Закон за данните | Адвокатска кантора "KGK"

In the age of connectivity, data has become the most valuable resource that fuels innovation and growth. But how do we ensure equitable access and use of this resource? This is where Regulation (EU) 2023/2854 of the European Parliament and of the Council, better known as the Data Act, comes in. This piece of European Union legislation is designed to transform the digital landscape by establishing harmonised rules for access to and use of data generated by connected products and services.

The Data Act is not just another regulatory act. It is a strategic initiative that aims to unlock the full potential of data while ensuring the rights and interests of all actors in the digital ecosystem are protected. The Regulation applies to data generated by connected products placed on the market in the Union and connected services provided in the Union, regardless of the location of the manufacturer or service provider. This means that its impact will be felt by a wide range of entities, from IoT device manufacturers to cloud service providers.

To better understand the reach of the Data Act, it is important to give some examples of related products and services.

Examples of connected products:

Smart home devices: thermostats, lighting systems, security cameras, refrigerators and other devices that collect and transmit usage data.
Industrial machinery: Sensors and other devices that collect data on the operation of machines in manufacturing plants.
Connected cars: Vehicles that collect data on location, speed, fuel consumption and other driving parameters.
Wearable devices: Smart watches, fitness trackers and other devices that collect data on users' health and activity.

Examples of related services:

Cloud services: cloud-based data storage, processing and analysis services.
Internet of Things (IoT) platforms: Platforms that collect, process and analyse data from IoT devices.
Smart Home Applications: Applications that allow users to control and manage their smart home devices.

One of the key principles of the Data Act is giving users more control over their data. Users of connected products and services will have the right to access the data generated by their use. Data holders will be required to provide access to this data on reasonable terms and in a transparent manner. This will enable users to use their data in ways that were previously impossible, for example for personalised services or to switch to another service provider.

In addition, the Data Act encourages data sharing between businesses. The Regulation provides mechanisms that will facilitate data sharing between companies, including an obligation for data holders to make data available to other businesses under certain conditions and for fair compensation. This measure aims to stimulate innovation and competition by enabling smaller businesses to compete with larger players in the market.

The Data Act also makes it easier to switch data processing service providers. The Regulation provides obligations for providers to assist users in transferring data and applications to a new provider. This will reduce users' reliance on a single provider and encourage competition between cloud service providers.

It is important to note that the Data Act contains provisions to protect trade secrets and other sensitive information. The regulation balances the need to share data with the protection of businesses' interests.

The Data Act came into force on the twentieth day after its publication in the Official Journal of the European Union and its implementation starts on 12 September 2025. They need to develop mechanisms to give users access to data, draw up data sharing agreements with other businesses, review their contracts with data processing service providers and put in place measures to protect trade secrets and other sensitive information.

The Data Act is a revolutionary piece of legislation that will change the way data is generated, used and shared. It will unlock new opportunities for innovation and growth, while ensuring that the rights and interests of all participants in the digital ecosystem are protected. Businesses need to become familiar with the provisions of the law and take the necessary steps to ensure compliance and take advantage of the new opportunities it offers.