European Parliament adopts new EU Data Act

The European Parliament adopted the new EU Data Act on 9 November 2023 – a new regulation which aims to enhance innovation for organisations by removing barriers to access personal data and harmonising rules on fair access to and use of data.

The EU Data Act will enable organisations to access more personal data by applying a set of rules on how personal data can be used and accessed across the economic sector in the EU.

Rhiannon Hastings, data protection paralegal in our commercial team, summarises what the Act sets out to achieve and what this means for you.

Background

On 23 February 2022, the European Parliament released its proposal to implement a new ‘Data Act’ to facilitate the volume of personal data generated by data subjects and machines as well as the growth in organisations use of personal data.

Following the European Parliament’s notability of low trust, conflicting economic incentives and technological obstacles impeding the data-driven innovation, the Data Act unlocks such potential by providing opportunities for the reuse of personal data, as well as removing barriers to the development of the European data economy.

The proposal’s specific objectives include:

• Facilitating access to and the use of personal data while preserving incentives to invest in ways of generating value through personal data by increasing legal certainty around the sharing of personal data
• Enable public sector and Union institutions in certain situations to process personal data where there is an exceptional need to do this to achieve a certain aim
• Put in place safeguards against unlawful personal data transfer without notification by cloud service providers
• Provide for the development of interoperability standards for data to be reused between sectors, in a bid to remove barriers to personal data sharing across domain specific EU personal data spaces.

What does this mean for you?

The new EU Data Act complements the EU GDPR – specifically Articles 15 and 20 concerning the rights of access and data portability.

As such, any processing your organisation undertakes that is subject to the provisions set out in the EU GDPR will also be subject to the new EU Data Act. This therefore provides the potential to increase your organisation’s innovation.

If a conflict transpires between the new EU Data Act and the EU GDPR, the law on the protection of personal data will prevail and must therefore be the main focus of your organisation’s processing.

It’s important to note the new EU Data Act does not form a part of UK data protection legislation (including the Data Protection and Digital Information Bill, which is yet to be implemented) and therefore does not affect any processing of personal data within the UK.

For more information on this and other data protection matters, please contact Rhiannon using [email protected].