Big Data & Issues & Opportunities: Data Sharing Agreements

Written By

benoit van asbroeck Module
Benoit Van Asbroeck

Partner
Belgium

As a partner and IP/IT specialist here at Bird & Bird in Brussels, I lead our Belgian Data Protection, Tech & Comms and Media practices, advising our clients on legal issues in privacy, data, e-commerce, digital marketing, cloud computing, the Internet of Things, AI, 3D printing, cookies, electronic signatures, intermediary liability and automated objects. I also co-head the Bird & Bird international special interest group on Copyright due my large experience in copyright matters with the Court of Justice of the European Union.

In this thirteenth article in our series on "Big Data & Issues & Opportunities" (see our previous article here), we offer a brief overview of what can be defined as a data sharing agreement, the rules that may apply to these agreements arising both from the law and from contractual obligations established by the parties, and of the guidance issued by the European Commission in this respect. This article also provides a critical analysis of the common practice to use data sharing agreements to govern the access to and/or exchange of data between stakeholders in a big data analytics lifecycle.

It follows from our previous articles in this article series that there is a multitude of actors on the market actively reaping the benefits of the data economy. The relationship between these actors is at the heart of the data value cycle. It is however also apparent from the previous articles that the legal framework is unfortunately not satisfactory at this stage. In fact, it is clear that one of the factors limiting the availability, use, and exchange of data in commercial settings is the legal regime – or lack thereof – in place.

As things stand, the various commercial entities exchanging data in the context of the (big) data value cycle do so mainly on the basis of contractual agreements (i.e. data sharing agreements or "DSAs").[1] It is therefore required to carefully assess the multiplicity of (often multi-layer) agreements governing the access and the exchange of data between the various actors, taking into consideration the type of data involved in the analytics processing.

Data sharing agreements: definition and applicable rules

A DSA can be defined as an agreement between two or more legal entities (or individuals) concerning the sharing of data or information of any kind between these legal entities (or individuals). The notion of 'data sharing agreement' is commonly used to refer to a broad typology of arrangements and documents between two or more organisations or different parts of an organisation. The present article does not intend to cover any contractual relationships with natural persons in their capacity as consumers or data subjects.

Depending on the specific needs of the parties, the sharing of data may take different forms, such as for instance reciprocal exchange of data, one or more organisations providing data to one or more third parties, several organisations pooling information and making it available to each other or to third parties, one-off disclosures of data in unexpected or emergency situations, different parts of the same organisation making data available to each other, etc.

Finally, the types of data shared may be of a different nature, such as for instance[2] data about identified or identifiable natural persons ("personal data" – see also our second article on Privacy and Data Protection), data protected by intellectual property rights or another kind of property-like right, data considered confidential (including trade secrets and know-how), financial data, etc.

The parties to a DSA are bound to comply with obligations at two levels:

  • Mandatory rules arising from the applicable law(s); and
  • Contractual terms and conditions specifically set forth and agreed upon by the parties.

The DSA shall first of all be in line and comply with the applicable (national) laws and regulations concerning the formation and execution of an agreement, notably relating to the activity of data sharing. Most of such rules derive from the contract law applicable to the DSA.

Such rules may concern, among others:

  • Formal requirements (when applicable): e.g. the applicable law may require that certain types of DSAs – for instance the data processing agreement to be executed between a data controller and a data processor – are executed in writing; or the choice of the law applicable to the contract is valid and enforceable only if agreed in writing between the parties.[3]
  • Formation of the contract: these rules are relevant to assess whether a DSA and its obligations are enforceable between the parties.
  • Termination: the right of the parties to terminate the agreement.
  • Liability: in case of breach of any contractual obligation, such as when one of the parties discloses the data received from the other party to another party not authorised to receive the data.
  • Capacity of signatories: the legal capacity of the persons undersigning the agreement to act on behalf of an organisation (e.g. if a person who signs a DSA does not have the capacity or authority to sign it, the DSA will be ineffective).
  • Assignment: the right of the parties to assign the DSA, or part of the rights and/or obligations under the DSA, to a third party (e.g. in most circumstances, and jurisdictions, the assignment or transfer of an agreement, especially if it is a DSA, requires the consent of the other party).

In addition to compliance with the possible restrictions laid down by the applicable legislations and/or regulations on the sharing of data in general, parties shall bear in mind when drafting the DSA that the sharing of the data under the agreed terms and conditions may need to comply with all specific rules that the applicable legislation may have set for a particular type of data or information, such as for instance financial data or health data.

Finally, within the limits identified above, the parties to a DSA are free to agree on additional terms and conditions applicable to their sharing of data. For instance, the parties may agree on details related to specific obligations connected to the sharing of data, time of disclosure, warranties (or lack of warranties) on the accuracy and completeness of data, obligations of the receiving party to manage the data according to specific rules and to apply certain security measures to protect the data, right of or prohibition to the receiving party to transfer onward/disclose the data to a third party, ownership of the data and intellectual property rights, payment of any consideration for the sharing of data, confidentiality obligations, audit of the receiving party by the disclosing party or by the authorities, warranties on the power to disclose and receive data, duration of the agreement, governing law, and competent court.

Guidance from the European Commission

Following a broad stakeholder consultation and dialogue, the European Commission recently deemed it inappropriate to take horizontal legislative action with respect to private sector data sharing. Companies had urged the Commission to be prudent when considering taking action in order to make more data available for re-use. It was argued that data value chains and data-based business models are extremely diverging and that a one-size-fits-all solution would most likely prove inadequate. Instead, companies expressed their preference for agreements as the way to address most concerns. Stating that "contracts build on trust", the latter was considered an essential prerequisite for all private sector data sharing.[4]

The European Commission then issued guidance on 'Sharing private sector data in the European data economy'.[5] This was aimed at providing a practical toolbox for both data-holding and data-using businesses across industries regarding the legal, business, and technical aspects of data sharing. The guidance addresses data sharing among private companies (i.e. business-to-business or "B2B"), as well as the provision of data from a private company to the public sector (i.e. business-to-government or "B2G"). Taking account of the fact that data sharing usually takes place on the basis of an agreement, the Commission establishes five principles to govern B2B data sharing agreements and six principles to govern B2G data sharing agreements. These will be briefly addressed below.

Illustration in the transport sector: On 19 October 2018, the European Commission published its Roadmap on Cooperative, Connected and Automated Mobility (CCAM) in light of its aim to publish a Recommendation on this subject during the first quarter of 2019. In addition, a Public Consultation was kicked off on 24 October 2018. One of the issues to be addressed by the Recommendation is access to in-vehicle data. The Commission indeed deems the centralisation of in-vehicle data (as it is currently practiced by some market players) insufficient to ensure fair and undistorted competition between service providers. The Commission Recommendation therefore aims to provide further guidance on a governance framework for access to and sharing of data generated by connected vehicles. The Roadmap and the Public Consultation were open for feedback on the Better Regulation platform until 16 November 2018 and 4 December 2018 respectively.[6] Any feedback will be taken into account for further development of the initiative.


B2B data sharing agreements

On a preliminary note, the Commission identifies five principles which should govern private data sharing in order to ensure "fair markets for IoT objects and for products and services relying on data created by such objects".[7] These principles are displayed in the table below:

Principle

DSAs should therefore:

Transparency

Identify the persons or entities that will have access and use the data generated by the product or service in question and specify the purposes for such data use.

Shared value creation

Recognise that, where data is generated as a by-product of using a product or service, several parties have contributed to creating the data.

Respect for each other's commercial interests

Address the need to protect both the commercial interests and secrets of data holders and data users.

Ensure undistorted competition

Address the need to ensure undistorted competition when exchanging commercially sensitive data.

Minimised data lock-in

Allow and enable data portability as much as possible, particularly where companies offer products or services that generate data as a by-product.

The guidance then goes on to discuss some of the legal aspects related to B2B data sharing through DSAs (i.e. data usage or licensing agreements). It recognises that data monetisation agreements are not necessarily bilateral and may be concluded between multiple parties. Emphasis is also put on the fact that these contracts do not exist in a legal vacuum and attention should therefore be given to ensure compliance with existing legislation, particularly legislation that would prevent data sharing or make it subject to specific conditions. This includes for instance the GDPR whenever personal data are involved, but may also cover sector-specific obligations. The Commission also voices its plans to collect best practices, existing model contract terms and checklists through a Support Centre for data sharing which is expected to become operational in the course of 2019.[8]

The section on DSAs also contains a list of considerations to help companies in the preparation and/or negotiation of data sharing agreements. It covers topics such as what data should be made available, who can access and (re-)use that data, what can that (re-)user do with the data, the definition of technical means of data access and/or exchange, what data should be protected and how, liability questions and audit rights for both parties.[9] We briefly address the most important considerations below.

Companies are advised to describe the data in the most concrete and precise manner possible. This ideally includes the levels of updates to be expected in the future. Another important question concerns the quality of the data. The Commission states that good quality data is accurate, reliable and where necessary up-to-date and that a dataset ideally does not have missing, duplicate or unstructured data. It should in any case be ensured that the rights of third parties are respected, including intellectual and industrial property rights.[10] 

The contract should determine in a clear and transparent manner who has a right to access, a right to (re-)use, and a right to distribute the data. According to the Commission, rights to access and re-use do not need to be unlimited and may be subject to conditions, which should be clearly defined in the DSA. The contract may limit e.g. the right to access to members of a certain group, or affiliates of a certain company, or limit the right to re-use to certain specific purposes. Companies should moreover consider if and how data may be licensed for re-use and include the necessary specifications in this regard. Sub-licensing may also be considered in the sense that it should either be expressly excluded, or the conditions under which it is allowed should be clearly stipulated.[11]

The parties gaining access to the data should be as open and clear as possible about how the data will be used, including by other parties downstream. This ensures transparency and increases trust of the data supplier. The contract can address this by specifying the exact usage that can be made of the data, including rights on derivatives of such data (e.g. analytics). Non-disclosure rules regarding downstream parties and others may be helpful in this respect.[12]

The DSA should moreover determine the technical means and modalities for data access and/or exchange. This includes among others the frequency of data access, maximum loads, IT security requirements and service levels for support.[13]

Considerations regarding the protection of data should be made at two levels. On the one hand, a company should require appropriate measures to be put in place for protecting its data. The measures ought to apply to data sharing transactions as well as data storage, taking account of the fact that data can be subject to theft or misuse by both organised groups and individual hackers. On the other hand, organisations should consider the protection of trade secrets, sensitive commercial information, licences, patents and other intellectual property rights. Neither party should aim at retrieving sensitive information from the other side as a result of the exchange of data.[14]

It is recommended to include liability provisions to cover situations of supply of erroneous data, disruptions in data transmission, low quality interpretative work if shared with datasets, or the destruction/loss or alteration of data (if unlawful or accidental) that may potentially cause damages. Companies are also advised to define a right for each party to perform audits regarding the respect of the mutual obligations. The duration of the contract and possibilities for termination should of course be carefully considered, as well as the applicable law and dispute settlement options.[15]

In addition to the legal (contractual) aspects, the Commission considers the technical aspects of B2B data sharing in its guidance. It notably distinguishes three types of technical data sharing mechanisms: (i) one-to-many via unilateral mechanisms, such as an application programming interface (API) or an industrial data platform; (ii) data monetisation via a many-to-many data marketplace; and (iii) data sharing via a technical enabler.

Illustration in the transport sector: Nallian[16] has created a cloud-based customisable platform that facilitates real-time data sharing in a controlled, flexible and agile environment and supports process synchronisation.[17] The users of Nallian's platform are currently logistics hubs and companies, vertical supply chains and multimodal transport networks.[18] Data suppliers can define rules for sharing and terms of use for the different members of the community through a rights-granting mechanism embedded in the platform (which could be qualified as a DSA).[19] Examples of communities relying on the Nallian platform relevant to the transport sector are BRUcloud[20], CargoStream[21], NxtPort[22], and Heathrow CargoCloud[23].


B2G
data sharing agreements

The Commission also identifies six principles to govern data sharing by private companies with public sector bodies (B2G data sharing), under preferential conditions for re-use. Said principles are listed in the table below.

Principle

DSAs should therefore:

Proportionality in the use of private sector data

Justify any requests for supply of private sector data under preferential conditions by clear and demonstrable public interest. Requests should be proportionate and the associated costs and efforts for the undertaking concerned should be reasonable compared with the expected public benefits.

Purpose limitation

Specify one or more purposes for the re-use of data by the public body, which may also include a limited duration for use of the data. Additionally, specific assurances should be offered by the public body that the data will not be used for unrelated administrative or judicial procedures.

ʻDo no harmʼ

Include safeguards to ensure that legitimate interests of the private company, notably the protection of its trade secrets and other commercially sensitive information, are respected, so as not to impede the company from being able to monetise the insights derived from the data in question with respect to other interested parties.

Conditions for data re-use

  • Seek to be mutually beneficial while acknowledging the public interest goal by giving the public sector body preferential treatment over other customers, particularly in terms of the agreed level of compensation.
  • Ensure that the same public authorities performing the same functions are treated in a non-discriminatory way.

Mitigate limitations of private sector data

Ensure that companies supplying the data offer reasonable and proportionate support to help assess the quality of the data for the stated purposes, including through the possibility to audit or otherwise verify the data wherever appropriate. Companies should however not be required to improve the quality of the data in question.

Transparency and societal participation

Be transparent about the parties to the agreement and their objectives, and ensure that public bodies’ insights and best practices of B2G collaboration will be disclosed to the public as long as those do not compromise the confidentiality of the data.

Similarly to the part on B2B data sharing, the guidance then lists a number of considerations to help public bodies and private companies in the preparation and/or negotiation of DSAs. These will not be examined in detail in this article but include topics such as (i) identification of a public interest purpose and of the private data concerned; (ii) identification of internal challenges and constraints related to the sharing of data; (iii) definition of technical means and modalities of data access and/or exchange; (iv) conditions for implementation; (v) common guiding principles for monitoring implementation of the contract; (vi) liability concerns; and (vii) dissemination by the public body of the results and/or insights of the collaboration without compromising the confidentiality of the data involved.[24]

The Commission also outlines the following technical means to achieve B2G data sharing: (i) data platforms; (ii) algorithm-to-the-data; and (iii) privacy-preserving computation.

Data sharing agreements: a critical analysis

As already mentioned in other articles in this article series, big data analytics involves a multitude of complex data flows, data sources, algorithms, analyses, etc. Also, it entails the participation of many different actors and many different activities that can be performed on the data. To this end, access to and/or exchange of data must be enabled and facilitated. It is apparent from our research that, at least from a legal perspective, this can currently only be achieved through the conclusion of data sharing agreements. In view of the aforementioned complexity and multitude of actors, data sources, data flows, algorithms, etc., an intricate chain of data sharing agreements should be put in place in order for the big data analytics to (legally) function in practice.

However, the authors of this article are reticent to settle for data sharing agreements as the one and final solution forevermore, given the inherent limitations of agreements in a big data context. Some of these limitations are briefly discussed below.

First, contractual agreements in principle only generate rights and obligations for the parties to such agreements. They can therefore not be enforced vis-à-vis third parties. In practice, this would entail that there is no recourse available against third parties that obtain unjustified access to and/or misuse the data.

Second, contractual agreements require a clear and precise definition of the concepts they intend to regulate. It proves however extremely difficult to clearly define the concept of "data" as no strict legal definition of this concept exists. In practice, this leads to a myriad of possible interpretations of "data" in different agreements without any harmonised view on the legal meaning of "data". In the same vein, similar difficulties arise when stakeholders active in the big data analytics lifecycle attempt to contractualise data ownership through the terms of the DSA, given that the concept of "data ownership" is not legally defined. Such stakeholders can therefore try to define the concepts of "data" and "ownership" as broadly as possible, thereby creating a far-reaching entitlement to any element included in the big data analytics process, which would practically impede the implementation of the big data analytics as a whole.

Third, aside from a broad definition of "data ownership", the specific terms of a data sharing agreement covering the permitted actions to be performed on or with the data may be phrased in a highly restrictive manner, thereby prohibiting actions such as reverse engineering, merging, enriching, sharing, decompiling, translating, adapting, arranging, preparing, structuring, cleansing, altering, displaying, reproducing, visualising, communicating, loading, running, transmitting, storing, observing, studying, testing, etc. In essence, this would render the whole data sharing exercise, and therefore the big data analytics, unworkable as the recipient(s) would be unable to do anything with the data.

Fourth, any restrictions on the downstream use of the data (such as e.g. those that may be imposed by a holder of intellectual property rights) and any warranties regarding the upstream source of the data (such as e.g. personal data collected directly from the data subject with the latter's consent) should be covered by complex back-to-back warranty clauses in the multiple data sharing agreements in order to ensure the proper legal functioning of the big data analytics. In absence of such clauses, the further use of data may be prohibited or restricted, which would allow blocking the whole big data analytics chain.

Conclusion

This article examined the common practice of using contracts, i.e. data sharing agreements, to govern the access to and/or exchange of data between stakeholders in a big data analytics lifecycle.

It is unclear, however, whether such practice enables covering all possible situations with the necessary and satisfactory legal certainty. Indeed, data sharing agreements entail numerous limitations in the absence of a comprehensive legal framework regulating numerous rights (e.g. ownership, access or exploitation rights) attached to data, the way in which such rights can be exercised, and by whom.

Against a background where the EU strives towards a data-driven environment in which both citizens and companies can reap the benefits of novel data technologies, but also against a background where the current legal framework does not sufficiently tackle all the issues related to data and where actors involved in the data value chain have no certainty as to the ownership of the data they have gathered, created, analysed, enriched or otherwise processed; a more solid and legally secure solution would be desirable.[25]

Our next article will address liability in the context of big data, with illustrations drawn from the transport sector.



This series of articles has been made possible by the LeMO Project (www.lemo-h2020.eu), of which Bird & Bird LLP is a partner. The LeMO project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement no. 770038.

The information given in this document concerning technical, legal or professional subject matter is for guidance only and does not constitute legal or professional advice.

The content of this article reflects only the authors’ views. The European Commission and Innovation and Networks Executive Agency (INEA) are not responsible for any use that may be made of the information it contains.



[1] European Commission, 'Synopsis Report: Consultation on the "Building a European Data Economy" Initiative' (European Commission 2017) 5 <http://ec.europa.eu/information_society/newsroom/image/document/2017-36/synopsis_report_-_data_economy_A0EFA8E0-AED3-1E29-C8DE049035581517_46646.pdf> accessed 23 October 2018; see also in the context of artificial intelligence: Hervé Jacquemin and Jean-Benoît Hubin, 'Aspects contractuels et de responsabilité civile en matière d'intelligence artificielle' in Hervé Jacquemin and Alexandre De Streel (eds), Intelligence artificielle et droit (Larcier 2017)

[2] Non-exhaustive and non-exclusive list

[3] Regulation (EC) 593/2008 on the law applicable to contractual obligations (Rome I) [2008] OJ L 177/6, art 3(1)

[4] European Commission, 'Synopsis Report: Consultation on the "Building a European Data Economy" Initiative' (European Commission 2017) 5 <http://ec.europa.eu/information_society/newsroom/image/document/2017-36/synopsis_report_-_data_economy_A0EFA8E0-AED3-1E29-C8DE049035581517_46646.pdf> accessed 23 October 2018

[5] Commission, 'Guidance on sharing private sector data in the European data economy Accompanying the document Communication from the Commission to the European Parliament, the Council, the European economic and social Committee and the Committee of the Regions "Towards a common European data space"' (Staff Working Document) SWD (2018) 125 final, 18

[6] European Commission, 'Cooperative, Connected and Automated Mobility (CCAM)' (European Commission 2018) <https://ec.europa.eu/info/law/better-regulation/initiatives/ares-2018-5349236_en> accessed 22 February 2019
[7] SWD (2018) 125 final, 3

[8] Ibid 6

[9] Ibid 6-8

[10] Ibid 6

[11] Ibid 7

[12] Ibid

[13] Ibid

[14] Ibid

[15] Ibid 7-8

[16] See <https://www.nallian.com>

[17] Everis Benelux, 'Study on Data Sharing between Companies in Europe' (European Commission 2018) <https://publications.europa.eu/en/publication-detail/-/publication/8b8776ff-4834-11e8-be1d-01aa75ed71a1/language-en> accessed 23 October 2018

[18] Ibid

[19] SWD (2018) 125 final, 11

[20] See <https://brucloud.com>

[21] See <https://www.cargostream.net>

[22] See <https://www.nxtport.eu>

[23] See <https://www.heathrow.com/company/cargo/cargocloud>

[24] SWD (2018) 125 final, 14-16

[25] Benoit Van Asbroeck, Julien Debussche and Jasmien César, 'White Paper – Data Ownership in the Context of the European Data Economy: Proposal for a New Right' (Bird & Bird 2017) <https://www.twobirds.com/en/news/articles/2017/global/data-ownership-in-the-context-of-the-european-data-economy> accessed 22 February 2019; Benoit Van Asbroeck, Julien Debussche, Jasmien César, 'Supplementary Paper – Data Ownership: a new EU right in data' (Bird & Bird 2017) <https://www.twobirds.com/en/news/articles/2017/global/data-ownership-a-new-eu-right-in-data> accessed 22 February 2019

Latest insights

More Insights
headphones and keyboard

Kingdom of Saudi Arabia: Imminent deadline for digital content platforms to comply with new KSA regulations

Oct 03 2024

Read More
cloud shape

Long-awaited German judgment by the District Court of Hamburg (Kneschke v. LAION) on the text and data mining exception(s)

Oct 01 2024

Read More
Keyboard and tablet on yellow background

UK: Developments in Direct-to-Device regulation

Sep 30 2024

Read More