulation is targeted and proportionate for industry.

In February 2020, the government published its initial response to the public consultation on the Online

Harms White Paper.

Whilst there is still some uncertainty in terms of what organisations will be subject to the new regulatory regime, the government’s view is that only a small number of UK businesses will be in scope.



Subsector Priority

The Online Harms White Paper called for an independent regulator to oversee and enforce the new regime. The UK Government has confirmed that rather than creating a new body (as suggested by some respondents to the consultation) it is minded to appoint Ofcom as the new regulator and expand its existing remit. That said, the response did not address the potential overlap between Ofcom and the ICO. Current organisations may be investigated or fined by both regulators for similar issues, particularly in light of the ICO’s recent publication of the Age

Appropriate Design Code of Practice that sets out standards

organisations should adopt when offering online services that children are likely to access

Data protection On 08 January 2020, the ICO launched a public consultation on a draft direct marketing code of practice. The consultation closed on 04 March 2020

The code applies to organisations processing personal data for direct marketing purposes. This means any advertising or marketing material that is directed to an individual, including the promotion of aims and ideals. It covers all processing activities that lead up to, enable or support direct marketing. However, it does not cover solicited requests, blanket advertising or genuine service messages

The ICO is currently analysing the feedback received from the consultation, which will inform the final version of the code

Once finalised, the ICO must take the code into account when assessing whether organisations carrying out direct marketing have complied with their obligations under the GDPR and PECR

The content of the draft code may be changed, clarified or expanded. Organisations processing data for direct marketing purposes should review the draft code and monitor the ICO’s progress, in preparation for the publication of the final version

All All

G

The code provides practical




Subsector Priority

guidance on how to carry out direct marketing fairly and lawfully, and how organisations can meet accountability obligations under the

GDPR.

While current ICO guidance in relation to direct marketing primarily focuses on PECR, the code adopts a broader approach in covering compliance with the

GDPR as well

Key points include:

i. Direct marketing purposes: the draft code applies to all processing of personal data for

“direct marketing purposes”. This is not defined in the GDPR or PECR, but the ICO

takes a wide interpretation of it in the draft code.

ii. Legal basis for processing: the draft code states that generally consent or legitimate interest are likely to be the most appropriate legal bases for processing personal data for direct marketing purposes.

Where consent is used as a legal basis for processing, this must meet the GDPR standard for consent. If consent is not required, then legitimate interest may be appropriate.

However, the code stresses that this should not be viewed as an “easy option”.

Data protection The UK Supreme Court has Although the case indicates that for serious Based on the Supreme Court’s interpretation of the All All recently handed down its decision

in the case of WM Morrison Supermarkets plc v Various

employee misconduct such as this, employers may not be held vicariously liable for data breaches arising from the acts of that employee

DPA 1998 in its ruling, it is likely that vicarious liability can still not be expressly excluded under the DPA 2018, meaning that clients should look to

G




Subsector Priority

Claimants [2020] UKSC 12 which this judgment does not give employers any relief consider whether they have sufficient vetting has particular implications for the from their existing security obligations under processes in place for employees handling vicarious liability of employers in GDPR or the DPA 2018 personal data and sufficient training programs to relation to the acts of their ensure employees handle personal data securely employees under data protection Employers must continue to the highest pursue and appropriately at all times law possible compliance with such obligations given that data security failings, whether exploiting by Given that the increasing use of data-drive The case had been referred on disgruntled employees or not, will nevertheless revenue streams, employees are likely to appeal from previous decisions in continue to attract direct liability for data increasingly use personal data in the context of lower courts, including most controllers under GDPR / the DPA 2018 their day-to-day roles. Employers must therefore recently the Court of Appeal. The continue to pay due regard to the processes and case involves actions taken by a safeguards that they have in place to protect Morrisons employee (an internal IT against misuse of personal data by employees to auditor) involving payroll data lower the risk of resulting claims under the GDPR / which resulted in a significant data

breach involving such data. The relevant employee removed payroll data through activities related to his role and posted the data on the internet and to th

Documents

Legal Headwinds: Quarterly Report Q2 2020...Legal Headwinds: Quarterly Report – Q2 2020 Headwind topic Region Principal issue This quarter Looking ahead Relevant to Relevant Subsector