European Data Strategy: What the new EU data laws mean for business

If data is the new oil that feeds AI machinery, then we want more of it. The more data we have, the more we can use it to innovate, create value and grow the digital economy.

The European Data Strategy: Setting standards on data

After the success of GDPR, followed by other regulations to smooth the free flow of non-personal data, the EU is a recognised standard-setter on the global stage. So, as AI exploded into being, the European Data Strategy introduced two significant pieces of legislation:

The Data Governance Act

In place since September 2023, the Data Governance Act sets the foundations for voluntary access, reuse and transfer of certain categories of protected public-sector data across nationally certified platforms. Organisations that share their data altruistically, must also register.

The Data Governance Act is not sector-specific, but will have value across multiple domains, like health and life sciences, energy and transport.

The Data Act

The extraterritorial Data Act, which applies from September 2025, aims to harmonise fair data access and use.

In a business-to-business context, the Data Act relates to non-personal data, generated by Internet-connected devices, for use in after-market and value-added services. It requires data holders to make data available on fair, reasonable and non-discriminatory (FRAND) terms. User-generated content; data transmitted to a connected product, like a server or the cloud, for storage; derivative data that includes investment activity, and data used in testing new products, are deemed out of scope.

Though data holders may guard their data as "trade secrets", they have no rights, under the Data Act, to refuse access. However, the data holder may seek a FRAND licence to opt out where there is high risk of:

• Serious economic damage from the disclosure of trade secrets

• Data transfer to third countries with weaker protections and enforcement

• Exploitation by competitors to reverse-engineer services or devices.

Eric urges data holders to identify the data that third parties may request from September 2025. "Audit and review your existing agreements with clients and determine whether you make your data available directly or via an intermediary," he says.

Proper governance procedures and training for IT and commercial staff are critical. "If a competitor asks an untrained person for data that is outside the scope of the Act, there's a real risk of losing business."

Data rights in financial services

Right now, data rights arise where data is copyrighted, trademarked or patented for licensing purposes, meaning it cannot be substantially extracted from databases.

However, data law, and particularly the incoming Financial Information Data Access (FiDA) proposal, will nullify database-access rights. It allows customers to authorise third parties to access data that is held by financial institutions.

More data laws and directives are coming down the line. "Some parts of the data pipeline will be impacted, and others not at all," explains Rich. "Some players will enforce their database rights; others will not. Some businesses, though entitled to hold data, will be precluded from using it once new database rights come into play."

European Data Strategy to unlock benefits of sharing

According to the European Commission, 80 per cent of industrial data is never used ¹. This is untapped potential, which can be shared over and over again. And that is good for innovation. It means:

• More data is available at less cost
  If the data is more valuable to B than to A, and there is no deprivation in A's value, A will licence the data to B. Some organisations, like Chicago Mercantile Exchange, introduced derived-data licence agreements to ensure that data used for activities outside of contract scope, is permitted and licensed.

• More data can be sold at higher cost
  Already we see network effects. The American Banking Association, for instance, brings together financial services companies to combine data. Some data providers operate on a sliding-fee scale. Purchasers not only pay an upfront cost but must report back on how data is used, allowing sellers to renegotiate their fees.

The new rules that form part of the European Data Strategy make more data available for reuse. They will impact every business. Understand what the rules means for you, your financial information and your disclosure obligations. Ask what will it mean for the services you provide and bundle? What terms will you amend? What will you lead on? How will you change the services you currently provide?

¹ https://ec.europa.eu/commission/presscorner/detail/en/ip_22_1113