Will companies be obliged to provide data access by design?

Another important plank of the EU’s scaffolding to construct a Digital Single Market fell into place when the European Commission published its new proposal for a Data Act on 23 February 2022. In an economy where products are increasingly a mere carrier for services, this proposal is designed to unlock troves of industrial data. According to the Commission, an estimated 80 per cent of industrial data is currently unused.

Objective of the proposal

The Data Act proposal sets common basic rules on who can use and access data across all economic sectors. It aims to create a Single Market for data in which this valuable resource is more accessible and can be shared without legal obstacles among European businesses and the public sector. In doing so, the Commission hopes that increased sharing of data will also support the bloc’s digital and green transitions.

Taking the form of a horizontal Regulation, the Data Act will be directly applicable to the 27 EU Member States. By creating this new legal framework, the Commission aims to encourage fair business-to-consumer, business-to-business and business-to-government exchange of data. The rights of users to port data will be spelt out more clearly. In addition, customers of cloud processing services will also be able to switch service providers more easily.

Small and medium-sized companies are set to benefit from the Data Act which will place mandatory obligations on data holders to make their data available under fair, reasonable and non-discriminatory (FRAND) terms. In this context, it is notable that very large companies designated as “gatekeepers” under the Digital Markets Act (DMA) are prohibited from receiving users’ data under the terms of the Data Act.

Infringements of the Data Act will be subject to fines to be determined by the competent authorities designated by the Member States. Similar to the General Data Protection Regulation (GDPR), fines may amount to EUR 30 million or up to 6% of total worldwide annual turnover.

Impact on different business sectors

This proposal will have implications for a wide range of industries including the automotive and life science sectors, as well as virtual assistants and smart home devices. As part of the Commission’s data strategy., the Data Act proposal is also meant to complement the recently agreed Data Governance Act.

At the launch of the proposal, Commission Executive Vice President Vestager and Internal Market Commissioner Thierry Breton made it clear that the Data Act will be followed by other sector-specific instruments to set further rules around data use and access in the health and mobility sectors and possibly also in the agricultural sectors.

Key obligations

Among other aspects, the proposal for a Data Act sets out rules regarding the following:

• Manufacturers and designers should design products in a way that data is easily accessible by design or by default;
• Data holders will be obliged to make data available to another enterprise on fair, reasonable and non-discriminatory conditions and any compensation must also be reasonable;
• Contractual terms unilaterally imposed by an enterprise on an SME will not be binding if they are unfair or grossly deviate from good commercial practice in data sharing;
• Public sector bodies and EU institutions will have free access to data held by enterprises in cases of “exceptional need” such as public emergencies, pandemics or disasters;
• Requirements imposed on providers of cloud, edge and other data processing services to enable switching between services to avoid lock-in effects;
• Safeguards regarding potentially unlawful third-party access to data processing services offered on the EU market;
• Additional rules are foreseen outlining common specifications on interoperability and essential requirements for the use of smart contracts in order to support data sharing; and
• A clarification to the existing Database Directive is included in the proposal to specify that databases containing machine-generated data are excluded from the protection of the sui generis.

Publication of the Data Act proposal has already triggered concerned statements from some industry groups. The Computer & Communications Industry Association, for example, which stated that European and international companies would face new restrictions regarding the transfer of non-personal data outside the EU, or even to process such data within the bloc.

We can expect intense discussions over the next months over the interplay of this regulation with the GDPR, competition law and the intellectual property framework including trade secrets.

Next steps

The Council and the European Parliament will now begin in the next weeks to discuss and amend the proposal. In the Parliament, leadership of this file still must be decided, but if it follows a similar course to the Data Governance Act, it is likely that the Industry, Research & Energy Committee (ITRE) will draft the main report, with the Civil Liberties Committee (LIBE), Legal Affairs Committee (JURI) and Internal Market Committee (IMCO) providing opinion reports.

For further information, contact Francine Cunningham

Sign up for our Connected newsletter for a monthly round-up from our Regulatory & Public Affairs team.