On Wednesday 25 November, the European Commission presented its draft regulation for encouraging data flows between business sectors and Member States. The document contains proposals for measures to facilitate the re-use of some of the data held by the public sector and the requirement for data intermediaries to treat data neutrally (see EUROPE 12594/9).
“These new rules do not require anyone to share data, but facilitate the process by providing legal clarity”, said European Commission Vice-President Margrethe Vestager.
The Commission believes there is a willingness to increase data sharing, but the main obstacles are the high cost of transactions, the lack of data intended for re-use and the fragmentation of the regulatory framework (see EUROPE 12429/5).
No requirement regarding location
Strictly speaking, contrary to an implication contained in an earlier draft of the text, the Regulation does not introduce a data location requirement. “There is no requirement to store and process data in the EU. Nobody will be prohibited from dealing with the partner of their choice”, says the press release, which also mentions an “open but assertive attitude towards international data flows”.
At a press conference, Commissioner Thierry Breton highlighted adequacy decisions and standard contractual clauses governing this type of data flow. He added: “For data in the public domain, it is important to have further conditions for so-called ‘highly sensitive’ data”. He then quoted a series of examples, including restrictions on the number of times data can be accessed in non-Member States, restrictions on further transfers of data and, if required, a ban on the transfer of data to non-Member States. This would be done in full compliance with World Trade Organization rules.
Three areas of focus
Overall, the draft Regulation is based on three priorities: - improve the re-use of public sector data that cannot be made available as open data under Directive 2019/1024; - introduce common principles for data intermediaries; - encourage data altruism. The Regulation is due to come into force a year after it is adopted, and will also establish a European Data Innovation Board to support the process.
First, the document notes that some Member States have already created secure and privacy-friendly conditions for the re-use of public sector data. The Regulation will make these practices more widespread throughout the EU by increasing the likelihood of finding such data and by ensuring that public sector bodies are technically equipped to ensure that any re-use of data maintains privacy and confidentiality.
Second, the text prohibits data intermediaries from acting in their own interest (e.g. by selling the data they manage to another company or using it to develop their own product). These intermediaries will have to declare their interest, will be under the supervision of public authorities and will be listed in a register kept by the European Commission. The document does not include a requirement for intermediaries to set up a company, but does include a requirement for them to be legally represented.
The document emphasises the fact that an entity engaging in sharing data for the public good (data altruism) will be able to sign up to a new public register on a voluntary basis. The organisation must be not-for-profit and meet the transparency requirements and specific safeguards needed to protect the rights and interests of citizens and businesses. The draft Regulation can be found at: https://bit.ly/33eEKho (Original version in French by Sophie Petitjean)