Taken from”The Legal Newspaper”, the legal information newspaper of the Wolters Kluwer Italia group and edited by Cedam, Utet Giuridica, Leggi d'Italia and Ipsoa.

The European Commission has presented, the November 25, 2020, a new proposal for a regulation on data governance, called”Data Governance Act”.

The proposal is the first of a series of measures announced by the new Commission that aims to promote the availability of data that can be used for European economic development and, in particular, that of the so-called 'data economy' and of business models based on data, as well as artificial intelligence, which requires a wide availability of data for better and more widespread development.

The objective is, therefore, to improve the conditions and mechanisms for data sharing in the internal market, creating a harmonized framework for the exchange of data, both for access and for reuse. In particular, the new regulation will establish a common legal framework by intervening on the sharing of data in the public sector, on intermediary services for the sharing of data between companies and interested parties provided for remuneration and on “data altruism”, i.e. the collection and processing of data made available for altruistic purposes by individuals and legal entities.

The regulation would apply without prejudice to the regulation 679/2016, so-called GDPR, however, the definitions already help to understand the paradigm shift with respect to the legislation for the protection of individuals with regard to the processing of personal data.

First of all, the application is extended to all data, personal and non-personal.

Second, the keywords are”reuse”,”sharing” and”logon”. By “reuse” means the use by natural or legal persons of data held by public sector bodies, for commercial or non-commercial purposes other than the initial purpose within the public task for which the data were produced; by “data sharing”, the provision by a data owner to a data user for the purpose of joint or individual use of the shared data, based on voluntary agreements, directly or through an intermediary. Finally, “Access” means “processing by a data user of data that has been provided by a data holder”, in accordance with specific technical, legal or organizational requirements, without necessarily implying the transmission or download of such data.

The main figures outlined are the”Data holder” and the”Data user”. The first, defined as the legal entity or interested person who, in accordance with applicable Union or national law, has the right to grant access to or share certain personal or non-personal data under its control. The second as the natural or legal person who has legal access to certain personal or non-personal data and is authorized to use such data for commercial or non-commercial purposes.

Among the proposed provisions, three main interventions can be identified:

(a) provisions on the conditions for the reuse, within the Union, of certain categories of data held by public sector bodies;

(b) a notification and supervisory framework for the provision of data sharing services;

(c) a framework for the voluntary registration of entities that collect and process data made available for altruistic purposes.

With regard to public data, a mechanism is introduced for the reuse of certain categories of public sector data, applicable to data held by public sector entities protected by: a) discretion; (b)”statistical confidentiality”; (c) protection of the intellectual property rights of third parties; (d) protection of personal data.

There is a prohibition of agreements that grant exclusive rights or that have the object or effect of granting such exclusive rights or of limiting the availability of data for reuse by parties other than the parties to those agreements, unless this is necessary for the provision of a service or product in the general interest. However, the period of exclusivity cannot exceed three years. In addition, the principles of transparency, equality and non-discrimination are applicable.

THEpublic body may establish the conditions for reuse - provided that always in a non-discriminatory, objective and proportionate way - both with respect to the processing methods and with respect to the purposes, and may also impose anonymization or pseudonymization.

Fees may be provided, but they must be predetermined in advance for all potential contractors and measures must in any case be provided to facilitate reuse for non-commercial purposes and for SMEs.

It is planned to identify competent authorities to support and oversee these sharing mechanisms, as well as the introduction of a single 'information point' at national level for keeping a register that describes the available data sets and meets the requests for 'data re-use'.

Additional specific provisions are envisaged for treatment in third-countries.

For data sharing services,”Data sharing services”, three categories are identified, subject to the notification regime: intermediation services between legal entities and potential data users, intermediation services between interested parties who seek to make their personal data available and potential data users, data cooperatives.

The former may include bilateral or multilateral data exchanges or the creation of platforms or databases that allow the joint exchange or exploitation of data, as well as the creation of a specific infrastructure for the interconnection of data owners and data users. The latter include services aimed at enabling and supporting the exercise of the rights of the interested party under the GDPR, in particular the right to data portability.

Finally, data cooperatives are services to support interested parties or sole proprietorships or micro, small and medium-sized enterprises, which give the cooperative the power to negotiate the terms and conditions for data processing, representing their interests.

In addition to the obligation to notify and oversee these activities, there are independence and third party requirements.

Finally, for”Data Altruism” means the consent of the interested parties to the processing of personal data concerning them, or the authorizations of other data holders to allow the use of their non-personal data without asking for remuneration, for purposes of general interest, such as scientific research purposes or improving public services.

These purposes would include healthcare, the fight against climate change, the improvement of mobility, the facilitation of the creation of official statistics or the improvement of the provision of public services. Support for scientific research, including, for example, technological development and demonstration, fundamental research, applied research and privately funded research, should also be considered as purposes of general interest.

Therefore, measures have been introduced to facilitate the circulation of data for altruistic purposes and a register has been established for organizations that engage in such altruistic uses, accompanied by measures for monitoring and supervision.

In addition, it is planned to introduce a European consent form for data altruism for the granting and revocation of consent, in particular in the context of scientific research and statistical use. To take into account the specificities of the individual sectors, also from the point of view of data protection, the possibility of sectoral adjustments is envisaged.

In addition, a European Data Innovation Board is established, to support the Commission in coordinating national practices and policies and promoting the cross-sectoral use of data, also working on standardization.

Proposal for a Regulation on European Data Governance (Data Governance Act), 25 November 2020

‍