11/12/2023 - Last week, the Council of the European Union ('the Council') adopted the proposal for the EU Data Regulation ('the Data Act'). This new regulation sets rules on fair access to and fair use of data. According to the European Commission ('EC'), most data currently remain (unused) in the hands of just a few large companies. With the Data Act, the European Union ('EU') aims to ensure that both individuals and organisations have more control over and access to data generated by smart objects, machines and devices.
But how will this work in practice? We dove into the text of the regulation and examined what the Data Act could mean for users, product manufacturers and third parties.
Reforming the data economy
With the Data Act, the EU is introducing new rules on who can access and or use generated data from all economic sectors. The aim of the regulation is, among other things, to ensure a fair distribution of data, encourage a competitive data market and create opportunities for data-driven innovation. In addition, the Data Act provides for the use of data by public authorities and EU institutions in cases where there is a need to use data, such as an emergency. Furthermore, the new regulation aims to facilitate switching between data processing service providers for users.
New rules on access to and use of generated data
The Data Act applies to any data collected during the use of a product (such as a smart thermostat or a vehicle) by a user, whether personal data or not. Under the Data Act, a user can be a natural or legal person who owns, rents or leases the product, such as a business or consumer.
Under the Data Act, a manufacturer qualifies as the data holder of user-generated data, such as manufacturers of vehicles, home equipment or agricultural and industrial machinery. Manufacturers will soon be required to make data - where possible - directly accessible to the user, for example from an on-device data storage. Where the user cannot access the data directly from the product, the manufacturer must make the data available to the user free of charge and, where possible, continuously and in real time. For example, through a simple electronic request.
Opportunities for third parties
In addition to the above obligations, a manufacturer is also obliged to make data available to a third party upon the request by a user or by a party acting on behalf of a user. This provision complements the right of data portability provided under the AVG. In order to incentivise continued investment in generating valuable data, the Data Act allows manufacturers to request a reasonable compensation to a third party for making data available. The compensation should cover the direct costs and investment required to make data available. This means that the compensation should not refer to payment for data itself. To enable a party to assess whether the compensation requested is reasonable, a manufacturer should provide sufficient information on the calculation of the compensation.
What does this mean for your organisation?
For both users and third parties, the Data Act brings many opportunities. By enabling users to obtain and transfer data more easily, companies and consumers will have more control over the data they generate. This will allow them, for instance, to benefit more from new services that depend on access to data generated through use of a product. In addition, due to data access and portability rights, third parties have more opportunities to compete with (big) data holders by being able to develop and offer, for example, aftermarket services, support or other services based on generated data.
For manufacturers, there is much work to be done. With the arrival of the Data Act, a large number of new obligations shall apply, which they have to start implementing. Consider, for instance, setting up infrastructure to make data available to a user or a third party and setting up a procedure for handling access requests.
When will the Data Act apply?
Following the Council's agreement, the final regulation will be published in the EU's Official Journal in the coming weeks. On the 20th day after publication, the regulation will enter into force. After the date of entry into force, there will be a 20-month period for companies to prepare for the obligations of the regulation. After this period, the Data Act will actually apply to parties. Depending on the number of weeks before publication, the Data Act is likely to be applicable by the end of 2025.