EU Data Act to cause friction in the automotive industry

This Act, which will apply from 12 September 2025, imposes data sharing obligations on OEMs which have far-reaching implications for the protection of trade secrets embodied in the data. In this article we look at the relevant provisions of the new Act, how those in the sector can prepare for its application and strategies to protect trade secrets.

What is the EU Data Act?

The EU Data Act (EU Regulation 2023/2854 on harmonised rules on fair access to and use of data) seeks to enhance the EU’s data economy by promoting fair data sharing practices and obliges data holders to share data, subject to certain exceptions, whether or not that data is personal or otherwise. Users of Internet of Things (“IoT”) devices will have access to data generated by their use of such products, and the option to request that the data holder make available data to third parties. The legislative goal is facilitating access to data, thereby fostering competition on the aftermarket (See Recitals 6 and 32 of the Act). Under the Act, OEMs will need to design connected products with this data portability in mind and adhere to international data transfer requirements (akin to those which currently apply to personal data). Rules on permissible use of data are aimed at bringing legal certainty, whilst measures mitigating contractual imbalances between established entities and smaller players are intended to open the market and foster competition. The Act also gives public sector bodies the ability to access and use data for specific public interest purposes such as public emergencies. However, any sharing of data pursuant to the Act still requires compliance with the General Data Protection Regulation (“GDPR”), as well as the need to take into account existing instruments and potential conflicts with contractual rights, competitors rights, and rights protected as trade secrets.

Who must comply with the EU Data Act?

The EU Data Act applies to any entity placing connected products on the EU market or providing related services in the EU (even where those entities are based outside the EU); as well as the users of those connected products (and also virtual assistants) and third parties requesting access to data on behalf users.

IP rights and the EU Data Act

OEMs obliged to share data under the EU Data Act will be keen to ensure competitors do not use the data to produce competing products (which is prohibited under the Act) or to train AI models. Below we look at how IP rights and trade secrets could help protect against such outcomes.

Limitation of IP rights

Databases are protected in the EU and UK by Database Right (In the EU, by the Database Directive and in the UK by The Copyright and Rights in Databases Regulations). However, Article 43 of the EU Data Act expressly states that Database Right will not apply when data is obtained from, or generated by, a connected product or a related service falling within the scope of the EU Data Act.

It is rare for IP rights to be expressly disapplied by legislation in this way, since the right to protect intellectual property is enshrined in the EU Charter of Fundamental Rights. Indeed, it is possible that the EU Data Act could face a constitutional challenge on this basis. For now, however, the disapplication of Database Right means that OEMs cannot use it to avoid disclosure obligations under the EU Data Act.

Copyright law is unlikely to come to the rescue, since under EU (and UK) law individual items of data within a database will only be protected by copyright where they represent the author’s “own intellectual creation”, a test which databases containing information collected automatically by connected products would not meet.

As discussed below, laws aimed at protecting trade secrets and other confidential information are a more promising way of preventing or limiting the disclosure of valuable data sets collected by smart vehicles, although there are still tight restrictions on the extent to which trade secrets can be used for this purpose. Data holders who are required under the Act to share data containing personal data of users may also have the opportunity (to some extent) to enforce limitations on the use of shared data for specific purposes (corresponding with the applicable lawful basis under data protection law(s) for sharing data). Additionally, they may also be able to use existing specific data security requirements to ensure any personal data comprised in the shared data is kept secure (especially where it is made available across borders). Finally, some of the existing mechanisms already used to protect personal information will undoubtedly be equally useful in protecting such transfers (together with any associated considerations arising from trade export restrictions and access requests from local authorities and governments).

Trade Secrets

In the EU, the law on trade secrets has been harmonised across member states by the Trade Secrets Directive (Directive (EU) 2016/943) which protects information which is secret (in the sense it is not known within the relevant circles), has commercial value because it is secret, and has been subject to reasonable steps to keep it secret.  The Trade Secrets Directive may, in principle, protect data sets collected by connected devices, although this is subject to the exceptions under the EU Data Act discussed below.

In the UK, the common law of confidential information protects, amongst other things, private collections of data, even where individual components of the collection are in the public domain (In the UK, The Trade Secrets (Enforcement, etc.) Regulations also implemented the majority of the Trade Secrets Directive, and these Regulations continue to apply still apply post-Brexit). Again, in principle the law of confidence may be used to protect data sets collected by connected products, although where such products (such as smart vehicles) have been placed on the market in the EU, the data holder’s ability to rely on trade secrets will be affected by the Act. Data holders may also wish to leverage confidentiality rights associated with any private or personal information comprised in, or which may be derived or interpreted from, the data requested.

The EU Data Act’s treatment of trade secrets

The EU Data Act provides that trade secrets shall be disclosed to third parties only to the extent necessary to fulfil the purpose agreed between the user and the third party. The data/trade secret holder is entitled to agree proportionate technical and organisational measures (such as model contractual terms, confidentiality agreements, strict access protocols, technical standards, and the application of codes of conduct) to protect their proprietary information. In the event the parties cannot agree on such technical and organisational measures, the trade secrets may be withheld.

Further, in exceptional circumstances, the trade secret holder can refuse to disclose trade secrets where such disclosure would make it highly likely that they will suffer serious economic damage, even where the measures mentioned in the previous paragraph were adhered to.

If follows that while trade secrets may help to mitigate the impact of disclosure under the EU Data Act, in most cases it will be difficult to use the trade secrets as a basis for avoiding disclosure completely. Significant litigation is likely in the coming years around exactly where the boundary lies between protecting trade secrets in data sets on the one hand, and the EU Data Act’s disclosure obligations on the other.

Preparing for application of the EU Data Act

The EU Data Act entered into force on 11 January 2024 and will apply from 12 September 2025 (While Article 50 provides for, in total, three phases beginning on 12 September 2025, 2026, and 2027, respectively, most provisions will apply from 2025). OEMs and distributors who are concerned about having to disclose valuable data collected by smart vehicles should start to prepare now, by reviewing and considering:

• the data sets which are at risk of disclosure (and, where applicable, identifying the extent to which such data comprises any personal data);
• how best to protect such data if it has to be shared under the Act (for example through contractual terms, confidentiality agreements, strict access protocols, technical standards and codes of conduct); and
• whether there is some data the disclosure of which would be so damaging that a refusal to disclose may be justified under the Act (crown jewels trade secrets).

For a separate analysis of this topic, please also listen to our corresponding Data as an Asset podcast, specifically focussing on the EU Data Act and Intellectual Property.

Further reading on the EU Data Act and trade secrets:

• EU Data Act formally adopted
• EU Data Act now formally adopted - part 2
• Global Trade Secrets Update
• Trends in Trade Secrets Litigation - view from the EU and UK
• Data as an Asset podcast series
• Data as an asset capability statement