The European Parliament adopted by 481 votes to 31, with 71 abstentions, a resolution on the proposal for a regulation of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act).

Parliament’s position adopted at first reading following the ordinary legislative procedure amended the Commission proposal as follows:

The new legislation establishes rules on sharing data generated by the use of connected products or related services (e.g. Internet of Things, industrial machines) and allows users to access the data they generate. It provides for new rules specifying who can access and use data generated within the EU across all economic sectors.

The regulation aims to:

- guarantee fairness in the distribution of the value produced by data between stakeholders in the digital environment;

- stimulate the development of a competitive data market;

- open up opportunities for data-driven innovation; and

- make data more accessible to the user.

This regulation lays down harmonised rules, inter alia , on:

- the making available of product data and related service data to the user of the connected product or related service;

- the making available of data by data holders to data recipients;

- the making available of data by data holders to public sector bodies, the Commission, the European Central Bank and Union bodies, where there is an exceptional need for those data for the performance of a specific task carried out in the public interest;

- facilitating switching between data processing services;

- introducing safeguards against unlawful third-party access to non-personal data; and

- the development of interoperability standards for data to be accessed, transferred and used.

Any processing of personal data pursuant to this Regulation should comply with Union data protection law.

The regulation contains measures concerning:

- the obligation to make data relating to products and data relating to related services accessible to the user;

- the rights and obligations of users and data holders regarding access to, use and provision of product data and related service data;

- the user's right to share data with third parties;

- measures to prevent the misuse of contractual imbalances in data sharing contracts due to unfair contractual terms imposed by a party in a stronger bargaining position;

- the protection of trade secrets and intellectual property rights, accompanied by appropriate safeguards against abusive behaviour;

- additional guidance with regard to reasonable compensation for making the data available and dispute settlement mechanism;

- certain adjustments regarding data sharing requests from public sector bodies due to exceptional needs;

- clearer and more widely applicable provisions regarding the effective switching from one data processing service to another ;

- the gradual withdrawal of switching charges;

- introducing safeguards against unlawful third-party access to non-personal data ;

- essential requirements regarding interoperability of data, of data sharing mechanisms and services, as well as of common European data spaces.

The European Parliament adopted by 500 votes to 23, with 110 abstentions, amendments to the proposal for a regulation of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act).

The issue was referred back to the committee responsible for inter-institutional negotiations.

Data and scope

Parliament clarified that the proposed Regulation should lay down harmonised rules on:

- the design of connected products to allow access to data generated by a connected product or generated during the provision of related services to the user of that product;

- data holders making available data they accessed from a connected product or generated during the provision of a related service to data subjects, users or to data recipients, at the request of the user or data subject;

- fair contractual terms for data sharing agreements;

- the making available of data to public sector bodies or Union institutions, agencies or bodies, where there is an exceptional need in the public interest;

- facilitating switching between data processing services;

- introducing safeguards against unlawful international governmental access to non-personal data; and

- providing for the development of interoperability standards and common specifications for data to be transferred and used.

Objectives

The Data Regulation aims to boost innovation by removing barriers obstructing consumers and businesses’ access to data. The legislation will clarify who can access data and under what conditions. It will allow a wider range of private and public entities to share data.

To void the fragmentation of the internal market, it is necessary to lay down a harmonised framework specifying who, is entitled to use accessible data collected, obtained or otherwise generated by connected products or related services, under which conditions and on what basis.

The Regulation:

- obliges manufacturers of connected products and providers of related services to design their products and services in such a way that users of a connected product or related service in the EU can access, in a timely manner, the data accessible from the product or generated during the provision of a related service and that those users can use the data, including by sharing them with third parties of their choice;

- requires data holders to make data available to users and to data recipients designated by those users;

- provides that data holders should make data available to data recipients in the Union on fair, reasonable and non-discriminatory terms and in a transparent manner;

- provides that, if there is an exceptional need, data holders should make data available to public sector bodies of the Member States and to Union institutions, bodies, offices and agencies;

- further aims to facilitate switching between data processing services and to improve the interoperability of data and data sharing mechanisms and services in the Union.

SMEs

Start-ups, SMEs and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. This Regulation aims to facilitate access to data for these entities, while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach.

When companies draw up their data sharing contracts, the law will rebalance the bargaining power in favour of SMEs, protecting them from unfair contract terms imposed by companies in a much stronger bargaining position.

Compensation for the provision of data

To incentivise the continued investment in generating and making available valuable data, including investments in relevant technical tools, this Regulation contains the principle that data holders may request reasonable compensation when legally obliged to make data available to the data recipient in business- to business relations.

Any compensation agreed between a data holder and a data recipient for making data available in business- to- business relations should be non - discriminatory and reasonable. A data holder, a data recipient or a third party should not directly or indirectly charge consumers or data subjects a fee, compensation or costs for sharing data or accessing it.

Members strengthened provisions to protect trade secrets and avoid a situation where increased access to data is used by competitors to retro-engineer services or devices. They also set stricter conditions on business-to-government data requests.

Emergency situations

The amended text also sets out how public sector bodies, in exceptional circumstances or emergencies, such as floods and forest fires, can access and use data held by the private sector where necessary.

Strengthened coordination

Each Member State should designate an independent competent coordinating authority (‘data coordinator’) as responsible for the application and enforcement of this Regulation, for coordinating the activities entrusted to that Member State, for acting as the single contact point towards the Commission, with regard to the implementation of this Regulation and for representing the Member State at the European Data Innovation Board.

To further enhance coordination in the enforcement of this Regulation, the European Data Innovation Board should foster the mutual exchange of information amongst competent authorities as well as advise and assist the Commission in certain matters.

Data processing

Union law on the protection of personal data, privacy and confidentiality of communications and integrity of terminal equipment shall apply to any personal data processed in connection with the rights and obligations laid down in this Regulation. Any contractual term in a data sharing agreement between data holders and data recipients which, to the detriment of the data subjects, undermines the application of their rights to privacy and data protection, derogates from it, or varies its effect, will be void.

International access and transfer

Providers of data processing services should take all technical, legal and organisational measures, including contractual arrangements, in order to prevent international transfer and third-country governmental access to such non-personal data held in the Union where such transfer or access would be in contravention of Union law or the national law of the relevant Member State.

PURPOSE: to set harmonised rules on fair access to and use of data (Data Act).

PROPOSED ACT: Regulation of the European Parliament and of the Council.

ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.

BACKGROUND : the volume of data generated by humans and machines has been increasing exponentially in recent years. Most data are unused however, or its value is concentrated in the hands of relatively few large companies. It is therefore crucial to unlock such potential by providing opportunities for the reuse of data , as well as by removing barriers to the development of the European data economy in compliance with European rules and fully respecting European values.

On 25 March 2021, the European Council reiterated the importance of better exploiting the potential of data and digital technologies for the benefit of the society and economy. On 1-2 October 2020, it stressed the need to make high-quality data more readily available and to promote and enable better sharing and pooling of data, as well as interoperability.

In its resolution of 25 March 2021 on a European Data Strategy, the European Parliament urged the Commission to bring forward a data law to encourage and enable greater and fairer data flows across all sectors, between businesses, between businesses and public administrations and vice versa, and between public administrations themselves. It also stressed the need to create common European data spaces to ensure the free flow of non-personal data across countries and sectors, and between businesses, academia, relevant stakeholders and the public sector.

Following the Data Governance Act , this proposal is the second main legislative initiative resulting from the February 2020 European strategy for data , which aims to make the EU a leader in our data-driven society. Its aim is to ensure fairness in the allocation of value from data among actors in the data economy and to foster access to and use of data.

The Data Act should ensure fairness in the digital environment, stimulate a competitive data market, open up opportunities for data-driven innovation and make data more accessible to all.

CONTENT: the proposed Regulation aims to establish a harmonised framework that specifies who, in addition to the manufacturer or other data holder, has a right of access to data generated by products or related services, under what conditions and on what basis, in all economic sectors.

The proposed Regulation:

- aims to ensure that users of a product or related service in the Union can access, in a timely manner, the data generated by the use of that product or related service and that those users can make use of that data, including sharing it with third parties of their choice. Manufacturers and designers should design products in such a way that data is easily accessible by default, and they should be transparent about what data will be accessible and how it can be accessed. Users would have the right to authorise the data holder to give access to the data to third party service providers, such as after sales service providers;

- sets out the general rules applicable to data provision obligations . Where a data holder is obliged to make data available to a data recipient, the general framework sets out the conditions under which the data is made available and the compensation for making the data available. All these conditions should be fair and non-discriminatory, and any compensation should be reasonable;

- adapts the rules of contract law and prevents the exploitation of contractual unfairness that hinder fair access to and fair use of data by micro, small or medium-sized enterprises. The Data Regulation would protect SMEs from unfair contract terms imposed by a party with significantly more bargaining power. The Commission would also develop model contract terms to help these companies draft and negotiate fair data sharing contracts;

- provide for the use by public sector bodies and Union institutions, agencies or bodies of data held by enterprises in certain situations where there is an exceptional data need . This primarily concerns public emergencies , but also other exceptional situations where compulsory business-to-government data sharing is justified;

- introduces minimum regulatory requirements of contractual, commercial and technical nature, imposed on providers of cloud, edge and other data processing services, to enable switching between such services . In particular, the proposal ensures that customers maintain functional equivalence (a minimum level of functionality) of the service after they have switched to another service provider;

- puts in place safeguards against unlawful data transfer without notification by cloud service providers. This is because concerns have been raised about non-EU/European Economic Area (EEA) governments’ unlawful access to data. Such safeguards should further enhance trust in the data processing services that increasingly underpin the European data economy;

- provides for the development of interoperability standards for data to be reused between sectors, in a bid to remove barriers to data sharing across domain-specific common European data spaces, in consistency with sectoral interoperability requirements, and between other data that are not within the scope of a specific common European data space;

- supports the setting of standards for 'smart contracts’ . These are computer programmes on electronic ledgers that execute and settle transactions based on pre-determined conditions. They have the potential to provide data holders and data recipients with guarantees that conditions for sharing data are respected.