- Member states may not require that non-personal data be stored or processed in their territory, except for public security.
- Authorities keep access to the data even if it is held in another Union country.
- It will apply from 28 May 2019, and makes it easier to switch cloud service providers.
On 28 November 2018 Regulation (EU) 2018/1807 on a framework for the free flow of non-personal data was published in the Official Journal of the European Union. The rule, signed on 14 November, enters into force on 18 December and will apply from 28 May 2019.
Its aim is for data that is not personal, such as industrial, machine or sensor data, to be stored and processed anywhere in the Union without unjustified national obstacles. It is a piece of the digital single market, complementary to the General Data Protection Regulation, which already guarantees the free movement of personal data.
What the regulation prohibits
The regulation prohibits data localisation requirements, that is, rules or practices that oblige data to be stored or processed in a specific member state or that make it difficult to do so in another. Such restrictions are only admitted when justified by public security. Member states must also make public the requirements they maintain.
This affects companies that buy cloud or hosting services: they will be able to choose the provider and the location of the data centre within the Union with greater freedom. It also opens a market to digital infrastructure providers, including data centres, which will be able to serve customers in other countries without localisation barriers.
Access by authorities and switching provider
Competent authorities keep access to data for the exercise of their functions, even if it is stored or processed in another member state, and cooperation mechanisms between administrations are provided for. It is an important guarantee for supervisors, tax authorities and other bodies that need to consult company information.
The regulation also encourages self-regulatory codes of conduct that make it easier to switch service provider and port data, so that a company is not tied to one cloud. It does not create an enforceable right to portability, but it encourages more transparent contract terms.
Personal and mixed data
The distinction between personal and non-personal data is not always simple. The same data set may contain both types, and when it does, the General Data Protection Regulation applies to the personal part. This separation obliges companies to know well what information they process and where, and to document it.
For companies operating in several countries, the regulation reduces the risk of a national rule imposing their own infrastructure on them. However, it does not remove sectoral obligations, nor does it affect tax or accounting rules requiring certain records to be kept, which must be analysed case by case.
What to review
Companies can review their cloud and hosting contracts: where data is stored, what happens if they want to change provider, how data is returned and in what format. It is also worth taking an inventory of which data is personal and which is not, and whether localisation requirements remain in force in their sector for public security reasons.
For technology providers and data centres, the rule opens the possibility of winning customers from other Union countries. It is worth reviewing commercial terms, security certifications and service-level agreements, and preparing the offer in good time with legal and technical advice.
Data will be able to travel more freely across the Union, and companies should always know where it is and who is responsible for it.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
