By Delia Belciu, Data Committee Chair, DB Law Office, RO

On 23 February 2022, the European Commission has published its proposal of a Data Act. The Act is one of the regulatory initiatives which form part of the European Union’s data strategy.

The Act complements the Data Governance Act (which focuses on reuse of public sector data) covering business to business and government to business data in all sectors. The rights and obligations under GDPR that apply to personal data remain and must be read in parallel.

The Act applies to all manufacturers and providers of connected products and services (e.g., IoT devices) in the EU, users (enterprise or individuals) of such products and services, data recipients, public sector bodies in the EU and providers of data processing services in the EU. There are exemptions for micro and small enterprises.

The proposal for the Data Act includes:

1. Measures to allow users of connected devices to gain access to data generated by them and to share such data with third parties;
2. Measures to rebalance negotiation power for SMEs by preventing abuse of contractual imbalances in data sharing contracts;
3. Means for public sector bodies to access and use data held by the private sector that is necessary for exceptional circumstances, particularly in case of a public emergency, such as floods and wildfires, or to implement a legal mandate if data are not otherwise available.
4. Specific rules on cloud and data processing services allowing customers to effectively switch between different cloud data-processing services providers and putting in place safeguards against unlawful data transfer.