EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
The Data Governance Act (Regulation (EU) 2022/868) complements this framework by creating mechanisms to encourage voluntary data sharing. It regulates data intermediation services, introduces a framework for data altruism organisations, and establishes condi - tions for the reuse of certain protected public sector data. The Data Act (Regulation (EU) 2023/2854) goes further and provides a broad, cross-sector regime governing access to and use of data generated by connected products and related services, including in the IoT environment. It imposes obligations on data holders to make data available to users and, in defined circum - stances, to third parties. It also introduces business- to-business data sharing obligations subject to fair, reasonable and non-discriminatory (FRAND) condi - tions, establishes rules to facilitate cloud switching and interoperability, and includes safeguards against unlawful access by third-country authorities. Taken together, these instruments form a layered regulatory architecture in which non-personal data regulation, competition policy and data protection law operate in parallel and, where relevant, cumulatively. 3.2 Interaction of Data Regulation and Data Protection The EU’s data economy instruments are designed to operate alongside, not instead of, the GDPR. They regulate access to and use of data, but do not alter the fundamental rules governing the processing of personal data. Where datasets are purely non-personal, instruments such as the Free Flow of Non-Personal Data Regula - tion and the Data Act apply without triggering GDPR obligations. In the case of mixed datasets, the GDPR continues to govern the personal data component, while the data economy framework regulates access, sharing and portability at the level of the dataset. The Data Act expressly states that it does not affect the application of Union data protection law. Accord - ingly, any data-sharing obligation must comply with GDPR requirements, including the existence of a law - ful basis, respect for purpose limitation and data mini - misation, and appropriate security safeguards.
Non-personal data may also be protected under trade secret law, intellectual property rules or contractual confidentiality. The Data Act seeks to balance broader access rights with the protection of commercially sen - sitive information through confidentiality safeguards. In this way, the EU framework is layered: data econo - my legislation promotes access and re-use, while data protection law continues to constrain the processing of personal data. 3.3 Rights and Obligations Under Applicable Data Regulation Across the EU data economy framework, several recurring principles and obligations emerge, distrib - uted across different instruments (Free Flow Regula - tion, Data Governance Act, Data Act, etc). Common Structural Features Although the relevant rules are spread across several instruments, they reflect a shared policy orientation. The EU data framework seeks to promote data mobil - ity and access, reduce structural imbalances in data- driven markets, and prevent technical or contractual lock-in, while preserving confidentiality and legitimate commercial interests. A first recurring principle is the free circulation of non- personal data within the internal market. The Free Flow Regulation prohibits unjustified data localisa - tion requirements and reinforces the idea that non- personal data may be stored and processed anywhere in the Union. A second core feature is the promotion of access to and re-use of data. The Data Act establishes access rights in defined contexts, particularly for data gen - erated by connected products and related services, allowing users to obtain and, in certain cases, direct the sharing of such data with third parties. More broadly, EU legislation aims to ensure that data access is not unreasonably withheld where it is economically and socially valuable. Fairness and non-discrimination are also central themes. In business-to-business settings, data shar - ing may be subject to fair, reasonable and non-dis - criminatory (FRAND) conditions. Switching and inter -
98 CHAMBERS.COM
Powered by FlippingBook