Data Governance Act

The ever-increasing volume of data is extremely important to today's economy.

Data is an integral part of the digital transformation enabling innovation in every sector. Recognizing the need to provide a framework for the use of data, the European Commission (hereinafter "EC"), in a communication issued in February 2020, outlined a European Data Strategy, one of the goals of which is to create a single common data market based on a harmonized framework for data exchange, crucial for the dynamic development of new technologies. As a result, the EC at the end of 2021 proposed the adoption of the Data Governance Act (hereinafter "DGA"[1]), which was published in the Official Journal of the European Union on 3 June 2022. The DGA provides for, among other things, conditions for the re-use of certain categories of data held by public sector entities, or a framework for notification and supervision for the provision of data intermediation services providers. The DGA amends Regulation (EU) 2018/1724[2] and otherwise supplements the regulations already adopted (both at the EU and national levels), without prejudice to their provisions. The regulation entered into force on 23 June 2022. Entities covered by the DGA provisions have time until September 24, 2023 to adapt their activities to the new rules.

Key points

Conditions for the re-use of the data held by public sector bodies

The DGA provides rules for the re-use by natural or legal persons of data held by public sector bodies, for both, commercial or non-commercial purposes, other than their original purpose within the framework of public tasks, for which the data was created.

The DGA introduces a mechanism allowing the re-use of certain categories of public sector data that are protected due to the rights of others - in particular, for reasons of commercial confidentiality, protection of intellectual property rights of third parties or protection of personal data. A ban on exclusivity arrangements is also introduced, which means that, in principle, it will not be possible to conclude agreements or engage in other practices that have the purpose or effect of granting exclusive rights or limiting the availability of data for re-use by others. Concluding an exclusive agreement for the re-use of public sector data will be possible to the extent necessary to provide a service or product in the general interest that would not otherwise be possible.

The DGA also provides for the obligation of each member state to establish a single information point to receive inquiries or requests for data re-use.  At the European level, a European single information point is also established, offering an electronic registry of data available at national level in single information points.

Data intermediation service

The DGA is introducing regulations governing the terms and conditions for the provision of data intermediation services, aiming at greater security to natural or legal persons sharing the data.

Intermediation services providers are to act as neutral providers whose role will be limited to brokering transactions. Thus, the use of exchanged data for other purposes is prohibited. In the case of providers offering their services to individuals, it will also be necessary for them to meet the additional criterion of assuming fiduciary duties towards the individuals who use the data, in order to ensure that they act in the best interests of the data subjects.

Intermediation services providers are subject to notification to the register of data sharing service providers, allowing them to be verified as reliable entities. The activities of intermediation services providers are subject to monitoring and supervision by the competent authorities established by each member state.

Data altruism

Data altruism is intended to allow individuals and businesses to more easily share data based on their consent for purposes of general interest. The DGA also introduced data altruism mechanisms, allowing organizations that wish to collect data for general interest purposes to register as a "data altruism organisation recognised in the Union" to increase trust in their activities. An organization intending to obtain such title and sign in with the relevant register will have to meet a number of requirements.

Data altruism organizations will be monitored and supervised by the authorities competent for the registration of altruism organizations, established by each member state.

European Data Innovation Board

A group of experts (the European Data Innovation Board) is being established to advise the EC and help coordinate national practices and policies on issues covered by the DGA, particularly concerning data intermediation services and altruistic approaches to data.

Sanctions

The DGA does not explicitly provide for sanctions, pointing to the role of member states to establish provisions for penalties applicable to violations of obligations, as well as to take all necessary measures to ensure their enforcement. Member states have until September 24, 2023 to notify the EC of the said provisions and measures.

[1] Regulation (EU) 2022/868 of the European Parliament and the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act)

[2] Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October 2018 establishing a single digital gateway to provide access to information, to procedures and to assistance and problem-solving services and amending Regulation (EU) No 1024/2012