EU reaches agreement on Data Act - new rules for industrial data use forthcoming

(Image by S. Hermann & F. Richter from Pixabay )

The European Commission is progressing closer towards its proposed EU Data Act, after the European Parliament and the Council of the EU reached political agreement this week on new rules for the use of industrial data across the trading bloc. The rules were proposed by the Commission in February 2022 and are now subject to formal approval by the two co-legislators. 

As highlighted by diginomica last year, the EU Data Act forms one of the building blocks of the Commission’s data strategy and aims to stimulate a competitive data market, making data generated by connected devices more accessible, reusable and shareable. 

The legislation has significant implications for both processors and users of data and given that it includes both personal and machine data, arguably goes way beyond the scope of what the EU’s GDPR data protection legislation covers. 

But the European Commission’s hope is that the wide scale access and availability of industrial data will drive new markets, business models and use cases for organizations in the EU. What will be particularly interesting is how the Data Act is applied to companies that are extracting machine data and applying that to machine learning and AI models - and how that data is accessible and reusable. 

Commenting on political agreement being reached, Erik Slottner, Swedish Minister for Public Administration, said: 

Today’s agreement will accelerate our Union’s digital transformation. Once the Data Act enters into force, it will unlock the economic and societal potential of data and technologies and contribute to an internal market for data. 

It will enhance the single market, allowing data to flow freely within the EU and across sectors for the benefit of our citizens and businesses.

The EC believes that the majority of this data is not being used to its full potential at present, with 80% of industrial data never used. Industrial data in this context means data generated by machines, devices and users. 

The Data Act, the EC states, addresses the legal, economic and technical issues that lead to data being under-used. It believes that the new rules will make more data available for reuse and generate €270 billion of additional GDP by 2028.

Simply put, the EC believes that data should be comparable to when you buy a ‘traditional' product. In that when you buy a ‘traditional' product, you acquire all parts and accessories of that product. However, when you buy a connected product (e.g. a smart home appliance or smart industrial machinery) generating data, it is often not clear who can do what with the data. Or it may be stipulated in the contract that all data generated is exclusively harvested and used by the manufacturer.

The Data Act aims to give both individuals and businesses more control over their data through a reinforced data portability right, copying or transferring data easily from across different services, where the data are generated through smart objects, machines and devices.

The detail

The political agreement clarifies the scope of the regulation, allowing users of connected devices, ranging from home appliances to smart industrial machinery, to gain access to data generated by their use - which as noted above, is often exclusively harvested by manufacture and service providers. 

The European Commission (EC) outlines that the Data Act includes: 

• Measures that enable users of connected devices to access the data generated by these devices and by services related to these devices - the EC says that users will be able to share such data with third parties with the hope that this will boost aftermarket services and innovation.

• Measures to provide protection from unfair contractual terms that are unilaterally imposed - the EC aims to safeguard EU companies from unjust agreements, fostering fair negotiations and enabling SMEs to participate more confidently in the digital marketplace.

• Mechanisms for public sector bodies to access and use data held by the private sector - public sector organizations will be able to access and use data in cases of public emergencies such as floods and wildfires, or when implementing a legal mandate where the required data is not readily available through other means

• New rules that grant customers the freedom to switch between various cloud data-processing service providers - the EC says that these rules aim to promote competition and choice in the market while preventing vendor lock-in. Additionally, the Data Act includes safeguards against unlawful data transfers, with the aim of ensuring a more reliable and secure data-processing environment.

• Measures to promote the development of interoperability standards - the aim being to encourage more data-sharing and data processing, in line with the EU Standardization Strategy.

The EC will also introduce penalties for breaches of the proposed EU Data Act, where the supervisory data protection authorities in each member state can impose fines. The fines will fall in line with GDPR penalties, which are up to €20 million or 4% of global annual turnover (whichever is greater). 

Implications

Global law firm Eversheds has published its thoughts on the introduction of the EU Data Act, where it says that the legislation demonstrates the Commission’s “growing awareness” of the competitive power of data and need for transparency. 

Eversheds’ legal team state that the requirements and legal framework set out by the EU Data Act are “no doubt beneficial” for a fairer and competitive market, and also maximize the benefits of the wider data economy. However, they raise concerns about the ability for EU authorities to enforce its provisions. 

It adds that data holders should be preparing to make extra provisions for users of connected products to access their data, given that the EU Data Act states that if users are unable to do so themselves, the provider of the product or service must make the data available “without undue delay, free of charge and, where applicable, continuously and in real time”. Eversheds adds: 

Therefore, platforms that are covered by the proposed Data Act should consider building in features and functionality, including reviewing existing APIs and user-request processes to prepare for such data requests. It could be particularly costly to retrofit such functionality.

My take

Although this is EU legislation, as we have seen with GDPR, the consequences will likely be global. There are many rapidly growing vendors that are making use of industrial data at their core, which will now have to think through how to make that data increasingly accessible and shareable for end users. Equally, those companies that are using industrial data as part of their AI/ML plans will have to think through the consequences of the legislation - how is that data made accessible? But if we are going to commit to data being the engine of the future economy, then 80% of industrial data remaining unused seems shortsighted. If, when and how this all unfolds will be unexpected though and the consequences of the use cases are unpredictable.