The EU’s Data Act introduces harmonised rules on fair access to and use of data and is foreseen to foster data-based innovation.
In February 2022, the European Commission proposed the European Data Act on harmonised rules on fair access to and use of data. The Data Act is a key pillar of the European data strategy and, therefore, also the Digital Decade. The regulation should complement the Data Governance regulation (see SwissCore article). While the Data Governance Act creates the processes and structures to facilitate data-sharing, the Data Act clarifies who can create value from data and under which conditions. The Data Act also sets up rules regarding the use of data generated by Internet of Things (IoT) devices. Moreover, the Data Act aims to ensure consistency between data access rights, which are often developed for specific situations and therefore have varying rules and conditions.
Regarding the scope of the legislation, the Data Act will enable users of connected devices, spanning from smart home appliances to sophisticated industrial machines, to access the data generated through their usage. This data is typically collected and used exclusively by manufacturers and service providers.
The measures introduced with the Data Act include four main paths. Firstly, it includes measures to increase legal certainty for companies and consumers who generate data on who can use what such data and under which conditions, and incentives for manufacturers to continue investing in high-quality data generation. Secondly, measures to prevent the abuse of contractual imbalances that hinder fair data sharing. Small and medium-sized enterprises (SMEs) will be protected against unfair contractual terms imposed by a party enjoying a significantly stronger market position. Thirdly, means for public sector bodies to access and use data held by the private sector that is necessary for specific public interest purposes will be introduced. And lastly, the Data Act includes new rules setting the right framework conditions for customers to effectively switch between different providers of data-processing services to unlock the EU cloud market.
The Data Act is foreseen to be a powerful engine for innovation and new jobs, as it allows the EU to ensure being at the forefront of all data-based innovation through enhanced data access and the stimulation of a competitive data market. The implementation and enforcement tasks are left to be conducted on a national level by the Member States.
The co-legislators reached a political agreement on the Data Act back in June 2023. On 9 November, the European Parliament adopted the final version of the Data Act, and finally, the Council of the EU also did so on 27 November 2023. With this, the adopted text becomes law and will enter into force 20 days after its publication in the EU official journal, which is expected in the coming weeks. The Data Act will then become applicable after 20 months, except for the requirements for simplified access to data for new products under Article 3(1), which will only apply after 32 months upon entry into force.