- The regulation creates rules for sharing data between companies, administrations and individuals with safeguards for trust.
- Data intermediation services will have to notify the authority and meet neutrality conditions.
- It introduces data altruism: a voluntary register for organisations managing data donated for general-interest purposes.
The Official Journal of the European Union published on 3 June 2022 Regulation (EU) 2022/868 of 30 May on European data governance, known as the Data Governance Act. It will enter into force on 23 June 2022 and will be fully applicable from 24 September 2023, so companies have more than a year to prepare.
It is one of the first legislative pieces of the European data strategy. It governs the reuse of certain categories of protected data held by the public sector, establishes a notification and supervision regime for data intermediation services and creates a voluntary register for data altruism organisations. Its aim is for data to circulate with more trust and be used for the benefit of the economy and society. That transitional period gives time, but not for improvising: the obligations may affect business models based on data platforms.
What the regulation covers
The first block concerns protected public-sector data: data that, for reasons of commercial confidentiality, statistical secrecy, intellectual property or personal data protection, are not available as open data. The regulation sets conditions for their reuse, so that administrations can allow access in secure environments and with safeguards, and not merely refuse it.
The second block regulates data intermediaries, that is, those offering services that connect people who hold data with those who wish to use it, such as platforms or data marketplaces. They must be neutral, not use the data for purposes of their own other than the service and notify their activity to the competent authority. The aim is to have trusted intermediaries in a market that is still emerging. An example would be a public body that provides aggregated statistical data to researchers through a secure access environment.
Altruism and the European space
The third block introduces data altruism: individuals and companies can voluntarily donate data for general-interest purposes, such as scientific research or improving public services. The organisations that manage them may enrol in a voluntary register and use the label of data altruism organisation recognised in the Union, which provides a signal of reliability.
The regulation also provides for a European Data Innovation Board, which will advise the Commission, and sets safeguards for third-country access to non-personal data held in the Union. Intermediaries already providing services before 23 June 2022 will have until 24 September 2025 to meet their specific obligations. One of the ideas of the regulation is to prevent a few large operators from concentrating control of data and to make it easier for smaller companies to enter.
What to review
Companies that share, buy or sell data, or that develop platforms for doing so, should take an inventory of their data flows and check whether they fit the definition of an intermediation service. It is also worth reviewing contracts, access policies and security measures, and considering whether they wish to take part as re-users of protected public data.
It is important to remember that this regulation does not replace the General Data Protection Regulation: where personal data are involved, data protection rules will continue to apply. If your business depends on data, your legal adviser can help you assess how these rules affect your contracts, your platforms and your compliance calendar until September 2023.
Sharing data with safeguards is now a legal matter and not only a technological one, and the regulation sets deadlines for it.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
