ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
For non-personal data, access and sharing obliga - tions under the Data Act/Data Governance Act are balanced against IP rights and trade secret protec - tion. The general rule is that sharing goes ahead, but the data holder may and should impose proportion - ate safeguards – for example, confidentiality clauses, technical access controls, or limiting the dataset to what is strictly necessary – so that disclosure does not destroy trade secret value or infringe IP. A refusal to share is allowed only in exceptional cases where no reasonable protective measures could prevent a serious risk of economic harm. Thus, conceptually, the system is a “dual compliance gate”: the GDPR determines whether and how per - sonal data can move; trade secret/IP law determines under what protections sensitive non-personal data can be shared, with access remaining the default out - come. 3.3 Rights and Obligations Under Applicable Data Regulation As a baseline, the Free Flow Regulation guarantees that non-personal data can be stored and processed anywhere in the EU, banning unjustified localisation rules. It also promotes portability and switching for professional cloud users, mainly through industry codes of conduct, and confirms that mixed datasets are governed jointly by the GDPR (personal layer) and free-flow rules (non-personal layer). The Data Governance Act does not impose broad pri - vate-sector access duties but sets trusted conditions for sharing. It regulates the re-use of certain protected public-sector data, creates a compliance regime for neutral data intermediation services, and enables vol - untary “data altruism” channels. The Data Act is the core horizontal regime. It gives users of connected products and related services a right to access the data they generate, and to require the data holder to share those data with a third party (data recipient). Data holders must design products/ services so that data is accessible by default, and must share B2B data under FRAND terms, with addi - tional safeguards for SMEs and controls on unfair con - tractual clauses. In parallel, the Act imposes strong switching, portability, interoperability and termina -
tion duties on providers of data processing services (cloud/edge), including removal of technical/contrac - tual lock-ins and limits on switching/egress fees. Any flow involving personal data remains fully subject to GDPR requirements; the Data Act does not override them. For organisations, the main action items are practical and contractual: • map and classify product-generated data (non- personal/personal/mixed); • build technical interfaces and APIs for user access and third-party sharing; • update notices and B2B templates to reflect FRAND pricing and Data Act unfair terms rules; • implement procedures to protect trade secrets proportionately when access is requested; and • for cloud providers, revise pricing, contracts and architectures to enable effective switching and interoperable portability. 3.4 Regulators and Enforcement In Italy, enforcement of the EU non-personal data regime is shared among multiple authorities. AgID is the lead authority for the Data Governance Act, over - seeing data intermediation services, data altruism registrations, and public sector data re-use; it also functions as the co-ordination hub. When data shar - ing involves personal or mixed datasets, AgID works with the GPDP to ensure GDPR compliance. Where access or FRAND terms create competition or unfair- contract concerns, the AGCM intervenes, and the ACN provides support in cybersecurity/cloud-security aspects. For the Data Act, Italy is moving towards a multi- authority model: digital/data-governance functions close to AgID, technical/market-surveillance authori - ties for connected products, the GPDP for the person - al data layer, and the AGCM for FRAND, unfair terms and anti-lock-in issues. The main trend is co-ordinated enforcement: Data Act cases are increasingly treated as “hybrid” matters requiring simultaneous privacy, competition and technical oversight, with regulators prioritising practical outcomes (IoT user access and cloud switching) over purely formal classifications.
208 CHAMBERS.COM
Powered by FlippingBook