‘Data Act’ and the European Data Economy: What it is, Who it Affects, and Why it Matters

The Data Regulation (DR), also known as the Data Act, has come into force. This text explains the types of data it covers and who it affects, outlines some of the rights and limits it introduces, and clarifies the purpose behind its creation.

We are not talking about personal data: the Data Regulation (DR) applies to data collected through the Internet of Things (IoT). This includes raw and pre-processed data captured via connected products (for example, connected cars, medical and fitness devices, industrial or agricultural machinery) and related services (i.e., anything that makes a connected product behave in a specific way, such as an app to adjust lighting brightness or regulate a refrigerator’s temperature). The scope also covers metadata, readily available data, and personal or non-personal data, although personal data remain subject to the provisions of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).

Understanding the DR is particularly relevant for the users of these connected products and small and medium-sized enterprises (SMEs), because it regulates who can access this data, under what conditions, and with what guarantees.

Regarding users, the person generating the data must be able to access it, and, if they wish, must be able to share it with another company of their choice. Similarly, companies need the consent of the IoT device user to use any non-personal data collected.

As for SMEs, the DR allows them to disregard abusive clauses that may be imposed by stronger companies in this context of access to and use of data. To this end, a clause is considered abusive if it aims to exclude or limit the liability of the party that has unilaterally imposed the clause in cases of intentional acts or gross negligence; leave the weaker party without remedies in the event of breach of contractual obligations; and grant the stronger party the exclusive right to determine whether the data provided complies with the contract or to interpret any contractual clause.

Or, for example, a clause is presumed abusive when it seeks to prevent the weaker party from obtaining a copy of the data they have provided or generated.

In all other respects, the DR refers to data exchange between companies, and between companies and public administrations, regarding minimum requirements for interoperability between cloud and edge services, as well as the participants of the data spaces.

But why has the European Union created this Regulation? In 2020, the European Data Strategy was established to strengthen the European Union (EU) data-driven economy and, therefore, also to improve its position relative to the US and China. The strategy is mainly structured around the DR, and the Data Governance Regulation (DGR, also called the Data Governance Act or Data Governance Law), which regulates the reuse of protected public-domain data, whether personal or non-personal, but also includes an investment plan for the development of infrastructure that makes the content of the rules practicable, sovereignty in the field of cloud services, and a whole action plan aimed at achieving the main objective.

In addition, the EU institutions are creating common European data spaces across various sectors: agriculture, energy, health, the Green Deal, finance, research and innovation, language, media, mobility, public administration, skills, cultural heritage, and tourism.

Having quality data would improve the opportunities for AI to thrive in Europe, as it is decisive for improving accuracy, performance in new cases, and reducing the risk of bias that, in turn, could lead humans to make poor decisions.

The DR, together with the DGR, aims to turn data generated by connected devices within the single market into an accessible asset, establishing rules for its use and reducing, as far as possible, legal and technical frictions, which, ultimately, is part of a strategy aimed at strengthening European digital sovereignty, opening markets to SMEs, and improving the quality of the data that feed AI systems.

Article published in Expansión