Trends in information technology law: looking ahead to 2021 – Lexology

This piece looks ahead to what we might expect as IT law develops in 2021.

2020: an extraordinary year of IT transformation at scale, pace and depth

At last, we can see 2020 through the rear view mirror. A year like no other within living memory, its impact on transformation in the world of IT is huge. It can be summarised in three words: Scale, Pace, Depth.

The digital economy is consuming the old economy said a former CEO of HSBC recently, neatly if graphically articulating the scale of change.[i] 2020s tech celeration and great shove online have compressed into months changes previously anticipated in years. And headlines in early December 2020 illustrate how the depth of these changes will impact all our lives:

The high street

Retail and the UK high street remained the place where these changes were most visible in 2020. The chart below[viii] shows how internet sales as a percentage of total retail sales inclined relatively gently upwards from 3% in 2006 to 20% in 2019, but then raced ahead to 30% in early 2020. The list of well-known UK retailers that went into liquidation or administration in 2020 as a result is likely to lengthen in 2021.

UK Internet sales as a percentage of total UK retail sales (Source: ONS)

Brexit and digital trade

So now we know what Brexit means Brexit means. Having ridden up six floors in the elevator of European economic integration, we finally got out at level 2, where we last were in 1960: tariff-free trade in UK- and EU- originating goods, bolted on to the WTOs basic principles of non-discrimination and equal treatment (see graphic).[ix]

Brexit means Brexit means getting out at Level 2

Decembers 1,246 page EU/UK Trade and Cooperation Agreement (TCA)[x] adds to this a number of high level terms on services plus commitments to negotiate. These include seven pages aiming to facilitate digital trade, to address unjustified barriers to trade enabled by electronic means and to ensure an open, secure and trustworthy online environment.[xi] The Government has called these out as some of the most liberalising and modern digital trade provisions in the world and the first time the EU has agreed provisions on data in a free trade agreement.[xii]

Brexit and data protection

As an example of the contortions that may lie ahead, many businesses are likely to end up with dual data protection compliance requirements. During the transition period, the GDPR continued to apply in the UK pretty much as before and the TCA defers the UK from being considered a third country for GDPR purposes until 30 June 2021 or (if earlier) when the EU makes an adequacy decision for the UK.[xiii] We will be keenly awaiting the outcome of the Commissions adequacy review.

However, as well needing to comply with UK GDPR, a UK business will also be subject to EU GDPR if it offers goods or services to data subjects in the EU, monitors their behaviour or has an EU establishment. Whilst divergence is unlikely to be material early on, room for inconsistency and conflict between UK GDPR and EU GDPR will grow over time.

If not reviewed before, the main areas affected that will need attention in 2021 are international data transfers, appointment of EU representatives and regulatory oversight for cross-border processing. The fall-out from the ECJ judgment in Schrems II (which struck down the US Privacy Shield arrangements with the EU)[xiv] and ongoing clarification in Brussels of points of EU GDPR detail are also likely to make this a volatile area of law for UK practitioners for a while.

At the global level, the data protection compliance picture is further complicated in 2021 as more states embed their own GDPR-type laws and rules. These include Brazil (September 2020); California (California Consumer Privacy Act: January 2020, California Privacy Rights Act: from January 2022); Canada (bill introduced November 2020); China (draft published October 2020); and South Africa (June 2021).

All the clouds a stage

IT transformation will continue to get star billing this year, and the main players are evident as we head into 2021. The cloud sets the stage where digital transformation plays out. In the world of everything as a service, efficient use of cloud resources is a pre-requisite to good performances from the rest of the 4th Industrial Revolution cast. Here, AI, 5G, blockchain, process automation, autonomous devices (robots, drones and vehicles), and virtual (aka augmented or extended) reality will be taking up the most important roles in 2021.

Towards the digital supply chain

Against this backdrop, transformation is taking place in different ways across different sectors, but emerging common features across industry include digital twinning, the development of secure digital supply chains and effective end to end governance and management of data and algorithms.

By way of example, the Air Transport Industry (ATI) has faced unprecedented challenges in 2020, from changing traffic patterns, through space and resource re-utilisation, to the green airport and greener ways to fly.

The ATI depends on a complex supply chain of layered, co-ordinated and structured processes, events and interactions from multiple entities including air traffic control, aircraft (in flight, landing, at stand and take-off), airports (departure and arrival), cargo, passengers and ticket distribution.

All these processes, events and interactions, or rather their digital twins, generate vast amounts of digital data. All the actors in the ATI supply chain are reliant on the availability and accuracy of this data: they all need the right data at the right time to perform their role. Viewed through the lens of data, the ATI supply chain becomes data points, data flows and data sharing based on common architectures, and permissioning within and between entities and ecosystems. Rules can be set through smart contracts, blockchain and standards to determine how these processes, events and interactions take place, and the value of data (as an asset) and its risk (as a liability) as it moves through the system.

Each process, event and interaction in the digital supply chain must comply with applicable legal requirements as critical infrastructure for example, and for cybersecurity, data protection, specific ATI regulation and data contracting and licensing.

The ATI is just one example of representing an industry through a data-centric lens which IT lawyers will see much more of in 2021.

Tech regulation: intermediary immunities and competition law

To the keywords of scale, pace and depth we might add regulation. With significant legislation in the works in Brussels and London, 2021 will be a seminal year for digital regulation, as well pointing the direction that regulatory divergence will take both between the UK and the EU, and between Europe and the US.

Longstanding intermediary immunities and safe harbours from liability are increasingly under challenge around the world as governments seek to deputise intermediaries to assist in law enforcement.[xv] These immunities arise in the EU under the E-Commerce Directive,[xvi] which the EU Commission is proposing to overhaul through the two pillars of its Digital Services Act package.[xvii] The first pillar will set out new rules on responsibilities of digital services providers towards their users, and the second will implement new rules on competition.

For the first pillar, the UK government stated in October 2020 that it had no current plans to change the UKs intermediary liability regime or its approach to prohibition on general monitoring requirements,[xviii] indicating that intermediary liability rules in the UK will diverge over time from those in the EU. On the second pillar, 2021 is scheduled to see UK legislative action around a new regulatory regime for online platforms and digital advertising, with responsibility shared between the new Digital Markets Unit of the Competition and Markets Authority, the Information Commissioners Office and Ofcom.[xix]

Regulating the distributed web

A feature of 2021 will be the rise of the distributed web, based on open source frameworks for publishing lightweight, peer to peer applications and decentralised data storage (like Holochain), encrypted identity verification (like Keybase) and third party service integration (like Electron). The distributed web heralds a move away from the centralised platforms of web 2.0 and towards a more user-centric, self-sovereign internet. But this new web world where theres no canonical single version of the truth as the data is stored on each users device may make the role of publishers and app developers more challenging in terms of intermediary liability, where the rules are set to tighten and effective notice and take down may no longer be in their gift. As ever, regulation struggles somewhat to keep up with the tech.

Telecoms regulation: OTT and the EECC

How the tides of tech regulation can catch business unawares is shown by the reach of the new European Electronic Communications Code (EECC).[xx] The EECC came into force on 21 December 2020, with the UK deferring certain provisions for a number of months. As part of a series of measures that replaces the 2002 EU telecoms regulatory package, it sets out general authorisation conditions for telecoms services. Under the old rules,[xxi] over the top (OTT) services calls and messages over the internet were outside the reach of telecoms law as they werent considered to be regulated electronic communications services (ECS). Brussels changed this in the EECC, where most OTT services now fall inside the definition of ECS and, if public ECS (essentially, where anyone can sign up), are subject to certain rules protecting users that the EECC imposes. However, note that the UK has not yet implemented the EECC fully in relation to OTT.

As public ECS, OTT services will also need to comply with the communications confidentiality, traffic data and location data rules in the (old) ePrivacy Directive (ePD),[xxii] which is due to be replaced in the EU by the ePrivacy Regulation (ePR) when agreed, likely in 2021. Of course, as the ePR wont apply in the UK and how the UK will deal with e-Privacy in 2021 isnt yet clear. The EECC, ePD and ePR rules are separate from the GDPR and other (largely EU-based) laws protecting consumers online, where the rule books are also lengthening.

With added dimension provided by Brexit, its a racing certainty that the scale, pace and depth of IT and regulatory change we have seen in 2020 will accelerate as we head into 2021.

Continue reading here:

Trends in information technology law: looking ahead to 2021 - Lexology