EU Data Governance Act provides framework for data sharing

The Data Governance Act became EU law last summer, but it only began to apply on Sunday 24 September.

The Act, proposed by the European Commission in late 2020, is multi-faceted.

The legislation is designed to enhance rights of organisations to access and re-use ‘protected data’ held by public bodies – including confidential data, information protected by intellectual property rights, and data constituting personal data for the purposes of data protection law – while setting out conditions on that re-use and retaining the right of public bodies to impose charges on such re-use. It remains to be seen how the legislation will interplay with existing legislation that provides such protection for information.

The Act also promotes the concept of regulated ‘data intermediation’ whereby service providers effectively act to facilitate data sharing between data holders, or data subjects, and data users – including, potentially, through online platforms.

Data law expert Andre Walter of Pinsent Masons said: “The need for exchanging data is greater than ever to facilitate innovation via data-driven business models. Yet, a majority of organisations still 'sit on’ their data and see it as their property. The problem, though, is that the first one sharing the data feels a ‘first mover disadvantage’, giving something with nothing in return. For the first time, the DGA regulates the data ecosystem and breaks through this conundrum. Clear requirements are provided for data intermediation services.”

The DGA also provides a framework for EU member states to establish new national policies promoting ‘data altruism’, should they wish to do so. It is not mandated. The concept is designed to encourage data subjects and data holders to make their data available for use in support of “objectives of general interest”, such as to support healthcare, combat climate change, or improve public services.

Walter said: “One example in this category is the German ‘Corona-Datenspende-App’ that was set up to ‘donate’ data, such as heart rate, body temperature, blood pressure, and sleeping patterns data, from fitness bracelets and smartwatches. Monitoring this data, researchers could identify possible Covid-19 hotspots at an early stage. Under the DGA, such altruistic service will have more legal certainty.”

Under the Act, a new European Data Innovation Board is to be set up to underpin some of the initiatives provided for in the legislation. It is envisaged that it would have a role in advising the European Commission on, for example, issues relevant to the re-use of public data and data altruism, and also help shape new guidelines – including common standards and practices to support data sharing and processing via new European data spaces, such as the European health data space.

Walter said: “While the DGA is an EU regulation that will have direct effect in EU member states, many of the provisions require underpinning actions to be taken by the member states themselves for the new data sharing system that the DGA provides for to fully function. There is not a clear picture on national implementation across the EU, but in the Netherlands the necessary legislation has still to be tabled before the national parliament.”

“Businesses, however, should not wait for governments to catch up – would-be data intermediation service providers should set up their governance and compliance programmes; public sector bodies should explore how they can make comply with the provisions on re-use of data they hold; and other businesses and research organisations that the DGA can benefit should ensure they have the appropriate safeguards in place to use data liberated under the Act,” he said.

Pinsent Masons is hosting an event in Amsterdam, in partnership with Arthur D. Little, on Tuesday 10 October, which will explore the latest trends and best practices for unlocking the power of data collaboration. Registration for the event is now open. Experts at Pinsent Masons recently explained how it is possible to mitigate risks around external data sharing to help businesses supercharge their organisation, and what data sharing models are available to select from.