On 9 November 2023, the European Parliament adopted the harmonised rules on fair access to and use of data (the Data Act), which complements the Data Governance Act of November 2020 by laying down rules on the use of personal and non-personal data in all economic sectors EU-wide as part of the European Data Strategy announced in 2020 to move Europe into the digital age.
Background
This legislation was first proposed by the European Commission in February 2022 with the aim to boost innovation by removing barriers for access by consumers and businesses to data. Under ordinary legislative procedure, the European Parliament first adopted its position on 14 March 2023, followed by the position of the Council of the European Union on 24 March. The positions were not far apart in principle and on 27 June 2023 the Parliament and the Council resolved outstanding issues, paving the way for the introduction of the comprehensive new European data protection legislation.
Key points
The horizontal regulation will encourage investment in data generation by giving creators balanced control over their data. The Data Act sets the criteria for data sharing by laying down rules for the terms and conditions for data holders. In addition to regulating B2C and B2B data sharing relationships, the Data Act also regulates the provision of data to public sector bodies and EU institutions, agencies and bodies in cases of extreme necessity where these necessary data are not otherwise available (B2G). The new rules will also allow customers effective switching between different cloud computing service providers and safeguards against unlawful data transfers.
The final version of the regulation addresses decisions on controversial issues such as ensuring adequate provisions for the protection of trade secrets and intellectual property. Furthermore, in addition to non-binding model contractual terms on data access and use, non-binding standard contractual clauses on cloud computing contracts have been included and will be further developed by the Commission to assist parties in drafting contracts that are fair, reasonable and non-discriminatory in terms of their rights and obligations.
Next steps
The Data Act now awaits formal approval by the Council to become law, then will enter into force on the 20th day following its publication in the Official Journal and will become applicable 20 months after its entry into force, which is expected in the second half of 2025.
For more information on the Data Act and data protection in the EU, contact your CMS client partner or these CMS experts.
Co-author: Mária Góth
Social Media cookies collect information about you sharing information from our website via social media tools, or analytics to understand your browsing between social media tools or our Social Media campaigns and our own websites. We do this to optimise the mix of channels to provide you with our content. Details concerning the tools in use are in our privacy policy.