- On 27 November the EU Council adopted the Data Act, after the European Parliament’s vote on 9 November.
- It gives users of connected products the right to access the data they generate and to share it with third parties.
- It sets rules on unfair terms in data contracts and makes it easier to switch cloud service providers.
On 27 November 2023 the Council of the European Union adopted the Data Act, completing its legislative process. The European Parliament had approved the final text on 9 November, with 481 votes in favour, 31 against and 71 abstentions. Only signature and publication in the Official Journal of the European Union are needed for it to enter into force, and most of its rules will apply after a transitional period.
The Commission proposed the measure on 23 February 2022 as part of the European data strategy. Its underlying idea is simple: the data generated by connected devices —a vehicle, an industrial machine, a smart appliance— should not remain exclusively in the manufacturer’s hands. Whoever uses them should be able to access them and decide who to share them with, and the market for services built on that data should be more open and competitive.
Access to data from connected products
The regulation gives users of connected products and related services the right to access, in a timely way, the data generated by their use and to share it with third parties of their choice, such as an independent workshop, an insurer or a maintenance service provider. Data holders, generally manufacturers, will have to make the data available on fair, reasonable and non-discriminatory terms.
Micro and small enterprises enjoy certain exemptions as manufacturers and more favourable conditions as data recipients. The regulation complements, and does not replace, personal data protection rules: where the data includes information about individuals, the General Data Protection Regulation and the rules on privacy in electronic communications continue to apply.
Contracts and cloud services
The text provides that unfair contract terms on access to and use of data, imposed unilaterally on a company, are not binding on it. The aim is to balance the position of small businesses against large providers, which often set the conditions. It also includes rules for switching providers of data-processing services, such as the cloud, with fewer technical, contractual and economic obstacles.
The latter affects any company that buys cloud services: dependence on a single provider, exit costs and the difficulty of migrating data are common concerns today. The regulation aims to make switching provider possible without disproportionate obstacles, although technical details and deadlines will be fleshed out over time. It also provides that in situations of exceptional need, data holders must make data available to public bodies.
What to review
Manufacturers and sellers of connected products —machinery, vehicles, household or industrial devices— should analyse what data their products generate, who can access it and how the user is informed, since product design will have to make that access easier. It is advisable to start to map data flows and review contracts with customers and suppliers.
Companies that buy cloud services can review their contracts on duration, exit costs, data portability and termination conditions, and assess whether they depend too much on a single provider. For everyone else, the regulation is a signal of where European data regulation is heading. This note is general information; for your case, consult your adviser.
Data stops being a by-product of the device and becomes a matter of rights and contracts.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
