Latest
Datan käytölle uusi EU-asetus

Datan käytölle uusi EU-asetus

news
10 Jan 2023
Category
Insights

Euroopan komission ehdottama uusi asetus datan käytöstä, ns. datasäädös (Data Act), on valmistelun loppuvaiheessa. Datasäädös avaa fyysisten tuotteiden keräämän IoT-tiedon käyttäjille sekä velvoittaa pilvipalveluntarjoajia avustamaan palveluiden siirrossa toisille palveluntarjoajille. Säädös koskee kaikenlaista dataa, mukaan lukien henkilötietoja sisältävää dataa. Säädös täydentääkin monilta osin tietosuoja-asetusta (GDPR).

Datasäädös tuo periaatteellisella tasolla merkittäviäkin uusia oikeuksia IoT- ja pilvipalveluiden käyttäjille. Pääsy IoT-raakadataan tai oikeus siirrättää omia tietoja yritykseltä toiselle tuo datan käyttäjille ”omistajuutta” omaan dataansa. Datan luontiin osallistuvien käyttäjien oikeuksien vahvistaminen onkin ollut yksi sääntelyn tavoitteista.

Yritysten kannalta sääntelyn tarkoituksena on antaa työkaluja torjua vendor lock-in’ia. Jos data siirtyy vapaammin tuotantoketjussa käyttäjäyritykselle, yrityksellä on teoriassa mahdollisuus kilpailuttaa teknologiatoimittajia. Sama koskee pilvipalvelutoimittajien kilpailuttamista. Käytännön elämässä vendor lock-in on kuitenkin dataa moniulotteisempi ilmiö ja nähtäväksi jääkin miten uusi sääntely tulee käytännössä toimimaan.  

IoT- ja pilvipalveluyritysten on syytä huomioida tuleva sääntely tuotekehityksessään. Kerätty data on syytä strukturoida siten, että siitä on helposti ja automaattisesti erotettavissa se osa, johon tietojenpääsy joudutaan tarjoamaan. Samoin ulkoiset rajapinnat on syytä suunnitella jo heti alkuun standardien mukaisiksi.

Datasäännöksen strategista merkitystä yrityksille vähentää se, että säännös avaa datan vain sen kohteelle/käyttäjälle, ei kaikille yrityksille, joilla dataan voisi olla intressi. Jatkossakin datan keräämisellä ja hallinnalla tulee siis olemaan merkittävä strateginen merkitys yrityksille.

Alla on tiivis kuvaus datasäädöksen tärkeimmistä ehdoista.

Ota yhteyttä, jos tarvitsette juridista tukea uuden datasäädöksen edellyttämiin toimenpiteisiin yrityksessänne.

Regulation on harmonised rules on fair access to and use of data (Data Act)

Status:

PENDING. Commission’s original proposal 23 February 2022. Compromise text 9 September 2022

Scope:
Relates to 1) making data, whether personal data or non-personal data, generated by the use of a product or related service available to their users (whether private or legal entity), third party businesses and public sector; 2) facilitates switching between data processing services; 3) introduces safeguards against unauthorized access to non-personal data; and 4) encourages development of interoperability standards
Type of products:
Physical products that obtain, generate and collect data relating to their use, performance or environment and are capable to communicate that (=IoT). Not products that are primarily intended for storing, processing, displaying or transferring data (e.g. smart phones outside of scope, but smart watches may be inside the scope).
Type of data:
Data generated by use of product or related services, including data recorded by user, generated when product switched-off, and diagnostics data. Only raw data; information derived or inferred from the core IoT data not within the scope of the regulation.
Type of services:
Inter-connected with a product and necessary for its functioning
Use of data:(cf. GDPR art 6; art 22)
Data holders (i.e. manufacturers or service providers who control access to data) may use any non-personal data only based on a contract with the user. Data holder may not derive insights from the data that could undermine the commercial position of the user in the market.
Information to users:(cf. GDPR art 13)
Data holder must provide users before sale of a product information about data generated, including data types, purpose of use and how it can be accessed.
Access to data by users:(cf. GDPR art 15)
Data generated by use of products that is accessible to the data holder must be easily and where appropriate directly and real-time accessible by the user (i.e. private person or a legal entity) free of charge in a structured format. User may also authorize a third party acting on its behalf to access its data.
Access to data by third parties:(cf. GDPR art 20)
User may instruct the data holder to provide access to data (whether personal or non-personal) to third parties for their business purposes (e.g. aftermarket service provider). Data holder shall provide access under fair, reasonable and non-discriminatory terms (FRAND). The terms of such access will be agreed, but may not be unfair. The terms must be equal to the terms applied within the data holder’s own affiliates. Compensation payable by micro and small enterprises may not exceed direct costs relating to making data available.
Access to data by public bodies:(cf. GDPR art 6)
Public sector bodies demonstrating an exceptional need have the right to access data.
Protection of IPR and trade secrets:
Trade secrets may be disclosed to users or third parties subject to confidentiality undertakings. Sui generis right for databases does not apply when applying these access rights. User may not use data to develop product that competes with the product from which the data originates.
Protection of personal data:
Personal data will be provided to user only if the user is the data subject or if there are valid legal basis under the GDPR art 6.
Exclusions:
Data sharing obligations do not apply to data generated by use of products provided by micro or small enterprises (i.e. <50 employees and turnover and balance sheet <10M €), provided they do not have affiliates with >25% ownership that do not qualify as micro or small enterprises
Switching service providers:(cf. GDPR art 20)
Data processing service providers must ensure that their customers, whether businesses or consumers, can switch (and port the data, metadata and other digital assets) to another service provider of the same service type or to an on-premise system. However, there Is no requirement for current service provider to adjust or develop its services to ensure functional equivalence with the services of the new provider.
Contractual terms relating to switching:
Customer must be able to terminate the service with max. 30 days’ notice. Service agreements must include specific terms relating to switching, including i.a. transfer assistance obligations and specification of portable data. Service provider may not charge for the switching process.
Technical aspects of switching:
Service providers must make open API available to customers and other service providers free of charge to enable development of porting software. Data processing services must comply with open interoperability specifications published by EU.
International transfers:(cf. GDPR chapter V)
Administrative or court decisions of third countries relating to transfer of non-personal data out of EU (or access from outside of EU) are recognized and enforceable only if based on international agreements or subject to case specific analysis of third country legal system.
Interoperability
Commission is empowered to adopt delegated acts relating to interoperability requirements for various data service providers to enhance interoperability of data and data services and for portability of digital assets.
Download
Download as PDF
Services
Share

Relevant news

All news