When data sharing and trade secrets collide: impact of the EU Data Act

In this context, the ability of companies and original equipment manufacturers (OEMs) to exploit and benefit from data sets collected by the equipment manufactured has been put at risk by the EU Data Act (the Act).

The Act, which will apply from 12 September 2025, imposes data sharing obligations on OEMs which have far-reaching implications for the protection of trade secrets embodied in the data: data holders will only be able to refuse requests to share their trade secrets in exceptional circumstances as we explain in more detail below. In this article we look at the relevant provisions of the new Act, how to prepare for its application, and strategies to protect trade secrets. 

What is the EU Data Act?

The EU Data Act[1] seeks to enhance the EU’s data economy by promoting fair data sharing practices and obliges data holders to share data, subject to certain exceptions, whether or not that data is personal or otherwise. Users of connected devices or recipients of services related to connected devices will be granted the right to request access to data generated by their use of such connected devices or related services, and the option to request that the data holder make available data to third parties. In this context, a ‘user’ is a legal person or entity that owns a connected product or to whom temporary rights to use that connected product have been contractually transferred, or that receives related services.

In addition, the manufacturer, seller or provider of the related service will be required to provide specific information relating to the nature, type, format, frequency and accessibility of data that may be collected and may be accessible to a ‘user’ prior to the conclusion of a contract in relation to the sale, transfer, lease or provision of the relevant connected device or related service.

The legislative goal is to facilitate access to data, thereby supporting data portability and fostering innovation and competition on the aftermarket[2]. Under the Act, OEMs will need to design connected products with data portability in mind and adhere to international data transfer requirements (akin to those which currently apply to personal data). Rules reinforcing data interoperability are aimed at facilitating data sharing, whilst measures mitigating contractual imbalances between established entities and smaller players are intended to open the market and foster competition. The Act also gives public sector bodies the ability to access and use data for specific public interest purposes such as public emergencies.

However, any sharing of data pursuant to the Act still requires compliance with the General Data Protection Regulation (GDPR) which also includes rights for individuals to benefit from data portability, as well as the need to take into account existing instruments and potential conflicts with contractual rights, competitors rights and rights protected as trade secrets.

Who must comply with the EU Data Act?

The EU Data Act applies to any entity placing connected products on the EU market or providing related services in the EU (even where those entities are based outside the EU); as well as the users of those connected products (and also virtual assistants) and third parties requesting access to data on behalf users.

IP rights and the EU Data Act

OEMs obliged to share data under the EU Data Act will be keen to ensure competitors do not use the data to produce competing products (which is prohibited under the Act) or to train AI models. Below we look at how IP rights and trade secrets could help protect against such outcomes.

Limitation of IP rights

Databases are protected in the EU and UK by Database Right[3]. However, Article 43 of the EU Data Act expressly states that Database Right will not apply when data is obtained from, or generated by, a connected product or a related service falling within the scope of the EU Data Act.

It is rare for IP rights to be expressly disapplied by legislation in this way, since the right to protect intellectual property is enshrined in the EU Charter of Fundamental Rights. Indeed, it is possible that the EU Data Act could face a constitutional challenge on this basis. For now, however, the disapplication of Database Right means that OEMs cannot use it to avoid disclosure obligations under the EU Data Act.

Copyright law is unlikely to come to the rescue, since under EU (and UK) law individual items of data within a database will only be protected by copyright where they represent the author’s “own intellectual creation”, a test which databases containing information collected automatically by connected products would not meet.

As discussed below, laws aimed at protecting trade secrets and other confidential information are a more promising way of preventing or limiting the disclosure of valuable data sets collected by smart devices and machines, although there are still tight restrictions on the extent to which trade secrets can be used for this purpose.

Trade Secrets

In the EU, the law on trade secrets has been harmonized across member states by the Trade Secrets Directive [4] which protects information which is secret (in the sense it is not known within the relevant circles), has commercial value because it is secret, and has been subject to reasonable steps to keep it secret.  The Trade Secrets Directive may, in principle, protect data sets collected by connected devices, although this is subject to the exceptions under the EU Data Act discussed below.

In the UK, the common law of confidential information protects, amongst other things, private collections of data, even where individual components of the collection are in the public domain.[5] Again, in principle, the law of confidence may be used to protect data sets collected by connected products, although where such products have been placed on the market in the EU, the data holder’s ability to rely on trade secrets will be affected by the Act. Data holders may also wish to leverage confidentiality rights associated with any private or personal information comprized in, or which may be derived or interpreted from, the data requested.

The EU Data Act’s treatment of trade secrets

The EU Data Act provides that trade secrets shall be disclosed to third parties only to the extent necessary to fulfil the purpose agreed between the user and the third party. The data/trade secret holder is entitled to agree proportionate technical and organizational measures (such as model contractual terms, confidentiality agreements, strict access protocols, technical standards, and the application of codes of conduct) to protect their proprietary information. In the event the parties cannot agree on such technical and organizational measures, the trade secrets may be withheld.

Further, in exceptional circumstances, the trade secret holder can refuse to disclose trade secrets where such disclosure would make it highly likely that they will suffer serious economic damage, even where the measures mentioned in the previous paragraph are adhered to.

It follows that while trade secrets may help to mitigate the impact of disclosure under the EU Data Act, in most cases it will be difficult to use the trade secrets as a basis for avoiding disclosure completely. Significant litigation is likely in the coming years around exactly where the boundary lies between protecting trade secrets in data sets on the one hand, and the EU Data Act’s disclosure obligations on the other.

Exemptions based on national security or data privacy

Public and national security

Article 1(6) of the Data Act states that the Act:

“does not affect the competences of the Member States concerning public security, defence or national security, regardless of the type of entity entrusted by the Member States to carry out tasks in relation to those competences, or their power to safeguard other essential State functions, including ensuring the territorial integrity of the State and the maintenance of law and order”.

Article 32 contains provisions relating to unlawful international governmental access and transfer of non-personal data.  However, the extent to which a refusal based on the above grounds would be permitted under the Act is not clear cut, and so further EU guidance or clarification from case law is required.  OEMs would clearly want to satisfy themselves of the identity of the requester as this would have a bearing on whether a refusal to disclose on grounds of public or national security or defence would be justified.  The extent to which such an exemption might be extended to or relied upon by those engaged by non-EU governments such as the UK remains to be seen.

Data privacy, international data transfers and security

Data holders who are required under the Act to share data containing personal data of users may also have the opportunity (to some extent) to enforce limitations on the use of shared data for specific purposes (corresponding with the applicable lawful basis under data protection law(s) for sharing data). Additionally, they may also be able to use existing specific data security requirements to ensure any personal data comprized in the shared data is kept secure (especially where it is made available across borders). Finally, some of the existing mechanisms already used to protect personal information will undoubtedly be equally useful in protecting such transfers (together with any associated considerations arising from trade export restrictions and access requests from local authorities and governments).

The Act seeks to prohibit or minimize the circumstances in which data holders may charge a fee for access to data, or in the context of cloud service providers for termination and migration of data assets, using a complicated format for transferring data. It is anticipated that data holders will want to verify requests, not only to verify the scope of a request, but also to the identity of the requester (especially where a competitor or potential foreign entity or government). In this context, trade export rules may apply to certain restricted information, especially where linked to protected know-how, trade secrets, intelligence or defence capabilities. In addition, those transferring data are obliged to consider the security of data transferred or accessed across borders (as well as the practical mechanisms of data sharing), alongside the timescales within which requests must be acknowledged and processed by data holders.

Following data sharing, the data holder may also wish to consider the usage rights associated with the data shared (to the extent those can be limited lawfully). As well as ensuring that the data shared is no greater than the scope of the original request (and that such data must be provided under the EU Data Act), the data holder may also wish to consider if and to the extent it may impose liability on the receiving part for the protection of the data and adhering to any inherent or third party rights associated with the particular categories of data within the data set.

Preparing for application of the EU Data Act

The EU Data Act entered into force on 11 January 2024 and will apply from 12 September 2025.[6] OEMs and distributors who are concerned about having to disclose valuable data collected by smart devices and machines should start to prepare now, by reviewing and considering:

• relevant standard terms and conditions of sale, lease, software licence(s) and service terms to ensure that all mandatory terms have been included, as required under the Act;
• the data sets which are at risk of disclosure (and, where applicable, identifying the extent to which such data comprizes any personal data, crown jewels trade secrets or security matters and tagging such data accordingly);how best to protect such data if it has to be shared under the Act (for example through contractual terms, confidentiality agreements, strict access protocols, technical standards and codes of conduct);
• whether there is some data the disclosure of which would be so damaging that a refusal to disclose may be justified under the Act; and
• the need for additional internal processes and safeguards for handling such disclosure requests.

For a separate analysis of this topic, please also listen to our corresponding Data as an Asset podcast available here, specifically focussing on the EU Data Act and Intellectual Property.

Further reading on the EU Data Act and trade secrets:

• EU Data Act formally adopted
• EU Data Act now formally adopted - part 2
• Global Trade Secrets Update
• Trends in Trade Secrets Litigation - view from the EU and UK
• Data as an Asset podcast series
• Data as an asset capability statement

[1]                 EU Regulation 2023/2854 on harmonized rules on fair access to and use of data

[2]                 See Recitals 6 and 32 of the Act.

[3]                 In the EU, by the Database Directive and in the UK by The Copyright and Rights in Databases Regulations

[4]                 Directive (EU) 2016/943

[5]                 In the UK, The Trade Secrets (Enforcement, etc.) Regulations also implemented the majority of the Trade Secrets Directive, and these Regulations continue to apply still apply post-Brexit.

[6]                 While Article 50 provides for, in total, three phases beginning on 12 September 2025, 2026, and 2027, respectively, most provisions will apply from 2025.