Regulation of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) entered into force on 11 January 2024, and it will become applicable in September 2025. Entrepreneurs therefore still have 19 months to prepare for the changes. What changes does the new EU regulation provide for?
Data as essential resource
Data Act is part of European Strategy for data which aims at creating a single market for data that will ensure Europe’s global competitiveness and the EU’s leadership in the global data economy.
We are currently witnesses of a data revolution. Data is changing our lives and creating new opportunities for growth. It is the foundation of digital transformation with enormous importance for innovation, especially for the development of creative industries and services. Although the amount of data is growing at a very fast pace, it is not being used properly or its value is concentrated in the hands of relatively few large companies. Access to it in many cases is difficult. This waste of data can lead to innovation debt, which new initiatives and legislation adopted by the EU aim to protect us from.
Products and related services – what the new regulation relates to?
The regulation applies only to certain products and services. For the purposes of Data Act ‘product’ means a tangible, movable item, including where incorporated in an immovable item, that obtains, generates or collects, data concerning its use or environment, and that is able to communicate data via a publicly available electronic communications service and whose primary function is not the storing and processing of data. Related service is a digital service, including software, which is incorporated in or inter-connected with a product in such a way that its absence would prevent the product from performing one of its functions.
Data Act applies in particular to manufacturers of above described products and suppliers of related services placed on the market in the UE and the users of such products or services.
Who will gain?
The beneficiaries of the new solutions will be consumers, but also entrepreneurs, especially small and medium-sized enterprises. The objectives of Data Act are: facilitation of access to and the use of data by consumers and businesses and switching between cloud and edge services. How does this change affect consumers and boost competitiveness?
Consumers will gain better access to data collected or produced by devices, which will create new opportunities such as comparison of products and services, customization, improvements. Currently each device’s data is locked by its manufacturer which have access to it. This allows it to secure an advantage in the market and at the same time makes it more difficult for consumers to use other service providers. The lack of data on customers and their use of products is a major barrier to entry for new businesses.
According to EU after implementation of the new solutions prices for aftermarket services and repair of smart devices will be lower. Consumer gets access to the data stored on used device, so there will be opportunities to repair it in any repair service, not only manufacture’s.
Who will lose?
The point is not that anyone should lose out, because an innovative and competitive economy and fair access to data is rather a gain and appreciated value. However, this does not change the fact that the new regulation also imposes new obligations and implementing them will be costly and time-consuming.
First of all, products have to be designed and manufactured, and related services provided, in such a manner that data generated by their use are, by default, easily, securely and, where relevant and appropriate, directly accessible to the user. Secondly, before concluding a contract for the purchase, rent or lease of a product or a related service, the user should obtain information about data generated by the use.
Apart from the right of users to access and use data generated by the use of products or related services, consumers will gain right to share data with third parties. Data holder will be obliged to make available the data generated by the use of a product or related service to a third party, without undue delay, free of charge to the user, of the same quality as is available to the data holder and, where applicable, continuously and in real-time.
Moreover, providers of a data processing service are obliged to ensure that customers of their service can switch to another data processing service, covering the same service type, which is provided by a different service provider. What does it mean in practice? They have to remove commercial, technical, contractual and organisational obstacles, which inhibit customers from terminating (after a maximum notice period of 30 calendar days) the contractual agreement of the service or concluding new contractual agreements with a different provider of data processing services covering the same service type.
New responsibilities? – Yes, but not for everyone
As mentioned above new regulation applies in particular to manufacturers of products and suppliers of related services placed on the market in the EU, but not all of them. These obligations will not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises.
What are the concerns about the new regulation?
Entrepreneurs draw attention to the need to protect business secrets, databases and the company’s know-how that may be breached by sharing data with other entities. Data Act has been met with criticism from many who point out that there are still not enough safeguards to ensure appropriate protection of cybersecurity and trade secrets.
The second most frequently repeated objection concerns the question of the vagueness of the provisions of the regulation.
How to prepare for changes?
First of all, it is crucial to identify the company’s role in the new data economy. Which role does it play: acting as a manufacturer, a data holder, a provider of a cloud service, a user or a third party?
Data Act should be taken into account already at the design stage of new solutions. It is also necessary to determine how to provide consumers with access to data for products and services already offered. Companies should prepare new documentation, primarily the information clause. They need to review the templates of contracts in use. Data Act contains a lot of requirements and restrictions of contractual terms. That is why the vacatio legis is so long for this regulation.
By Anna Dabrowska – Lipka, Senior Associate, KWKR Konieczny Wierzbicki and Partners