Following 18 months of intense discussions, the EU institutions reached a provisional agreement on a new EU market-defining law governing the fair access to and use of data (Data Act) on 27 June 2023.
The last weeks saw the European Parliament and the Council hashing out their differences over the scope of the Data Act, the protection of trade secrets, the governance model and the transitional period to reach a political deal before the end of the Swedish Council Presidency. The new law aims to unlock non-personal industrial data generated by connected machines and devices by establishing a harmonised framework that specifies who (together with the manufacturer or the data holder) has a right of access to data generated by products or related services, under what conditions and on what basis.
Scope
The data covered under the Data Act’s sharing obligations is the one that “represents the digitalisation of user actions and events […] recorded intentionally or indirectly resulting from the user’s action” (Recital 14a Data Act).
The provisional agreement included the Parliament’s proposal to differentiate between ‘product data’, the data generated by the use of a connected product, and ‘related service data’, which represents the digitalisation of users’ actions while keeping the horizontal concept of ‘readily available data’ as a mix of both these categories of data that can be shared without disproportionate effort by data holders. Data processed through complex ‘proprietary algorithms’ was also excluded from the scope. Personal data must be anonymised following the EU General Data Protection Regulation (GDPR).
A topic that was discussed until the last round of interinstitutional negotiations (“trilogue”) was the territorial scope of the Data Act. In the end, the representatives agreed to limit the applicability of the Data Act to data recipients and third parties within the EU.
Data markets
Under the new law, users of connected products have the right to access and share (with a third party of their choice) the data they have generated. The final text included proposals from the European Parliament to monetise data sharing to create EU data markets. In particular, owners of connected devices can profit from the data they generate by selling, sharing or licensing it to companies of their choice. Specifically, users can monetise non-personal granular data, whilst data holders can license aggregated industrial data in return for a non-discriminatory and reasonable compensation that could include a margin.
Trade Secrets
The most controversial issue of the Data Act concerned the protection of trade secrets. Under the final agreement, data holders will have the right to refuse data access if disclosing trade secrets would lead to “serious and irreparable economic losses” or if there are specific safety requirements that could be undermined by data sharing. The text also introduced the concept of ‘trade secret holder’ as a complement to ‘data holder’ in cases where these are not the same legal person.
Cloud switching
Another principle of the Data Act is to remove barriers between cloud service providers facilitating switching processes. In scope are only cloud infrastructure services (IaaS), not platform services (PaaS). According to the final text, co-legislators agreed to introduce obligations for providers of data processing services not to impose (or remove, if they exist) obstacles inhibiting customers from unbundling data processing services from one another. The Council also welcomed a proposed amendment from the Parliament whereby all parties must commit to working together in good faith throughout the switching process.
Next steps
The agreed text must now be formally adopted by the European Parliament and Council, following legal-linguistic revision and translation into the official EU languages. The adoption process should happen by September-October 2023.
Once adopted, the Data Act will enter into force on the 20th day following its publication in the EU Official Journal. It will become applicable 20 months after the entry into force, most likely from the second half of 2025.
For more information contact Paolo Sasdelli or Francine Cunningham.
SIGN UP FOR OUR CONNECTED NEWSLETTER FOR A MONTHLY ROUND-UP FROM OUR REGULATORY & PUBLIC AFFAIRS TEAM.
