FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
This interaction creates specific legal constraints. For example: • Legal basis – The Data Act grants rights of access and sharing but does not create a standalone GDPR legal basis for processing personal data. Where disclosure involves personal data – espe - cially if the requesting user is not the data subject – a valid GDPR legal basis must independently exist. • Trade secrets and IP – The Data Act protects trade secrets and intellectual property. As a rule, access should be enabled with appropriate confidentiality measures; refusal to share on trade secret grounds is limited to narrowly defined and exceptional cir - cumstances and cannot serve as a pretext to block legitimate access. 3.3 Rights and Obligations Under Applicable Data Regulation Access and Sharing of Connected Product Data The Data Act gives users of connected products and related services the right to access and share certain “readily available” product and related service data, including necessary metadata (Articles 3–7). Accordingly, data holders must notably: • design products for data accessibility (for products placed on the market from 12 September 2026); • provide access without undue delay, free of charge, in a structured, commonly used, machine-readable format (including continuous/real-time access where relevant and technically feasible); • enable user-directed sharing with third parties under equivalent conditions; • respect the GDPR where personal data is involved; • apply trade secret protections only where justified, proportionate and safeguarded; and • ensure third-party use complies with statutory limitations. B2B Fairness and Cloud Switching The Data Act controls unfair terms in B2B data-shar - ing contracts where clauses are unilaterally imposed by one party, and it regulates the concept of reason - able compensation in certain mandatory data-sharing scenarios, including specific safeguards in defined SME-related situations. To support implementation,
the European Commission issued non-binding Model Contractual Terms and Standard Contractual Clauses in November 2025 (Chapter IV). In relation to switching between data processing ser - vices (including cloud and edge computing services), providers must: • allow switching with no more than two months’ notice; • complete the transition generally within 30 calen - dar days (subject to exceptions); and • eliminate switching charges entirely from 12 January 2027, following a transitional cost-based regime (Chapter VI). Public Sector Access and Third-Country Requests The Data Act permits public sector bodies to access privately held data only in situations of “exceptional need”, including certain emergencies, and subject to strict requirements of necessity and proportionality (Chapter V). It also establishes safeguards against unlawful access by third-country authorities to non- personal data held in the EU, with implications for contractual arrangements and cloud governance structures (Chapter VII). Key Organisational Priorities Organisations should: • identify whether they qualify as data holders and/or providers of data processing services; • map “readily available” product/service data; • implement compliant access and sharing mecha - nisms; • align contracts (data-sharing and cloud) with fair - ness and switching rules; • update mandatory information and ensure GDPR alignment; and • document trade secret and non-discrimination safeguards. 3.4 Regulators and Enforcement ARCEP is the competent authority for enforcing the cloud-related provisions of the SREN Law. It has investigative powers, can settle disputes, and may impose fines of up to 3% of worldwide annual turno -
123 CHAMBERS.COM
Powered by FlippingBook