EU adopts the Data Act

The Data Act is a part of the European data strategy where the EU seeks to combine the ambition to be at the forefront of a competitive data market with the values of availability and fair access to data. Examples of previously adopted legislation within the strategy is the Data Governance Act, applicable as of September 2023. Where the Data Governance Act primarily regulates data sharing between individuals and the public sector, the Data Act will regulate access to, and use of, data generated in the context of products and services in all economic sectors.

The Data Act includes, inter alia:

• safeguards against unauthorised transfers of data by cloud service to prevent customer data from being transferred to countries outside the EU without a legal basis,
• provision to facilitate customers' switching of data processing service providers, for example switching cloud services,
• measures against the abuse of contractual imbalances in respect of data sharing, to prevent large companies to abuse their position when entering into agreements with smaller businesses, and measures ensuring fair compensation for making data available,
• strengthening the right to data portability for individuals, i.e. the opportunity to transfer data; and
• on obligation on companies, as data holders, to provide data to national authorities and EU institutions under exceptional circumstances.

Entry into force

The Regulation will enter into force on the twentieth day after its publication in the Official Journal of the EU (i.e. probably before the end of 2023/2024), and will be applicable 20 months later, i.e. probably at the end of summer 2025. However, some provisions will only become applicable later:

• The obligation to provide users of e.g. IoT products or other smart products with access to data produced by their use of for example a smart product is applicable 32 months after the entry into force, i.e. likely in the second half of 2026.
• 44 months after the entry into force, i.e. likely in the second half of 2027, the measures against abuse of contractual imbalances will apply also to contracts concluded before or on the date of entry into force of the regulation, provided that the duration of the contract in question is either indefinite or lasts more than 10 years from the entry into force of the regulation.

EU's digital strategy

The Data Act is one of several legislative products adopted within the framework of the European digital strategy which aims to create a Europe equipped for the digital age. Vinge has previously reported on several of the other legislative products proposed and/or adopted within the framework of this strategy. See, for example, our article on the negotiations on the EU AI Regulation, the EU Digital Markets Act and the EU Digital Services Act. If you have any questions, please feel free to contact us.