Discussions around the potential of data and rules to build a fairer data economy are centre stage in Brussels, where the European Commission yesterday published its draft “Data Act”. The proposal covers data generated by the Internet of Things (IoT), i.e. connected products and their related services such as smart home assistants or connected industrial machinery. As such, it will affect a wide range of businesses. Sectoral rules, including for the automotive and the health sectors, will follow.

With the General Data Protection Regulation (GDPR), the EU positioned itself as a global standard-setter in the protection of personal data. With the Data Act, it is setting standards for IoT data with potentially significant implications for data-generating businesses such as smart manufacturers, producers of connected products such as smart cars, and the aftermarket service and insurance sectors. We have mapped out three aspects of the proposal businesses should be aware of:

1. Pack-up and go – a portability right for IoT data

Potentially the most striking suggestion in the proposal has been borrowed from the GDPR: A right for both private individuals and businesses to request the data they have generated. For example, a farmer using a tractor with proprietary software can request his or her data, allowing the tractor to be repaired by a workshop of choice instead of the original manufacturer. Drivers of smart cars may choose to share their data continuously with insurance providers to prove they have a low risk driving style and should be eligible for any relevant premiums.

The key element here is that data should be shared free of charge and without undue delay, or even in real-time in some cases. From a practical perspective alone, this is bound to be contested in discussions going forward. While there are many competition elements to this proposal (that may warrant a future overview), the text notably prohibits the development of competing products using the data requested by a user this way, but safeguards appear to be lacking.

The inclusion of this right is a huge win for the aftermarket service and insurance sectors, with an outcry from original equipment manufacturers expected. Where exactly this leaves third party service providers such as mobility providers or the leasing sector needs to be assessed carefully.

2. More fairness in the data value chain

Success is increasingly underpinned by companies’ ability to interpret and use data – the backbone of the digital economy, including e-commerce, the platform economy, etc. The access to and use of this data however is often determined in bilateral data-sharing agreements. The Data Act aims to even out imbalances in these relationships, ensuring that consumers and businesses have access to the data generated by the connected products or services they are using or leasing, regardless of contractual terms.

The text addresses this through general fairness and non-discrimination requirements. For example, a data holder must not discriminate between different companies or their partners when making data available – a manufacturer will not be allowed to prefer its own subsidiaries or affiliated companies, for instance. Clauses in data sharing agreements that are not in line with the Data Act will be considered non-binding. SMEs will benefit from model clauses and an “unfairness test” for their data sharing contracts, where grossly unfair clauses will also become non-binding.

3. Government access under emergency circumstances

A potentially controversial aspect of the Act is an obligation on businesses to make data available to governments in the event of emergency circumstances. In cases of “exceptional need to respond”, for example, a public health emergency, terrorist attack, or a flood, businesses can be required to share relevant data freely. In other less urgent cases governments can request data at a reasonable profit margin. While the Data Act notes that such government requests must be proportionate, i.e., not exceed what is necessary to address a certain situation, this suggestion will likely raise eyebrows.

The Data Act is the last proposal coming out of the EU’s data strategy that applies to all sectors. It will be complemented by sector-specific rules going forward, with rules on health data already underway and recently confirmed plans to draft a specific proposal for the automotive sector. The draft law will be discussed and amended by the European institutions, with heated lobby campaigns on access and portability rights, among others, to be expected.

Our digital team will would be happy to help you assess the potential impact on your business and to discuss taking any further action. Please do get in touch by clicking here or replying to this email if this is of interest.