The EU Data Act has come into force - scoping the impact for data holders

The EDA creates rights for users of connected products, whether they are individuals or corporate entities, to gain access to data (personal and non-personal data) that they generate from the use of the product or related services.  Related services are those services the absence of which would prevent a connected product from performing one or more of its functions, or which are subsequently connected to the product to add to or adapt its functionality. 

Where technically possible, data should be accessible directly by the user e.g. from on-device data storage or from a remote server.  Where direct access is not possible, data must be made available without undue delay, easily, securely, in a commonly used and machine-readable format, and, where relevant and technically feasible, of the same quality as is available to the data holder, continuously and in real-time.  There are transparency obligations imposed on data holders: data holders must provide clear and comprehensive information on the data that will be generated, including the nature and volume of the data, how this data will be used, means of access and the right to lodge a complaint with a competent authority. 

The data sharing obligations do not end there.  The EDA also obliges data holders to share data with public sector bodies in the case of emergency.  Perhaps of greatest concern to data holders, is the obligation also to share data (at the user's request) with third parties, which could include the data holders' competitors.

Similar to GDPR's "privacy by design" concept, manufacturers of connected products need to design their products and related services so that they support all of these data sharing obligations (i.e. direct access, where possible).

There are some limited protections for data holders, including for trade secrets (more on which, see section 4 below).  The possible anti-competitive use of these data access provisions is also addressed to a degree. "Gatekeepers" under the EU Digital Markets Act – the very largest online platforms (e.g. social networks, online marketplaces and search engines) – are ineligible to receive data for example.    

Any business that sells connected devices in the EU, where the data recipients are also in the EU, will need to consider the implications of the EDA – the location of the data holder, within or outside the EU, is not relevant.  There are however some carve-outs for data holders that are SMEs.

The application of the EDA is staggered and the timeline below shows when the various obligations begin to apply. 

Data holders may wish to undertake a scoping exercise, if they have not done so already, to work out what can legitimately be de-scoped from their data sharing obligations. The scope of the sharing obligations is undoubtedly very broad and, for example, the "related service" concept forces data holders to think beyond the confines of a particular device, to identify extensions to its functionality that exist elsewhere that capture data about the use of the device, perhaps an app or other smart product, such as a TV or smart plug.  There are nevertheless carve-outs to products and data which data holders may look to explore to limit what it will share:

• The data sharing obligations only apply to raw data and pre-processed data in respect of connected devices – pre-processed data is data that's enriched by metadata to provide basic context and time stamp to make it usable.  Importantly, data that is derived from the raw data and which is the outcome of additional analysis and investment are not subject to the data sharing obligations under the EDA.
  
  
• The original draft of the EDA mentioned content-rich products such as PCs, smartphones, cameras and webcams specifically as falling outside the scope of the EDA – this is no longer the case in the final version and these products remain within scope, but the EDA still does not apply to data when the user records, transmits or plays content (textual, audio or AV content) nor to the content itself.
  
  
• If the design of the product does not foresee data to be stored or transmitted outside the component in which the data is generated, then there's no obligation to make it retrievable and share it.
  
  
• Prototypes, as well as products the primary function of which is storing, processing, or transmitting data on behalf of any party other than the user (e.g. servers, cloud infrastructure), are excluded from scope.  

Safety exception.  It will also be possible under the EDA to agree contractual restrictions to restrict or prevent access where the data holder can show that the sharing of data can jeopardise personal safety – for example, where sharing creates a vulnerability from a cyber perspective that creates a safety risk.  To rely on this carve-out, data holders would need to notify the competent authority (i.e. the designated authority in the relevant Member State) and there's then a process for complaint and redress if the user disagrees.

There is also some comfort for data holders in that the EDA prohibits data recipients from using data to produce competing products. However, the same restriction does not apply in relation to competing services. The EDA also prohibits the use of data to "derive insights about the economic situation, assets and production methods of the manufacturer or, where applicable, the data holder".

Data holders should also consider how their terms and conditions will need to change and which of their terms and conditions will be impacted.

One key concern will be to ensure that data holders can use generated data as they intend: their terms and conditions are the route to achieving this.  Data controllers are well acquainted with the constraints that the GDPR places around their use of personal data but, so far, they have been free to use, as they wish, non-personal data generated by their customers' use of their connected products or related services.  That situation is about to change and the EDA will place limitations on data holders' use of non-personal data too: data holders will only be able to use data on the basis of a contractual agreement with the user – so it is going to be important for data holders to ensure that their terms and conditions are sufficiently clear about the purposes for which they will use data and with whom they are entitled to share data. 

Terms and conditions will also need to comply with transparency requirements (similar to the information provision requirements under the GDPR, which gave rise to privacy policies).

Finally, data holders will need to assess the fairness of their terms.  Contracts with consumers will be subject to consumer protection laws but the EDA will also require all business-to-business data sharing contracts to be on terms that are fair, reasonable and non-discriminatory (FRAND) and will impose a reverse burden of proof on data holders to prove that terms are non-discriminatory.  Moreover, unnegotiated contracts with SMEs will be unenforceable to the extent that they contain abusive terms from a data sharing perspective – the EDA sets out three blacklisted clauses, as well as types of clauses which are presumed unfair, which data holders should watch out for.  The European Commission is required to publish model terms to demonstrate what FRAND terms for data sharing look like. 

Data holders will also want to understand the extent to which they can recover costs for data sharing, as these costs could be significant, and to plan for this.  They will not be entitled to recover any costs from users.  However, there is an opportunity to recover some costs from third party recipients.  While they cannot charge for data per se, they can recover compensation from third parties which are not SMEs, to include both the costs of the technical steps to make data available and the investment that has been sunk into collecting and producing the data – which can include a reasonable margin.  For third party recipients that are SMEs, only costs, no margin, and no sunk investment, can be recovered.  Compensation will need to be reasonable and non-discriminatory (and data holders will need to be sufficiently clear about how it has been calculated).

Please feel free to contact us to find out more about the EDA and how our experts in the Technology & Commercial Transactions team at Travers Smith can help you to conduct a scoping exercise, better protect your commercially sensitive information or revise your terms and conditions.