EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
operability obligations for data processing services aim to prevent lock-in and enhance market contest - ability. Finally, all instruments recognise the need to safe - guard confidential business information. Trade secrets and commercially sensitive data remain protected, and access obligations must be implemented with While these principles are common across the frame - work, certain instruments introduce more specific obligations. For instance, the Data Act imposes duties on “data holders” to make product-generated data accessible to users and, in defined circumstances, to third par - ties. It also introduces interoperability and switching obligations for data processing service providers. Similarly, the Data Governance Act regulates data intermediation services and data altruism organisa - tions, requiring neutrality, transparency and organisa - tional safeguards. Organisational Compliance Considerations For organisations, compliance begins with identifying their role under the relevant instruments (data holder, user, intermediary or cloud service provider) and map - ping relevant data flows, particularly in IoT environ - ments. appropriate confidentiality safeguards. Instrument-Specific Rights and Duties Contractual arrangements must be reviewed to ensure alignment with access and FRAND standards, and technical systems assessed for interoperability and switching readiness. Internal processes should safe - guard trade secrets and commercially sensitive infor - mation. Where personal data is involved, GDPR obligations apply in parallel. 3.4 Regulators and Enforcement Under the Data Governance Act and the Data Act, member states are required to designate one or more competent authorities responsible for supervision and
enforcement. The institutional choice is left to national law, and approaches differ across the EU. Some member states have opted to entrust enforce - ment, at least in part, to their data protection authority, particularly where Data Act obligations overlap with personal data processing (eg, France, Spain). Others have designated digital, communications or com - petition regulators as lead authorities, reflecting the market-regulatory dimension of the framework (eg, Germany, Netherlands). This divergence reflects the hybrid nature of EU data economy legislation, which combines elements of data governance, digital market regulation and, in certain cases, competition oversight. Where personal data is involved, co-ordination with GDPR supervisory authorities is necessary. In parallel, disputes involving dominant platforms or data access conditions may also fall within the remit of competition authorities. Overall, enforcement remains decentralised but increasingly requires co-operation across regulatory domains, mirroring the integrated structure of the EU’s digital regulatory strategy. Online tracking technologies (including cookies, SDKs, pixels and similar device identifiers) are gov - erned primarily by Article 5 (3) of the ePrivacy Directive (Directive 2002/58/EC), as implemented in national law, in conjunction with the GDPR. Article 5 (3) establishes a general opt-in model: storing or accessing information on a user’s device requires prior informed consent, unless the technol - ogy is strictly necessary to provide a service explicitly requested by the user. This rule applies regardless of whether the data accessed is personal data. Where personal data is subsequently processed, the GDPR applies in parallel. Although the core consent requirement is harmonised, implementation and enforcement vary across mem - ber states. In practice, most member states require 4. Sectoral Topics 4.1 Use of Cookies
99 CHAMBERS.COM
Powered by FlippingBook