LERU’s Final Remarks on the Draft European Data Act

The Data Act proposal regulates a variety of situations where data holders may be under an obligation to share or transfer data they hold to data recipients. Art. 9 establishes the compensation due to data holders for the costs incurred when under an obligation to share data.

In the text initially proposed by the European Commission (EC) there is a specific favourable treatment of SMEs that limits the amount of compensation that they may be asked to pay. However, the EC text, like the Council text, does not address the situation where research organisations are data recipients. It is therefore very welcome to see in the text of the European Parliament (EP) the inclusion of research organisations next to SMEs, making research organisations benefit from the same special reduced compensation.

However, notwithstanding the importance of this recognition of research organisations next to SMEs, it seems disproportionate to simply put them on the same level in the calculation of the compensation amount. Of course, SMEs deserve a special treatment due to their size and importance in the EU’s entrepreneurial system, as highlighted in Recital 44 of the EP text:

“To protect micro, small or medium-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models, the compensation for making data available to be paid by them should not exceed the direct cost of making the data available and be non-discriminatory. The same regime should apply to those research organisations that use the data on a not-for-profit basis.”

However, in LERU's view, research organisations should not be asked to sustain any cost for the sharing of data, as they perform a fundamental public function and are already structurally underfunded.

The Business to Government (B2G) obligations to share data in cases of exceptional need to the benefit of public sector bodies is a very important achievement of the proposed European Data Act. It sets forth a powerful tool at the EU level to deal with special situations where the availability of data privately held could contribute to respond to or prevent public emergencies (health emergencies like the still too recent Covid health crisis, but also other relevant emergencies including climate, environmental, cybersecurity), or other situations where public sector bodies - including research organisations - are prevented from fulfilling a specific task in the public interest provided by law. These obligations are limited to extraordinary situations of high public relevance and include mitigating measures for the potential harm that they could cause to data holders (scope limitations, purpose limitations, compensation, etc). It is therefore worrying to see, particularly in the text proposed by the Council, a severe compression of the B2G provisions. The text of Art. 14 as drafted by the EC should be maintained in all its amplitude in order to avoid emptying of any practical useful effect this key data access provision.

An interesting and welcome development is the text of Art. 15 as proposed by the EP which appears to simplify the situations of exceptional need (although in this case the reference to “non personal” data should be removed). Likewise, the new Art. 15a in the EP text introduces an interesting “single point” for handling public sector bodies’ requests which should considerably lower the burden on data holders.

Within the general framework of the B2G obligations, a public sector body or a Union institution is entitled to share data with individuals or organisations in view of carrying out scientific research or analytics compatible with the purpose for which the data was requested. This provision effectively empowers research organisations to act in support of public sector bodies in cases of exceptional need.

Art. 21 of the EC text regulates specifically the rights and obligations of organisations, including research organisations receiving data under this framework. Art. 21 is thus a crucial provision that allows research organisations to assist other public sector bodies in the prevention and response to public emergencies and in the fulfilment of their public interest tasks. It is very worrying that the text of the EP considerably reduces this provision. Whereas the notification to the data holder by the public sector body that the transmission of data has taken place (as in the EC and Council texts) sounds well drafted, the possibility by data holders to object to this transfer (EP text, Art. 21(4)) appears as an illogical and disproportionate limitation of the role of research organisations in contributing to public interest tasks and should thus be removed.