Data Act

The user can request that “readily available data” be made available. These are not just any data, but instead only product data or related service data, in each case including the metadata required for interpretation.

The term “readily available” has several implications:

• Firstly, this only includes data that the data holder lawfully obtains or can lawfully obtain from the connected product or related service without disproportionate effort. [Article 2(17) Data Act] The design of the product or service determines what types of data these are. The manufacturer does not have an obligation to design certain data as readable. Essentially, it can therefore determine which data are to be accessible at all by means of its design decisions. If data do not leave the component in which they are generated, they are not readily available. [Recital 20 Data Act] Only if data can generally be obtained from the product as intended (e.g. in order to store them in a central CPU or to transfer them to a central data centre of the data holder) are they readily available. Thus, there is no obligation under the Data Act to store product data and related service data on a central computing unit. [Recital 20 Data Act]
• Secondly, only data that at most require a low level of processing are “readily available”:
  • The raw data, i.e. the data obtained directly and unprocessed from the connected product or related service, are readily available data.
  • A certain level of pre-processing is also possible. Such pre-processed data include, for example, measurement data that are already interpreted as a certain temperature, certain coordinates, certain pressure, etc. However, this may only involve simple processing. [Article 2, point 17 Data Act]

Data that are interpreted or manipulated and analysed by algorithms are no longer readily available data (e.g. where the results of various sensors of an automated vehicle are combined and analysed to create an all-around picture of the surroundings, so-called sensor fusion). There is no right to such analyses.

The question is how long the data holder must retain the data. The recitals suggest that this only has to be the case for a “reasonable” period of time. [Recital 24 Data Act] Systematic erasure that effectively excludes or severely restricts the possibility of access is likely not permissible. However, the situation is likely to be different if the data are constantly being overwritten for technical reasons, e.g. if there is limited storage and at the same time a high volume of data.

Roughly speaking, a connected product is an IoT (internet of things) product. It has the following characteristics:

• It generates, records or collects data about its environment or its use, and
• it can communicate these product data by whatever means (e.g. WLAN, physical connection, NFC, 4G/5G).

Examples: Smartwatches; connected cars; industrial machines which communicate use or maintenance data; remote surveillance cameras, etc. This does not include cloud storage or other products whose main task is to store/process/transmit data for third parties.

A related service is a digital service which is connected to a connected product and supports its functions. It can also be software. It renders, adds to, updates or adapts the product’s functions either from the outset or later. However, a mere ability to read data from a connected product is not sufficient; a data exchange must take place, i.e. the service must also be able to control the product functions. 

Examples: Software updates which improve the security or performance of a connected product or add new functions; apps or services for remote servicing or diagnosis; personalised recommendations or advertising that is offered based on user behaviour. 

One can be a user of a connected product or a related service. (What is meant by a connected product and a related service see alsoin Question 10) Both are treated in the same way. The user can be a natural or legal person. Not only the end consumer who uses or obtains the product or service for private purposes can be a user, but a company can as well.

• The user of a connected product is its owner or someone who is contractually entitled to use the product for a fixed period of time, i.e. in particular the renter or lessee. [Article 2(12) Data Act] Several persons can also be users of a connected product at the same time, e.g. co-owners. Contrary to the German wording “Besitzer” (English: possessor), mere actual possession is not sufficient. Accordingly, if someone has purchased or leased a smartwatch (a connected product) for example, they are its user. If they lend it to a friend as a favour to use for sports, that friend does not become a user because they have not acquired a contractual right of use.
• The user of a related service is the person who makes use of the service. [Article 2(12) Data Act] The Data Act does not appear to require a contractual relationship in this case. However, this should most likely be interpreted to mean that the user is the person who has (contractually) subscribed to the service and utilises the services on this basis.

The Data Act is unclear as to who the data holder is. [Article 2(13) Data Act] Until this is clarified, it would make sense in our assessment to assume that the data holder is the person who has the actual or legal authority to dispose of the data. 

The problem with the definition is that it states that the data holder is the person that has the right or obligation under EU law to use and make available data. This goes round in circles, however, because the obligation under the Data Act applies precisely to the data holder. The German version also has a translation error that creates the impression that it is only about related service data  (“Daten […] zu nutzen und bereitzustellen, die sie während der Erbringung eines verbundenen Dienstes abgerufen oder generiert hat”: “to use and make available data [...] which it has retrieved or generated during the provision of a related service”). 

Yes, there can be several users at the same time.

This may be the case, for example, if a connected product is jointly owned by several people. There will also be more than one user if the connected product is rented or leased, as the product will also have at least one owner as well.

In principle, every user is entitled to the provision of readily available product data and related service data (see also question 9). It is not directly apparent from the text of the Data Act to what extent joint users can assert this right. It is conceivable that each of them can request any and all data, or that each user can only request the data that they have generated themselves, e.g. by driving the connected car or wearing the smartwatch on their wrist.

The recitals contain statements that could be read to mean that the solution is to set up user accounts in order to “enable each user to have access to the data they generate”. [Recital 21] But “generating data” is not a prerequisite for a user having the right to request that data be made available. The owner of a connected vehicle can, for example, also request the data generated by her husband, to whom she has lent the car (subject to data protection requirements). It is also accepted that data generated when the car is at rest, e.g. while it is parked, can be requested. No-one is actively “generating” the data at that time. In our assessment, it therefore seems a more likely scenario that every user has a comprehensive right to the provision of all product data and related service data, including data actively generated by a co-user, e.g. by driving the car. Where personal data is involved, the proviso laid down in Article 4(12) Data Act obviously applies (see also question 19). Otherwise, the “mere” owner who has rented out or leased a product and therefore does not normally use it would never be entitled to the provision of the data generated with it. This would mean that the owner of a leased fleet of vehicles would have virtually no rights. But according to the Data Act, owners are explicitly included in the group of users without necessarily having to use the product themselves.

Only the current user is entitled to the provision of product data and related service data (see also question 8). 

From a practical point of view, the question arises as to how the respective user can be identified. User accounts that allow users to close their accounts if they resell the product will be particularly suitable for this purpose. The new user can then open a new account. [Recital 21] The data holder may in principle require appropriate user identification to verify a user’s entitlement to access the data. [Recital 29] However, no information may be required that goes “beyond what is necessary”. [Article 5(4) Data Act]

Yes, specific requirements must be met:

• The data must be made available to both the user and a third party without undue delay, easily, securely and in a comprehensive, structured, commonly used and machine-readable format. Where relevant and technically feasible, the data must be made available continuously and in real-time. [Article 4(1) and Article 5(1)]
• In the case of a third party, the data must also be made available in the same quality as is available to the data holder. [Article 5(1)] Where the data are made available directly to the user, this requirement only applies “where relevant and technically feasible”. [Article 4(1)]
• The data must always be made available free of charge to both the user and any third party nominated by the user. [Article 4(1) and Article 5(1)] If the third party is an enterprise, the data holder may request compensation from such enterprise subject to FRAND principles (see also question 25).

It is not yet clear what is meant by “make available”. It could mean that the data holder may be required to provide a copy of the data or that it would be sufficient for the data holder to grant access to, for example, one of its servers on which the data are stored and where they can be read and, if necessary, analysed and manipulated. Since the Data Act, e.g. in Article 11(1) (albeit in a different context), refers to a right of the user to “obtain a copy of the data”, a mere right of access without obtaining a copy does not generally appear to us to be sufficient.

It depends on who the data is made available to.

• The data must be made available to the user free of charge. [Article 4(1) Data Act]
• For data which a data holder must make available to persons other than the user, the rules of Chapter III, including Article 9 Data Act, apply (see also question 25). According to these rules, compensation may be requested from a third party if such third party is an enterprise. However, the amount of the compensation may not be arbitrary. The conditions must always be reasonable and non-discriminatory. [Article 9(1)]
• If the third party is not an enterprise, but in particular therefore a consumer or public body, Article 9 Data Act does not apply. Whether compensation can be requested, and if so in what amount, is left open. The recitals state that the reasonable compensation pursuant to Article 9 Data Act does not constitute payment for the data themselves, but are merely to constitute investment incentives. [Recital 46] This could be interpreted to mean that in general, payment may not be demanded for the data, but merely investment incentives to the extent regulated by law. However, it will be necessary to await legal developments in this respect.

This depends on whether the data are made available to the user or a third party.

• A user may generally use the data that are made available for any legal purpose. It may also share them with third parties, including for commercial purposes. Exception: It may not use the data to develop a competing product (although the development of a competing related service is allowed) and may not share the data with this intention. Moreover, the user may not use the data to derive insights about the economic situation, assets and production methods of the manufacturer or the data holder. [Article 4(10)].
• If the data are made available to a third party, the scope of the right of use will depend on what it has agreed upon with the user. [Article 6(1)] 

• You may only use the data as you have agreed with the user. If personal data are involved, you must additionally comply with the GDPR. [Article 6(1) Data Act]
• You must delete the data once you have fulfilled the purpose of the agreed use unless otherwise agreed with the user. [Article 6(1) Data Act]
• You may not share the data with another third party without the consent of the user. If sharing is allowed, it must be ensured that the recipient protects any trade secrets contained in the data. [Article 6(2)(c) and (d) Data Act] (For more on the protection of trade secrets, see Question 20)
• You may not develop any products that are in competition with those of the user or share the data for that purpose. [Article 6(2)(e) Data Act]
• You must avoid any use that could jeopardise the security of the product or the service. [Article 6(2)(f) Data Act]
• You may not ask the user to make the data available to you exclusively. [Article 6(2)(h) Data Act]

No. As the data holder you may only use data generated from a connected product or a related service if there is a legal basis for doing so.

• Are the data personal data within the meaning of the GDPR? If so, you may only use these data if and to the extent permitted by the GDPR. You must comply with the data protection rules.
• Are they non-personal data? If so, you may only use them if and to the extent the user has contractually permitted you to do so [Article 4(13) Data Act]. Accordingly, you absolutely need a contract with the user.

The following are in any case prohibited:

• using the data to obtain insights about the economic situation, assets and production methods of the user (or a third party with which the user has shared the data);
• using the data to develop a product that competes with the connected product or the related service from which the accessed data originate;
• sharing the data with other third parties unless the user has permitted this.

No. If personal data are involved, restrictions under data protection law must be observed.

This means that personal data may only be made available to a user, even at their request, if the user is the “data subject” within the meaning of the GDPR (and thus their data are involved). If that is not the case, the data holder may only provide the data to the user if there is a legal basis for doing so under the GDPR. [Article 4(12) Data Act] The duty to make data available, as well as the right to access the data do not comprise a legal basis within the meaning of the GDPR; accordingly, it is only permissible to make the data available if, for example, consent has been given or this is necessary to perform a contract or protect legitimate interests. [Article 6(1) (a), (b) and (f) GDPR]

This requires data holders to walk a regulatory tightrope. Focusing too strongly on data protection can lead to a breach of the duty under the Data Act to make data available, while focusing too strongly on data access can lead to a violation of data protection law. Data holders may not be able to avoid requiring the establishment of individual user accounts – meaning that data which were originally not personal will become personal data.

Yes, even trade secrets generally have to be disclosed. However, technical and organisational measures to preserve their confidentiality may be requested. Suitable measures would include the use of model contractual terms, confidentiality agreements, strict access protocols and codes of conduct.

Only in two cases is it possible to refuse to provide the data:

• Where no agreement is reached on the necessary measures or the user fails to implement these measures. In that case, the data holder must adequately substantiate its decision, provide such substantiation in writing to the user and notify the supervisory authority as well. [Article 4(6) and (7), Article 5(9) and (10) Data Act]
• If the data holder is able to demonstrate that despite the confidentiality measures, it is highly likely to suffer serious economic damage. This refusal must also be adequately substantiated and communicated to the supervisory authority. [Article 4(8), Article 5(11) Data Act]

No. Contractual terms which restrict the rights of the user are not binding on the user. [Article 7(2) Data Act]

An exception applies only if otherwise statutory security requirements would be undermined and the health, safety or security of natural persons would be jeopardised as a result. [Article 4(2) Data Act] Theoretically, the new Cyber Resilience Act, which will impose security requirements on connected products, could be considered here. 

Yes, there is an obligation to provide information before concluding a contract. [Article 3(2) and (3) Data Act]

Among other things, information must be provided on

• the type, format and volume of the data to be generated
• the possibility of generating data continuously and in real-time
• the storage capabilities
• how the user can access the data.

From a practical point of view, this obligation to provide information before concluding a contract can be fulfilled by providing a web link that leads to the information. 

Under three conditions: In the case of B2B transactions, where data are involved, and where terms are unilaterally imposed.

• The unfairness test under Chapter IV of the Data Act only applies to the B2B sector, not in relation to consumers. But within this sector it applies to all enterprises and not just in relation to micro-, small or medium-sized enterprises. However, it cannot be ruled out that the results of an unfairness test carried out in respect of B2B transactions under the Data Act will find their way indirectly into a review under the provisions that govern general terms and conditions carried out in relation to consumers.
• The contractual term must involve data. This is the case if it relates to data access, data use or liability or legal remedies regarding data-related obligations.
• The contractual term must be imposed unilaterally. Such a term is considered to be “unilaterally imposed” within the meaning of the Data Act if it was supplied by one party and the other party could not influence its content despite an attempt to negotiate it. [Article 13(6) Data Act] According to the wording, it is not sufficient that one party supplies a contractual term and the other party simply accepts it. If this provision were to be applied by the courts in this way, the legal situation would differ from the German understanding of general terms and conditions.

Contractual terms that define the main subject matter of the contract or the adequacy of the price paid in exchange for the data provided are excluded from the unfairness test. [Article 13(8) Data Act] This is in line with German practice, which likewise does not regard the essentialia negotii as general terms and conditions. 

The Data Act follows a three-stage approach: 

1. First of all, the Act stipulates which contractual terms are always considered unfair, the “blacklist”. [Article 13(4) Data Act] These are terms whose validity is not open to assessment. 
2. The “greylist” contains terms whose validity is open to assessment. [Article 13(5) Data Act] These terms are presumed to be unfair, but companies can rebut this presumption. 
3. Contractual terms that do not fall under either the “blacklist” or the “greylist” can still be unfair according to the general prohibition of unfair terms. [Article 13(3) Data Act]

The following contractual terms, for example, are always unfair:

• a term that excludes the party’s liability for intentional acts or gross negligence; [Article 13(4)(a) Data Act]
• a term that stipulates that the party imposing the term determines whether the data supplied are in conformity with the contract. [Article 13(4)(c) Data Act]

A contractual term is presumed to be unfair, for example,

• if the party on whom the term was unilaterally imposed 
  • is prevented from using the data provided or generated by it during the term of the contract, or is so restricted that it can no longer  use, capture, access or control such data or exploit the value of such data in an adequate manner; [Article 13(5) (c) Data Act]
  • obtaining a copy of the data provided or generated by that party during the period of the contract or within a reasonable period after the termination thereof; [Article 13(5) (e) Data Act] or
• if the party imposing the term grants itself the option
  • to terminate the contract at unreasonably short notice; [Article 13(5) (f) Data Act]
  • to change substantive conditions related to the nature, format, quality or quantity of the data without specifying a valid reason and without granting the other party the right to terminate the contract. [Article 13(5) (g) Data Act]

For a contractual term to fall under the general prohibition of unfair terms, it must be of such a nature that its use grossly deviates from good commercial practice in data access and use, contrary to good faith and fair dealing. [Article 13(3) Data Act] This very vague wording allows for a more or less restrictive interpretation The German translation presents another problem. There, the two aspects - gross deviation from good business practice and violation of good faith - are connected with an "or". Consequently, the question arises whether it is sufficient for only one of the two elements to be present, or whether both, as expressed in the English version, must be present cumulatively.