EU Data Act – now formally adopted

Why should I read this?

Following our prior article on EU Data Act (Part 1), the Data Act is now in force which means users of connected devices can gain access to their personal and non-personal data.

The Data Act intends to address the digital transformation journey to improve access to data within EU Member States. These new rules ensure that data is more accessible and offers more protection for European businesses from unfair contractual terms.

If you are a cloud service provider, the new Data Act contains detailed and specific provisions which apply to all providers (including IaaS, PaaS and Saas) in relation to:

• new rules on switching cloud services which makes it easier for customers to move from one cloud provider to another
• restrictions for international transfers of non-personal data
• unfair terms in B2B data licences
• the rapid growth of Internet of Things data
• promotion of interoperability standards, and
• the ability of public authorities to access private sector data

What should I do?

The Data Act has now been published in the Official Journal and is officially in force as of 11 January 2024. Art. 50 of the Data Act provides for a phased entry into force of individual provisions, commencing from 12 September 2025 (subject to certain follow-on provisions). However, please note that paragraph 1 of Article 3 (simplified access requirements for new products) will apply to connected products and related services 32 months from this date.

While the Data Act does provide new opportunities and better access to data collected by devices, you will need to review and audit the data which is likely to be impacted by the Data Act and apply adequate safeguards.

There are established market standards (such as the SWIPO Code of Conduct) which could be relied upon by cloud service providers to ensure that they comply with legal requirements imposed by the Data Act. Costs is also a factor to be considered, particularly when it comes to mandatory data sharing requirements charged out of B2B data licences.

What else do I need to know about the EU Data Act?

The Data Act aims to make more data available for use. However, product manufacturers will need comply with specific rules and adhere to significant compliance obligations that the Data Act introduces in relation to ‘product data’ and service data when it comes to connected devices.

There is now a mandatory switching requirement on cloud services vendors to enable customers to change to an alternative provider or allow them to insource these services. The Data Act sets down high-level principles such as:

• contractual wording allowing for such switching
• allowing customers of IaaS services to obtain functional equivalence from a new provider
• cooperation in good faith
• advance notice to the customer when their data is being exported

The restrictions on exporting non-personal data to those outside of the EEA also adds another layer of complexity for global companies, when combining these with existing GDPR-restrictions on international transfers.

There are broader competition law considerations. The draft Data Protection and Digital Information Bill is on the horizon and some of its provisions, though limited, do reflect the Data Act.

The new measures also complement the Data Governance Act which came into force in September 2023 - this regulates processes and structures that facilitate voluntary data sharing while the Data Act provides clarification on who can create value from data. Both the Data Act and the Data Governance Act are part of the overall European strategy for data. Competition in digital markets is also being encouraged in the UK in light of its National Data Strategy.

Further reading on the EU Data Act

For more detail, please read our detailed article on EU Data Act (Part 2).

We also shared an update in November last year about the EU Data Act and that it has been formally adopted; please see our part one of our series on this topic here: EU Data Act (Part 1).