The European Commission proposed new rules on February 23 to complement existing legislation governing data. The proposed Data Act is the second main legislative initiative resulting from the European strategy for data that intends to boost the EU’s leadership in the regulation of the data-driven society.
While the proposed rules are not indented to limit the capacity of Big Tech companies to collect data generated in Europe, these rules may oblige them to share more data with EU firms and consumers. The Data Act seeks to empower consumers by giving them the option to easily take their data from one provider to another, and for small and medium companies to have more power to negotiate better data-sharing contracts.
The proposed rules, according to the Commission, would “ensure fairness in the digital environment, stimulate a competitive data market, open opportunities for data-driven innovation and make data more accessible for all.”
For instance, users of connected devices, like smartwatches or virtual assistants, could access their data and share it with third parties to provide other data-driven services. The rules may help SME in Europe and still will enable Big Tech companies and other manufacturers to harvest data from the same devices. However, some provisions may be aimed at not only promoting competition between firms, but also boosting EU presence in some industries — and this is the case for cloud computing. The new rules will make it easier for customers to switch cloud data-processing services providers, and the EU is very concerned about the lack of strong EU players in this sector. This provision could facilitate some EU companies to scale up their operations.
The proposal also includes measures to prevent abusive contractual terms in data sharing contracts (and rebalance negotiation power for SMEs). Notably, the Commission will develop model contractual terms to help companies to draft and negotiate fair data-sharing contracts. These models or templates likely won’t be imposed on non-EU companies, but there is a possibility that they become an industry standard if the European Commission sees those as a way to validate data-sharing contracts.
“Today is an important step in unlocking a wealth of industrial data in Europe, benefiting businesses, consumers, public services and society as a whole. So far, only a small part of industrial data is used, and the potential for growth and innovation is enormous. The Data Act will ensure that industrial data is shared, stored and processed in full respect of European rules. It will form the cornerstone of a strong, innovative and sovereign European digital economy,” said Thierry Breton, Commissioner for Internal Market.
The new legislation also intends to "place safeguards against unlawful data transfer," which could affect American or other foreign companies. Data disputes between the EU and the U.S. tech giants have been growing since the Edward Snowden mass surveillance leak of 2013.
The effects of these new regulations are not as straightforward as it may seem. For instance, Meta already warned investors in the last quarterly report that the data rules in Europe could affect the company's ability to transfer data from the EU to the U.S. and subsequently, this could have a significant impact in the operations of Facebook and Instagram in the region.
Read More: Regulator Could Order Meta to Stop EU-US Data Transfers
The Data Act intends to complement the General Data Protection Regulation. The latter mostly relies on the principle of informational self-determination, which leaves the policing of the privacy markets to the consumers themselves by assuming that the users will be engaged in taking care of their privacy (for instance, by requesting companies to delete their data). The Data Act, however, relies on a more transactional logic. If many of the privacy-related problems are in part due to the lack of competition, the Data Act can have an interesting effect easing the development and functioning of data markets.
The proposed rules will need to be debated in the EU Parliament, where lawmakers could introduce amendments to the text. The final text won’t likely enter into force until 2023.
Read More: EU Council May Push for DMA, DSA Approval Before Summer
Sign up here for daily updates on the legal, policy and regulatory issues shaping the future of the connected economy.
