"I can't meet my obligations because of coronavirus"

Yes, well, it was about time I wrote about coronavirus, I guess.

I've been asked a few times "what happens if I can't meet my obligations because of coronavirus", or the opposite, "what happens if my supplier says they can't perform its obligations because of coronavirus".

The answer is inevitably fact-specific, but I set out some high-level general principles here. I've written this from the perspective of a supplier which is struggling to meet its obligations so, if you are on the receiving end, you'll need to reverse this.

Problems performing your contractual obligations

If you have agreed to do something under a contract, and find you cannot do so, the first step (unsurprisingly) is to see what the contract says.

Check if you are covered by a "force majeure" clause

Contracts often contain a clause entitled "force majeure" or "events beyond a party's control". This clause typically sets out a list of things which are considered to be sufficiently serious to permit a party to suspend, or deviate from, contractual performance.

If your contract has one of these clauses, check the following three things:

  • Check if coronavirus falls within the scope of the clause. This will depend on how you (or your lawyer) has drafted the force majeure provision. There's often scope for argument as to whether the force majeure clause is invoked, so you'll probably need to look at wider information — such as governmental or other official commentary about the impact of coronavirus — to see whether it meets the conditions in the clause.
    • A customer's obligation to pay is often carved out of force majeure clauses. If you cannot pay because of coronavirus – for example, it has adversely affected your cashflow in some significant way — you might have some luck with the force majeure clause, but you might not, as this is often excluded from the scope of force majeure clauses.
      • The contract may still offer some relief, but you'd need to read it carefully.
      • You might also find that the supplier has the right to terminate or suspend performance if you are unable to pay your debts as they fall due, so be mindful of that too.
  • Check what you have to do, how, and when. If coronavirus falls within the scope of your force majeure clause, you'll probably find you need to take certain action. For example, the contract might require you to give notice to the other party within 5 Business Days.
    • You'll need to check both the force majeure clause, and also any "notices" clause, to work out what constitutes valid notice.
    • Stick to the contractual requirements exactly. Even if you give an informal notice as part of your working relationship, make sure you also comply with the formal notice provision. Otherwise, there's a good chance that, in the event of a dispute, a court will find that you didn't invoke the force majeure clause, and so might be liable for the full impact of non-performance
  • Check the impact of the provision. A force majeure clause might permit you to delay performance, or it might permit you (or the other party) to terminate the contract.

Frustration

If your contract does not contain a force majeure clause, or coronavirus falls outside the force majeure clause, you might still be able get relief from the full force of your contractual obligations, under the principle of "frustration".

A contract is said to be "frustrated" if the underlying factual matrix has changed for some reason other than a party's own fault, and the change is so great that performance is rendered impossible, or the situation is so radically different from what the parties had in mind when they formed the contract.

This is a high threshold, and if the contract is merely more difficult, or more expensive, to perform, you're unlikely to be able to claim it has been frustrated.

The consequence of frustration is drastic: automatic termination, relieving a party of its obligations, but only in respect of future performance. You cannot use frustration to escape from obligations which had already fallen due.

Neither force majeure nor frustration apply

If neither force majeure nor frustration apply, unhelpfully, all I can say on this is "get advice, and get it early".

You might be able to negotiate some lesser performance, or delayed performance, but obviously this will depend on a whole range of things.

Get any variations agreed in writing If you do agree to vary the contract, capture the variation in writing.

Follow your contract's variation clause — if this needs to be in signed writing reciting the name of the contract (for example), make sure you do that.

Non-contractual obligations

The principles of force majeure and frustration are creatures of contract. They don't apply to non-contractual obligations.

To work out whether you can be relieved from your obligations if you are genuinely unable to perform them because of coronavirus, you'd need to look at the specific obligation in question.

Some are bounded by "reasonableness" (such as obligations to disclose communications data to law enforcement, following a demand under the Investigatory Powers Act 2016), which may give you some leeway, whereas others are phrased in absolute terms.

Subject access and the GDPR

There is no principle within the GDPR which permits a controller extra time to respond to the exercise of rights from data subjects in the event of something like coronavirus. The obligation on the controller is absolute.

However, there is some potential comfort, as the ICO has said:

"We can’t extend statutory timescales, but we will tell people through our own communications channels that they may experience understandable delays when making information rights requests during the pandemic."

So still do your best, and communicate openly and honestly with the data subject but, if you really cannot respond in time, and you can show you have a genuine reason for it linked to coronavirus, you probably don't need to worry about action from the regulator. (If you are thinking about using coronavirus as an excuse for something that is, or was, within your control, don't expect an easy time...)

Could someone sue you for the breach? Yes, but, in our experience, most people are reluctant to sue. Moreover, a court may not be inclined to grant relief if the controller has a good reason for non-compliance.

Security and the GDPR

Not really within the scope of this blogpost, but more and more companies are considering last-minute remote working options, so that people stuck at home in self-isolation, or (sensibly) trying to avoid catching coronavirus, can do so.

The position under the GDPR is that you have to have "appropriate" security measures in place.

While it could be a challenge to implement remote working on short notice, coronavirus is unlikely to be an excuse for operating in an insufficiently secure way. If a personal data breach occurs because of your remote working arrangements, I expect you'd struggle to use coronavirus as a shield.