Articles

16.08.2023

European Data Strategy: What Organizations Need to Know?

Organizations have an incredible amount of data about customers, suppliers and preventing data flow does not seem possible in today’s conditions. For this reason, it is necessary to determine the processes, procedures, policies, roles and standards within the organization that ensure the effective use of data in order for an organization to achieve its aims. This can only be achieved through data governance policy. Data governance ensures that data-related roles are clearly defined and that responsibility and accountability are agreed upon across the organization. In this regard, organizations should consider regulations on data governance that are currently in effect or are under preparation. Besides General Data Protection Regulation (“GDPR”), European Union data framework provides a source of inspiration to organizations adopting legal measures in certain areas.

One of those regulations is Data Governance Act(“DGA”), presented to European Commission for the first time in 2020. The Data Governance Act realizes that data obtained from public sector bodies can be reused for commercial purposes or even be provided for a reasonable and proportionate price. With that awareness, the DGA will create a mechanism to enable the safe reuse of certain categories of public-sector data that are subject to the rights of others. It applies to data held by public sector bodies which are protected on the grounds of commercial confidentiality, statistical confidentiality, protection of intellectual property rights of third parties, protection of personal data.

The DGA provides certain obligations, especially in terms of data subjects, for data sharing service providers who will act as intermediaries between the data holders and the data users. For this purpose, public bodies will be expected to protect the rights and interests of third parties — for instance, by taking technical measures or by helping re-users seek the appropriate legal basis such as obtaining explicit consent from the data subjects.

Another legal regulation which has been proposed but not entered into force yet is Regulation on Privacy and Electronic Communications, known as ePrivacy Regulation. The ePrivacy Regulation is in cooperation with the GDPR in terms of its privacy provisions. It clearly stipulates that any interference with electronic communications data, such as by listening, tapping, storing, monitoring, scanning or other kinds of interception, surveillance or processing of electronic communications data, by persons other than the end-users, shall be prohibited, except when permitted by the Regulation.

The ePrivacy Regulation lays down rules regarding the protection of fundamental rights and freedoms of natural and legal persons in the provision and use of electronic communications services, and in particular, the rights to respect for private life and communications and the protection of natural persons with regard to the processing of personal data.

The territorial scope of the ePrivacy Regulation has been proposed to be the provision of electronic communications services to end-users in the EU, irrespective of whether a payment of the end-user is required, the use of such of such services and the protection of information related to the terminal equipment of end-users located in the EU. It is important to note that where the provider of an electronic communications service is not established in the EU it shall designate in writing a representative in the EU. The representative shall be established in one of the Member States where the end-users of such electronic communications services are located.

The proposed Digital Services Act and Digital Markets Act also aim to make sure that large online platforms behave in a fair way. The regulations become one of the centrepieces of the European digital strategy. The digital services cover a wide range of daily activities including online intermediation services, such as online marketplaces, online social networking services, online search engines, operating systems or software application stores.

Many of the large platforms benefit from comprehensively tracking and profiling end users. A few of them increasingly act as gateways or gatekeepers between business users and end users. The Digital Markets Act (“DMA”) establishes a set of narrowly defined objective criteria for qualifying a large online platform as a so-called “gatekeeper”. These criteria will be met if a company:

  • Has a strong economic position, significant impact on the internal market,
  • Operate one or more important gateways to customers,
  • Enjoy or are expected to enjoy an entrenched and durable position in the market, meaning that it is stable over time.

As a result, the DMA lays down harmonised rules ensuring contestable and fair markets in the digital sector across the Union where gatekeepers are present.

The proposal of the DMA is also fully coherent with the proposal for a Digital Services Act (“DSA”). The DSA is focusing on issues such as liability of online intermediaries for third party content, safety of users online or asymmetric due diligence obligations for different providers of information society services depending on the nature of the societal risks such services represent. The Digital Services Act is known as the act, modernising the Directive 2000/31/EC regarding illegal content, transparent advertising, and disinformation.

Finally, it is of great importance to mention the latest Data Act proposal which has been published by the European Commission on February, 23rd 2022. The Act is considered to be one of the pioneers of the European data strategy and aims to ensure fair access to data and to regulate the procedures and principles regarding the use of data. The Data Act applies to both personal and non-personal data and provides a broad definition of data, covering all kinds of digital outlooks. The proposal complements the recently adopted and aforementioned Data Governance Act and Digital Markets Act. The Data Act applies to;

  • Manufacturers of products and suppliers of related services placed on the market in the EU and the users of such products or services,
  • Data holders that make data available to data recipients in the EU,
  • Data recipients in the EU to whom data are made available,
  • Public sector bodies and EU institutions, agencies or bodies that request data holders to make data available where there is an exceptional need to that data for the performance of a task carried out in the public interest and the data holders that provide those data in response to such request,
  • Providers of data processing services offering such services to customers in the EU.

The Act envisages certain obligations to data owners, such as making available to the user the data generated by its use of a product or related service where data cannot be directly accessed by the user from the product and without undue delay, free of charge and if possible, continuously and in real-time. Within the scope of the Data Act, regulations regarding the protection of trade secret and intellectual property rights in data transfers are also included in the proposal.

The Data Act gives public bodies a limited and exceptional right to access data held by the private sector. This right can be used where the access is necessary to prevent, respond to or recover from a public emergency such as terrorist attacks, public health emergencies, natural disasters, or where the lack of data prevents the public body from fulfilling a duty in the public interest provided by law.

As the European Commission mentioned, the legislative initiatives including the Data Act will create a single market to allow data to flow freely within the EU and across sectors for the benefit of businesses, researchers, public administrations and society at large and the Data Act is deemed to be one of the main initiatives.