EU Data Act: Money for data

“The EU Parliament and states have agreed on a data law. In the future, manufacturers of networked devices will be able to share their data. What consequences that could have.

A fitness watch rarely comes alone. In order for swimmers, cyclists or runners to be able to view their training data, they usually have to download an app – often the one from the manufacturer. Simply selecting a different system is hardly possible.

If the European Union has its way, this will soon be over. In the future, consumers should be able to decide for themselves who they want to make their data available to, regardless of the specifications made by the manufacturers. Then it would be easy for the owners of self-driving cars, for example, to switch and use the autopilot of another provider at some point. On Tuesday evening, the negotiators from EU states and the European Parliament agreed on a data law that is intended to clarify the legal, economic and technical access to data for consumers, states and companies.

What is the problem?

The number of networked devices is increasing, be it the car, the vacuum cleaner robot or the intelligent heating system at home. Nevertheless, very few people know what data is collected and for what purposes it is evaluated. This is also a problem for the economy: if the heating needs to be serviced, a medium-sized tradesman cannot easily access the smart thermostat. The same applies in the case of damaged cars for car workshops. Here, too, consumers must contact the manufacturer or his contractual partner directly, even if it is more expensive.

In the future, the owners of Internet-of-Things devices should be able to pass on the data to third parties - regardless of whether it is a networked kettle or an industrial wind turbine.

What is the aim of the law?

Consumers should have more control over what data is generated, stored and how it is used. "Illegal data transmissions are thus ended," says Tabea Rößner (The Greens), chairwoman of the Bundestag Committee for Digital Affairs. The General Data Protection Regulation (GDPR) already provides that consumers can ask manufacturers to disclose their data. But it often takes a lot of time to get there.

The Data Act envisages that users will even be able to view the data in real time in the future.

  Companies should also benefit from the law: If they want to see data from the providers, they have to approach the user, who then has to arrange for data access.

Data from modern cars, networked household appliances and industrial plants such as wind turbines should be better used in Europe in the future. The law is intended to create the basis for a European data market, and the EU hopes that the new regulation will boost innovation in the digital economy.

How would that work exactly?

Theoretically, consumers would have to be asked in future whether they want to make the data available or not, for example in the form of data usage or service contracts that they can accept or reject, so data access could then apply against data usage.

What is the criticism?

Consumer advocates warn that trying to understand such contracts with all their clauses could overwhelm consumers. In addition, the purposes for which such data are collected in the first place should have been defined more precisely in the Data Act and, for example, the collection of personal data for advertising purposes should have been excluded from the outset.

It is also unclear what happens if consumers decide to share their user data. It is possible that they get money for it.

  "The consequences that the voluntary sharing of data can have are difficult to survey. Companies could exploit this to take advantage of people or set false incentives," says Ramona Pop, head of the Federal Association of Consumer Organizations (vzbv). The consumer advocates criticize that data protection could even be weakened by the law.

Surely companies are reluctant to share such data?

That's correct. Many companies, including German corporations such as SAP and Siemens, have criticized the law. The digital association Bitkom, for example, fears that companies could be forced to share company and business secrets.

On the other hand, the manufacturers have enforced sensitive restrictions on the data access right of the users, complains the EU parliamentarian Damian Boeselager (Volt, Greens/EFA). They can refuse to share data if they expect serious and irreparable loss. However, they must report the refusal to pass on data, which in turn can be checked for plausibility by an authority.

How is the sharing of the data supposed to be technically realized?

The data should be standardized, readable and accessible in real time. The law also provides for the development of interoperability standards. What is meant by this is the ability for systems from cloud providers to work together at all. These standards aim to ensure that data can be easily copied or transferred from different services when generated by intelligent machines and devices.

What applies to the transfer of data to public authorities?

The law provides that public bodies, the Commission, the European Central Bank and Union bodies can access and use data held by the private sector when necessary in exceptional circumstances, particularly public emergencies such as floods and forest fires, or for compliance a task in the public interest. This applies to both personal and non-personal data, disclosure to third parties is not permitted.

What are the consequences of the law for US tech companies?

The new regulations also apply to non-European manufacturers if they are active in Europe. The regulations are designed to enable customers to switch effectively between different providers of data processing services. It is about so-called cloud switching, large cloud providers such as Amazon Web Services, Microsoft and Google are obliged to establish standards for easier provider switching and to prevent illegal access to data.

When does the law come into force?

The agreement has yet to be formally confirmed, which is expected this fall. It will then take 20 months for the law to come into force. Manufacturers then have another year, i.e. probably until mid-2026. From then on, a period of five years should apply to current contracts.”