The European Commission proposes the creation of a single European data space

On 19 February 2020, the European Commission (the "Commission") presented two initiatives which are a part of its wider digital strategy to make "Europe fit for the digital age": a European data strategy and a white paper on artificial intelligence. This legal update focuses on the European data strategy and its implications for businesses.

The objective of the strategy is to make 'Europe' (i.e. the EU) a role model and a leader for a society empowered by data. Over the next five years, the Commission will focus on three key objectives:

• technology that works for people;
• a fair and competitive economy; and
• an open, democratic and sustainable society.

The EU plans to build on its existing legal framework, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Regulation on the free flow of non-personal data (EU) 2018/1807, the Regulation (EU) 2019/881 (better known as the Cybersecurity Act) and the Open Data Directive (EU) 2019/1024, to create a single European data space. The Commission describes it as:

"a genuine single market for data, open to data from across the world – where personal as well as non-personal data, including sensitive business data, are secure and businesses also have easy access to an almost infinite amount of high-quality industrial data, boosting growth and creating value, while minimising the human carbon and environmental footprint."

Four pillars

The European strategy for data is based on four pillars:

1. a cross-sectoral governance framework for data access and use;
2. investments in data and strengthening Europe's capabilities and infrastructures for hosting, processing and using data, as well as interoperability;
3. empowering individuals, investing in skills and in SMEs; and
4. common European data spaces in strategic sectors and areas of public interest.

The Commission plans to introduce a legislative framework for the governance of common European data spaces to facilitate the use of data for innovative business ideas in line with the European industrial strategy announced in March 2020 and in compliance with applicable personal data protection, consumer protection and competition laws.

The Commission proposes to establish nine common European data spaces:

• Industrial (manufacturing) data space: to support the competitiveness and performance of EU industry, to capture the potential value of use of non-personal data in manufacturing.
• Green Deal data space: to harness the major potential of data in support of the Green Deal priority actions on climate change, circular economy, zero pollution, biodiversity, deforestation and compliance assurance.
• Mobility data space: to position Europe at the forefront of the development of an intelligent transport system, including connected cars as well as other modes of transport. Such a data space will facilitate access, pooling and sharing of data from existing and future transport and mobility databases.
• Health data space: to ensure essential progress in preventing, detecting and curing diseases as well as for informed, evidence-based decisions to improve the accessibility, effectiveness and sustainability of the healthcare systems.
• Financial data space: to stimulate, through enhanced data sharing, innovation, market transparency, sustainable finance, as well as access to finance for European businesses and a more integrated market.
• Energy data space: to promote stronger availability and cross-sector sharing of data, in a customer-centric, secure and trustworthy manner, to facilitate innovative solutions and support the decarbonisation of the energy system.
• Agriculture data space: to enhance the sustainability, performance and competitiveness of the EU agricultural sector through the processing and analysis of production and other data, allowing for a precise and tailored application in respect of farming production.
• Data space for public administration: to improve transparency and accountability of public spending and spending quality, fighting corruption, both at EU and national level, and to address law enforcement needs and support the effective application of EU law and enable innovative GovTech, RegTech and LegalTech applications supporting practitioners as well as other services of public interest.
• Skills data space: to reduce the skills mismatch between education and training systems on the one hand and the needs of the labour market on the other.

The Commission also proposes to explore the need for legislative action (the 2021 Data Act) to incentivise voluntary horizontal data sharing across different sectors.

At the moment, the Commission's view is that compulsory data-sharing in specific sectors might need to be adopted only if existing competition laws cannot be used to solve an identified or foreseen market failure in a particular sector. The Commission is planning to update the Horizontal Co-operation Guidelines and provide more guidance to businesses on the compliance of data sharing and pooling arrangements with EU competition law.

According to the proposals, the Data Act is not aimed at redressing the role of technology companies which have accumulated vast amounts of data. The Observatory on the Online Platform Economy has led the Commission's work in this area and the Commission is planning a separate Digital Services Act to update the regulatory framework for digital platforms.

The Commission also plans to review the intellectual property rights framework to enhance further access to proprietary data sets with a possible revision of the Database Directive 96/9/EC and a clarification of the Trade Secrets Protection Directive (EU) 2016/943 to loosen restrictions.

A big focus of the Commission's proposals is empowering individuals to be in control of their own data. The Commission is planning to explore enhancing the portability right for individuals under Article 20 of the GDPR to give individuals more control over who can access and use their personal data (possibly as part of the 2021 Data Act).

According to the proposals, the Commission will, by the end of 2021, also create an analytical framework for measuring data flows both within the EU, and between the EU and the rest of the world.

Tensions between competition law, intellectual property rights and data protection

There is an apparent tension in the Commission's proposals between opening up data to businesses across different sectors to promote competition and protecting the data held by businesses (whether personal data or non-personal data such as commercially sensitive data and trade secrets and the ownership of intellectual property rights in them).

In a world of strict data protection laws, which give individuals control over their data and regulate who controllers can and cannot share personal data with, businesses will not only need to be provided with incentives to share data but also legal certainty that by making their datasets available to others they do not infringe intellectual property rights of third parties, fail to comply with data protection obligations or breach competition law. To achieve its three key objectives, the Commission will need to present fair and clear rules on data access and use that provide legal certainty to all parties involved.

Impact on businesses

The Commission's proposals build on its previous initiatives like open banking (covered in a separate legal update), which required banks to share a customer's data with third parties with that customer's permission. Last year, the Open Data Directive entered into force; this has encouraged EU Member States to make as much information from the public sector available for re-use as possible. Most recently, during the COVID-19 pandemic, researchers and funders have been encouraged to ensure that research findings and data relevant to the outbreak are shared rapidly and openly to inform the public health response.

Depending on the wording of the final proposals from the Commission, businesses will need to consider carefully what personal and non-personal data they hold and whether any of this data might fall under the Commission's proposals for facilitating data sharing. This can present various opportunities for businesses that are able to take advantage of the increased data flows and leverage the data made available by the public sector and other businesses. However, all parties involved will need to ensure that their respective behaviour is compliant with competition law, especially in relation to information sharing, and the applicable data protection legislation and intellectual property rights in that data enjoyed by others.

While the UK Government is not expected to adopt any legislative proposals coming from the Commission after the end of the Brexit transition period, the Commission's proposals are likely to have an impact on any businesses operating in the EU regardless of their country of incorporation.

Moreover, the UK Government has announced in its Spring Budget that it will create a digital markets taskforce within the Competition and Markets Authority and accept all six strategic recommendations from last year's Furman report on Unlocking digital competition, which included a recommendation to advance data openness and access to non-personal or anonymised data. It is therefore likely that like the EU, the UK will implement rules to encourage and facilitate data sharing in the private sector.

At the moment, it is not clear what the impact of the COVID-19 pandemic will be on the Commission's proposals but it is likely that any strategic legislative proposals will be delayed as a result of the pandemic. However, the Commission and / or national governments might potentially speed up their efforts to encourage data sharing with public authorities to evaluate the effectiveness of social distancing measures, analyse where serious outbreaks of the pandemic might occur and/or warn individuals who have recently been in touch with individuals exposed to the virus.