Online gambling businesses have historically located their operations and employees across the EU, with London, Gibraltar and Malta being key business hubs. Brexit has therefore impacted the gambling industry in a number of ways.
Many gambling businesses undertook significant amounts of restructuring work in preparation for the end of the Brexit transition period. Much of this was driven by gambling regulatory considerations. First, certain gambling licences (such as those issued by the gambling regulators in Spain and Malta, including Maltese recognition notices) must be held by an entity established in the EEA. Secondly, there are significant regulatory advantages in dealing with consumers in unregulated or restricted EU territories via an operating company located in the EU. A number of gambling companies have expanded their operations in Malta, and moved their EU-facing servers to Ireland, for example.
Although there is now more certainty as to the future relationship between the UK and the EU, with the UK-EU having agreed the terms of the Trade and Co-operation Agreement (TCA), gambling businesses are still faced with some unknowns.
In relation to digital trade, a bridging period has been put in place for four months, extendable by two months, for the EU Commission to decide whether to make an adequacy decision in relation to the UK's post-Brexit data protection regime. In the meantime, data transfers from the EEA to the UK are not subject to any additional restrictions, as the UK is effectively not being treated as a third country under GDPR for these purposes. On 19 February 2021, the European Commission published its draft adequacy decision in relation to the UK's data protection regime. As we discuss here, the decision must now be considered further by the European Data Protection Board, and also a committee of representatives of EU Member States, and may also be subject to challenge.
If, however, the EU does not accept that the UK's data protection regime is adequate following the bridging period, contracts which involve the transfer of personal data from the EU to the UK may need to be revisited (to reflect the guidance issued by the European Data Protection Board, after the Schrems II decision, in relation to international data transfers). The European Gaming & Betting Association recently commented that the lack of a long-term agreement relating to data transfers between the UK and the EU is the "most concerning outstanding issue with Brexit". GIn case the adequacy decision is not confirmed, or it is but is subject to a challenge, gambling businesses should assess how many of their intra-group and external contracts would be affected and make contingency plans accordingly. Businesses should also consider the extent to which they will continue to transfer personal data across UK and EU borders. If processing operations in relation to a customer take place in both the EU and the UK/Gibraltar, there is a risk that any data protection breach could result in overlapping investigations, and two sets of fines.
Gambling businesses should also continue to prepare for the fact that employees may not be able to relocate across the EU border without encountering some degree of friction. EU nationals and their family members arriving in the UK from 1 January 2021 now require a visa under the UK's immigration rules. EU nationals who were working in the UK as at 31 December 2020 will need to apply to the EU Settlement Scheme by 30 June 2021, to ensure that they will be able to continue living or working in the UK. Business should assess which of their employees need to apply to the EU Settlement Scheme. Businesses may also wish to apply for or vary their existing sponsor licences. Similarly, UK nationals working in most EU countries will require a local work permit.
In relation to trade between the UK and the EU, while the TCA has ensured that goods may continue to be traded between the UK and the EU tariff-free, provided they comply with the relevant rules of origin, the UK has now become a third country for VAT purposes. Businesses should assess whether this is likely to affect any contracts they have with service providers, and consider whether those contracts need revising. Unlike with trade in goods, the TCA is largely silent on services, and the ability to provide services in the EU will, subject to ongoing negotiations between the UK and the EU, be a matter for each Member State to determine. Businesses should also prepare for possible changes in the application of tax residency rules, with EU tax authorities more likely to argue (for example) that a business with a majority of directors in a particular EU state is tax resident in that state.