The European Commission has formally launched its legislative initiative aimed at increasing access to and further use of data, so that more public and private actors can benefit from technologies such as Big Data and machine learning. The Commission has published its inception impact assessment on the forthcoming Data Act, on which interested stakeholders can submit comments until 25 June 2021. In parallel, the Commission has launched a public consultation for the legislative initiative, to be conducted by an online questionnaire, with a deadline of 3 September 2021. Feedback will be taken into account for further development and fine tuning of the initiative to be tabled in Q3-Q4 2021.
- Data Act ‘Inception Impact Assessment’ – invitation to comment
The so-called “inception impact assessment” document sets out the basis on which the Commission plans to define the problem(s) and design the legislative solution(s), in order to achieve effective legislation. Impact Assessments are required steps in the legislative process.
The ‘Data Act’ inception impact assessment is available here. According to the document, the initiative seeks to address the following four main issues:
a. lack of structure and rules governing reliable data sharing functions and transparent production of privately-held data to the public sector;
b. unfair terms and conditions imposed on companies seeking data access and interoperability/portability barriers;
c. contractual, technical and economic barriers to switching/porting data between different cloud computing service providers; and
d. differences in approach between the EU and third countries in relation to essential guarantees against disproportionate government access to non-personal data for law enforcement and other legitimate purposes.
To address the above issues, the Commission is considering a number of high-level solutions, including the implementation of:
a. a more flexible framework for access and use of private data sources by public bodies;
b. specific transparency obligations for manufacturers of connected objects;
c. data access and use obligations, potentially on the basis of fair, reasonable, proportionate, transparent and non-discriminatory terms;
d. technical specifications to help individuals take advantage of the GDPR portability right – this could involve mandating companies selling smart home appliances, wearables and home assistants to have in place technical interfaces that allow real-time portability of the data collected by such devices;
e. a binding obligation on cloud computing service providers to offer data and application portability; and
f. obliging cloud computing service providers to notify the user every time they receive an access request by foreign authorities (and potentially also mandate cloud services to ensure that they have all necessary measures in place to prevent the transfer of or access to non-personal data to third countries’ governmental authorities, where such transfer or access would conflict with EU or national laws).
The Commission is seeking the views of stakeholders on its proposed methodology and key fundamentals/objectives affecting the proposed legislation (some of which will be impactful for ongoing policymaking on Schrems II obligations). Stakeholders can send their comments by 25 June 2021.
- Public consultations – online questionnaire
In the inception impact assessment document the Commission notes that one of the ways in which it intends to gather evidence to inform the design of its legislation (in addition to consulting with national competition authorities and conducting some ‘targeted’ stakeholder consultations) is by holding public consultations. Therefore, in parallel, it has launched a public consultation for its ‘Data Act’ legislative initiative, to be conducted by online questionnaire, with a deadline of 3 September 2021.
The questionnaire is of a targeted, ‘check-box’ nature on a range of narrow issues which fall into the four buckets set out above. The questionnaire also allows stakeholders to submit a short advocacy paper covering broader points of principle or any concluding remarks. Notably, respondents may request anonymous treatment of their responses so that only the respondent type, country of origin and response are published, but not their identities.