JAPAN INTELLECTUAL PROPERTY ASSOCIATIONASAHI SEIMEI OTEMACHI BLDG.18F
6-1 Otemachi 2-chome
Chiyoda-ku Tokyo, 100-0004, JAPANTEL: 81 3 5205 3321
FAX: 81 3 5205 3391
URL: http://www.jipa.or.jp/

September 3, 2021
European Commission
Charlemagne building
Rue de la Loi 170
1040 Brussels
Belgium
Re: JIPA Comments to Public consultation on the Data Act
and amended rules on the legal protection of databases, June 2021

We, the Japan Intellectual Property Association (JIPA), are one of the world's
largest organizations of IP users with a membership of 1,346 members (as of August 30,2021), most of which are Japanese companies.
In light of the fact that our member companies expand business in Europe andhave a great concern on the legislative proposal of Data Act and amended rules on thelegal protection of databases. Therefore, JIPA has carefully considered “Request forComments on Public consultation on the Data Act and amended rules on the legal
protection of databases” in June 2021 by European Commission. We, JIPA, respectfully
submit our comments on the act and the rules, as below.
European Commission is kindly requested to take our comments into consideration
when deciding on the revisions to the act and rules.
Sincerely yours,

Toshio ASAI

Hisashi ISHIJIMA

Toshihiko KOBAYASHI

Vice-PresidentManaging Director

Managing Director

Attachment:
Re: JIPA Comments to Public consultation on the Data Act
and amended rules on the legal protection of databases, June 2021
(Contact) Ms. Maho Furuya : furuya@jipa.or.jp

Attachment

Re: JIPA Comments to Public consultation on the Data Act andamended rules on the legal protection of databases, June 2021

I. Business-to-government data sharing for the public interest
Access to private sector data can provide public authorities in the EU with valuable insights, for example toimprove public transport, make cities greener, tackle epidemics and develop more evidence-based policies.
To facilitate such data sharing, the European strategy for data announced that one of the objectives of theData Act would be to create a framework to bring certainty to business-to-government (B2G) data sharing
for the public interest and help overcome the related barriers.
In this context, ‘public interest’ is understood as general benefits to society as a whole – like effective
responses to disasters or crises and improvements to public services – as recognised in law, at EU or
Member State level. Some key examples are provided in the question "In which of the following areas do

you think that, for specific use-cases with a clear public interest, B2G data sharing should be compulsory,
with appropriate safeguards?"
This framework could set the objectives, general obligations and safeguards that should be put in place for
B2G data sharing.
An Expert Group on B2G data sharing, whose report was published in February 2020, issued a number ofrecommendations in order to ensure scalable, responsible and sustainable B2G data sharing for the public
interest. In addition to the recommendation to the Commission to explore a legal framework in this area, it
presented several ways to encourage private companies to share their data. These include both monetaryand non-monetary incentives, for example tax incentives, investment of public funds to support thedevelopment of trusted technical tools and recognition schemes for data sharing.
In this section, we would like to hear your views on how the Commission should foster B2G data sharing for
public interest purposes.

Have you or has your organisation experienced difficulties/encountered issues
when requesting or responding to requests for access to data, in the context of
B2G data sharing for the public interest?
Yes
No
I don't know / no opinion-1-Please specify
200 character(s) maximum

Should the EU take additional action so that public sector bodies can access andre-use private sector data, when this data is needed for them to carry out theirtasks in the public interest purpose?
EU level action is needed
Action at Member State level only is needed
No action is needed
I don’t know / no opinion
To what extent do you believe that the following factors impede B2G data sharing
for the public interest in the EU?
I don’tStrongly

Somewhat

agree

agree

NeutralSomewhat

Stronglyknow

disagreedisagree/noopinion

Legal uncertainty due todifferent rules acrossMember States
Legal barriers to the useof business data for the
public interest (e.g. on
what data can be shared,
in what form, conditions
for re-use), including
competition rules
Commercial disincentives
or lack of incentives/interest/ willingness
Lack of skilled
professionals (public and/or private sector)
Lack of bodies to help
bring together supply anddemand for data, and topromote, support andoversee B2G data
sharing (e.g. provide bestpractice, legal advice)-2-

Lack of safeguards
ensuring that the data will
be used only for the
public interest purpose
for which it was requested
Lack of appropriate
infrastructures and costof providing orprocessing such data (e.
g. interoperability issues)Lack of awareness(benefits, datasets
available)
Insufficient quality of
public authorities’ privacy
and data protection tools

●

Other

Please specify
There are not definite reasons and issues to establish the law instead of agreement for B2G data sharing,
although B2B data sharing are able to proceed based on the agreements.

In which of the following areas do you think that, for specific use-cases with a clear
public interest, B2G data sharing should be compulsory, with appropriate
safeguards?
Yes, itshould becompulsory
Data (e.g. mobility data from Telecom operators, loss data frominsurance companies) for emergencies and crisis management,
prevention and resilience
Data (e.g. price data from supermarkets) for official statistics
Data (e.g. emissions data from manufacturing plants) for
protecting the environment
Data (e.g. fuel consumption data from transport operators) for ahealthier society
Data for better public education services
Data (e.g. employment data from companies) for a socially
inclusive society-3-

No, itI don’tshould not

know

be

/no

compulsory

opinionData for evidence-based public service delivery and policymaking

●

Other

Please specify
200 character(s) maximum

Legal structure govt. may use data without consent from holders should be limited to emergencies
like disasters,lifesaving-needs,or when it cannot be handled by voluntary and/or contractual
agreement.

When sharing data with public bodies, businesses should provide it:
For freeAt a preferential rate/ below market price (marginal cost or other)
At market priceDepending on the purpose it may be provided at market price, preferential
rate or for free
I don’t know/ no opinion
Please provide an example(s) of when public sector bodies should be able toobtain data for the public interest at a preferential rate.
The above purpose include the usage range and recipient of data.
There are other factors to consider, such as the affect of our business(including the provision of data forour competition) and relationship with our customer.

What safeguards for B2G data sharing would be appropriate?
Data security measures including protection of commercially sensitive
information
Specific rules on proportionality and reasonableness of the request
Transparent reporting on how the public authority has used the data
Limitations regarding how long public bodies may use or store specificdatasets before having to destroy them
Other

Framework to prevent private sectors from bearing excessive additional costs to share data.
Authorities are responsible and indemnify the provided data to data providers for
Please specify unintended use and disclosure of data.
Appropriate consideration for data provision.
200 character(s) maximum
In the course of the government's data collection, if it becomes clear that a company has
violated any laws or regulations with the data it has provided, the company should not beheld liable for that violation with respect to the government's use of the data.

Which of the following types of financial compensation would incentivise you toengage in a B2G data-sharing collaboration for the public interest (select all that
apply):-4-

Marginal costs for dissemination
Marginal costs for dissemination + fair return on investment (ROI)
Market price
Which of the following types of non-monetary compensation would incentivise you
to engage in a B2G data-sharing collaboration for the public interest (select all that
apply):Tax incentives
Increased know-how and innovation through co-creation with public bodies
Reputation/ public recognition programmes (e.g. corporate social
responsibility)
Investment of public funds to support the development of trusted technicaltools for B2G data sharing
I don’t know / no opinion
Other
Please specify
200 character(s) maximum

II. Business-to-business data sharing
In this section, we would like to hear your views on fair contractual terms and conditions as an important
tool that can stimulate companies to exchange their data while safeguarding the freedom of contracts andin full compliance with applicable legislation (such as the GDPR or competition law). The Data Strategy
intends to promote business-to-business (B2B) data sharing which will benefit in particular start-ups andSMEs, putting emphasis on facilitating B2B voluntary data sharing based on contracts. We are seeking
options for promoting fairness in contracts governing access to and use of data.
Model contract terms would provide businesses willing to share data, but lacking the experience, inparticular SMEs and start-ups, with practical guidance on how to set up the contract based on fair terms.
The use of such model contract terms would be voluntary for the parties.
A legislative fairness test for all B2B data sharing contracts would create general boundaries with the
purpose to prevent the application of abusive contract clauses imposed by the party with the stronger
bargaining power on the weaker party. The fairness test would only address excessive clauses while allother terms would be left to the parties’ contractual freedom. A contracting party would not be bound by an
unfair contract term. Precedents for a B2B fairness test in EU law can be found in Directives 2011/7/EU(Late Payments) and Directive (EU) 2019/633 (Unfair trading practices in the food supply chain).
If sectoral rules were to establish a data access right, horizontal access modalities would regulate in a-5-harmonized way how data access rights should be exercised while the possible creation of sectoral data
access rights would be left to future sectoral legislation, where justified. The contract which the parties
would agree for such data access could be based on variations of fair, reasonable, proportionate,transparent and non-discriminatory terms taking into account possible specificities of the relevant sectoral
legislation. Whenever personal data are concerned, processing of such data shall comply with the GDPR.
The data concerned would not include commercially sensitive data that could facilitate collusive outcomeson the market, nor data that is very strategic for competition, including trade secrets, nor legally protected
data, for instance those covered by intellectual property rights.

Does your company share data with other companies? (This includes providing
data to other companies and accessing data from other companies)
● Yes

No
I don't know / no opinion
Are you:
Data holder
Data user
Both data holder and user
Other
In the last five years, how often has your company shared data with othercompanies?
Many times
Only a few times
Don’t know
Please describe the type of data shared, and the type of businesses with whom it isshared200 character(s) maximum

On what basis does your company share data with other companies?
Voluntary
Mandatory
Both voluntary and mandatory
I don’t know / No opinion
Why does your company share data with other companies?
-6-

Optimisation of the supply chain
Predictive maintenancePrecision farming
Moving to circular production
Training algorithms for AI
Design of innovative solutions/products
Other
Please specify
200 character(s) maximum

Which services/products based on data sharing exist/are under development inyour sector and what type of data are needed for these purposes?
300 character(s) maximum

What benefits from data sharing do you expect to be reaped in your sector?
300 character(s) maximum

Has your company experienced difficulties/encountered issues when requesting
access to other companies' data?
YesNo
I don’t know / no opinion
How often did such difficulties occur in the last 5 years?
Very often
Often
Sometimes
RarelyI don’t know / no opinion
What was the nature of such difficulties/issues?

-7-

The data holder refused to give data on the basis of competition law
concerns
The data holder refused to give access to data for reasons other thancompetition law concerns
The data holder is prevented by law to give access to data
There is no legal basis for the data holder to give access to data
The data holder gave access to data at unreasonable conditions, e.g.
unilateral change of contractual terms, disproportionate restriction of use ofdata, limitations in the termination of contract
The data holder gave access to data at an unreasonable priceTechnical reasons like the data was not in usable format or quality or lacks
shared vocabularies or metadata or the data holder doesn’t support
standards for enforce data usage controls (connector)
Other
I don’t know / no opinion
Please indicate the type of difficulties / issues
It200
is sometimes
difficultto provide or receive the data because the data holder and the data user can not agree
character(s)maximumthe terms and conditions for using data such as the data protection method, data managements,
considerations, IP handling, deliverable handling, etc..
The above question assume that the data providers give an unreasonable conditions, but in some case data
users give an unreasonable conditions.

Do you agree that the application of a ‘fairness test’, to prevent unilateral imposition
by one party of unfair contractual terms on another, could contribute to increasingdata sharing between businesses (including for example co-generated nonpersonal IoT data in professional use)?
YesNo
I don’t know / no opinion
Do you agree that model contract terms for voluntary use in B2B data sharing
contracts could contribute to increasing data sharing between businesses(including for example co-generated non-personal IoT data in professional use)?
YesNo
I don’t know/ no opinion
Do you agree that horizontal access modalities based on variations of fair,reasonable and non-discriminatory conditions applicable to data access rights,-8-established in specific sectors, could contribute to increasing data sharing between
businesses (including for example co-generated non-personal IoT data inprofessional use)?
YesNo
I don’t know / no opinion
What, in you view, could be the benefits or risks of the options mentioned in thethree previous questions, for example in relation to incentives for data collection,competitiveness and administrative burden
It is unfair that theand administrative
regulations impose or promote data holders to provide the data beyond the limitation under the competition
300laws
character(s)maximumlaw. We believe and request the guideline, model contract and law should be appropriately balanced for data holder and user in light of their benefits andrisk.
Whether to use a model contract should be directed at the discretion of businesses. It may constrict and reduce the usage and distribution of data if
businesses are forced to use the model contract.
Model contract
terms should bedata
carefully
considered
be balanced
between dataproportionate,
holders and users. If unbalanced
model contract
Regardingaccess
attofair,reasonable,transparent
and terms
non-would be
published and used inflexibly, a negotiation for data sharing would not work well. It should be required to collect opinions from wide-variety of user
companies, andto publish model contract
terms ratherwhich
selectableof
accordingto purposes anduse cases.。do you consider mostdiscriminatory
conditions,the following
elements
FRAND conditions
are generally
used in IPR policies
standard setting organizations which publish standards accessible for anyone. It should be required to
relevant
to increase
datain sharing?
consider carefully whether FRAND conditions could be applied similarly to a purely bilateral B2B data sharing contract. Obligating FRAND conditions might
at most
3 choice(s)disincentivize dataholders
and a reward for a data holder could depend on business relationship between the data holder and a user.

The party sharing data obtains a reasonable yield on investment and theparty requesting access to data pays a reasonable fee
Distinctions can be made depending on the type of data or the purpose of its
use
Availability of standards for interoperability that would allow data sharing andexploitation at a low marginal cost (in terms of time and money)
Structures enabling the use of data for computation without actually
disclosing the data
Availability of an impartial dispute settlement mechanism
None of the above
Other
I don’t know / no opinion
Please explain
200following
character(s)Thearemaximum
issues to be considered.
－The terms and conditions for using data when sharing data between different sectors－Difficult interpretation of FRAND and difficult specific terms and conditions for recognitions as FRAND

III. Tools for data sharing: smart contracts-9-This section seeks to get your views on smart contracts. Smart contracts are computer programs, which
automatically execute data and/or value transfers according to certain predetermined parameters. Smartcontracts have important potential in manufacturing 4.0, smart mobility, and smart energy. Smart contracts
can play an important role here by automating data transfers and data pooling, by triggering payments fordata transfers and for guaranteeing the implementation of conditions linked to a data transfer. The following
questions aim to (1) solicit your experiences with smart contracts and relevant uses cases, and (2) get yourviews on the need of harmonized standards for smart contracts in order to ensure interoperability and what
the essential elements of such standards should be.

Are you using smart contracts or have you been involved in proofs of concept or
pilots for Distributed Ledger Technologies that make use of smart contracts?
Yes
No
Please briefly explain the use case(s) you tested
200 character(s) maximum

Do you consider that smart contracts could be an effective tool to technically
implement the data access and use in the context of co-generated IoT data, inparticular where the transfer is not only one-off but would involve some form ofcontinuous data sharing?
Yes
No
Please explain your answer
200 character(s) maximum

Do you consider that when individuals request data portability from businesses,
smart contracts could be an effective tool to technically implement data transfers, inparticular where the transmission is not only one-off but would involve some form ofcontinuous data sharing?
Yes
No
Please explain your answer
200 character(s) maximum

The smart contracts are effective for the date sharing on the data platforms, then the provenancemanagement becomes crucial to guarantee quality of IoT data.

-10-In your experience, what are the primary challenges for scaling smart contracts
across blockchains and/or across ecosystems? Are these challenges related to: (0lowest, 10 highest)
1

2

3

4

5

6

7

8

9

10

Legal uncertainty
Lack of interoperability
Difficulties with governance
Data protection issues
Competition law complianceconcerns
OthersPlease specify

If interoperability is an issue for scaling smart contracts, which requirements should
inform standardisation to scale smart contracts across blockchains and/or acrossecosystems? Should such standards determine in particular minimum safeguards
for cyber security? If so, which best practices would you consider relevant?
300 character(s) maximum

IV. Clarifying rights on non-personal Internet-of-Things data stemming fromprofessional use
In this section, we would like to hear your views on non-personal data that is generated by smart objects
connected to the Internet-of-Things (‘IoT objects’) in professional use. Examples of such objects include
industrial robots, machine tools with sensors, construction engines or smart farming equipment.

Do you currently or are you planning to use in the near future a smart
object connecting to the Internet-of-Things?
Yes
No
I don’t know / no opinion-11-

Do you agree that IoT objects and data coming from such objects may represent
new challenges for market fairness when access to relevant information concerning
the functioning and performance is held by the manufacturer of such object?
Yes
No
I don’t know / no opinion
Please explain your answer
200 character(s) maximum

If such information is held by the manufacturer, it can lock in its users through providing additional
services, such as maintenance, by using this information, and it may increase a risk of unfair
competition.
Through analyzing the information, the manufacturer may find out sensitive business information or
technological secret of the users.
If such information is held by the manufacturer, it becomes difficult for the users to use theinformation by themselves to improve their operation.

-12-

To what extent are the following elements well addressed in contracts relating to
the sale or long-term lease of IoT objects for professional use?
Very welladdressed

Somewhatwelladdressed

NeutralNot welladdressed

Right to know whichdata is being collectedby the IoT object’
Right to access data
generated by the IoT
for own information
purposes
Rights to use data
generated by the IoT
object by selectedparties
Information on
applicable legal ruleson access to data interminal equipment(ePrivacy Directive)
Rights to transmit data
generated by the IoT
object to selectedparties
Incentives (services,functionalities or otherrewards) for permitting-13-

Not at allwelladdressed

I don’tknow/noopinionthe manufacturer of
the IoT object, hisbusiness partners or
third parties to use thedata that the object
generates
Protection of trade
secrets and othercommercially sensitive
information in thecontext of the regular
data feedbacks of the
IoT object
Other

-14-

Please explain
200 character(s) maximum

Have you experienced any of the following as a result of insufficient rights incontracts relating to the sale or long-term lease of an IoT object?
I could not sell the IoT object onwards
I could not pick and choose a repair or maintenance company of my choice
I could not use a data analytics service offered by another company because
it was legally impossible to allow this service to read the data from the object
that I use
I could not use a data analytics service offered by another company because
it was technically impossible to allow this service to read the data from theobject that I use
I could not use the data internally (including combining it with other data I
hold)
Other
No, I have not experienced any of the above
Please explain
200 character(s) maximum

How relevant where the difficulties signalled in response to the previous question?
They appear frequently and/or are having a considerable impact on mybusiness
They appear infrequently and/or are having only a minor impact on mybusiness
They only appear rarely and/or have an insignificant impact on my businessI don't know / no opinion
Do you feel you are able to acquire sufficient contractual rights to use the data thatthe components your company develops generate in order to observe how thesecomponents perform in real-world scenarios?
Yes, my company is able to acquire the rights it needs.
My company cannot acquire the rights to use a sufficient amount of data.
-15-

My company cannot acquire the rights to use the data for the purposes it
would like to (including sharing it with third parties).
My company cannot use any of the data.
I don’t know / no opinion
Is your company in the business of after-sales services that use data from IoT
objects in professional use in order to offer that service (e.g. repair andmaintenance, data analytics services)?
YesNo
I don’t know / no opinion
Has your company experienced difficulties in accessing relevant data?
YesNo
I don’t know / no opinion
What was the nature of such difficulties?
Outright denial of data access
Prohibitive monetary conditions for data access
Prohibitive technical conditions for data accessRestrictive legal conditions for data access and use
Competition law compliance concerns
Other
I don’t know / no opinion
Please specify
200 character(s) maximum

How relevant where the difficulties signalled in response to the previous question?
They appear frequently and/or are having a considerable impact on mybusiness
They appear infrequently and/or are having only a minor impact on mybusiness
They only appear rarely and/or have an insignificant impact on my business-16-

I don't know / no opinion
Please provide reasons
200 character(s) maximum

V. Improving portability for business users of cloud services

In this section we would like to hear your views on cloud service portability. In order to prevent vendor lockin, it is necessary that business users can easily switch cloud providers, by porting their digital assets in the
broadest sense, including data and applications, from one cloud provider to another provider or back totheir own infrastructure and software on-premise IT systems, including those digital assets stored at theedge of the network.
Cloud service providers and cloud users have jointly developed self-regulatory (‘SWIPO’) codes of conduct
to address this issue in IaaS- and SaaS-specific contexts (IaaS i.e. Infrastructure as a Service; SaaS, i.e.
Software as a Service), as mandated by Regulation (EU) 2018/1807 on a framework for the free flow of
non-personal data in the European Union.
As part of the Commission’s evaluation of the development and implementation of the codes of conduct,
the Commission will evaluate whether self-regulation in the field of business-to-business (B2B) data
portability achieved the desired outcomes or whether other policy options should be considered.
The outcome of the recent public consultation on European Strategy for Data showed that 22.6% of thetotal respondents are of the opinion that the self-regulation is not the appropriate best practice in area ofdata portability. On the contrary, 30.8% agreed it is appropriate practice. The remaining (46.6%) of
respondents did not express their opinion on the topic. However, 48% of the respondents answered thatthey have experienced problems in the functioning of the cloud market, the most common problem
experienced being vendor lock-in.
Considering the above, the following questions aim to receive additional input on the topic of B2B data
portability.

Was your organisation aware of the SWIPO Codes of Conduct prior to filling in thisquestionnaire?
YesNo
I don’t know /no opinion
In your opinion, do the self-regulatory SWIPO codes of conduct on data portability
developed by the cloud stakeholders represent a suitable approach to address
cloud service portability?
-17-

Yes
No
I don’t know /no opinion
Please explain
How much vendor lock in risk each cloud vendor causes is different depending on industries orareas. Therefore, the self-regulatory approach is appropriate to choose the most suitable option foreach specific industry or area.

In your opinion, could the SWIPO codes of conduct represent a suitable approachto address cloud service portability, if:
The principles formulated in the self-regulatory SWIPO codes of conduct
would be binding for all cloud services offered in Europe
The codes of conduct would be supplemented by Standard Contractual
Clauses translating the Codes’ requirement into contractual elements
Both
Other
Please specify
200 character(s) maximum

Do you consider there is a need to establish a right to portability for business usersof cloud computing services in EU legislation?
Yes
No
I don’t know / no opinion
Please explain your answer, detailing as much as possible what this right should
entail.
200 character(s)maximum should be minimized. There is a concern that rules that burden companies willTheburden on companies
become barriers to market entry; companies that cannot adapt to the rules, including SME, will not be able
to enter the market

Please explain your answer
For
cloud
computing
services, how to create network effect is one of the most important strategies. If a powerful and200
character(s)maximumcomprehensive portability right is established in EU legislation, it limits for the cloud services the way to create network
effect and may disincentivize new players to enter to the cloud service market. Considering that vendor lock-in becomes
serious where one or few companies hold market share mostly, the powerful portability right should be introduced only
when market failure can not be fixed by the self-regulatory approach.

What legislative approach would be the most suitable in your opinion, if the data
portability right for cloud users would be laid down in an EU legislation?
-18-

High-level principle(s) recognising the right for cloud service portability (forexample, a provision stipulating that the cloud user has the right to have its
data ported in a structured, widely used and machine-readable format toanother provider or proprietary servers, against minimum thresholds)
More specific set of conditions of contractual, technical, commercial andeconomic nature, including specification of the necessary elements toenable data portability
Other solution
I don’t know / no opinion
Please explain
Becausemechanismsof vendor lock-in as well as effective way of data portability to avoid it are different for each
200 character(s)maximumsituation, customized approach for each situation is essential.
Therefore, the self-regulatory approach is appropriate to choose the most suitable option for each specificindustry or area rather than legislation.

Would the self-regulatory SWIPO codes of conduct on data portability developedby the cloud stakeholders in your opinion represent a suitable baseline for thedevelopment of such a legislative cloud service portability right?
Yes
Yes, but further elements would have to be considered (please be as
specific as possible on which elements are currently not/insufficiently
addressed in those codes of conduct – optional)No
No opinion
I am not familiar with SWIPO codes of conduct
Please explain

Would it be suitable to develop – as a part of legislative approach to cloud service
portability - standard APIs, open standards and interoperable data formats,timeframes and potentially other technical elements?
Yes
No
I don't know / no opinion
Can you be more specific about which standards should be developed in thisregard?
-19-

200 character(s) maximum

Do you consider that formally requesting European standardisation development
organisations to design such standards or the necessary APIs would be an
appropriate solution?
Yes
No
I don't know / no opinion
Please specify how such standards should be identified / developed
200 character(s) maximum

Would it be necessary in your opinion to develop Standard Contractual Clauses forcloud service portability to improve negotiating position of the cloud users?
Yes, it would be necessary and sufficient as a stand alone solution.
Yes, it would be necessary but in addition to a legislative right of data
portability
It would not be necessary but it would simplify the data portability and/or
harmonise its aspects across the EU
No, it would not be necessary
No opinion
Do you have any other comments you would like to address with respect to cloudservice portability, which were not addressed above?
300 character(s) maximum

VI. Complementing the portability right under Article 20 GDPR
In this section we would like to hear your views on the portability of personal data. Under Article 20 of the
GDPR, individuals can decide to port certain personal data to an organisation or service of their choice.
Non-discriminatory access to smart metering data is mandated by Article 23 Directive (EU) 2019/944 oncommon rules for the internal market for electricity. Additional rules are proposed for facilitating theportability of personal data generated in the context of an online service offered by a “gatekeeper platform”
under Article 6(1)(h) of the proposal for a Digital Markets Act (COM(2020) 842 final).
Smart connected objects connected to the Internet-of-Things (IoT objects) and services available on them,e.g. smart home appliances or wearables, generate a growing amount of data. Normally, the data-20-

generated by such objects and by the services available on them in their interaction with their human users
are personal data. Such data is covered by the General Data Protection Regulation (GDPR). Any datastored in terminal equipment, such as connected objects, can only be accessed in accordance with Article 5(3) of Directive 2002/58/EC (ePrivacy Directive). However, the obligations under Article 20 GDPR does not
require the controller to put in place the technical infrastructure to enable continuous or real-time portability.

To what extent do you agree with the following statement: “Individual owners of asmart connected object (e.g. wearable or household appliance) should be able topermit whomever they choose to easily use the data generated by their use of that
object.”Strongly agree
Somewhat agree
NeutralSomewhat disagree
Strongly disagree
I don’t know / no opinion
To what extent do you agree with the following statement: “The device
manufacturer of a smart connected object (e.g. wearable or household appliance)
should be able to permit whomever they choose to easily use the data generated
by the use of that object, without the agreement of the user.”
Strongly agree
Somewhat agree
NeutralSomewhat disagree
Strongly disagree
I don’t know / no opinion
Among the elements listed below, which are the three most important elements thatprevent the right under Article 20 GDPR to be fully effective?
The absence of an obligation to provide a well-documented Application
Programming Interface
The absence of an obligation to provide the data on a continuous basis
The absence of universally used methods of identification or authenticationof the individual that makes the portability request in a secure manner
The absence of clearer rules on data types in scope
The absence of clear rules on liability in case of misuse of the data ported-21-

The absence of standards ensuring data interoperability, including at thesemantic level
Other
I don’t know / no opinion
Please specify
200 character(s) maximum

VII. Intellectual Property Rights – Protection of Databases
The Directive 96/9/EC on the legal protection of databases (Database Directive) provides for two types ofprotection for databases. Firstly, databases can be protected, when original, under copyright law. Copyrightprotection applies to databases (collections of data) that are creative/original in the selection and/or
arrangement of the contents and constitute their authors’ own intellectual creation.
Secondly, databases for which a substantial investment has been made into the obtaining, presentationand verification of the data can benefit from the protection under the so-called “sui generis” right. Suchprotection is automatically granted to the maker of any database which fulfils these conditions. The makerof databases protected under the sui generis right can prevent the extraction or re-use of their database
content. The Directive lays down two main mechanisms to manage rights of users: the exception regimes(including the provision of specific exceptions in the fields of teaching, scientific research, public security orfor private purposes) and the rights of lawful users.
To sum up, the copyright protection of databases only arises where the structure of the database, including
the selection and arrangement of the database’s contents, constitute the author's own intellectual creation.
The sui generis right protects, as an intangible asset, the results of the financial and/or professional
investment carried out towards the methodical and systematic classification of independent data.
The Commission published a report evaluating the Database Directive in 2018. The evaluation highlighted
that important questions arose as regards the interaction of the Directive with the current data economy,notably in view of the potential legal uncertainties as to the possible application of the sui generis right tomachine generated data. The evaluation concluded that the Directive could be revisited to facilitate data
access and use in the broad context of the data economy and in coordination with the implementation of abroader data strategy.
The following consultation is focusing on the aspect of the application of the Database Directive within the
Data Economy, while also asking questions of a more general nature on this instrument.
Intellectual Property Rights - General questions

In your view, how are intellectual property (IP) rights (including the sui generis
database right) and trade secrets relevant for business-to-business sharing of data?
To protect valuable data through IP, where possible-22-

To share data in a manner that ensures control on who will use it and forwhat purposes
To protect data from misappropriation and misuse
To refuse sharing of data
IP has nothing to do with data sharing
I don’t know / no opinion
Other
Please specify or explain
200 character(s) maximum

In almost all cases, contractual agreements are more relevant for B2B data sharing than the laws.

“Control over the accessibility and use of data should not be realised through theestablishment of additional layers of exclusive, proprietary rights”. To what extent
do you agree with this statement?
Strongly agree
Somewhat agree
NeutralSomewhat disagree
Strongly disagree
I don’t know / no opinion
Please explain
Consideringthemaximum
feature of value creation process from data, where many players add values through200
character(s)trading data, exclusive proprietary rights may increase complexity to deal with such rights owned bydifferent players and it may become new barriers for data utilization.

Questions on the Database Directive

Please select what describes you best
Maker of databases containing machine generated data
Maker of databases containing other type of data than machine generated
data
Maker of databases containing mixed type of data
User of databases containing machine generated data
User of databases containing other type of data than machine generated
data
User of databases containing mixed type of data
-23-

User-maker of databases containing machine generated data
User-maker of databases containing other type of data than machine
generated data
User-maker of databases containing mixed type of data
Other
Please specify

In your view, how does the Database Directive apply to machine generated data (inparticular data generated by sensor-equipped objects connected to the Internet-ofthings objects)?
I consider that the sui generis right under the Database Directive may apply
to databases containing those data and offers opportunity to regulate therelationship with clients, including licences
I consider that the sui generis right under the Database Directive may apply
to databases containing those data and offers protection against third-party
infringements (i.e. unauthorised use of machine generated data)
I am not sure what the relationship is between such data and the Database
Directive
Other
Please explain and substantiate your answers with concrete examples and any
useful information and experience you may have.
It 200is likelythat it is
not clear whether the sui generis right under the Database Directive Database apply
character(s)maximum
to machine generated data or not in the current law.
On the other hand, it will be necessary to carefully discuss whether to include machine generated data
into the scope of the sui generis right from the perspective of both protection and utilization of data.

According to your experience, which of these statements are relevant to youractivity / protection of your data?
The protection awarded by the sui generis right of the EU Database
Directive is used to regulate contractual relationships with clients
The protection awarded by the sui generis right of the EU Database
Directive is used against third-party infringements
The protection awarded by the Trade Secret Rights Directive [Directive (EU)2016/943] is used against third-party infringements
Other contractual means of protection are used-24-

Technical means to prevent illicit extraction of content are used
There is certain content that is deliberately not protected
I don’t know / no opinion
Other
Please explain and substantiate your answers with concrete examples and any
useful information and experience you may have.
200 character(s) maximum

Have the sui generis database right provided by the Database Directive (Directive
96/9/EC) or possible uncertainties with its application created difficulties andprevented you from seeking to access or use data?
YesNo
I don't know / no opinion
The difficulties you are aware of or have experienced because of the sui generis
database right relate to the access or use of:Data generated in the context of Internet-of-things/machine generated data
Data other than generated in the context of Internet-of-things/machine
generated data
Data, irrespective of their type (machine generated or data other thanmachine generated)
No difficulties experienced
I don’t know / no opinion
Other
Please specify
200 character(s) maximum

What was the source of such difficulties?
No difficulties experienced
Difficulty to find the right holder of the sui generis database right (databasemaker)-25-

Lack of reaction from the part of the right holder of the sui generis databaseright / Refusal of cooperation from the part of the right holder of the sui
generis database right
Prohibitive licence fees
Technical measures / technical difficulties
Denied access despite the proposed use falling under one of the exceptions
defined in the Database Directive
Denied access despite the proposed use falling under the rights of the lawfuluserLack of clarity regarding application of the sui generis right to the database(incl. possible legal consequences and risk of litigation)
Other
I don’t know / no opinion
Please explain and substantiate your answers with concrete examples and any
useful information and experience you may have. Please indicate how often you
have encountered these difficulties in the past 5 years.
200 character(s) maximum

To what extent do you agree that there is a need to review the sui generis
protection for databases provided by the Database Directive, in particular as
regards the access and sharing of data.
Strongly agree
Somewhat agree
NeutralSomewhat disagree
Strongly disagree
I don’t know / no opinion
Please explain and substantiate your answers with concrete examples and any
useful information and experience you may have.
200 character(s) maximum

Data is distributed globally. We afraid that the exclusive right of data to European-only will have a negative
impact on the distribution of data and the promotion of European industry.

-26-

Do you think that it is necessary to clarify the scope of sui generis right provided by
the Database Directive in particular in relation to the status of machine generated
data?
Yes
No
I don’t know / no opinion
Please explain and substantiate your answers with concrete examples and any
useful information and experience you may have.
character(s)maximumthe scope of the sui generis right can contribute to create a fair data economy by
We 200considerthat clarifying
ensuring access to and use of data.
Meanwhile it will be necessary to give careful consideration whether it is appropriate that we should expand
the scope of the sui generis right related to machine generated data beyond the current law and rules.

In your opinion, how should the new scope of the sui generis right be defined?
By narrowing the definition of the scope to exclude machine generated data
By explicitly including machine generated data in the scope
I don’t know / no opinion
No need for a change of the scope
Other
Please explain and substantiate your answer with concrete examples and any
useful information and experience you may have. If possible, indicate also theimpact on cost and potential benefits of your selected option.
200 character(s) maximum

Do you think that the Database Directive should provide specific access rules toensure access to data and prohibit companies from preventing access andextraction through contractual and technical measures?
Strongly agree
Somewhat agree
NeutralSomewhat disagree
Strongly disagree
I don’t know / no opinion-27-

In your opinion, how would specific access rules in the Database Directive be best
achieved?
Creating a new exception
Creating compulsory licences to access data
Creating general access rightNo need for a specific access rules
Other
I don’t know / no opinion
Please explain and substantiate your answers with concrete examples and any
useful information and experience you may have. If possible, indicate also theimpact on cost and potential benefits of your selected option.
We200
believethat there
is no need to strengthen the protection of data legally and that we can protect ourcharacter(s)maximum
data through appropriate contracting practices under the current laws.
On the other hand, if we review the laws from the perspective of the data user, there are several matters
we should consider to strike a right balance between the protection and utilization of data.

Do you agree that databases held by public authorities should be treated differently
than other type of databases under the Database Directive?
Strongly agree
Somewhat agree
NeutralSomewhat disagree
Strongly disagree
I don’t know / no opinion
In your opinion, how should databases held by public authorities be treateddifferently?
Creating an exception to the sui generis rightExcluding public sector databases from the scope of the sui generis right of
the Database Directive
Creating compulsory licences to access public sector databases
No need for different treatment
Other
I don’t know / no opinion
Please explain and substantiate your answers with concrete examples and any
useful information and experience you may have.
-28-

We agree that databases held by public authorities should be treated differently from other type of
databases
for ensuring
access to and use of government data as Public Domain.
200 character(s)maximum
However, we consider that, if databases held by public authorities contain companies- owned data, inthe deliberation process of data protection legislation and rules, it is necessary to fully incorporate
opinions of stakeholders so as not to harm enterprise business and benefit.

In 2018, the Commission published an Evaluation of Directive 96/9/EC on the legal
protection of databases, which was preceded by a public consultation. The
Evaluation Report pointed out several legal uncertainties related to the Database
Directive that may prevent the Directive from operating efficiently. Please indicate
which of the following elements of the Database Directive could be reviewed:
Definition of a database
Notion of substantial investment in a database
Notion of substantial part of a database
Exclusive rights of database makers
Exceptions to the sui generis right
Notion of the lawful user and his rights and obligations
Term of protection
No elements need to be reviewed
I don’t know/ no opinion
Other
Please explain and substantiate your answers with concrete examples and any
useful information and experience you may have. If possible, indicate also theimpact on cost and potential benefits of your selected option.
200 character(s) maximum

Please provide any other information that you find useful regarding the applicationof the Database Directive in relation to the data economy.
200 character(s) maximum

Questions about trade secrets protection
As indicated in the intellectual property action plan (COM(2020) 760 final), fostering data sharing requires asecure environment where businesses can keep investing in data generation and collection, while sharing
them in a secure way, in particular as regards their confidential business information and their trade secrets.
At EU level, the legal protection of trade secrets is harmonised by the Trade Secret Directive (Directive
2016/943), which has been transposed in all Member States and is not up for evaluation before 2026. It-29-

includes the definition of a trade secret, which means information meeting all of the following requirements:

it is secret in the sense that it is not, as a body or in the precise configuration and assembly of its
components, generally known among or readily accessible to persons within the circles that normallydeal with the kind of information in question;it has commercial value because it is secret;it has been subject to reasonable steps under the circumstances, by the person lawfully in control of
the information, to keep it secret.

The Directive defines cases of lawful and unlawful acquisition, use and disclosure of trade secrets. The
Directive also specifies the measures, procedures and remedies in case of unlawful acquisition, use or
disclosure of a trade secret. Exceptions to trade secret protection as well as the freedom to reverse
engineer are also included in the directive.

Do you rely on the legal protection of trade secrets when sharing data with otherbusinesses?
Yes
No
I don’t know / no opinion
With whom do you share?
Partner
Supplier
Customer
Unrelated business
Other
Please specify
200 character(s) maximum

How do you ensure that the shared information remains secret?
By contractual arrangements, e.g. a non-disclosure agreement
By using a trustee (a law firm or another trusted intermediary)
By means of a special cyber security solution that also ensuresconfidentiality, such as encryption
Other
No specific measures are taken-30-Please specify
200 character(s) maximum

Please indicate why
We are not certain whether the legal protection for trade secrets applies
We do not share commercially sensitive data with other businesses
We do not share any data with other businesses
I don’t know / no opinion
Other
Please specify
200 character(s) maximum

If you share confidential business information, how do you ensure control over theuse of your data by other businesses, i.e. that it is not misused, misappropriated ordisclosed unlawfully?
We rely on the legal protection of trade secrets
We rely on intellectual property rights
We rely on contractual arrangements
We rely on technical means
We do not take any specific measures to control the use of our data
I don’t know / no opinion
Other
Please specify which rights
200 character(s) maximum

If other, please specify
200 character(s) maximum

VIII. Safeguards for non-personal data in international contexts-31-Non-personal data generated by EU companies may be subject to access requests pursuant to provisionsof laws of third (non-EU/EEA) countries. This would be specifically relevant when processing of such data
occurs in a cloud computing service, the provider of which is subject to the laws of third countries. The
recent proposal for a Data Governance Act does not cover such services. The access requests can be of alegitimate nature, in particular for certain cross-border criminal law investigations or in the context ofadministrative procedures. In particular, these requests may be made in the framework of multilateral orbilateral agreements that determine certain conditions and safeguards. Whereas the GDPR provides forrules and safeguards in this respect, for non-personal data there are currently no statutory law rules thatwould oblige the cloud computing service providers to give precedence to EU law on the protection of IP
and trade secrets. There can be differences in approach between the EU and third countries, e.g. to thefundamental rights safeguards or on the scope of legislation that can mandate access requests to data forlaw enforcement and other legitimate purposes. Where conflicts of law occur, this may expose the cloudproviders to conflicting legal obligations and as a result of this conflict put commercially sensitive data of EU
companies at risk.

How likely do you think it is that a cloud computing service or other data processing
service provider that is processing data on your company’s/organisation’s behalf
may be subject to an order or request based on foreign legislation for the
mandatory transfers of your company/organisation data ?
This is a big risk for our company
This is a risk for our company
This is a minor risk for our company
This not a risk at all for our company
We do not use cloud computing/data processing service provider to store orprocess our company
I don’t know / no opinion
Please explain what order or request for the mandatory transfers of you company/
organization data would you consider as illegitimate or abusive and as suchpresenting the risk for your company:
200 character(s) maximum

Do you consider that such an order or request may lead to the disclosure and/ or
misappropriation of a trade secret or other confidential business information?
This is a big risk for our company
This is a risk for our company
This is a minor risk for our company
This not a risk at all for our company
I don’t know / no opinion-32-

Does the risk assessment related to such possible transfers of your company/organisation data to foreign authorities affect your decision on selection of the dataprocessing service providers (e.g. cloud computing service providers) that store orprocess your company/organisation data?
Yes
No
I do not use data processing services to store or process my data
I don’t know / no opinion
Please explain how it affects your decision
200 character(s) maximum

In light of risk assessment of your data processing operations as well as in thecontext of applicable EU and national legal frameworks (e.g. national requirements
to keep certain data in the EU/EEA), do you consider that your company/organisation data should be stored and otherwise processed:
All of my company/organization data in the EU/EEA only
Some of my company/organization data in the EU/EEA only
All of my company/organization data anywhere in the world
I don't know / no opinion
Please explain what categories of data that should be stored in the EU/EEA only
are concerned and why
200 character(s) maximum

In your opinion, what would be the best solution at an EU regulatory level tomitigate the risk for European companies stemming from the request for access byforeign jurisdiction authorities to their data?
Introducing an obligation for data processing service providers (e.g. cloudservice providers) to notify the business user every time they receive arequest for access to their data from foreign jurisdiction authorities, to theextent possible under the foreign law in question
Introducing an obligation for data processing service providers to notify to
the Commission, for publication on a dedicated EU Transparency Portal, all-33-

extraterritorial foreign laws to which they are subject and which enable
access to the data they store or process on behalf of their business users
Introducing an obligation for data processing service providers to put inplace specified legal, technical and organisational measures to prevent thetransfer to or access of foreign authorities to the data they store or process
on behalf of their business users, where such transfer or access would be inconflict with EU or national laws or applicable international agreements on
exchange of data
Providing for compatible rules at international level for such requests.
Other solution
There is no action needed to address this
I do not know / no opinion
Please specify
200 character(s) maximum

Closing section (possibility to upload a document, and to share final
comments)

Please upload your file
Only files of the type pdf,txt,doc,docx,odt,rtf are allowed

Final comments-34-