# The New Law of the European Data Markets: Demystifying the European Data Strategy

Teodora Groza, Beatriz Botero Arcila

► To cite this version:

Teodora Groza, Beatriz Botero Arcila. The New Law of the European Data Markets: Demystifying the European Data Strategy. Global Jurist, 2024, 10.1515/gj-2024-0045. hal-04630119

HAL Id: hal-04630119

https://sciencespo.hal.science/hal-04630119v1

Submitted on 1 Jul 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

Review

Teodora Groza* and Beatriz Botero Arcila

# The New Law of the European Data Markets: Demystifying the European Data Strategy

https://doi.org/10.1515/gj-2024-0045

Received May 10, 2024; accepted June 3, 2024; published online June 26, 2024

**Abstract:** The European Data Strategy, published in 2020, aims to turn the EU into a society empowered by data which captures its benefits to generate improvements in health, well-being, the environment, transparent governance, and convenient public services. This article examines the European Data Strategy, focusing on the Data Act and Data Governance Act, and situates them within broader data governance discussions. It argues that the Strategy has at its centre a tension between fostering a robust, fair data market versus scepticism towards market-based data governance mechanisms, and analyses to what extent the regulatory techniques the Data Strategy proposes can address this tension.

**Keywords:** data governance; law & economics; data strategy

1 Introduction

In 2020, the European Union set the goal to 'become a leading role model for a society empowered by data to make better decisions – in business and the public sector (...) [and] to capture the benefits of better use of data, including greater productivity and competitive markets, but also improvements in health and well-being, environment, transparent governance and convenient public services.'¹ To do so, the European

1 European Commission, 'Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions A European

Both authors contributed equally to this paper.

*Corresponding author: Teodora Groza, Ecole de Droit, Sciences Po, Paris, France,

E-mail: teodora.groza@sciencespo.fr. https://orcid.org/0009-0007-2149-5662

Beatriz Botero Arcila, Ecole de Droit, Sciences Po, Paris, France; and Faculty Affiliate at the Berkman Klein

Centre for Internet & Society at Harvard University, Cambridge, MA, USA. https://orcid.org/0000-0001-7784-6897

<figure><img src="image_3.png" /></figure>

<figure><img src="image_4.png" /></figure>
Strategy for Data ('Data Strategy' or simply 'the Strategy') seeks to create a single market for data by 2030 where personal as well as non-personal data is secure yet accessible, 'boosting growth and creating value' while being mindful of European values and fundamental rights.<fnref n="2" />

In a nutshell, the Data Strategy creates different rules and institutions that seek to improve and facilitate data access and enhance data utilisation. Its ultimate goal is to give rise to a data market that achieves two objectives which are difficult to reconcile: maximising the gains from data to enhance welfare on the one hand, and protecting the European values of equality and fundamental rights on the other.

This Article analyses the EU Data Strategy through its two main regulatory elements, the Data Governance Act ('DGA') and the Data Act ('DA'). It intervenes in the academic and policy conversation about the governance of the data economy in the European Union and contributes to this literature in three main ways:

First, the Article is one of the first to present a comprehensive overview of the European Data Strategy and its main regulatory components to date – the DGA and the DA – and to situate it within the broader data governance literature.<fnref n="3" /> It conceptualises the European Data Strategy as emerging from the EU's historical inclination toward market-based approaches to achieve various objectives,<fnref n="4" /> while also acknowledging concerns within the data governance literature about potential overreliance on market mechanisms for data regulation.<fnref n="5" />

Indeed, much of the contemporary academic discussion on the governance of data seems to take one of three rough perspectives. A first and baseline perspective aims for economic efficiency as a proxy for welfare. This strand of literature proposes that data markets' operations should be improved 'by transforming data into merchandisable

<footnote>Strategy for data' COM(2020) 66 final [Brussels, 19 February 2020], hereinafter 'European Data Strategy,' <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52020DC0066&from=EN> accessed 5 May 2023.</footnote>

<footnote n="2">2 European Data Strategy (n 1).</footnote>

<footnote n="3">3 See Thomas Margoni, Charlotte Ducuing, Luca Shirru, 'Data property, data governance and Common European Data Spaces' [2023] <https://zenodo.org/record/7867881> accessed 30 April 2023. For other comprehensive studies focused on the Data Governance Act see Gabriele Caravano and Michène Finck, 'Regulating data intermediaries: The impact of the Data Governance Act on the EU's data economy' [2023] Computer Law & Security Review Volume 50; Lukas von Ditfurth & Gregor Lienemann, 'The Data Governance Act–Promoting or Restricting Data Intermediaries?' [2022] Competition and Regulation in Network Industries, 23(4).</footnote>

<footnote n="4">4 For an analysis, see Miguel Poiares Maduro, 'Reforming the Market or the State? Article 30 and the European Constitution: Economic Freedom and Political Rights' (1997) 3(1) European Law Journal 55.</footnote>

<footnote n="5">5 For a review of this literature see Nadya Purtova & Gijs van Maanen, 'Data as an economic good, data as a commons and data governance' (2023) Law, Innovation and Technology <https://doi.org/10.1080/17579961.2023.2265270> accessed 18 January 2024.</footnote>
private goods' and offering legal certainty to parties providing and producing data.<fnref n="6" /> A second perspective criticises this baseline approach on the ground that data market structures sustain the inequalities of the digital economy, participate in the erosion of corporate accountability and give rise to new forms of social control.<fnref n="7" /> Legal scholars in this camp emphasise the role of law (private law, regulation, and the lack thereof) in enabling the accumulation of outsized power, resources and data in the hands of a few actors in the data economy.<fnref n="8" /> A third approach focuses on imagining and developing institutional alternatives to de-concentrate data markets and democratise access. Scholars and organisations adopting this view often start from the nature of data as a non-rival economic good. They note that exclusive private data use – and relying on commodification and property law – may contribute to data being underutilised and argue, for example, that sharing data or making more data available can improve (public) services.<fnref n="9" /> Thus, they propose institutions that are alternatives or complements to the market logic of current data exchanges, such as semi-commons arrangements.<fnref n="10" /> In

<footnote n="6">6 As Charlotte Ducuing explains, the European Commission did contemplate the creation of a property or ownership-like right on data in the document 'Building a European data economy.' This would have brought legal certainty for entitlements on data, and endorsed and adapted the economic reality that data is being commodified. The creation of this type of right has been discussed and mostly opposed by lawyers, however, this approach seems to have been largely dropped by the Commission. Charlotte Ducuing, 'Beyond the Data Flow Paradigm' (2020) Technology and Regulation 2020 Vol 2; European Commission, Communication 'Building a European data econ-omy', COM/2017/ 09 final, 10.1.2017 and the accompanying Commission Staff Working Document 'On the free flow of data and emerging issues of the European data economy', SWD/2017/02 final. See also, arguing for certain forms of data markets, Josef Drexl (2017) 'Designing Competitive Markets for Industrial Data – Between Propertisation and Access' JIPITEC, 257-29; H. Zech, (2016) 'Data as tradeable commodity', in De Franceschi, A. (ed.) European Contract Law and the Digital Single Market, Intersentia, 51-79.</footnote>

<footnote n="7">7 See e.g. Alain Strowel, 'Les Données Des Ressources En Quête de Propriété – Regards Sur Quelques Développements Récents En Droit Européen', in Elise Degrave, Cécile de Terwangne, Séverine Dusollier, Robert Queck (eds) Law, Norms and Freedoms in Cyberspace / Droit, Normes et Libertés Dans Le Cyber monde – Liber Amicorum Yves Poullet Collection Du CRIDS (Larcier, 2018), 251–68; see, in general Purtova & van Maanen (n5)</footnote>

<footnote n="8">8 See Julie Cohen, Between Truth and Power: The Legal Constructions of Informational Capitalism (Oxford University Press, 2019); Amy Kapczynski, 'The Law of Informational Capitalism' [2020] 129(5) The Yale Law Journal; Katharina Pistor, 'Rule by Data: The End of Markets?' [2020] 83 Law and Contemporary Problems 101, 124</footnote>

<footnote n="9">9 See Ducuing (n 6).</footnote>

<footnote n="10">10 See e.g. Sylvie Delacroix and Neil D. Lawrence, 'Bottom-up data Trusts: disturbing the ‘one size fits all’ approach to data governance' [2019] 9(4) International Data Privacy Law; See e.g. JM Nolin, 'Data as Oil, Infrastructure or Asset? Three Metaphors of Data as Economic Value' (2020) 18 Journal of Information, Communication and Ethics in Society 28 <https://doi.org/10.1108/JICES-04-2019-0044> (accessed 6 April 2023); Charlotte Ducuing, 'Data as Infrastructure? A Study of data-sharing Legal Regimes' (2020) 21 Competition and Regulation in Network Industries 124 <https://doi.org/10.1177/1783591719895390> (accessed 6 April 2023); Tommaso Fia, 'An Alternative to Data Ownership: Managing Access to Non-Personal Data</footnote>
this piece, we leverage all these strands of scholarship to show how the Data Strategy learns from contemporary data governance scholarship to propose a new form of data markets.

Second, we show how the DA and the DGA seek to operationalize these modes of data governance through specific legal interventions aimed at streamlining data access and exchanges. We take seriously the legal-institutionalist insight that markets arise and operate through law – both public regulation and private law regimes – and are the result of complex and vast webs of legal and political choices and the path dependencies they give rise to.¹¹ Here, we show that these two regulations create specific entitlements, rights, and obligations over and about data, de facto creating a private law of non-personal data. The Article exposes how the Data Strategy constitutes a novel regulatory approach that interweaves conservative regulatory techniques of fixing market failures with an un-orthodox vision of regulation as market structuring. From punctual interventions that seek to create incentives for data holders to share or trade their data, to bolder measures that aim to level the playing field by enhancing the bargaining power of small players, the acts display a wide spectrum of regulatory techniques.

Third and last, the Article analyses the opportunities and challenges of (re) shaping the structure of the European data market in a way that is both welfare-enhancing and respectful of European values. To do so, we draw both on cost-benefit analysis and distributive analysis to assess the different mechanisms adopted by the Strategy. We question, for example, whether enough incentives are indeed in place to share data, what the scope of application of data protection law should be in this context, and whether the Strategy, inadvertently, may not be hindering the opportunity to compete by newcomers. The final part suggests some avenues for future regulatory work and research.

The Article is divided into four sections. The first part presents the Article's theoretical framework and methodology. The second part presents the legal and economic background on the economics of data, data markets, and data law in the EU. The third part presents the Data Strategy and analyses it, focusing both on what it aims to do and what it may end up doing in practice. The fourth part discusses the challenges the Strategy needs to address and how it fits within the broader European regulatory landscape.

through the Commons' (2021) 21 Global Jurist 21, 181 <https://doi.org/10.1515/gj-2020-0034> (accessed 6 April 2023); Bertin Martens et al. 'Business-to-Business data-sharing: An economic and legal analysis' (2020) JRC Digital Economy Working Paper 2020-05 <https://joint-research-centre.ec.europa.eu/document/download/c48fbb97-7e53-4082-a5a1-9a4ad1b6577c_en>; Purtova & van Maanen (n 4).

11 See Hanoch Dagan et al., ‘The Law of the Market’ (2020) 83 Law and Contemporary Problems i, xviii; Cohen (n 10), Kapczynski (n 8), Delacroix and Lawrence (n 10).
# 2 Background: Data and Data Markets, Law and Economics, and Methodology

The Data Act and the Data Governance Act are part of the EU's manifold regulations aiming to align the digital economy with EU values while at the same time enhancing innovation.<fnref n="12" /> As its name implies, it is mostly concerned with the governance of data, notably access to data. In this section, we introduce the key conceptual tools for analysing the Strategy – data and data markets – and explain our theoretical framework and our methodology.

## 2.1 Key Definitions

### 2.1.1 Data

The DA and the DGA define data as ‘any digital representation of acts, facts or information and any compilation of such acts, facts, or information, including in the form of sound, visual or audio-visual recording.’<fnref n="13" /> This definition, like most modern understandings of data, situates the digital context as the default setting for data governance. Similarly, the data governance and data economics literature typically understand and define data as a digital representation of information.<fnref n="14" />

It is generally accepted that data is a valuable resource. The Economist popularised the idea that ‘data is the new oil’ in 2017, a phrase first formulated in 2006 by mathematician Clive Humby.<fnref n="15" /> In Humby’s original formulation the metaphor was meant to signify that data, like oil, is not useful in its raw state but needs to be refined

<footnote n="12">12 See in general European Commission, ‘Shaping Europe’s digital future’ [2023] <https://digital-strategy.ec.europa.eu/en> accessed Jan 19 2024. Other main regulatory interventions include the Digital Services Act (Regulation 2022/2065 on the European Parliament and of the Council – DSA), the Digital Markets Act (Regulation 2022/1925 of the European Parliament and of the Council – DMA), and the Artificial Intelligence Act (COM(2021)02).</footnote>

<footnote n="13">13 See Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) Art. 2(1); Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act) [2022] OJ L 152, Art 2(1)</footnote>

<footnote n="14">14 Purtova & van Maanen (n 5) 6.</footnote>

<footnote n="15">15 ‘The world’s most valuable resource is no longer oil, but data’, *The Economist* (May 6, 2017) <https://www.economist.com/leaders/2017/05/06/the-worlds-most-valuable-resource-is-no-longer-oil-but-data> accessed 19 January 2024.</footnote>
and turned into something useful.<fnref n="16" /> Relatedly, critically oriented scholars emphasise that metaphors that analogize data to natural resources seem to convey that data is a finished good that exists naturally in the world.<fnref n="17" /> This is not the case. Data is a representation of information. Hence, both data generated intentionally – either by digitising some already available information or by immediately collecting digital data, as well as data collected by sensors – needs not only to be refined and turned into something useful but is also the result of human-created infrastructures and institutions.<fnref n="18" /> Policy-makers and scholars highlight that these infrastructures and institutions (e.g. the technical capabilities required for data production and storage, data governance laws) give rise to the inequalities and challenges endemic to the digital economy: data produced is often not representative enough along gender, race or class dimensions;<fnref n="19" /> some countries produce most of the data in the world, and, particularly, most data is produced and controlled by few technology companies.<fnref n="20" /> The literature highlights that these inequalities also influence who benefits from the data economy.<fnref n="21" />

As an economic good, data is non-rivalrous, which means that its use by one individual does not prevent others from using it at the same or at any other time.<fnref n="22" /> Despite the possibility of non-rival consumption, data is also generally an excludable good.<fnref n="23" /> This is in no small part a function of technical and legal aspects and interventions – hence, of concrete choices. Data, when produced and collected, is automatically stored in devices or servers which usually belong to a legal person and are rarely publicly accessible. These parties collecting and storing data then rely on technical and legal interventions to

<footnote n="16">16 John Suarez-Davis, 'Data is not 'the new oil' – it's way more valuable than that, *The Drum* (December 12, 2022) <https://www.thedrum.com/opinion/2022/12/12/data-isn-t-the-new-oil-it-way-more-valuable#:~:text=When%20British%20mathematician%20Clive%20Humby, value%20lies%20in%20its%20potential> accessed 19 January 2024.</footnote>

<footnote n="17">17 See Angelina Fisher & Thomas Streinz, 'Confronting Data Inequality' [2022] 60(3) Columbia Journal of Transnational Law, 829–956; Catherine D'Ignazio & Lauren F. Klein, *Data Feminism* (The MIT Press, 2020)</footnote>

<footnote n="18">18 Fisher and Streinz (n 17) 11.</footnote>

<footnote n="19">19 See D'Ignazio & Klein (n17); Safiya U. Noble, *Algorithms of oppression: How search engines reinforce racism* (NYU Press, 2018).</footnote>

<footnote n="20">20 See Sarah Lamdan, *Data Cartels: The Companies That Control and Monopolize Our Information* (Stanford University Press 2022).</footnote>

<footnote n="21">21 Fisher and Streinz (n 17).</footnote>

<footnote n="22">22 See Purtova & van Maanen (n. 4); Roxana Mihet and Thomas Philippon, 'The Economics of Big Data and Artificial Intelligence' in JJ Choi and B Ozkan (eds), *Disruptive Innovation in Business and Finance in the Digital World* (Emerald Publishing Limited, 2019) 29 <https://doi.org/10.1108/S1569-376720190000020006>.</footnote>

<footnote n="23">23 Purtova & van Maanen (n 5) 14.</footnote>
cabin the universe of parties able to access data, such as blocking access technically via encryption, and / or legally via relying on trade secrecy laws.<fnref n="24" />

Legally, there is no concerted approach to data ownership, access, and control in Europe. Data is not physical (though it is stored in physical devices)<fnref n="25" /> and therefore it is not clear whether it can be covered by rights in rem designed for corporeal entities, even if some argue that it would be possible.<fnref n="26" /> It is also typically not covered by intellectual property laws because it fails to satisfy the criterion of originality.<fnref n="27" /> We discuss at some length the different approaches proposed by the literature to govern data in Part 2. Here, however, it suffices to say that there is a patchwork of laws and rules creating entitlements over data that shape how data can be accessed, shared, and used. These include data protection laws, trade secret protections, sector-specific regulations covering issues like the disclosure of government-held data, and, importantly, private ordering via contract law.<fnref n="28" />

## 2.1.2 Data Markets

As an excludable good, data can be traded. The 2021–2023 European Data Market study published by the EU Commission defines data markets as ‘marketplaces where digital data and insights from data are exchanged as products or services that result from the elaboration of raw data.’<fnref n="29" /> On the supply side of these markets, there are data-related digital products, services, and technologies such as credit scores, client

<footnote n="24">24 See Nestor Duch-Brown, Bertin Martens and Frank Mueller-Langer, ‘The Economics of Ownership, Access and Trade in Digital Data’ (17 February 2017) <https://papers.ssrn.com/abstract=2914144> (accessed 8 April 2023), 76; Charles I Jones and Christopher Tonetti, ‘Nonrivalry and Economics of Data’ (2020) 110 American Economic Review 2819; 77 Maryam Farboodi and Laura Veldkamp, ‘A Growth Model of the Data Economy’ (2021) Working Paper 28427 <http://www.nber.org/papers/w28427> (accessed 4 December 2021) 2.</footnote>

<footnote n="25">25 James Grimmelmann and Christina Mulligan, ‘Data Property’ (2023) 72 American University Law Review 829 (arguing that data is embodied in physical objects, which the authors refer to as ‘instances’).</footnote>

<footnote n="26">26 Andreas Boerding et al. ‘Data Ownership – A Property Rights Approach from a European Perspective’ (2018) 11 Journal of Civil law Studies 2 (arguing that even if this concerted approach does not exist, EU law provides a sufficient basis for an approach to data ownership based on property law. According to them, this would require specifying how data as an asset can be allocated to a legal subject and the countours of the property right).</footnote>

<footnote n="27">27 See below Section III.</footnote>

<footnote n="28">28 For example, the French ‘LOI n° 2016-1321 du 7 octobre 2016 pour une République numérique’, allowing the public sector to access certain (private sector) data of general interest or the Finnish Forest Act obliging forest owners to share information related to the management of the forest with the public sector. See also Boerding et al. (n 26) (discussing the general patchwork at the EU level).</footnote>

<footnote n="29">29 Mike Glennon, et al. ‘Results of the New European Data Market Study 2021–2023’ (European Commission, REPORT / STUDY, Publication 07 May 2021),11, (hereinafter European Data Study).</footnote>
profiles or insights on the traffic in a particular city. On the demand side, companies and governments acquire data or data insights to use in their decision-making processes and ultimately make their operations more efficient.<fnref n="30" />

It is worth highlighting that data markets are not that new: Data trading on a large scale was made possible at the latest in the 1990s by a confluence of widely available public records coupled with growing public and private interests in operationalizing and monetizing this information.<fnref n="31" /> Choicepoint, a data broker, was already in 2001 selling ‘information in markets–insurance, business and government, and marketing’ which included ‘(...) history data, motor vehicle records, police records, credit information and modelling services, employment background screenings and drug testing administration services, public record searches.<fnref n="32" />

Despite their considerable history, data markets have been in the spotlight only over the last few years. After the Cambridge Analytica scandal and its possible role in the Trump election, as well as the Brexit vote in 2016, concerns that unrestrained data markets could represent a risk for democracy and political stability became prominent.<fnref n="33" /> These have sparked a broader conversation on the risks that unrestrained data flows pose to fundamental rights such as privacy and data protection, and of the dominant role that the main technology companies play in dictating access to data and how it is used.<fnref n="34" />

It is worth noting that not all data markets are the same. Notably, in the EU, data markets look different from their American counterparts. The General Data Protection

<footnote n="30">30 Glennon et al. (n 29).</footnote>

<footnote n="31">31 See Chris Jay Hoofnagle, ‘Big Brother’s Little Helpers: How Choicepoint and Other Commercial Data Brokers Collect, Process, and Package Your Data for Law Enforcement’ [2003] 29 N.C.J. Int’l L. & Com. Reg 595. To give an example, many of the main credit reporting agencies were created in the 1960 TransUnion, ‘Company History’ <https://www.transunion.com/about-us/company-history> accessed 15 April 2023.</footnote>

<footnote n="32">32 EPIC, ‘In re: Choicepoint’ (*Epic*) <https://epic.org/documents/choicepoint-2/> accessed 30 April 2023; The UK’s Information Commissioner’s Office defines data broking as ‘the practice of obtaining information about individuals and trading, including by licensing, this information or information derived from it as products or services to other organizations or individuals. Information about individuals is often aggregated from multiple sources, or otherwise enhanced, to build individual profiles. Information Commissioner’s Office, *Investigation into Data Protection Compliance in the Direct Marketing Data Broking Sector (ICO)*, October 11, 2020) <https://ico.org.uk/media/action-weventaken/2618470/investigation-into-data-protection-compliance-in-the-direct-marketing-data-brokingsector.pdf> accessed 22 November 2022.</footnote>

<footnote n="33">33 Rob Pegoraro, ‘The Real Problem Wasn’t Cambridge Analytica, But The Data Brokers That Outlived It’ (*Forbes*, 8 October 2020) <https://www.forbes.com/sites/robpegoraro/2020/10/08/the-realproblem-wasnt-cambridge-analytica-but-the-data-brokers-that-outlived-it/?sh=2e13da9826a4> accessed 27 May 2023; Zuboff (n 9); Cohen (n 8).</footnote>

<footnote n="34">34 See Chris Jay Hoofnagle, ‘Big Brother’s Little Helpers: How Choicepoint and Other Commercial Data Brokers Collect, Process, and Package Your Data for Law Enforcement’ (2003) 29 North Carolina Journal of International Law 595.</footnote>
Regulation (GDPR) forbids the selling and sharing of personal data without a legal basis, thereby reducing the privacy risks associated with unregulated data markets.35 The European Data Market Study reports that in the European data market, data related to individuals is anonymized, pseudo-anonymized or aggregated.36 Nonetheless, despite being more privacy-friendly, this market remains highly concentrated. The prominent role a few non-European technology companies play in the European data landscape through unilaterally determining who has access to data has led both policy-makers and scholars to stress the importance of facilitating and encouraging data access to boost innovation and competition.37 This dynamic shows that addressing privacy concerns is not a panacea. Furthermore, it raises questions as to potential trade-offs between enhancing privacy protection and deconcentrating markets, as well as how these should be resolved.

## 2.2 Law and Markets and the Economic Analysis of Law

In this Article, we use a mix of orthodox and heterodox law and economics tools to analyse the DGA and the DA, namely cost benefit analysis and distributional analysis. We rely on these methodological instruments to evaluate whether the proposed interventions of the acts achieve their goals in creating a different kind of data market.

<footnote n="35">35 See Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ 2 119/45, Art. 6. For a recent discussion of this kind of risk see Barry Friedman and Danielle Keats Citron, 'Indiscriminate Data Surveillance' (2024) Virginia Law Review forthcoming.</footnote>

<footnote n="36">36 European Data Study (n 29) 99.</footnote>

<footnote n="37">37 See Pistor (n 8); European Commission, 'European Data Strategy' (n 1). Data brokers operating on the European market are firms like Transunion, Data Intelligence Hub and DAWEX. They collect, host, store and share data in partially open marketplaces, whilst simultaneosly offering a myriad of data services, such as data monetization, data analytics and credit reporting for third parties like financial institutions. DAWEX, for example, provides its customers with data governance tools like data needs alerts, customised suggestions for data sources, etc. Some of the data brokerage platforms even have software architectures that allow certified users on the supply side to specify usage restriction policies to the data they provide, increasing their control over their data. See DigitalEU, CONNECT University: Data Brokers in the EU, (YouTube, 7 July 2022) <https://www.youtube.com/watch?v=MwxxhPHpveY&t=3006s> accessed 2 May 2023; Systems D, 'Data Exchange, data-sharing, Data Marketplace & Data Hub' (Dawex, accessed 30 April 2023) <https://www.dawex.com/en/> accessed April 30, 2023; Data Intelligence Hub, 'Home' (Home, accessed 30 April) https://dih.telekom.net/en/; TransUnion, 'About Us' (Transunion, accessed 30 April) <https://www.transunion.com/about-us accessed> accessed 30 April 2023.</footnote>
Given that our analysis is centred on the impact of legal rules on market dynamics, we
begin by clarifying our position as to the role of the law in shaping markets.

2.2.1 Law and Markets

The departing point of our intervention is that markets are a legal construct, i.e. their functioning is heavily reliant on a combination of contract laws, property rights, and regulation.<fnref n="38" /> This does not mean, however, that regulatory action or formal law is required for trading. As Richard Brooks describes, ‘people have been buying, selling, swapping and trading goods and services from time immemorial.’<fnref n="39" /> There is a difference, however, between trade as an activity and markets as institutionalised arenas for trade. The emergence of markets requires the establishment of ‘rules of the game’ which provide market players with clarity as to who owns what, and under what conditions assets and services can be traded. Nonetheless, since trading customs evolve, and new assets – such as data – become tradeable, it is often the case that laws designed for pre-existing markets are stretched to regulate new assets or new trading arenas. Furthermore, regulatory tools which are not meant explicitly to influence trading can impact trading conditions. Think, for example, of the GDPR, which was meant as a data protection regulation, but has drastically changed the conditions under which data can be collected and shared.

The current data market is thus shaped by an amalgam of laws that condition
who can access data. At the same time, the market practices of certain dominant
market actors have had a deep influence on data trading. Due to their bargaining and
market power, the big tech players managed to secure quasi-property entitlements
over data by private ordering and reliance on technical capabilities.<fnref n="40" /> For example,
Amy Kapczynski documents how companies possessing technical control of large
amounts of data have managed to exclude third parties from accessing and reaping
the benefits of the data they hold, creating property-like regimes through ‘contracts
with their vendors, customers, and collaborators that require data and algorithms to
be kept secret or not shared.’<fnref n="41" />

<footnote n="38">38 This is due to a revival of institutional economics among legal scholars. See Simon Deakin et al., ‘Legal Institutionalism: Capitalism and the Constitutive Role of Law’ (2014) 45(1) Journal of Comparative Economics 188 (arguing that law accounts for many of the structures of modern capitalist societies); Dagan et al. (n 11) arguing that markets arise out of and operate through law.</footnote>

<footnote n="39">39 Richard R.W. Brooks, ‘Black Markets and the Exchange Structure’ (2020) 83 Law and Contem-
porary Problems 151, 152.</footnote>

<footnote n="40">40 Kapczynski (n 8) 1502.</footnote>

<footnote n="41">41 See Kiel Brennan-Marquez and Daniel Susser, ‘Privacy, Autonomy and the Dissolution of Markets’ (2022) Knight First Amendment Institute, Data & Democracy Essay Series (arguing that ‘firms capture information about us’); Cohen (n 8); Kapczynski (n 8); Fia (n 10).</footnote>
Law and economics scholars point out that when the law does come forth to shape markets, it usually translates existing realities into what law and economic scholars have labelled as ‘entitlements.’<fnref n="42" /> To give a simple example, property entitlements were initially granted to those who managed to secure physical control over assets.<fnref n="43" /> Although there is no clear definition of what entitlements are, they can be understood as legal interests which prevail in the case of conflict. As Calabresi and Melamed put it, when allocating entitlements, the state ‘decide[s] which of the conflicting parties will be entitled to prevail.’<fnref n="44" />

Law, however, does not need to limit itself to translating existing realities into rules – it can also shape and steer markets towards certain outcomes. In this sense, we distance ourselves from monolithic understandings which portray markets as institutions that are necessarily destined to produce unjust distributional outcomes, exacerbate existing inequalities, and, when the traded asset is data, undermine human autonomy and agency.<fnref n="45" /> The law can shape markets by authorising certain transactions and prohibiting others, making some transactions easier than others, and granting certain entitlements to certain parties and refusing them to others. In doing so, the law can alter market dynamics and direct them towards more fair distributional outcomes.<fnref n="46" /> Briefly, different kinds of laws give rise to different kinds of markets. This is what we understand that the Data Strategy is ultimately trying to do.

As it will become obvious in the analysis of the next section, the Data Strategy tries to give rise to a different kind of data market by creating entitlements meant to facilitate data-sharing, trading and access. For example, while avoiding the vocabulary of property and ownership, the Data Act grants users of IoT devices the right to ask that the data their use generates be shared with third parties under certain conditions. Before the Data Act’s intervention, this data was held exclusively by

<footnote n="42">42 Guido Calabresi and A. Douglas Melamed, ‘Property Rules, Liability Rules, and Inalienability: One View of the Cathedral’ (1972) 85(6) Harvard Law Review 1089 (arguing that allocating entitlements is the first issue which must be faced by any legal system).</footnote>

<footnote n="43">43 Guido Calabresi and A. Douglas Melamed, ‘Property Rules, Liability Rules, and Inalienability: One View of the Cathedral’ (1972) 85(6) Harvard Law Review 1089 (arguing that allocating entitlements is the first issue which must be faced by any legal system). Thomas W. Merrill, ‘Formalization, Possession, and Ownership’ (2017) Brigham-Kanner Property Rights Journal 113 (discussing at length the distinction between possession and ownership)</footnote>

<footnote n="44">44 Merrill (n 43) 1090.</footnote>

<footnote n="45">45 See Roxana Vatanparast, ‘The Code of Data Capital: A Distributional Analysis of Law in the Global Data Economy’ (2021) (1) juridikum 98; Pistor (n 8).</footnote>

<footnote n="46">46 Robert C. Hockett & Saule T. Omarova, “‘Private’ Means to “Public” Ends: Governments as Market Actors’ (2014) 15 Theoretical Inquiries in law 53, 55 (arguing that regulation ‘determines the shape and indeed the possibility of the market somewhat as DNA structures a life form and is prerequisite to such forms’).</footnote>
manufacturers of IoT devices, preventing any other market players from using it to provide aftermarket services. This example shows that the Data Strategy is an effort to deconcentrate data markets and enable a fairer allocation of the value derived from data. As the analysis below shows, the pursuit of these comes at a cost, as they can diminish incentives to collect data and ultimately innovate. The Strategy navigates several such delicate trade-offs.

### 2.2.2 Methodology: Cost Benefit Analysis and Distributional Analysis

This Article analyses the DGA and the DA through the lenses of both orthodox and heterodox law and economics, namely through the tools of cost benefit analysis and distributional analysis.<fnref n="47" /> By orthodox law and economics, we refer to the Chicago School and its aftermath. This line of scholarship is based on a commitment to markets as the best institutions for allocating resources, a narrow vision of regulation as limited to fixing market failures, and the belief that the goal of the entire legal system is to maximise social welfare. Under this view, legal rules are perceived as artificial interventions in ‘the market’ whose costs and benefits can be calculated.

While orthodox law and economics is easy to define as a movement, heterodox law and economics refers to a much looser aggregation of ideas. Since it never crystallised as a movement, it is much more difficult to identify any core tenets or shared assumptions. However, what we take out of it is an understanding of markets as being heavily influenced by laws, and a commitment to relying on laws as structural levers which can lead to markets that are more fair, less concentrated, and more egalitarian. Rather than theorising an idealised vision of ‘the market’, this scholarship views markets as institutions that arise through laws and can take a multitude of forms. Much of the literature adopting this approach is labelled as ‘private law theory’ rather than heterodox law and economics. Nonetheless, this literature takes a law and economics perspective in the sense that it views the law as an essential vector in dictating the shape of markets and assesses the desirability of legal rules in terms of the economic outcomes they give rise to.

The choice for combining two perspectives matches the ambition of the acts: aligned with the law and economics orthodoxy, the acts seek to provide efficient solutions for fostering data exchanges and data use and reuse, yet they are also committed to ensuring fairness in the allocation of resources and economic opportunities.

<footnote n="47">47 For an example and explanation of heterodox law and economics see Duncan Kennedy, ‘Law and economics from the perspective of critical legal studies’, *The New Palgrave Dictionary of Economics and the Law* (Ed. Peter Newman, Macmillan Reference Limited, 1998). For an example of orthodox law and economics see Steven Shavell, *Foundations of Economic Analysis of Law* (Harvard University Press 2004).</footnote>
Cost benefit analysis requires assessing the costs and benefits of the rules at stake without factoring in any distributional impacts.<fnref n="48" /> We use this tool to evaluate the relative efficiency merits of the new rules created by the acts. It is important to clarify that a frequent mistaken assumption regarding cost benefit analysis is that it is tied to the adoption of efficiency as the overarching goal of the legal system. Under this view, cost benefit analysis can only be used to assess whether a proposed intervention maximises social wealth, in the sense that resources are allocated to those who value them most.<fnref n="49" /> We are aware that the pursuit of efficiency has undergone criticism, and that its use as a normative standard has become controversial.<fnref n="50" /> Nonetheless, in this article, we follow the approach of heterodox law and economics scholars and dissociate cost benefit analysis from the pursuit of wealth maximisation.<fnref n="51" /> As Eric Posner underscores, cost benefit analysis ‘helps analysts identify superior means for achieving a given goal in settings that are abstracted from moral and political questions that will nonetheless have to be answered before a policy is implemented.’<fnref n="52" /> In simple words, cost benefit analysis allows us to identify the best tool to carry out a pre-established goal, but not to identify the relative worthiness of different goals, as the latter process would require the adoption of wealth maximisation as the benchmark of the assessment.<fnref n="53" /> In this vein, this article relies on cost benefit analysis to assess whether the DGA and the DA are cost-effective tools for reaching their stated goals, and not whether they maximise societal wealth.

However, even decoupled from wealth maximisation, cost benefit analysis is blind to how the costs and benefits factored in the assessment are distributed between different stakeholders. Since one of the overarching objectives of the Strategy is to achieve a fairer distribution of the value derived from data, cost benefit analysis takes us only halfway through the assessment. To evaluate the acts' distributional

<footnote n="48">48 E.J. Mishan & Euston Quah, *Cost benefit Analysis* (Routledge 2021) (providing an exhaustive account of the methodology of cost benefit analysis),</footnote>

<footnote n="49">49 Richard A. Posner, ‘Wealth Maximization Revisited’ (1985) 2 Notre Dame Journal of Law, Ethics and Public Policy 85 (providing an explanation of the meaning of wealth maximisation).</footnote>

<footnote n="50">50 See, inter alia, Duncan Kennedy, ‘Cost benefit Analysis of Entitlement Problems: A Critique’ (1981) 33(3) Stanford Law Review 387 (showing the indeterminacy of cost benefit analyses); Ronald Dworkin, ‘Is Wealth a Value?’ (1980) 9(2) The Journal of Legal Studies 191 (showing that a society that has more wealth in the sense of the wealth maximisation goal is not better than a society having less); Zachary Liscow, ‘Is Efficiency Biassed?’ (2018) 85 The University of Chicago Law Review 1649 (showing that the pursuit of wealth maximisation / efficiency is often biassed toward the rich given their superior willingness to pay).</footnote>

<footnote n="51">51 Eric Posner, ‘The Boundaries of Normative Law and Economics’ (2021) 38 Yale Journal on Regulation 657 (clarifying that it is possible to keep cost benefit analysis as a tool but separates it from the overarching goal of achieving efficiency. He calls this version of law and economics ‘modular’).</footnote>

<footnote n="52">52 ibid 658.</footnote>

<footnote n="53">53 ibid.</footnote>
impact, we rely on the heterodox method of distributional analysis. Distributional
analysis takes cost benefit analysis one step forward by identifying how the costs and
benefits at stake are allocated between different stakeholders.<fnref n="54" /> Since the acts target
constituencies with very different entitlement and resource endowments – natural
persons, SMEs, and big tech platforms – distributional analysis is particularly well
suited for assessing their impact. Furthermore, distributional analysis reveals that
there are tradeoffs involved in any legal move.<fnref n="55" /> Enhancing data-sharing leads to a
diminution in privacy and data protection. Companies that will be subject to
mandatory data-sharing obligations will lose their exclusive control, whereas third
parties that will benefit from this obligation will win access to a key competitive
resource. Relying on distributional analysis highlights that there are ‘winners and
losers’ of every proposed intervention. Here, we underscore that these actions
involve a delicate balance of navigating crucial trade-offs.

3 Data Governance and the EU Data Market

This section situates the European Data Strategy within the literature on data
governance and shows how the Data Strategy draws from it, and also calls for the
strengthening of the data market.<fnref n="56" /> The literature that seems to inspire the strategy
focuses on alternatives to property rights, such as commons arrangements. To
explain and conceptualise why reliance on property rights was not the alternative
chosen in the Data Strategy we present in what follows the law that governs data
markets today, and then the literature on data governance and data markets.

**3.1 The Existing Law of Data Markets**

Data markets are institutional arrangements where digital data and insights from
data are exchanged as products or services.<fnref n="57" /> Data markets assume, like all markets,
the possibility to clearly define those products, goods and services. In the case of data,
this is enabled by the fact that data is an excludable good.<fnref n="58" />

<footnote n="54">54 David Kennedy, ‘Law in Global Political Economy: Now You See It, Now You Don’t’ in Poul F. Kjaer (ed), *The Law of Political Economy: Transformation in the Function of Law* (Cambridge University Press 2020) 149</footnote>

<footnote n="55">55 Jorge Esquirol, ‘Making the Critical Moves: A Top Ten in Progressive Legal Scholarship’ (2021) (92) University of Colorado Law Review 1079, 1125.</footnote>

<footnote n="56">56 See Ducuing (n 6).</footnote>

<footnote n="57">57 European Data Study (n 62).</footnote>

<footnote n="58">58 See Purtova & van Maanen (n 5) 6.</footnote>
Standard economic and regulatory theory holds that property rights be estab-
lished over goods to strengthen markets.<fnref n="59" /> Property rights are legally enforceable
rights to exclude others from using an owned thing, the privilege to reap the fruits of
it, and the power to transfer it.<fnref n="60" /> Economic analysis observes that property rights
allow individuals in a given community to not have to negotiate over entitlements,
reducing transaction costs and uncertainty, and therefore increasing the efficiency
of markets.<fnref n="61" /> Furthermore, traditional economic thinking proposes creating prop-
erty rights over resources to generate investment incentives.<fnref n="62" /> In the absence of
property rights, too many individuals may use a resource without taking into account
the costs of doing so, therefore depleting it and not investing in its maintenance or
renewal, which leads to its exhaustion.<fnref n="63" />

Along this line of thought, some policy-makers and scholars in the EU and
around the world have proposed that clear entitlements be created over data via
property or intellectual property rights.<fnref n="64" /> Preparatory documents for the EU Data
Strategy the Commission considered, for example, the creation of ‘a new data pro-
ducer right with the objective of enhancing the tradability of non-personal or ano-
nymised machine-generated data as an economic good’ which ‘could be envisaged as
a right in rem.’<fnref n="65" /> Similarly, earlier policy discussions over the protection of data and
how to create incentives for its productions led to the approval of the 1996 EU
Database Directive. The Database Directive created full copyright protection for
‘databases which (...) constitute the author’s own intellectual creation shall be

<footnote n="59">59 Hernando de Soto, *The Mystery of Capital: Why Capitalism Triumphs in the West and Fails Everywhere Else* (Basic Boks 2003) (advocating for the formalization of property rights as a panacea for economic development).</footnote>

<footnote n="60">60 See William M Landes, Richard A Posner, *The Economic Structure of Intellectual Property Law* (Harvard University Press, 2003), 34; see also The French Civil Code, which defines property as ‘the right to enjoy (i.e., benefit from) and dispose of things in the most absolute manner provided that they are not used in a manner prohibited by laws or regulations’ (France, Civil Code, art. 544). Property rights also typically give rights-holders the rights to the produce of the thing owned (France, Civil Code, art. 546).</footnote>

<footnote n="61">61 Landes and Posner (n 59) 12.</footnote>

<footnote n="62">62 Landes and Posner (n 59) 13.</footnote>

<footnote n="63">63 Garrett Hardin, ‘The Tragedy of the Commons’ (1968) 162 Science 1243.</footnote>

<footnote n="64">64 See Eric Posner and Glen Weyl, *Radical Markets: Uprooting Capitalism and Democracy for a Just Society* (Princeton University Press 2018); Jeffrey Ritter and Anna Mayer, *Regulating Data as Property: A New Construct for Moving Forward* [2018] 16 Duke Law & Technology Review 220, 226–27; Evgeny Morozov, ‘To Tackle Google’s Power, Regulators Have to Go After Its Ownership of Data’ *The Guardian* (July 2, 2017 <http://www.theguardian.com/technology/2017/jul/01/google-european-commission-fine-search-engines> accessed January 19, 2024; Grimmelmann and Mulligan (n25); Lothar Determann, ‘No One Owns Data,’ (2018) 70 Hastings Law Journal 1, 10.</footnote>

<footnote n="65">65 Commission Staff Working Document ‘On the free flow of data and emerging issues of the European data economy’, SWD/2017/02 final.</footnote>
protected' and a 15 years 'sui generis right' for 'the maker of a database which shows
that there has been qualitatively and/or quantitatively a substantial investment in
(...) the obtaining, (...) of the contents (...) of that database.'<fnref n="66" /> In practice, after some
ECJ rulings, databases are only subject to IP protection in the very narrow circum-
stances where they constitute products of human creativity, but not, as in most
circumstances, when data is created by digital appliances.<fnref n="67" />

The fact that data is not (yet) covered by property or IP law does not mean,
however, that there are no rights or legal entitlements over it. Data protection law,
for example, limits the grounds under which personal data can be processed and
shared.<fnref n="68" /> Relatedly, data holders have been known to try to argue that certain data is
a trade secret to oppose data-sharing mandates.<fnref n="69" /> A significant amount of scholar-
ship studying the digital economy, especially in the US, has focused on the role of
private ordering – e.g., contract law – in establishing entitlements to access and use
data. Julie Cohen and Amy Kapczynsky have shown that the private ordering of the
data market has an important role in giving rise to a very unequal marketplace,
where users and other stakeholders are disempowered and subjected to the, often
objectionable, data-processing practices of companies with outsize market power.<fnref n="70" />
This occurs because the companies that control important amounts of data leverage
‘access-for-data’ contracts and non-disclosure agreements that create a network that
simulates exclusivity over data, consolidating control over its use in their hands.<fnref n="71" />

<footnote n="66">66 Legal Protection of Databases Directive, 1996 OJ (L 77/20) (Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996) Arts. 3 and 7.</footnote>

<footnote n="67">67 See Legal Protection of Databases Directive, C-203/02 The British Horseracing Board and Others (2004) ECLI:EU:C:2004:69.</footnote>

<footnote n="68">68 See General Data Protection Regulation, Art 6; art 4(11), European Charter for Fundamental Rights of the European Union [2012] OJ C 326, Arts. 6, 8, 20. One of us has documented how, in the United States, companies have even used data protection laws to oppose data-sharing mandates, arguing that their users' privacy rights prevent them from sharing data with other stakeholders, such as local governments or NGOs. See Beatriz Botero Arcila, 'Jump v. LA,' Jump v. Los Angeles: Removing Platforms Further From Democratic Control?' [2020] 68 UCLA Law Review Discord 160.</footnote>

<footnote n="69">69 See Kapczynsky (n 10); see also, in a slightly different contexts, Amazon's opposition to the Digital Services Act obligation to publish transparency reports discussed in Beatriz Botero Arcila, 'An early win for the transparency measures of the DSA. A comment on Amazon Services v. European Commission (C-638/23)' (May 2, 2024 *DSA Observatory*) <https://dsa-observatory.eu/2024/05/02/an-early-win-for-the-transparency-measures-of-the-dsa-a-comment-on-amazon-services-v-european-commission-c-638-23/> accessed 10 May 2024.</footnote>

<footnote n="70">70 It is worth noting again that much of this scholarship does not take into account data protection laws, as the United States does not have a horizontal data protection law. Przemisław Palka, for example, makes a similar critique in the GDPR context, arguing that the GDPR is not that different from the American notice and consent regime. See Przemysław Palka, ‘Data Management Law for the 2020s: The Lost Origins and the New Needs,’ [2020] 68 Buffalo Law Review 559.</footnote>

<footnote n="71">71 Kapczinski (n 8); Cohen (n 8).</footnote>
These legal webs that simulate exclusion-like entitlements have led scholars like Cohen and Kapczynski to the conclusion that, if we accept that the key function of property rights is to set entitlements that govern people's access to and control over resources, *de facto* property-like entitlements already exist over data.<fnref n="72" /> Additionally, because large tech firms hold most data and they get to decide who can access it, markets are strongly biassed in favour of the main data holders.

## 3.2 The Proposals to Enhance Access to Data

Despite the existence of *de facto* property-like rights over data, and the policy proposals to create actual ownership rights over data, there is increasing consensus that data is an awkward fit for property and property-like rights. There are certain important differences in the objectives underlying property rights and the way data seems to be produced. First, it is unclear whether data ownership rights are required for the production of data, because data is often a by-product of already profitable economic activities, and thus its generation does not require additional incentives.<fnref n="73" /> Second, as discussed above, data is made excludable through technical protection – unlike copyrighted material, which is meant to be distributed widely. Third, the value of data often resides in their immediacy and what is most valuable is not the data *per se* but the information and insights that can be drawn via data analytics and in relating different data with each other.<fnref n="74" /> We elaborate on these strands below.

Several scholars thus criticise approaches that propose an ownership-based approach to data governance, primarily because given its non-rivalrous nature, many actors could benefit from processing data. Thus, using private data exclusively might result in the underutilisation of data. Néstor Duch-Brown et al. argue that the property law assumption that information production requires a financial incentive doesn't hold in regard to data and, therefore, the claim that certain exclusive rights

<footnote n="72">72 Cohen (n 8); see also European Commission, Communication ‘Building a European data econ-omy’ (n6) saying in 2017 that: ‘Therefore, comprehensive policy frameworks do not currently exist at national or Union level in relation to raw machine-generated data which does not qualify as personal data, or to the conditions of their economic exploitation and tradability. The issue is largely left to contractual solutions. (...) In some cases manufacturers or service providers may become the *de facto* ‘owners’ of the data that their machines or processes generate, even if those machines are owned by the user. A *de facto* control of this data can be a source of differentiation and competitive advantage for manufacturers. However, this can be problematic, because the user is often prevented by the manufacturer from authorising usage of the data by another party’.</footnote>

<footnote n="73">73 See Duch-Brown et al. (n 5824) 13.; Purtova & van Maanen (n 5) 16. Martens et al. (n 10).</footnote>

<footnote n="74">74 See Duch-Brown et al. (n 5824), 15; and Salome Viljoen, ‘A Relational Theory of Data Governance,’ [2021] The Yale Law Journal 131(2); Kean Birch, ‘Data as asset? The measurement, governance, and valuation of digital personal Data by Big tech’ (2021) Big Data & Society 8(1),</footnote>
over data should be put over data to maximise welfare may not hold.<fnref n="75" /> Thus they suggest that regulation should not be targeted at incentivizing data production or reasonable use but, rather, data-sharing and availability.<fnref n="76" /> Betin et al. and other law and economics oriented scholars note that fully shared common data pools may face overutilization and the motivation to invest in data diminishes, but agree that intermediate semi-commons data governance solutions should be favoured.<fnref n="77" />

Commons arrangements are an alternative to private property arrangements when considering how to manage the risk of depletion of resources.<fnref n="78" /> Elinor Ostrom famously showed that communities can manage shared resources successfully when group boundaries are clear, and when these groups have mechanisms to set up rules and change them to govern common goods in ways that adapt to local needs and conditions.<fnref n="79" /> A second main school, focused on ‘open access commons’ showed that some commons could be open access, and that these were pervasive and successful in the digital networked environment.<fnref n="80" /> Unlicensed spectrum, free and open source software, Wikipedia, open access publications and creative commons are all examples of open access commons that have yielded high degrees of value.<fnref n="81" /> A characteristic of the resources that can be managed as open access commons is that they tend to be intangible, and thus non-depletable.<fnref n="82" /> Commons scholars, such as Brett Frischman, have also shown that both open access and closed commons are pervasive in modern economies in the forms of ‘infrastructures’ and that they generate significant value when openly accessible – such as highways.<fnref n="83" /> In conversation with

<footnote n="75">75 See Duch-Brown et al. (n 24) 26.</footnote>

<footnote n="76">76 Purtova & van Maanen (n5) 16, citing B Carballa-Smichowski, N Duch-Brown, and B Martens, 'To Pool or to Pull Back? An Economic Analysis of Health Data Pooling' (2021) JRC Digital Economy Working Paper Seville: European Commission <https://joint-research-centre.ec.europa.eu/system/files/2021-12/jrc126961.pdf> (accessed April 8 2023).</footnote>

<footnote n="77">77 See i.e. Purtova & van Maanen (n 5); and Martens et al. (n 10) 5.</footnote>

<footnote n="78">78 Elinor Ostrom, *Governing the Commons: The Evolution of Institutions for Collective Action*. (Cambridge University Press,1990).</footnote>

<footnote n="79">79 Ostrom (n 78).</footnote>

<footnote n="80">80 Yochai Benkler, 'Open Access and Information Commons', *Oxford Handbook of Law and Economics: Private and Commercial Law*, Francesco Parisi, ed. (Oxford University Press, 2016).</footnote>

<footnote n="81">81 See Benkler (n 80) arguing that open access commons respond to three practical problems under certain resource conditions: '(a) high persistent positive externalities, of which nonrivalry in information goods is an extreme case; (b) uncertainty, under which exploration trumps appropriation and has its primary impact in innovation; and (c) social disembeddedness, or the risk that markets will drive resource utilisation in ways that will lead to social instability or political intervention'.</footnote>

<footnote n="82">82 Benkler (n 80).</footnote>

<footnote n="83">83 Echoing mainstream economic thought on the governance of public goods, Frischman defines infrastructures as resources that '[f]irst, (...) generate value when used as inputs into a wider range of productive processes. Second, the outputs from these processes are often public and nonmarket goods that generate positive externalities that benefit society. Third, managing infrastructure</footnote>
this literature, data governance scholars and policymakers have developed frame-
works to enhance and facilitate data access and sharing, while guaranteeing the
protection of other interests such as data protection.

The debate on how to govern data came a few years after the literature on commons governance was developed, and adopted its arguments to suggest that data should be governed more as commons or infrastructure than as a private good. In *Data-Driven Innovation: Big Data for Growth and Well-Being*, an influential report published in 2015 by the OECD, data was described as a general-purpose good that should be regulated like an open commons.<fnref n="84" /> The report advocated for open data access because, like with other infrastructures, individual willingness to pay reflects the value that individuals expect to realise themselves, but that value is difficult to estimate *a priori* and would not account for positive social externalities.<fnref n="85" /> Later work, however, recognized that open access to data conflicts with other protected interests in data such as privacy rights.<fnref n="86" /> In 2022, for example, the OECD seemed to tame its optimism for open access in another report, where it stated that '[d]ata access, sharing and reuse ('data openness') can generate significant social and economic benefits. (...) However, data openness also comes with risks to individuals and organisations. These include risks to privacy and data protection, intellectual property rights, and digital and national security.'<fnref n="87" /> The report thus proposes technical, organisational, and legal approaches to effectively balance these interests, and to create incentives and possibilities for different parties to share data and 'unlock' its value, but to do so safely.<fnref n="88" />

Scholars and civil society have been proposing new technical, organisational
and legal approaches to balance interests in data since at least the 2010s, though
the earliest skirmishes go back as far as 2004.<fnref n="89" /> These arrangements often look

<footnote>resources in an openly accessible manner may be socially desirable when it facilitates these
downstream activities. Brett M. Frischman, ‘An Economic Theory of Infrastructure and Commons
Management,’ (2005) 89 Minnesota Law Review 918.</footnote>

<footnote n="84">84 OECD, *Data-Driven Innovation: Big Data for Growth and Well-Being* (OECD Publishing, 2015), 181 <https://read.oecd-ilibrary.org/science-and-technology/data-driven-innovation_9789264229358-en#> accessed 18 May 2023.</footnote>

<footnote n="85">85 OECD (n85). 182; this also echoes Duch-Brown et al. (n 24) 26.</footnote>

<footnote n="86">86 See Nadezhda Purtova, ‘The law of everything. Broad concept of personal data and future of EU data protection law,’ [2018], Law, Innovation and Technology, 10(1), 40–81 <https://doi.org/10.1080/17579961.2018.1452176> accessed Jan 19, 2024; Beatriz Botero Arcila, ‘Future-Proofing Transparency: Re-Thinking Public Record Governance For the Age of Big Data’ Michigan State Law Review *forthcoming* 2024.</footnote>

<footnote n="87">87 OECD (n 85) 5.</footnote>

<footnote n="88">88 ibid.</footnote>

<footnote n="89">89 Lau Jia Jun, Jeremiah and Penner, James and Wong, Benjamin, 'The Basics of Private and Public Data Trusts' (September 23, 2019). NUS Law Working Paper No. 2019/019, EW Barker Centre for Law &</footnote>
like intermediary bodies where participants exchange data to create public value, or where the intermediary body manages data rights on behalf of beneficiaries within a ‘consent based structure and towards a defined goal.’<fnref n="90" /> Data trusts, for example, are bodies where an intermediary, the data trustee, has a fiduciary relationship towards the data subject to act and administer their data, in their best interest. They remain mostly a theoretical proposal as there is no legal framework enabling such fiduciary relationships. Other examples are pools of genomic data, where the intermediate body hosts the data and ensures that only authorised researchers can access it.<fnref n="91" /> In this type of example, the intermediary is often a non-profit organisation that facilitates data collection and analysis while guaranteeing the protection of privacy or trade-secret rights, or simply provides the infrastructure for pooling together and analysing data coming from different sources.<fnref n="92" />

There are, however, relatively few data intermediaries in comparison to the size of the data economy.<fnref n="93" /> Civil society and research organisations explain this as the result of not having the right institutional frameworks and coordination mechanisms.<fnref n="94" /> This translates into difficulties amongst parties seeking to share and access data, in particular in negotiating how data should be handled. Contributing factors are also the lack of internal capacity and resources about how to share data,

<footnote>Business Working Paper 19/03, Available at SSRN: https://ssrn.com/abstract=3458192 or https://doi.org/10.2139/ssrn.3458192.</footnote>

<footnote n="90">⁹⁰ Mozilla Foundation, 'Data Futures Lab Glossary' <https://foundation.mozilla.org/de/data-futures-lab/data-for-empowerment/data-futures-lab-glossary/#data-governance> accessed 9 January 2023 see also Delacroix and Lawrence (n 10); Stefaan Verhulst, 'reuse of smart city data: The need to acquire a social license through data assemblies' (Medium, Jan 19, 2021) <https://medium.com/data-stewards-network/reuse-of-smart-city-data-the-need-to-acquire-a-social-license-through-data-assemblies-c096c1694cfc> accessed 8 May 2024.</footnote>

<footnote n="91">⁹¹ See Beatriz Botero Arcila, ‘Is that even Legal? A Guide for Builders Experimenting with Data Governance in the United States’ [2022] Mozilla Foundation, Data Futures Lab, <https://foundation.mozilla.org/en/research/library/is-that-even-legal/builders-guide/> accessed 19 January 2024 (discussing The Genomic Data Commons (GDC) is an initiative of the U.S. National Cancer Institute (NCI)).</footnote>

<footnote n="92">⁹² Data Collaboratives, available at <https://datacollaboratives.org/> accessed 9 May 2024; Bram Klievink, Haiko van der Voort, and Wojnand Veeneman, ‘Creating Value Through Data Collaboratives,’ (2018) *Information Polity* 23, 379.</footnote>

<footnote n="93">⁹³ See TheGovLab, Data Stewards <https://medium.com/data-stewards-network> accessed 19 January 2024.</footnote>

<footnote n="94">⁹⁴ Hannah Chafetz, ‘An agenda for advancing trusted data collaboration in cities’ (Data Stewards Network – Medium, March 20, 2023), available at <https://medium.com/data-stewards-network/an-agenda-for-advancing-trusted-data-collaboration-in-cities-222d4889b16a> accessed 20 May 2023.</footnote>
as well as an absence of common data standards and data interoperability.<fnref n="95" /> The EU seems to be trying to address this with the Data Strategy, as we explain in the next section.

## 4 Enter the European Data Strategy

The European Data Strategy was published by the European Commission in February 2020. The Communication situates the Strategy in the wider context of the digital transformation of the economy and society and highlights the importance of placing the interests of individuals first in a society where they generate ever-increasing amounts of data. This should be done ‘in accordance with European values, fundamental rights and rules (...) At the same time, the increasing volume of non-personal industrial data and public data in Europe, combined with technological change in how the data is stored and processed, will constitute a potential source of growth and innovation that should be tapped into.’<fnref n="96" />

The two main implementing regulations of the Strategy are to date the Data Governance Act (DGA) and the Data Act (DA). The DGA, in force since May 2022, provides a regulatory framework for data intermediaries which enables the exchange of data between interested parties, including in the form of data markets, as well as rules for making data available for the public interest (‘data altruism’), and rules that ‘aim to increase trust’ and lower cost when sharing data in B2B and C2B transactions. The DA, adopted in January 2024, and which will enter into force in 2025, seeks to create incentives for data-sharing with the ultimate goal of ‘ensuring fairness in the allocation of value from data.’<fnref n="97" />

This section presents and analyses the main elements of the Strategy: the Communication, the DGA and the DA. These are all sufficiently complex documents to prevent us from summarising them exhaustively. We instead present their main elements and situate them in the broader context presented in the former section, and preliminarily examine the challenges and potential of the Strategy to meet its goals. As we present each of these elements, we also assess how they generate costs and benefits to data-sharing and exchanges, and analyse how these costs and benefits are distributed across different types of players in the data ecosystem.

<footnote n="95">95 ibid.</footnote>

<footnote n="96">96 European Data Strategy (n 1).</footnote>

<footnote n="97">97 European Commission, ‘Data Governance Act explained’, (*Shaping Europe’s Digital Future*) available at <https://digital-strategy.ec.europa.eu/en/policies/data-governance-act-explained#:~:text=The%20Data%20Governance%20Act%20(DGA,%20data%20for%20altruistic%20purposes).> accessed 4 May 2023.</footnote>
## 4.1 The Communication for a European Strategy for Data

The Communication starts by explaining that the European Strategy for data is based on Art. 114 of the Treaty on the Functioning of the European Union (TFEU) on the harmonisation of laws to improve the functioning and integration of the internal market. It is a regulatory and policy package that seeks to harmonise the legal regime of data governance in the internal market. There is a sense of urgency in the acknowledgement of the EU's potential to become a leader in the data economy of the future and vis-à-vis the notion of a need to catch up with competitors, such as China and the US, who have already made headways in innovating quickly when it comes to all things digital and data-related.<fnref n="98" /> The EU's solution is to address the underlying differences and fragmentation between Member States as it concerns data governance, which they see as currently inhibiting market players from leveraging the EU's data potential.

The Strategy identifies eight important issues keeping Europe from realising the full potential of its data economy.<fnref n="99" /> For this piece we only discuss the main non-technical ones:<fnref n="100" /> (i) not enough data is available for innovative reuse; (ii) imbalances in market power, (iii) data interoperability and quality and (iv) data governance;<fnref n="101" /> all within a wider landscape of regulatory fragmentation between Member States, where different States have started adapting their legal frameworks to allow the use of privately-held data by government or for scientific research.<fnref n="102" />

To address this, the Commission proposed four pillars of action, which include investing in infrastructure and skill building. Most importantly for our purposes, a

<footnote n="98">98 European Commission, ‘European Data Strategy’ (n 1) 4.</footnote>

<footnote n="99">99 These are fragmentation between Member States, Availability of data, Imbalances in market power, Data interoperability and quality, Data governance, Data infrastructures and technologies, Empowering individuals to exercise their rights, Skills and data literacy, and Cybersecurity. European Commission, ‘European Data Strategy’ (n 1), 9–11.</footnote>

<footnote n="100">100 The Commission points to other 4 factors, amongst them data infrastructures and technologies (need to mitigate EU's technological reliance on strategic infrastructure), empowering individuals to exercise their rights (provide individuals with the technical tools and means through which to exercise agency over their data), skills and data literacy (actively address the shortage of data experts and overall deficiency in workforce data literacy that inhibits the EU's capacity to advance in the data economy) and cybersecurity (address the challenges posed to cybersecurity by the new data paradigm where data is no longer concentrated solely in data centres). European Commission, ‘European Data Strategy’ (n 1), 9–11.</footnote>

<footnote n="101">101 The Commission seems to broadly define data governance ‘frameworks that as reinforce the governance of data use in society and the economy’ European Commission, ‘European Data Strategy’ (n 1)</footnote>

<footnote n="102">102 European Commission, ‘European Data Strategy’ (n 1), 7.</footnote>
key pillar is creating an overarching framework of horizontal measures for data access and use to avoid market fragmentation, as well as creating ‘common European data spaces in strategic sectors and domains of public interest.’<fnref n="103" /> These data spaces are conceived in the strategy as infrastructures and platforms through which different actors can exchange and access data without undermining legitimate interests in that data and European values (such as privacy).<fnref n="104" /> They strongly resemble alternative data governance bodies, such as data collaboratives, though the Communication leaves this for further exploration in ensuing legislation.<fnref n="105" /> The main strategic line of work in this pillar is creating an enabling framework for those data spaces and engaging in legislative action to provide incentives for horizontal data-sharing.<fnref n="106" />

The DGA and the DA are to date the two key regulations enacted within the Strategy which develop the overarching mandate of establishing rules of access and incentivizing the creation of data-sharing spaces. The next sections present them and show how they draw from the data governance literature referenced above.

## 4.2 The Data Governance Act: Creating Legal Infrastructure for Data-Sharing

The Data Governance Act is a regulation that entered into force in June 2022 and started to apply in September 2023.<fnref n="107" /> Its main objectives are (1) to improve the conditions for data-sharing in the internal market, notably through increasing trust<fnref n="108" /> and (2) to create a competitive environment for data-sharing.<fnref n="109" /> To do so, the Act creates a harmonised framework for a new category of players in the data economy labelled as ‘data intermediaries:’ market actors whose role is to facilitate

<footnote n="103">103 ibid 13, 22.</footnote>

<footnote n="104">104 According to the Strategy '[s]uch spaces aim at overcoming legal and technical barriers to data-sharing across organisations, by combining the necessary tools and infrastructures and addressing issues of trust, for example by way of common rules developed for the space. The spaces will include: (i) the deployment of data-sharing tools and platforms; (ii) the creation of data governance frameworks; (iii) improving the availability, quality and interoperability of data – both in domain-specific settings and across sectors.' 'European Data Strategy' (n 1), 17.</footnote>

<footnote n="105">105 ibid 20.</footnote>

<footnote n="106">106 ibid 14.</footnote>

<footnote n="107">107 Data Governance Act (n 13).</footnote>

<footnote n="108">108 ibid Recital 3.</footnote>

<footnote n="109">109 ibid Recital 33.</footnote>
data-sharing. These can take forms ranging from commercial data marketplaces to data altruism organisations.<fnref n="110" /> In terms of scope, the Act applies to both personal and non-personal data, across all sectors.<fnref n="111" />

The Act is structured in 9 chapters. The first chapter, on general provisions, lays out the subject matter, scope and definitions, as described above. The second chapter discusses the reuse of certain categories of data held by public sector bodies. The third chapter discusses the requirements for data intermediation services, including data marketplaces. The fourth Chapter introduces data altruism organisations.<fnref n="112" /> Chapters V, VII, VIII, and IX cover procedural, organisational and international access and transfer issues. Chapter VIII also creates a framework for the formation of a European Data Innovation Board.<fnref n="113" /> We focus on Chapters III and IV, dedicated to the creation of new data intermediaries to enhance data-sharing.

### 4.2.1 Data Intermediation Services

The third chapter of the DGA lays down rules for the establishment of data intermediation services. This is a novel concept which refers to ‘services which aim to establish commercial relationships for the purposes of data-sharing between an undetermined number of data subjects and data holders on the one hand, and data users on the other.’<fnref n="114" /> By data-sharing, the DGA refers to ‘the provision of data by a data subject or a data holder to a data user for the purpose of [...] the use of such data, based on voluntary agreements [...] or law, directly or through an intermediary, for example under open commercial licences subject to a fee or free of charge.’<fnref n="115" />

The preamble to the DGA clarifies that data intermediaries refer to ‘services which aim to establish commercial relationships for the purposes of data-sharing between an undetermined number of data subjects and data holders on the one hand and data users on the other’ and gives as examples of data markets, ‘data-sharing ecosystems,’ and data pools licensed ‘in a manner that all participants receive a

<footnote n="110">110 ibid Recital 3.</footnote>

<footnote n="111">111 ibid Recital 15.</footnote>

<footnote n="112">112 Additional issues covered by the Act are rules applicable to the authorities safeguarding the registration of data altruism organisations, international access to and transfers of data, and the adoption of delegating acts.</footnote>

<footnote n="113">113 The European Data Innovation Board will be an expert group, consisting of representatives of the competent authorities for data intermediation services and the competent authorities for the registration of data altruism organisations of all Member States and other relevant entities with the task of advising the commission on different data-sharing and data altruism best practices. See, however, Chapter VI of the Data Governance Act (n 13).</footnote>

<footnote n="114">114 Data Governance Act (n 13), Recital 28</footnote>

<footnote n="115">115 ibid Art 2(10).</footnote>
reward for their contribution.’<sup>116</sup> The Act envisages three possible designs for data
intermediation services: (1) between data holders and potential data users, (2)
between data subjects themselves and potential data users, and (3) data cooperatives
which seek to strengthen the position of individuals in ‘making informed choices
before consenting to data use and influence the terms and conditions of data user
organisations attached to data use.’<sup>117</sup>

Despite the commitment to fostering the emergence of new businesses in the
data economy, the requirements and obligations imposed on data intermediation
service providers go well beyond what is expected of business players active in other
sectors. First, to enter the market, service providers need to submit a notification to
the competent national authority, which needs to include extensive information
including legal status, ownership structure, and relevant subsidiaries.<sup>118</sup> Second,
alongside this procedural requirement, data intermediation service providers need
to satisfy several substantive conditions enshrined in Article 12. To begin with, the
data intermediation services need to be completely separated from any other line of
business in which the service provider may be active. This is reflected in several
requirements: (1) the data intermediation services need to be provided through a
separate legal entity; (2) the data that is being traded cannot be used for any other
purposes by the service provider; (3) the meta-data collected through providing the
data intermediation service can only be used for improving the intermediation
service; and (4) the commercial terms offered to the service recipients shall not be
dependent upon whether the service recipients use other services offered by the data
intermediation service provider or by any other related entity.<sup>119</sup> All these re-
quirements impose important costs on market players interested in providing data
intermediation services, raising questions as to the efficiency of creating a legal
framework which might discourage market entry.

Nonetheless, the DGA can not be confined to an efficiency discourse. It aims to facilitate the emergence of data intermediaries that operate differently from contemporary big tech platforms and is much in line with the data governance literature. There is a strong distributional orientation which seeks to empower small market players and tame the market power of the firms dominating the markets for digital services. Think, for instance, of the requirement that actors providing data intermediation services are obliged to separate these services from their other lines of business and are prohibited from deriving private benefits from the data

<footnote n="116">116 ibid Recital 28.</footnote>

<footnote n="117">117 ibid Art 2(15).</footnote>

<footnote n="118">118 ibid Art 11(1) and 11(6).</footnote>

<footnote n="119">119 ibid Art 12.</footnote>
traded.<fnref n="120" /> The vision of data intermediaries put forward by the Act is one of channels that allow the interconnection of buyers and sellers, without being allowed to extract any value from the intermediation services apart from financial compensation for the provision of the intermediation services. This is reminiscent of the image of platforms that predominated up until the early 2010s: traditional marketplaces, warehouses, trading boards, etc. which were responsible for connecting buyers and sellers but derived no additional benefit than the fee charged for providing this infrastructural service.<fnref n="121" />

Additionally, strengthening its distributional ambition, the DGA demands more from data intermediaries than pure commercial neutrality. Article 12(m) requires that they should act ‘in the data subjects’ best interests [...] in particular by informing, and where appropriate, advising data subjects [...] about intended data uses by data users and standard terms and conditions attached to such uses before data subjects give consent.’<fnref n="122" /> This requirement demands service providers to act like quasi-trustees vis-a-vis data subjects, going well beyond what is normally expected from commercial actors. In doing so, the DGA is opening pockets of non-market relationships in the data economy and strengthening the position of data subjects, who are, on average, much less knowledgeable than data collectors and traders about how their data is used. What is surprising about this design is that data intermediaries remain commercial actors, yet they are required to protect the interests of weaker parties and not just maximise their profits. This approach projects a very different kind of data market than the ones we are used to today.

### 4.2.2 Data Altruism

Further strengthening the view that the DGA opens up pockets for non-market relationships, chapter four of the Act provides rules for data altruism organisations. According to Article 2(16), data altruism means ‘the voluntary sharing of data on the basis of the consent of data subjects to process personal data about them, or permissions of data holders to allow the use of their non-personal data without seeking or receiving a reward that goes beyond compensation related to the costs they incur where they make their data available for objectives of general interest.’<fnref n="123" /> Data

<footnote n="120">120 These requirements are an example of regulatory convergence across the Union's digital regulations, mirroring the Digital Markets Act's rule prohibiting large market players from combining data they gather across different service lines, but they are much more far-reaching as they apply also to market players who do not have gatekeeper status. Digital Markets Act (n 12).</footnote>

<footnote n="121">121 For this view on platforms, see *Chicago Board of Trade v. United States*, 246 U.S. 231</footnote>

<footnote n="122">122 Data Governance Act (n 13), Art 12(m).</footnote>

<footnote n="123">123 ibid Art 2(16).</footnote>
altruism is, thus, characterised by (1) the lack of commercial incentives and (2) the pursuit of objectives of general interest such as healthcare, combating climate change, improving mobility, improving public services, etc.<sup>124</sup>

In contrast with providers of data intermediation services, data altruism organisations can choose to apply to be registered in a public national register.<sup>125</sup> To do so, they need to be established in the form of a legal person tailored to meet public interest objectives, must operate on a not-for-profit basis and be legally independent of any entity that operates on a for-profit basis, and they need to carry out data altruism activities through a structure that is functionally separate from any other activities.<sup>126</sup> In addition to registration requirements, providers of data altruism services need to abide by transparency requirements during their activities. In particular, they need to keep granular records concerning the identity of the parties allowed to process the data, the duration of data processing, the purpose of data processing, as well as any fees paid by the data receiver, and submit these records to the designated national competent authority.<sup>127</sup>

These procedural requirements are coupled with substantive requirements ‘to safeguard the rights and interests of data subjects and data holders about their data.’<sup>128</sup> Providers of data altruism services need to ‘inform data subjects or data holders before any processing of their data, of the objectives of general interest for which the data is being processed, and if personal data is at stake, the explicit and legitimate purpose for which personal data is to be processed.’<sup>129</sup> Crucially, they are ‘not allowed to use the data for any other purpose than the general interest objectives for which the data subject or data holder allows the processing’ and cannot ‘use misleading marketing practices to solicit the provision of data.’<sup>130</sup> In addition to this negative obligation, service providers need to actively empower data subjects and data holders concerning their data through ‘providing tools for obtaining consent from data subjects or permissions to process data made available by data holders’ and ‘tools for easy withdrawal of consent or permission.’<sup>131</sup>

<footnote n="124">124 ibid Recital 45.</footnote>

<footnote n="125">125 ibid Art 19.</footnote>

<footnote n="126">126 ibid Art 18.</footnote>

<footnote n="127">127 ibid Art 20.</footnote>

<footnote n="128">128 ibid Art 21.</footnote>

<footnote n="129">129 ibid Art 21(1).</footnote>

<footnote n="130">130 ibid Art 21(2).</footnote>

<footnote n="131">131 ibid Art 21(3).</footnote>
## 4.3 The Data Act: Fair Access to and Use of Data

The Data Act is a regulation that entered into force on 11 January 2024 and will start to apply from 11 September 2025. It seeks to enhance access to data and achieve a fairer distribution of the benefits derived from data use and reuse. The chosen mechanism is creating certain mandatory, even if limited, obligations of data-sharing. The Act aims to maximise the value of data in the economy by ensuring that a wider range of stakeholders gain control over their data and that more data is available for innovative use while preserving incentives to invest in data generation.

The Act builds on the acknowledgement that increasing amounts of data are being produced daily and ‘a small number of very large companies have emerged with considerable economic power [...] through the aggregation of vast volumes of data and the technological infrastructure for monetising them.’<fnref n="132" /> Consequently, ‘start-ups and SMEs from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data.’<fnref n="133" /> The Act sets out to change this by stimulating, and sometimes mandating, data-sharing, responding directly to the Data Strategy’s diagnosis that not enough data is available for innovative reuse. To do this, it lays down rules for business-to-customers, business-to-business and business-to-government data-sharing.

The specific objectives of the Act are (1) to facilitate access to and use of data by consumers and businesses, while preserving incentives to invest in generating data; (2) to give public sector bodies access to business data in exceptional circumstances; and (3) to create interoperability standards for data to be reused between sectors.<fnref n="134" /> The text of the Act is structured in eleven chapters, providing rules on, amongst others, business-to-customers (B2C) and business-to-business (B2B) data-sharing, obligations for data holders, unfair contractual terms, business-to-government (B2G) data-sharing, and interoperability. The Act also contains chapters dedicated to switching between data processing services and international data transfers, which are not covered in this article.

The ambitious goals of the Act are balanced by its limited scope. When it comes to B2B data-sharing, the Act applies only to data generated by the use of Internet of Things (IoT) devices. Examples of such data are the number of times a smart fridge is opened, the size of a room vacuumed by a Roomba, or the errors of a smart speaker.<fnref n="135" /> Importantly, the Act does not cover data generated by the use of devices

<footnote n="132">132 Data Act (n 13), Recital 40.</footnote>

<footnote n="133">133 ibid.</footnote>

<footnote n="134">134 Wolfgang Kerber, ‘Governance of IoT Data: Why the EU Data Act Will not Fulfil Its Objectives’ [2023] GRUR International 72(2) 120</footnote>

<footnote n="135">135 Data Act (n 13), Recital 14 ('data concerning their performance, use or environment').</footnote>
which record, transmit, display or play textual, audio or audiovisual content.<fnref n="136" /> Even though no longer specified in the Act, such devices include personal computers, tablets, and smart televisions.<fnref n="137" /> The B2G data-sharing provisions of the DA are similarly narrow: businesses are obliged to share data with public authorities only where the data is necessary to respond to a public emergency, or where the lack of data prevents the public authority from fulfilling its tasks.

This Section dives deeper into (1) the B2C and B2B data-sharing, and (2) B2G data-sharing. In doing so, it follows the structure of the Act: Chapters I to IV deal with B2C and B2B data-sharing, whereas Chapter V lays down rules for B2G data-sharing.

## 4.4 B2C and B2B Data-Sharing

### 4.4.1 Creating Rights and Obligations over Non-personal Data

The preamble of the Act begins by identifying barriers to data-sharing which ‘prevent an optimal allocation of data to the benefit of society,’ mentioning, amongst others, the lack of incentives for data holders to enter voluntarily into data-sharing agreements, uncertainty about rights and obligations about data, transaction costs, and abuse of contractual imbalances concerning data access and use.<fnref n="138" /> The Act aims to remove these barriers by laying down a framework specifying who, other than the manufacturer, is entitled to access the data generated by products or related services.<fnref n="139" /> Note that data generated by IoT devices is overwhelmingly non-personal data, meaning that data protection law does not regulate how it can be collected, accessed, and used. One of the key interventions of the Act is, thus, the creation of legal entitlements over non-personal data.

First, Article 3 lays down an obligation for data holders – generally, the manufacturers – to make data generated by the use of products or related services accessible ‘by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly accessible to the user.’<fnref n="140" /> Users are defined as natural or legal persons, including data subjects, that own, rent, or lease a product or receive a

<footnote n="136">136 *ibid* Recital 16.</footnote>

<footnote n="137">137 Interestingly, Recital 15 of the previous version of the act mentioned ‘personal computers, servers, tablets and smartphones, smart televisions and speakers, cameras, webcams, sound recording systems and text scanners.’ The switch to the new terminology may aim at keeping the list of products not covered by the Act as open as possible.</footnote>

<footnote n="138">138 *ibid* Recital 2.</footnote>

<footnote n="139">139 *ibid* Recital 4.</footnote>

<footnote n="140">140 *ibid* Article 3(1).</footnote>
related service.<fnref n="141" /> In addition to the obligation to make data accessible to users, manufacturers are also required to provide them with comprehensive information on, amongst other things, how much data is collected and the purposes for which it is used.<fnref n="142" /> This obligation is complemented by a right granted to users to access and use the data generated by their use of IoT devices, enshrined in Article 4. The underlying principle of this provision is that ‘data generation is the result of the actions of at least two actors, the designer or the manufacturer of a product and the user of that product’:<fnref n="143" /> Since users are crucial to the data generation process, they should have the right to access that data, too. This obligation shows that the DA, too, has a redistributive ambition: it seeks to ensure that the benefits of data generation do not accrue solely to data producers.

This data is of little relevance to the users themselves, though: few, if any, natural or legal persons are interested in accessing the data collected by the smart fridges or tractors they own, lease, or use. However, the right of users to access the data brings us only halfway through the regime of rights created by the Act. The DA complements it with the right to share that data with third parties, enshrined in Article 5. According to the Article, ‘upon request by a user, or by a party acting on behalf of a user, the data holder shall make available the data generated by the use of a product or related service to a third party, without undue delay, free of charge to the user, of the same quality as is available to the data holder [...]’.<fnref n="144" /> It is this provision that gives teeth to the right of users to access their data: whereas the data is quasi-worthless to the users themselves, it represents a vital resource for micro, small, and medium enterprises (‘MSMEs’) which seek to offer aftermarket services for IoT devices, such as repair and maintenance services.<fnref n="145" /> In the absence of this data, any undertaking seeking to compete with the manufacturers themselves for aftermarket services would be placed at a competitive disadvantage: access to performance data enables manufacturers to offer services superior to those of any competitor.

### 4.4.2 Zooming in on the Qualified B2B Data-Sharing Regime

The crucial change of entitlements enacted by the Act is to allow third parties access to the non-personal data produced by manufacturers upon the request of the users. Interestingly, the Data Act does not frame the new data access regime as the right of third parties to access data, but as the right of users to share the data their use of the

<footnote n="141">141 ibid Art 2(5).</footnote>

<footnote n="142">142 ibid Art 3(2).</footnote>

<footnote n="143">143 ibid Recital 6.</footnote>

<footnote n="144">144 ibid Art 5.</footnote>

<footnote n="145">145 Note, however, that this right can be exercised by bigger market players, too.</footnote>
products generates. The Act does not establish a genuine B2B data-sharing mechanism, but rather a business-to-customer-to-business 'B2C2B' hybrid design which is intermediated by customers: even if the data flows directly from one business to another, it is the user who has to initiate the transfer.

We have expressed elsewhere our worries that this mechanism overly estimates the ability of users to manage their data and might consequently fail to achieve the goal of enhancing data-sharing.<fnref n="146" /> A quick look suffices to show that this regime is costly for users and that the benefits might be too remote to be worth the costs. Even though critiques of data self-management are already mainstream in the data governance literature,<fnref n="147" /> the DA builds on this model, relying on the establishment of a system of incentives to stimulate users to initiate data transfers. First, the Act puts forward an economic dependence argument: requesting the data to be shared leads to ‘a wider choice in aftermarket services’,<fnref n="148" /> which ultimately means that consumers are no longer locked in the manufacturer’s ecosystem for obtaining aftermarket services. Second, there is an innovation incentive: enhancing data access for competitors leads to broader data-based innovation and the development of products or services unrelated to those initially purchased or subscribed to by the user. Both incentives build on a progressive vision of the economy in which customers and manufacturers are on a level playing field and in which customers are entitled to innovative products and services as a reward for their participation in data-generating activities. However, both of these rewards are long-term and structural, meaning that customers derive no immediate, personal, concrete benefits in exchange for incurring the costs of issuing data-sharing requests. Consequently, this design choice might prove to be a serious limitation to the effectiveness – and efficiency – of B2B data-sharing. A potential workaround might be for the interested undertakings themselves to find ways to incentivize users to prompt data-sharing requests.<fnref n="149" />

In addition to reliance on users as intermediaries, the B2B data-sharing regime comes with several other limitations. The most important ones are as follows. First, under Article 5(2), undertakings designated as gatekeepers in the meaning of the DMA cannot benefit from the right of users to request their data to be shared. This limitation is intuitive, given that these market players already have access to vast

<footnote n="146">146 Beatriz Botero Arcila and Teodora Groza, ‘Comments to the Data Act from the Law and Technology Group of Sciences Po Law School’ [2022] available on SSRN at <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4135212> accessed 2 May 2023.</footnote>

<footnote n="147">147 Daniel J. Solove ‘Privacy Self-Management and the Consent Dilemma’ (2013) 126 Harvard Law Review 1880</footnote>

<footnote n="148">148 Data Act (n 13), Recital 36.</footnote>

<footnote n="149">149 Nonetheless, pursuant to Article 5(4), tactics deployed by MSMEs to nudge users to have their data shared cannot involve ‘coercive means’.</footnote>
troves of data, and that two of the market failures that the Data Act and the Data Strategy more broadly seek to address is the existence of ‘bottlenecks impeding data access.’<fnref n="150" /> It is also reflective of the broader redistributional orientation in that it strengthens the market position of small(er) players at the expense of the biggest ones.

Second, Article 6(2)(e) prevents recipients from using the data they receive ‘to develop a product that competes with the product from which the accessed data originates or share that data with another third party for that purpose.’<fnref n="151" /> This limitation enshrines the objective of the Data Act to facilitate access to and use of data by consumers and businesses while preserving incentives to invest in ways of generating value through data. It also shows that, despite its redistributional orientation, the DA remains rooted in an efficient discourse. Nonetheless, the cost-benefit analysis underlying this rule is not bulletproof. Whereas the trade-off between facilitating data-sharing and preserving investment incentives is real, it may be overly expansive.<fnref n="152" /> Prohibiting businesses who benefited from user data from developing competing products may have the undesired side-effect of entrenching the market power of the manufacturers Indeed, companies which are active in the aftermarket of repair and maintenance services are distinctly well positioned to enter the primary market for the products at stake given their knowledge of the industry and their commercial relationships with customers – preventing them for an indefinite time from entering the primary market might incidentally cushion the market position of manufacturers.

Third, under Article 5(9), trade secrets shall only be disclosed if it is strictly necessary to do so, and the third parties receiving such information are obliged to preserve confidentiality. Furthermore, the final version of the Act grants data holders the right to withhold or suspend the sharing of data qualified as trade secrets in other circumstances.<fnref n="153" /> This reflects again the Data Act's attempt at balancing data-sharing and access with other private interests in data. Fourth, according to Article 7, micro, small and certain medium-sized enterprises, as long as they are not linked to enterprises which do not enjoy the same qualification, are exempted from the obligation of sharing their users' data with third parties.<fnref n="154" /> This exemption surfaces the DA's redistributive aims: given that such enterprises are less likely to possess the technical means which would enable frictionless data-sharing with third parties, imposing data-sharing obligations on them is considered overly

<footnote n="150">150 Data Act (n 13), Recital 2.</footnote>

<footnote n="151">151 ibid Art 6(2)(e).</footnote>

<footnote n="152">152 Botero Arcila and Groza (n 146).</footnote>

<footnote n="153">153 Data Act (n 13), Art 5(10).</footnote>

<footnote n="154">154 ibid Art 7.</footnote>
burdensome. The decision to insulate these players from data-sharing obligations reflects the Act's commitment to improving the competitiveness of small market players, which demands not only positive action in the sense of imposing duties on data-rich companies but also negative action in the sense of refraining from burdening small players.

### 4.4.3 Making Data Available: A Complex Regime of Obligations

Chapter III of the Act lays down the regime of obligations imposed on data holders when carrying out their obligation to make data available. These obligations are very detailed and some of them are technical, thus we discuss only the most important ones for our purposes. First, under Article 8(1), data needs to be made available ‘under fair, reasonable and non-discriminatory terms and in a transparent manner.’<fnref n="155" /> Second, data holders are not allowed to give more favourable treatment to any data recipients, in particular when these are enterprises with whom they have commercial links, and when there is any suspicion of positive discrimination, the burden of proof is on the data holder to demonstrate the lack thereof.<fnref n="156" /> Third, under Article 9(1), data recipients can only receive ‘reasonable’ compensation for making the data available, and in case the recipient is an MSME, the compensation shall not exceed ‘the costs incurred in making the data available.’<fnref n="157" /> Fourth, according to Article 10, any disputes between the data holder and the data recipient shall be settled by bodies certified by the Member States to meet the criteria of, amongst others, impartiality, independence, and expertise.

Chapter III is complemented by Chapter IV, which prohibits unfair contractual terms unilaterally imposed. Article 13(1) in conjunction with Article 13(3) specifies that contractual terms which have been unilaterally imposed on MSMEs are not binding if they are unfair in the sense that they ‘grossly deviate from good commercial practice in data access and use, contrary to good faith and fair dealing.’<fnref n="158" /> According to Article 13(4), contractual terms are unfair if they either limit the liability of data holders, limit the remedies available to data recipients, or give data holders exclusive rights to assess whether the data provided is in conformity with the contractual terms.<fnref n="159" /> Additionally, Article 13(5) contains a laundry list of contractual terms which are presumed unfair.

<footnote n="155">155 ibid Art 8(1).</footnote>

<footnote n="156">156 ibid Art 8(3).</footnote>

<footnote n="157">157 ibid Art 9(2)(a).</footnote>

<footnote n="158">158 ibid Art 13(2).</footnote>

<footnote n="159">159 ibid Art 13(3).</footnote>
#### 4.4.4 Semi-final Observations

The enactment of this web of entitlements displays an unorthodox regulatory technique, fitting with what Dagan and Kreitner call ‘the neglected half of regulatory theory.’<fnref n="160" /> In enacting rights and obligations covering non-personal data,<fnref n="161" /> the DA is *de facto* creating a novel regime of private law applicable to this data.<fnref n="162" /> This regulatory choice is fit for the purpose of addressing the issues identified by the Act: instead of punctual market failures, the market in non-personal data is plagued by suboptimal trading and missed innovation opportunities due to uncertain allocations of rights. These are issues specific to novel industries and unregulated emerging markets, where it is unclear who holds entitlement to what resources and under what conditions trade is possible.<fnref n="163" /> As Zingales and Rolnik put it, the preferred regulatory choice for intervening in emerging markets is to ‘reallocate rights to provide more incentives to trade.’<fnref n="164" /> This is what the Data Act does. Recall that today, and before the intervention of the Act, the exchange structure of non-personal data works on the basis of a ‘rule of capture:’ whoever records the data gets to keep it and reap all the benefits from its use and reuse.<fnref n="165" /> According to this rule, most data was *de facto* owned by big market players who have the customer bases and technical means required to capture, store, and process vast amounts of data.

Additionally, note how the Act adopts semi-commons arrangements and argues that ‘rights regarding access to and the use of data are preferable to awarding exclusive rights of access and use.’<fnref n="166" /> Whether this reallocation of rights will allow the EU to realise the important economic benefits of data as a non-rival good is an empirical question which will be answered by the future evolution of the data economy.

<footnote n="160">160 Hanoch Dagan and Roy Kreitner, ‘The Other Half of Regulatory Theory’ (2020) 52(2) Connecticut Law Review 615.</footnote>

<footnote n="161">161 The Data Act also applies to personal data. However, the emphasis here is on non-personal data because (1) the bulk of the data at stake is non-personal, and (2) there was no pre-existing regulatory regime covering non-personal data.</footnote>

<footnote n="162">162 Roger Sherman, *Market Regulation* (Pearson 2008) 11.</footnote>

<footnote n="163">163 In these market scenarios, it is unclear who owns what because both the product and its derivatives are new and there are no pre-existing entitlements. For a discussion of markets with unclear allocations of property rights, see, for instance, DD Li, ‘A Theory of Ambiguous Property Rights in Transition Economies: The Case of the Chinese Non-State Sector’ (1996) 23(1) Journal of Comparative Economics 1.</footnote>

<footnote n="164">164 Luigi Zingales and Guy Rolnik, ‘A Way to Own Your Social Media Data’ (New York Times, 30 June 2017) available at <https://www.nytimes.com/2017/06/30/opinion/social-data-google-facebook-europe.html> accessed 2 May 2023.</footnote>

<footnote n="165">165 Sherman (n 162) 13.</footnote>

<footnote n="166">166 Data Act (n 13), Recital 6; See supra section II.</footnote>
# 5 Final Analysis: Considerations for the Future of the European Data Strategy

The Data Strategy lays down the vision of a European single data market that aims to be in sync with EU fundamental rights and values. The DA and the DGA intend to turn this into reality through concrete legal interventions designed to facilitate data access and exchanges and thereby enable businesses and the public sector alike to better capture the benefits of data. In doing so, the Strategy as a whole creates and alters certain data-entitlements and has the ambition of reshaping the European data market.

The in-depth analysis carried out in the previous section presented the Acts, assessed how they generate costs and benefits to data-sharing and exchanges, and how these costs and benefits are distributed across different types of players in the data ecosystem. For example, whereas the inability of gatekeepers to make use of the DA's regime of accessing user data represents a cost to them, it represents a benefit to the market actors who can tap into this data. The preference for small(er) players at the expense of the gatekeepers displays a redistribution ambition aimed at strengthening the bargaining power of weaker parties.

Building on the granular analysis of the previous section, this section finishes by reflecting on the nature and challenges of these interventions by focusing on three main elements: (1) whether the friction created by personal data protection and information asymmetries has been eased by the proposed regulatory framework for data intermediaries; (2) what kind of regulatory techniques the DA and the DGA display, and to what extent they venture in promoting alternative, non-market based data governance mechanisms, and lastly (3) what are the limits and potential of the EU Data Strategy and how it aligns with other pillars of EU regulation of the digital economy.

## 5.1 Challenges Ahead: Legal Uncertainties and Information Asymmetries Unsolved

The main motivation of the European Data Strategy is that ‘the potential of data-sharing is not realised, [and] data-sharing remains limited in Europe.’<fnref n="167" /> Despite the fact that they are not singled out in the Acts, two of the fundamental frictions to data-sharing seem to be the pre-existing European personal data protection rules and the lack of available information as to what data can be shared or traded, how, and by

<footnote n="167">167 European Commission, ‘Data Governance Act explained’ available at <https://digital-Strategy.ec.europa.eu/en/policies/data-governance-act-explained> accessed 2 May 2023.</footnote>
whom. In this section, we examine to what extent these issues are actually addressed
by the Strategy.

5.1.1 Can Personal Data Now Be Exchanged?

The first challenge at issue is that the proposed new institutional frameworks for
‘data-sharing’ and ‘data intermediation’ established by the Acts may be at odds with
data protection law. Recall that the DGA operates with the new notion of the ‘data
holder,’ which means ‘a legal person, including public sector bodies and interna-
tional organisations, or a natural person who is not a data subject with respect to the
specific data in question [and] which [...] has the right to grant access to or to share
certain personal or non-personal data.’<fnref n="168" /> The notion of the data holder introduced
by the DGA creates a new regime under which the data holder has the right to grant
access to or share data concerning the data subject with an unlimited number of
third parties, for purposes which cannot be (exhaustively) specified in advance.

In contrast, the GDPR only recognizes the notions of ‘data controller’ and ‘data
processor.’ ‘data controller’ refers to a ‘natural or legal person [...] which [... [
determines the purposes and means of the processing of personal data,’ whereas a
‘processor’ means ‘a natural or legal person [...] which processes personal data on
behalf of the controller.’<fnref n="169" /> Under the GDPR, data controllers/processors can only
process personal data if they comply with at least one of the legal bases enshrined in
Article 6. It is unclear, thus, to what extent the notion of the data holder overlaps or
conflicts with those of data controller or processor.

In their joint opinion issued on the basis of the draft version of the DGA, the
European Data Protection Body (‘EDPB’) and the European Data Protection Super-
visor (‘EDPS’) took the view that such processing would be incompatible with the
framework of the GDPR. The two bodies argue that the DGA builds on a right of the
data holder to grant access to data or to share it with third parties which implies, first,
the existence of a right of the data subject to share their data with a third party, and
second, a transfer of this right from the data subject to the data holder.<fnref n="170" /> None of
these rights are as of now articulated neither in the GDPR nor in the DGA.

<footnote n="168">168 Data Governance Act (n 13), Art 2(8).</footnote>

<footnote n="169">169 General Data Protection Regulation (n 35), Art 4(7) and Art 4(8).</footnote>

<footnote n="170">170 EDPB-EDPS, Joint Opinion 03/2021 on the Data Governance Act, Version 1.1., 11 available at <https://edpb.europa.eu/system/files/2021-03/edpb-edps_joint_opinion_dga_en.pdf> accessed 2 May 2023. Note, however, that Recital 7 of the General Data Protection Regulation states that ‘natural persons should have control of their own personal data.’ The language of control might imply the existence of at least an entitlement to share the data under one’s control. General Data Protection Regulation (n 35).</footnote>
We believe there are potentially two main ways to think about this potential conflict: Under the GDPR, data controllers/processors can only process personal data if they comply with at least one of the legal bases enshrined in Article 6. The GDPR narrowly defines the reasons for which personal data can be processed: to fulfil a contract with an individual, to comply with a legal obligation, to protect vital interests, to perform a task in the public interest, to pursue a legitimate interest that is not overridden by an individual's rights and freedoms, or with the explicit consent from the individual.<fnref n="171" /> In practice, a very frequent mechanism for satisfying this requirement is asking for the consent of the data subject or claiming that it is in the legitimate interest of the processor. One way to think about this, thus, is that the data subject grants consent *only* to the data controller at hand, and for specific purposes. Bringing the DGA and the GDPR together, thus, is unclear whether individuals will or should be able to *delegate* their right to grant consent about the treatment of the personal data.<fnref n="172" /> A second and alternative legal basis would be to argue that it pursues the legitimate interests of the (third-party) data processors. The challenge going forward would be how to construe this legal basis for it not to be overused.

The legal uncertainty about how the GDPR and the DGA work together may hinder certain players from engaging in the data transactions the DGA seeks to facilitate.<fnref n="173" /> Gabriele Caravano and Michèle Finck have argued that digital intermediaries may face considerable tensions and legal uncertainty regarding data protection law that may hinder the achievement of the Data Strategy's goals.<fnref n="174" /> Caravano and Flinck similarly argue that data intermediaries that classify as providers of data processing services will bear significant obligations costly to comply with that may weaken their competitiveness.<fnref n="175" /> But it is worth considering the effects of assuming that the Act created an implied entitlement of data holders to share personal data widely. One could think that the impacts of this intervention are limited: personal data already flows widely in the EU economy, not in an 'open' market, but in the hidden architecture of the digital services economy.<fnref n="176" /> Ditfurth

<footnote n="171">171 General Data Protection Regulation (n 35), Art 6.</footnote>

<footnote n="172">172 General Data Protection Regulation (n 35), Art 7, as well as recital 32, provide that consent must be freely given, specific, informed and unambiguous. To satisfy the requirements of being informed and specific, the data subject must be notified about the controller's identity, the kinds of data that will be processed, and how it will be used. It is difficult to imagine how such consent could be granted in the context of chains of transactions of data.</footnote>

<footnote n="173">173 Caravano and Finck (n 3).</footnote>

<footnote n="174">174 ibid.</footnote>

<footnote n="175">175 ibid.</footnote>

<footnote n="176">176 See, e.g., Paypal, List of third parties (other than paypal customers) with whom personal information may be shared (List updated on 1 January 2024) <https://www.paypal.com/ie/legalhub/ third-parties-list. ccessed, January 19, 2024, Explaining also, that ‘Certain third parties and PayPal group companies provide services to PayPal (Europe) S.à r.l. et Cie, S.C.A. (PayPal) in order for PayPal</footnote>
and Lienemann argue that the overall regulatory approach, while aiming to prevent competition risks, may be however adding compliance costs and preventing the full realisation of the benefits of data intermediation services in facilitating data-sharing markets. This may, in the end, reduce the value and incentives to provide data intermediation services.<fnref n="177" />

### 5.1.2 The Problem of Information Asymmetries

A second challenge is the problem of information asymmetries: ensuring the transferability of personal data does not suffice to achieve functional data intermediation and trading. Recall that economists have shown that though digital technology lowers information costs, it does not solve the problem of information asymmetries.<fnref n="178" /> The Data Strategy addresses these challenges in several ways – from requiring or enabling the registration of data intermediaries to granting data subjects the right to be informed by data intermediaries about the uses of their data. Nonetheless, these steps might not be sufficient.

When it comes to the position of new market entrants interested in buying or accessing data, even after data intermediaries will be registered, the information costs of navigating the landscape of data holders are likely to remain significant. This will be a bigger problem in the DGA than in the DA, since the data-sharing schemes of the DA are rather specific and respond to end-user needs: if I want my IoT devices repaired by company X, I can ask Y, the manufacturer, to give X the needed information. The DGA's mechanism for making information about data intermediaries available is the requirement that providers of data intermediation and data altruism services need to be registered in a public national register, which could be made open access. Nonetheless, the obligation to register is framed as a duty towards competent national authorities, and not as an effort at maximising transparency and ensuring that adequate information is available to potential data providers and receivers.

On the other hand, the Data Strategy seeks to significantly strengthen the information endowments of data subjects. A couple examples suffice to prove this point. Under the Data Act, all users of IoT devices – including natural persons – are granted the right to access all the data their usage generates. Under the Data Governance Act, data subjects have the right to be informed by data intermediaries as to the intended uses of their data. What remains unclear, though, is to what extent data subjects will be able and willing to exercise these rights.

<footnote>to offer services to you. We may share data with these parties that could include account information such as your personal and/or business details and details of your transactions.'</footnote>

<footnote n="177">177 ibid.</footnote>

<footnote n="178">178 See Duch-Brown et al. (n 24).</footnote>
## 5.2 Regulatory Technique: From Fixing Market Failures to Structuring Markets

The previous section has shown that the context in which the acts intervene is one in which there are plenty of frictions preventing data exchanges from reaching the welfare-maximising level. Alongside the issues of personal data protection and information asymmetries, the acts mention a series of obstacles which impede data-sharing: lack of incentives for data holders to enter voluntarily into data-sharing agreements, unclear rights and obligations over data, transaction costs, high level of fragmentation in data silos, and bottlenecks impeding data access. Whereas some of these barriers to data-sharing fall into the category of textbook market failures (e.g. lack of incentives, transaction costs), others are endemic to the data economy (e.g. unclear rights and obligations over data, data bottlenecks) and warrant legal interventions that go beyond traditional regulatory techniques that merely remedy market failures. The Acts do not shy away from using unorthodox regulatory instruments to tackle these issues. For example, the DA prohibits unfair terms in data-sharing contracts, thereby actively shaping the bargaining power of the transacting parties. In doing so, the Act moves from redressing market failures to *structuring* the data market by equalising the level playing field between large and MSMEs.<fnref n="179" /> A further case in point is the DGA's prohibition of operators of data marketplaces from using the data they trade in their other lines of business, presumably in ways which increase profitability.<fnref n="180" /> The ambition here is to ensure that providing data intermediation services cannot be leveraged as a competitive advantage in adjacent markets, seeking to break the vicious cycle of digital platforms expanding their market power across related markets.<fnref n="181" />

As this Article has shown, the EU Data Strategy pursues a more radical goal than merely fixing punctual market failures: it aims to redress the inability of existing data markets to promote the best interests of society while protecting fundamental

<footnote n="179">179 This is not to say that the Data Strategy and its acts are the first regulatory instruments performing this task. For instance, Directive (EU) 2019/633 on unfair trading practices in business-to-business relationships in the agricultural and food supply chain (Unfair trading practices directive) [2019] OJ L 111/59.</footnote>

<footnote n="180">180 Data Governance Act (n 13), Art 12; See also von Ditfurth & Lienemann (n 12); Baloup et al., 'White Paper on the Data Governance Act' CiTiP Working Paper (2021).</footnote>

<footnote n="181">181 For an analysis of how platforms leverage their power across markets, see Friso Bostoen, *Abuse of Platform Power – Leveraging Conduct in Digital Markets under EU Competition law and Beyond* (Concurrences 2023).</footnote>
rights.<fnref n="182" /> To do so, the Acts rely on two innovative regulatory techniques: (1) creating new entitlements and rearranging existing ones and (2) opening up pockets of non-market relationships. First, the acts create new rights and obligations over data which change the status quo in which big businesses have *de facto* exclusive access to the data they capture. From granting users the right to request that the data they generate is shared with competitors, to creating trusted intermediaries for data exchanges, the acts are about democratising access to data through stimulating data-sharing. The intent is to go from a deeply unequal data economy in which data is captured and locked in the ecosystems of dominant players to a more democratic data market where data is treated as a societal good that should deliver welfare for all actors in the economy, from citizens to MSMEs. It is interesting to note, however, that the path taken is outright pro-market: the mechanisms chosen are underlined by an implied idea that sometimes repairing the imbalances of markets requires relying on even more market mechanisms, not less. This approach — of proposing more market-based mechanisms to fix faulty markets — aligns with the views of scholars such as Posner and Weyl, who note that ‘our supposedly competitive market economy is actually plagued by monopolised and missing markets’ and seek to expand markets to achieve a fairer distribution of resources.<fnref n="183" /> This is what the EU seems to be doing with the Data Strategy: injecting vitality in data markets to give everyone a stake in the data economy.

However, the Data Strategy is not all about market-based mechanisms. In a very European fashion, the Strategy seeks to avoid a sum-zero game in data governance where the outcome would be either ensuring data protection through preventing data-sharing or an unregulated data economy. The EU is decidedly a pro-market entity, yet European markets are more protective of consumers and individuals, more regulated, and more fair than their American counterparts, where much of the literature on data governance comes from. Thus, alongside the commitment to structuring markets through rearranging entitlements, it opens up pockets for non-market relationships through proposing alternative data governance mechanisms. The DA's section requiring businesses to share data with governmental authorities in cases of public emergencies, and the DGA's legal framework for data altruism reflects Dagan and Markovits' vision of markets with incomplete commodification: despite the fact that the data economy is primarily markets-based, it retains the space for interactions which maintain a non-commercial and public-interested aspect.<fnref n="184" />

<footnote n="182">182 As Medema and Marciano put it, this is the difference between fixing punctual market failures and fixing the failure of markets to deliver desired outcomes. *See* Alain Marciano and Steven Medema, ‘Market Failure in Context: Introduction’ [2015] History of Political Economy 47(1) 2.</footnote>

<footnote n="183">183 Posner & Weyl (n 66).</footnote>

<footnote n="184">184 Dagan et al. (n 11).</footnote>
## 5.3 From Data Law to Market Law: The European Data Strategy in Its Broader Context

Lastly, it is worth noting that despite its ambitious goal of revamping the European data economy, the Data Strategy does not intervene on a blank slate. As the previous section has shown, the extent of data-sharing is already pre-configured by the GDPR. Nonetheless, data protection regulation is not the only legal regime influencing data-sharing: Competition law, IP law, the novel DMA and DSA, and internal market law impact what kind of data can be shared and how. In the parlance of legal institutionalists, these legal instruments form the 'background rules' or the exchange structure which configure data-sharing, even if they are not directly targeted at regulating it.<fnref n="185" /> Analyses of new regulations often take these background rules for granted and fail to address how pre-existing legal rules impact novel regulatory instruments.<fnref n="186" /> However, to properly assess the role of the Data Strategy in shaping the European data economy, it is necessary to briefly put it in dialogue with the background regime in which it intervenes.

Looking at the EU's broader new regulatory toolkit dedicated to digital markets, it appears that whereas the dominant narrative is that the DMA seeks to fix market failures that could not be addressed by existing legal instruments,<fnref n="187" /> the DGA and the DA reflect a forward-looking ambition to structure an emerging data market differently. The preamble of the DMA is rooted in acknowledging two layers of institutional failure. On the one hand, the Act mentions that in the digital economy 'market processes are often incapable of ensuring fair economic outcomes.'<fnref n="188" /> On the

<footnote n="185">185 Duncan Kennedy, 'The Role of Law in Economic Thought: Essays on the Fetishism of Commodities' [1985] 34 The American University Law Review 939.</footnote>

<footnote n="186">186 Nonetheless, there is a wide array of scholarship that analyses the interplay between new rules and pre-existing background rules. A notable example in the US is Katarina Pistor, *The Code of Capital* (Princeton University Press 2019) (assessing how property and contract laws interwoven with new legal techniques affect the distribution of wealth). In the EU, a notable strand of literature following this approach is the scholarship on the Digital Markets Act. See, for instance, Natalia Moreno Belloso and Nicolas Petit, 'The EU Digital Markets Act (DMA): A Competition Hand in a Regulatory Glove' (2023) 48 European Law Review 431 (assessing how the DMA fits with the pre-existing competition law regime).</footnote>

<footnote n="187">187 This was the justification for the adoption of the DMA. Originally called a 'New Competition Tool', the DMA was designed to 'address gaps in the current competition rules' given the existence of 'structural competition problems that the current rules cannot tackle'. See European Commission, 'Impact Assessment for a possible New Competition Tool', available at <https://competition-policy.ec.europa.eu/public-consultations/2020-new-comp-tool_en> last accessed 20 April 2024. For a critique of the view that the DMA is that different from pre-existing competition law rules, see Moreno Belloso and Petit (n 186).</footnote>

<footnote n="188">188 Digital Markets Act (n 12), Recital 5.</footnote>
other hand, it acknowledges that existing legal instruments have failed to ‘ensure the contestability and fairness for the markets in the digital sector in general,’ and hence a regulatory instrument dedicated to achieving this aim was necessary.<fnref n="189" /> Consequently, the DMA proposes rules that seek to remedy harms already observed in digital markets. To home in on this, take the example of Article 5(2)(b), which prohibits gatekeepers from combining personal data they gather through providing intermediation services with personal data gathered from any other services.

The ambitions of the DGA and DA are different. This is made clear by the preamble of one of the acts: the aim is to foster ‘the emergence of new data-driven ecosystems independent of any player with a significant degree of market power, while allowing non-discriminatory access to the data economy.’<fnref n="190" /> Recall the DGA’s requirement imposed on providers of data intermediation services to separate data intermediation services from any other lines of business. This obligation reflects the wisdom gathered through observing how businesses active in the platform economy have evolved,<fnref n="191" /> achieving dominance through combining several lines of business and leveraging the power secured in one market to monopolise adjacent markets.<fnref n="192" /> The DGA and DA intervene at a moment in which the data intermediation economy is still in its infancy and aim to ensure *ex ante* that this novel economic sector will not replicate the structural imbalances we have witnessed in the other digital markets. In this sense, the Acts are akin to an infrastructural project that seeks to facilitate the emergence of a data market that looks different from contemporary digital markets.

This approach – of using regulation as infrastructure – is distinctly European: The single market was also facilitated by piecemeal regulatory efforts, from the Single European Act to the liberalisation directives and the introduction of the Euro.<fnref n="193" /> Whether the same approach will be successful in the data economy is an open question, though. Time will tell if we are witnessing the emergence of a fifth freedom of movement, alongside goods, services, capital and people, or if this is the failed constitutional moment of the data economy.

<footnote n="189">189 ibid Recital 7.</footnote>

<footnote n="190">190 Data Governance Act (n 13), Recital 27.</footnote>

<footnote n="191">191 Take the example of Amazon, which plays the dual role of offering the marketplace service which intermediates between buyers and sellers and of selling its own goods in the same marketplace. This dual capacity has enabled Amazon to gather data about the success of other sellers and to leverage it to optimise its own commercial activities, which has ultimately allowed it to divert customers from its competitors and to achieve market dominance.</footnote>

<footnote n="192">192 For an overview of different forms of leveraging abuses, see Friso Bostoen, *Abuse of Platform Power – Leveraging Conduct in Digital Markets Under EU Competition Law and Beyond* (Concurrences 2023).</footnote>

<footnote n="193">193 For an analysis, see Stephen Weatherill, *The Internal Market as a Legal Concept* (Oxford University Press 2017).</footnote>
# 6 Conclusions

This Article has analysed the European Data Strategy and its main implementing acts – the Data Governance Act and the Data Act – by relying on a mix of orthodox and heterodox law and economics tools and leveraging the literature on data governance and data markets. In sum, the Data Strategy displays a European approach to data markets – committed to respecting the privacy of data subjects and to achieving public interest objectives – but is still a pro market Strategy.

The analysis revealed that the Data Strategy puts forward a novel approach to data governance, for several reasons. First, it constitutes a break from the EU's previous exclusive emphasis on the protection of the fundamental rights of data subjects. Whereas the GDPR has placed the interests of data subjects at the heart of data governance, the Data Strategy introduces the imperative of tapping into the societal potential of data, seeking to strike a balance between fundamental rights and values, and unlocking the potential value of data-sharing and trading. Second, the Strategy deploys a unique mix of regulatory techniques that seek to create the requisite legal infrastructure for the emergence of a data economy that looks different from existing digital markets. From provisions seeking to prevent the emergence of outsize market power, to efforts at equalising the bargaining power of small and big players, and the injection of non-market, altruism-based institutional frameworks for data-sharing, the Strategy puts forward an unorthodox legal toolkit for facilitating the emergence of a different kind of data economy. Third, in leveraging the power of regulation to inject vitality into data trading and sharing, the Strategy revitalises the European approach of using regulation as a market-building mechanism, which was deployed for the erection of the internal market in goods, services, workers, and capital.

Whether the Data Strategy will achieve its ambitious goals remains an open question. Important questions on legal certainty, information asymmetries and how efficient the emerging markets will be are yet unanswered. However, regardless of the factual outcomes, we highlight that the Strategy represents an impressive project of legal infrastructure which has the potential to reshape the global academic discussion on data governance. It symbolises a step ahead from the polarised literature on data governance which tends to be silo-ed in two camps: one focusing on the many privacy and democratic risks of data-sharing and the digital economy, and the other emphasising the many potential benefits of unrestrained data-sharing, trading, and markets. Through proposing a vision of thoroughly regulated data markets, it suggests that there is potential for law and regulation to shape markets that are not plagued by the ills of excessive concentration and unchecked power accumulation at the top.
**Acknowledgments:** The authors would like to thank Giovanna Hajdu Hungria Da Custódia for her helpful research assistance, and two anonymous reviewers and the participants at the ‘Commodification and the Law’ conference organized at EUI in December 2022 for their helpful comments and feedback.