What legal steps should UK companies follow when launching a product that may affect national security?

The landscape of security regulations in the United Kingdom has evolved significantly over the past few years. With the increasing reliance on technology and data, the government has set up several control measures to protect the national security of the country. As your company prepares to launch a product that might have potential implications on this security, it is mandatory to understand the legal steps that should be followed. This article will provide a comprehensive guide to these necessary procedures.

Understanding the National Security and Investment Act

The United Kingdom's National Security and Investment Act (NSIA) is a key legislation that companies need to familiarize themselves with when launching a product that could affect national security. Enacted in 2024, the NSIA outlines the government's power to scrutinize and potentially intervene in business transactions that might pose a risk to the country's security. This applies to both foreign and United Kingdom-based companies.

The NSIA introduced a mandatory notification system for qualifying entities operating within the 17 sectors specified by the Act. Some of these sectors include data infrastructure, satellite and space technologies, defense, telecommunications, and artificial intelligence. If your company operates within any of these sectors, you will be required to notify the Department for Business, Energy & Industrial Strategy (BEIS) before proceeding with any transactions that could affect national security.

Comprehending Mandatory Notification and Voluntary Notification

The mandatory notification system under the NSIA requires entities to notify the government about any transaction within the specified sectors that could result in a change of control over a qualifying entity. This notification is reviewed by the Secretary of State, who then decides whether to call in the transaction for a national security assessment.

However, even if your company's transaction does not fall under the mandatory notification parameters, you still have the opportunity to notify the government voluntarily. This is particularly beneficial if your company is uncertain about whether its transaction could pose a national security risk. Voluntary notification can provide security for your company, as it offers indemnity against future government intervention if the transaction has been cleared.

Grasping the Role of The Investment Security Unit

The Investment Security Unit (ISU) within the BEIS has been established to oversee the functioning of the NSIA. The ISU is responsible for handling all notifications, and providing guidance on the Act to entities. Therefore, it forms a crucial point of contact for your company in understanding the requirements of the NSIA and gaining clarity on the notification process.

The ISU has published a guidance document which provides an in-depth understanding of the NSIA, the sectors it covers, and the process of mandatory and voluntary notifications. Companies like yours can refer to this guidance for detailed information and for addressing any uncertainties regarding the NSIA.

Understanding Potential Government Intervention

If a transaction has been called in for a national security assessment, there could be potential government intervention. This could range from the imposition of conditions on the transaction to mitigate the risks, or in a more serious case, blocking the transaction altogether. The decision for the same lies with the Secretary of State.

It is to be noted that the government's powers to intervene apply retroactively to transactions carried out from 12th November 2020. Therefore, even if your company's product launch or acquisition has already taken place, the government still has the power to scrutinize it and take necessary action.

Ensuring Compliance with Data Protection Regulations

In the age of digitalization, many products involve the collection, storage, and processing of data. If your product deals with data, it is also important to ensure compliance with the United Kingdom's data protection regulations. The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 set out the rules for processing personal information. They require companies to handle personal data responsibly, ensuring its security and the privacy of individuals.

Non-compliance with data protection regulations can lead to severe penalties, including hefty fines. Therefore, it is crucial for your company to understand these regulations and take the necessary steps to ensure data protection. This includes practices such as obtaining explicit consent from individuals before collecting their data, providing clear information about how their data will be used, and implementing strong security measures to protect the data.

While launching a product that could affect national security, your company must navigate through several legal steps. Understanding the NSIA and its implications, notifying the government about your transaction, ensuring compliance with data protection regulations, and preparing for potential government intervention are all crucial aspects of this process. As you embark on this journey, remember that the key is to remain informed, proactive, and committed to safeguarding national security.

Navigating the Process for Mandatory and Voluntary Notifications

The first step towards compliance with the National Security and Investment Act (NSIA) is to understand the mandatory and voluntary notification processes. The mandatory notification is legally required for transactions within the specified sectors that could result in a change of control over a qualifying entity.

To initiate the notification process, your company must complete a ‘mandatory notification form’ and submit it to the BEIS. This form includes details about the transaction and the entities involved. It also requires an explanation of why the transaction may affect national security. The BEIS will then issue a 'completion notice' or a 'call-in notice', depending on whether the transaction is cleared or called in for a national security assessment.

In addition to the mandatory notification, your company may choose to submit a voluntary notification. This is particularly beneficial if there is uncertainty regarding the national security implications of a transaction. The voluntary notification process requires the submission of a 'voluntary notification form', which is similar to the mandatory notification form. If the transaction is cleared following voluntary notification, your company is indemnified against future government intervention related to that transaction.

Preparing for Potential Government Intervention and the Final Order

Once a transaction has been called in for a national security assessment, your company must be prepared for potential government intervention. The Secretary of State has the power to impose conditions on the transaction to mitigate identified security risks. In extreme cases, the Secretary of State can issue a final order to block the transaction altogether.

The government intervention process starts with a review period, during which your company will be invited to make representations to the Secretary of State. Following this, the Secretary of State will make a decision on whether to clear the transaction, impose conditions, or block it.

If a final order is issued, your company must comply with the conditions set out in the order. Non-compliance with a final order can lead to criminal penalties, including imprisonment and fines. Thus, it is crucial for your company to fully understand the implications of a final order and to take the necessary steps to comply with it.

Conclusion

The launch of a product that may affect the national security of the United Kingdom is a complex process that requires careful navigation of numerous legal steps. Understanding the National Security and Investment Act (NSIA), ensuring compliance with data protection regulations, and preparing for potential government intervention are all crucial aspects of this process.

Throughout this journey, your company must remain proactive, informed, and committed to safeguarding national security. By familiarizing yourself with the NSIA and its requirements, notifying the government about your transaction, and ensuring the protection of personal data, your company can successfully navigate the legal landscape and contribute positively to the nation's security.

Remember, the key to this process is not just about compliance, but about being a responsible corporate citizen committed to the United Kingdom's security. Stay informed, stay compliant, and prioritise the protection of national security in all your business endeavours.