In recent years, the European Union (EU) has been working to regulate the digital world. The goal is to give citizens more control over their data and to impose stricter rules on large companies. With the Data Act, that has entered into force on January 11th, 2024, there will be rules for accessing data, making data available to the government and switching between cloud services. What exactly does this Regulation entail? And perhaps more importantly, what does it mean for you and your business?
The EU is busy implementing its Digital Agenda. In that context, many regulations and directives have already been adopted, such as the GDPR, the AI Act and the NIS 2 Directive. The Data Act is the next step in this strategy. Among other things, this act sets rules on:
-
Transparency about and access to the data a product collects and generates
-
Switching between cloud services
-
Government requisitioning of data
-
Prohibited clauses and mandatory clauses in contracts
-
Interoperability
These rules apply to any company that collects data or sells smart devices, from phone vendors to tech giants.
Transparency and access
Central to the Data Act is the duty for manufacturers and sellers to be transparent. A product such as a phone or cloud subscription must be designed so that the data generated can be easily and securely accessed by default. The seller or provider must be clear about this to the customer. For example, before buying or entering into the subscription, information must be given about what data is being collected, whether or not it will be generated in real time, who will use the data and how the user can access the data.
In addition, under the Data Act, the user of services and products is given the right to have the data made available free of charge. If a user wants to, the data holder is also obliged to share the data with a third party. This recipient may not then misuse the data for its own gain; the right exists specifically to accommodate the user.
Switching between cloud services
In this context of data access and transfer, there is also an important focus on the right to switch between cloud services. For example, the Act prohibits commercial, technical, contractual or organizational issues that prevent users from canceling or entering into an agreement with another provider. This makes it mandatory for a party like Google or Apple to enable switching between Google Drive and iCloud. The goal here is to achieve "functional equivalence."
For the first 3 years of the Act, providers are allowed to charge a fee for this, but after that, the cloud switch must be provided free of charge.
Claiming data
In exceptional situations, the government is given the right to request a data holder to make data available. This can happen in three cases:
-
There is a general emergency;
-
There is a threat of a general emergency that the government is trying to prevent;
-
The lack of available data prevents the government from fulfilling a specific task in the public interest. This option only applies when there is no way to purchase the data, and the data would significantly reduce administrative burdens.
If the government makes a substantiated request in any of these three cases, it may request and use the data, limiting it to necessary uses.
Contracts
The Data Act mandates and prohibits a number of contractual provisions.
A contract involving data processing services must mandatorily include provisions for switching to another service or to an on-premise environment. This switch must be provided within 30 days. A full specification of all categories of data that may be exported during the switch must also be offered, including all data originally entered by the customer, and all data and metadata created.
All contracts for products and services that collect data are prohibited from including provisions that grossly deviate "from good commercial practice in data access and use, contrary to good faith and fair dealing." This means, for example, that liability for gross negligence may not be excluded. Also, a provision that makes it difficult to obtain and use data is deemed unfair (and is therefore prohibited).
Interoperability
Finally, data space operators must ensure that they are compatible with other data spaces. That means they must describe a whole host of matters, and that they must enable the use of smart contracts. For example, the data set, usage restrictions, licenses, data collection methods, data quality and uncertainty must be described so that the recipient can find, access and use the data. In addition, data structures, data formats, vocabularies, classification schemes, taxonomies and code lists must be described in a manner that is publicly accessible and consistent. Finally, technical access to the data, such as interfaces and terms of use, should be described to allow for automatic access to and transfer of data between parties.
Future
The obligations under the Data Act are very far-reaching at points, and demand a lot from companies. The openness that the Data Act seeks to achieve is certainly not always the norm at this time. In addition, there are many companies that may have to (partially) revise their business models. There is still time for companies to properly prepare for the Data Act. The actual entry into force of the Data Act will be sometime in 2025.
The Data Act brings big changes. Are you active in the IT industry and do you have legal questions about the Data Act? Or are you a seller of technical products and want to know more about your rights and obligations? Then feel free to contact me or one of my colleagues IT Law.
