The dust has barely settled on the compliance regimes for personal information – the EU GDPR and its UK equivalent – which have been very intrusive for the university sector since they were introduced five years ago. Now there is a new set of complex rules that universities need to worry about – international sanctions. This week, the UK government banned the University of Manchester from licensing vision-sensing technology to a Chinese company, under powers it gave itself in the National Security and Investment Act 2021.
The legal regime for sanctions is a mixture of the old and the new. There have been laws about exporting goods that have military applications for many decades. In IP Draughts’ first real job, as an in-house lawyer, he was responsible for making applications to the UK government for export licences for “dual use” technologies – e.g. software related to the design of ships, which could be used for both civilian and military ships.
More recently, there has been a proliferation of laws. Some are focused on criminal activity (the terrorism and money-laundering regimes), some concern technology and infrastructure (e.g. the Act mentioned above which is concerned with 17 areas of sensitive technology), and others focus on individuals and political regimes (e.g. the sanctions regimes for Russia and its oligarchs). All of these areas of law potentially raise time-consuming compliance issues for universities and technology-based companies.
So far, this article has mentioned only UK laws, some of which it inherited from the EU at the time of Brexit. This week, IP Draughts reviewed a draft funding agreement between a US-based charitable foundation and a UK university. The terms of the agreement required the university to comply with US laws, including “U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) Compliance”. The research to be done under the agreement is likely to involve collaboration with institutions and individuals in developing countries
How is a university supposed to comply with domestic and overseas laws in this field? IP Draughts is aware of at least one university that employs a full-time compliance manager. But will any such manager (if your institution has one) learn about proposed collaborations and licence agreements in sufficient time to ensure that the law is not broken? And how cautious will be the institution be about compliance, e.g. in the area of voluntary notification to the UK government under section 18 of the National Security and Investment Act?
These are areas for senior management to grapple with, and seek legal advice where appropriate. They may well result in disappointment for individual academics who are used to taking their own decisions on who to collaborate with, and where to seek funding for their research.