Council of theEuropean Union
Brussels, 24 September 2021
(OR. en)12124/21
Interinstitutional File:
2020/0340(COD)

LIMITETELECOM 347
COMPET 654
MI 691DATAPROTECT 222
JAI 1008
CODEC 1243

NOTE
From:
To:

Presidency
Permanent Representatives Committee

No. prev. doc.:
No. Cion doc.:

11599/21
13351/20

Subject:

Proposal for a Regulation of the European Parliament and of the Council
on European data governance (Data Governance Act)- Mandate for negotiations with the European ParliamentI.

INTRODUCTION
1.

The Commission adopted the proposal for a Regulation on European data governance(Data Governance Act, DGA) on 25 November 20201. It is the first of a set of measuresannounced by the Commission in the 2020 European strategy for data2.

12

doc. 13351/20.
COM/2020/66 final.

12124/21
TREE.2.B

RB/ek

1

LIMITEEN2.

The aim of the Commission proposal, based on Article 114 TFEU, is to foster theavailability of data for use in the economy by increasing trust in data intermediaries andby strengthening data-sharing mechanisms across the EU. More specifically, theinstrument addresses the following situations: i) making public sector data available forre-use, in situations where such data is subject to rights of others; ii) facilitating data
sharing among businesses, against remuneration; iii) allowing personal data to be usedwith the help of a ‘personal data-sharing intermediary’, designed to help individuals
exercise their rights under the General Data Protection Regulation (GDPR); and iv)
allowing data use on altruistic grounds.

3.

In the Council, the examination of the proposal has been carried out in the Working
Party on Telecommunications and Information Society (hereinafter: WP TELECOM).
WP TELECOM started discussing the proposal under the DE Presidency. The work
continued under the PT Presidency, with four compromise proposals presented andthoroughly discussed by the delegations. A progress report was presented to the TTE
Telecom Council on 4 June 2021.

4.

On 13 July the SI Presidency held a further discussion on the proposal in WP
TELECOM. Based on the outcome of this discussion and taking into account theadditional comments and drafting suggestions received from the delegations during thesummer, the SI Presidency prepared the fifth compromise text of the DGA, which was
thoroughly discussed and analysed by WP TELECOM on 14 September 2021.

5.

Based on the feedback received, and taking into consideration final written submissions
from the Member States, the Presidency has prepared the final compromise text,
attached to this document. The Presidency considers that it is a balanced proposal taking
into account the key concerns of the Member States. The Permanent Representatives
Committee is invited to endorse the attached document as a mandate for the
Presidency to start negotiations with the European Parliament.

12124/21
TREE.2.B

RB/ek

2

LIMITEEN6.

In Section II, the main changes made to the Commission proposal are explained, while
Section III details the changes made since the last WP TELECOM document (fifthcompromise text - doc. 11599/21). Changes in the document as compared with theCommission's proposal are marked as follows: new text is indicated with bold, anddeletions with strikethrough. Changes as compared with the fifth Presidency
compromise are underlined.

II.

MAIN CHANGES IN COMPARISON WITH THE COMMISSION PROPOSAL
The most important changes in the text enclosed in the Annex of this document ascompared to the proposal of the Commission concern the following areas:
1.

The relationship of the DGA with the GDPR: The relationship of the DGA with the
GDPR has been thoroughly clarified, in particular in Chapter I, with a clear delineation
additionally made throughout the whole text between situations where personal data isconcerned, and situations where non-personal data is meant. Furthermore, a reference tonational laws on the protection of personal data was added to reflect the fact that suchnational laws can be adopted under the GDPR, and it has been made explicit that the
DGA does not create a legal basis for the processing of personal data.

2.

Reuse of protected public sector data: A number of provisions regulating theadministrative aspects of the provision of protected public sector data for reuse havebeen modified in Chapter II, in order to ensure that there is more flexibility for theMember States regarding their internal administrative setups for supporting the public
sector bodies which allow the re-use of protected categories of data. An important
modification in this respect has been made in Article 5(6), and it provides that public
sector bodies are not obliged to provide assistance to potential re-users in seeking
consent or permission for re-use, but may choose to do so in certain cases.

12124/21
TREE.2.B

RB/ek

3

LIMITEEN

3.

Data intermediation services: As regards the novel services which are supposed tofacilitate data sharing in the economy, the relevant provisions have been modified toindicate more clearly which types of entities are in scope of the obligations laid down in
Chapter III of the DGA. More specifially, the definition of 'data intermediation
service' has been added in Article 2(2a), which makes it explicit that these new actors
do not share data themselves but only provide an intermediation service to entities
wishing to engage in data sharing. For further clarity on the scope, a non-exhaustive listof types of entities that are not considered to be data intermediation services for the
purposes of the DGA has been included in the respective recitals, together withextensive additions that are meant to provide more clarity on the key characteristics ofdifferent types of data intermediation services and their role in the data economy,
including in the context of the establishment of common European data spaces.

4.

Data altruism: As regards data altruism, the compromise text contains new provisionsin Chapter IV that encourage the Member Stares to develop organisational and/or
technical arrangements to facilitate data altruism at the national level, which may also
include the development of fully-fledged national policies on data altruism. Moreover,
the requirement that a structure through which a recognised data altruism organisation
performs the activities related to data altruism should be legally separate from its otheractivities has been replaced with the requirement for a functional separation. Finally,some important changes have been made to indicate that codes of conduct, developed inclose cooperation with data altruism organisations and relevant stakeholders, will be
adopted by the Commission through implementing acts, and that compliance with thosecodes will be a requirement for registration as a recognised data altruism organisation inaccordance with the DGA.

12124/21
TREE.2.B

RB/ek

4

LIMITEEN

5.

European Data Innovation Board: The provisions in Chapter VI concerning thestructure and tasks of the European Data Innovation Board (the EDIB) have been
modified to indicate that it should consist of at least one sub-group composed of thecompetent authorities and at least one sub-group responsible for technical discussions
on standardisation and interoperability. Moreover, it has also been clarified that one of
the tasks of the EDIB should be to facilitate the cooperation between national competentauthorities regarding international access and transfer of data.

6.

International access and transfers od data: As regards international access andtransfers of data, the text contains numerous amendments in Articles 5 and 30, whichclarify the interplay between the various safeguards that are meant to ensure that incases where certain types of data are transferred to third countries, they are afforded thesame level protection as in the EU. The main change in this respect concerns theintroduction of the possibility of adopting model contractual clauses by theCommission, through an implementing act, in Article 5(10aa). Such model contractual
clauses would support public sector bodies and re-users in their compliance withconditions for re-use set out in the DGA, in the case of transfers of public sector data
data to third countries.

III. DETAILED CHANGES IN COMPARISON WITH THE FIFTH PRESIDENCYCOMPROMISE (DOC. 11599/21)
1.

Scope and definitions (Chapter I)
a)

In Article 2(2a), which includes the definition of a 'data intermediation service', a
new point (d) has been added. It contains the provision which was previously
included in Article 14, clarifying that public sector bodies which offer data
sharing intermediation facilities on a non-commercial basis are not to beconsidered as data intermediation services. Furthermore, to ensure a clearer scope,
the element of ‘main objective’ has been incorporated into the definition. The
various elements of the definition have also been rearranged to further clarify its
intended meaning.

12124/21
TREE.2.B

RB/ek

5

LIMITE

EN

2.

Reuse of certain categories of protected data held by public sector bodies (Chapter
II)a)

In Article 5(5a) the words 'where appropriate' have been added to indicate that incases where the re-user is obliged to inform the legal persons whose rights may beaffected through an unauthorised re-use of non-personal data held by a public
sector body, the assistance of the public sector body may not always be required.

b)

In Article 5(8) a reference to 'statistical confidentiality' has been included toindicate that it should be considered in the same way as commercial
confidentiality when deciding on allowing the reuse of public sector data.

c)

In Article 5(8a) the words 'where appropriate' have been included to clarify thatthe assistance of the public sector body may not always be required in cases where
the re-user is obliged to inform the legal person whose rights and interests may beaffected of his intention to transfer protected non-personal data protected to a third
country.

d)

The changes in Article 8a(1) are meant to clarify that the Member States may
prescribe shorter time limits for processing request for reuse than those laid downin the DGA.

e)

The addition of the word 'directly' in Article 8a(2) is meant to narrow down thescope of application of the right of redress to only those natural or legal persons
that were directly affected by a decision of a public sector body or of thecompetent body with regard to a reuse request.

3.

Requirements applicable to data sharing services (Chapter III)a)

The addition of paragraph (7a) in Article 11, which provides that dataintermediation service providers should inform data holders in case of anunauthorised transfer, access or use of the non-personal data, is supposed tomirror a similar provision in Article 19(2c) pertaining to data altruism
organisations. Similarly, in paragraph (8) the word 'high' has been replaced with'appropriate' to ensure consistency with Article 19.

12124/21
TREE.2.B

RB/ek

6

LIMITEEN

4.

Other changesa)At the end of Recital 11 a reference to 'data holders' has been added to reflect thefact that public sector bodies may facilitate the re-use of both personal and nonpersonal data, on the basis of consent of data subjects or permissions of legal
persons.

b)

At the end of Recital 22 a reference to 'data subjects' was added in order to reflect
the fact that data intermediation services may also act as intermediaries for
personal data.

c)

A number of minor editorial adaptations have been made in Articles 5(3a) and(6), as well as in Recitals 16 and 18.

_______________________

12124/21
TREE.2.B

RB/ek

7

LIMITEEN

ANNEX

Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
on European data governance and amending Regulation (EU) No 2018/1724(Data Governance Act)

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114
thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Having regard to the opinion of the European Economic and Social Committee3,
Having regard to the opinion of the Committee of the Regions4,
Acting in accordance with the ordinary legislative procedure,
Whereas:(1)

The Treaty on the functioning of the European Union (‘TFEU’) provides for theestablishment of an internal market and the institution of a system ensuring that competitionin the internal market is not distorted. The establishment of common rules and practices in
the Member States relating to the development of a framework for data governance should
contribute to the achievement of those objectives.

3

OJ C , , p. .
OJ C , , p. .

412124/21
TREE.2.B

RB/ek

8

LIMITEEN

(2)Over the last few years, digital technologies have transformed the economy and society,affecting all sectors of activity and daily life. Data is at the centre of this transformation:
data-driven innovation will bring enormous benefits for citizens and the economy, forexample through improved personalised medicine, new mobility, and its contribution to theEuropean Green Deal5. In its Data Strategy6, the Commission described the vision of acommon European data space, a Single Market for data in which data could be usedirrespective of its physical location of storage in the Union in compliance with applicablelaw. It also called for the free and safe flow of data with third countries, subject to
exceptions and restrictions for public security, public order and other legitimate public
policy objectives of the European Union, in line with international obligations. In order toturn that vision into reality, it proposes to establish domain-specific common European data
spaces, as the concrete arrangements in which data sharing and data pooling can happen. As
foreseen in that strategy, such common European data spaces can cover areas such as health,mobility, manufacturing, financial services, energy, or agriculture or thematic areas, such as
the European green deal or European data spaces for public administration or skills, as well
as a combination of these areas, e.g. energy and climate.

5

Communication from the Commission to the European Parliament, the European Council, the Council, theEuropean Economic and Social Committee and the Committee of the Regions on the European Green Deal.
Brussels, 11.12.2019. (COM(2019) 640 final)
COM (2020) 66 final.

612124/21
TREE.2.B

RB/ek

9

LIMITEEN

(3)It is necessary to improve the conditions for data sharing in the internal market, by creating aharmonised framework for data exchanges and laying down certain basic requirements
for data governance. Sector-specific legislation can develop, adapt and propose new andcomplementary elements, depending on the specificities of the sector, such as the envisaged
legislation on the European health data space7 and on access to vehicle data. Moreover,certain sectors of the economy are already regulated by sector-specific Union law that
include rules relating to cross-border or Union wide sharing or access to data8. This
Regulation is should therefore be without prejudice to Regulation (EU) 2016/679 of theEuropean Parliament and of the Council (9), and in particular the implementation of thisRegulation shall not prevent cross border transfers of data in accordance with Chapter V ofRegulation (EU) 2016/679 from taking place, Directive (EU) 2016/680 of the European
Parliament and of the Council (10), Directive (EU) 2016/943 of the European Parliament andof the Council (11), Regulation (EU) 2018/1807 of the European Parliament and of theCouncil (12), Regulation (EC) No 223/2009 of the European Parliament and of the Council(13), Directive 2000/31/EC of the European Parliament and of the Council (14), Directive
2001/29/EC of the European Parliament and of the Council (15), Directive (EU) 2019/790 of
the European Parliament and of the Council (16), Directive 2004/48/EC of the European

7

See: Annexes to the Communication from the Commission to the European Parliament, the Council, theEuropean Economic and Social Committee and the Committee of the Regions on Commission Work
Programme 2021 (COM(2020) 690 final).
For example, Directive 2011/24/EU in the context of the European Health Data Space, andrelevanttransport legislation such as Directive 2010/40/EU, Regulation 2019/1239 andRegulation (EU)2020/1056, in the context of the European Mobility Data Space.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protectionof natural persons with regard to the processing of personal data and on the free movement of such data, andrepealing Directive 95/46/EC (General Data Protection Regulation), (OJ L 119, 4.5.2016, p.1)
Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection ofnatural persons with regard to the processing of personal data by competent authorities for the purposes of theprevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties,
and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA. (OJ L 119,4.5.2016, p.89)
Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection ofundisclosed know-how and business information (trade secrets) against their unlawful acquisition, use anddisclosure. (OJ L 157, 15.6.2016, p.1)
Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on aframework for the free flow of non-personal data in the European Union. (OJ L 303, 28.11.2018, p. 59)
Regulation (EC) No 223/2009 of the European Parliament and of the Council of 11 March 2009 on European
statistics and repealing Regulation (EC, Euratom) No 1101/2008 of the European Parliament and of theCouncil on the transmission of data subject to statistical confidentiality to the Statistical Office of the European
Communities, Council Regulation (EC) No 322/97 on Community Statistics, and Council Decision
89/382/EEC, Euratom establishing a Committee on the Statistical Programmes of the European Communities.
(OJ L 87, 31.03.2009, p. 164)
Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000, on certain legal aspects
of information society services, in particular electronic commerce, in the Internal Market (Directive onelectronic commerce). (OJ L 178, 17.07.2000, p. 1)
Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation ofcertain aspects of copyright and related rights in the information society. (OJ L 167, 22.6.2001, p. 10)
Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright andrelated rights in the Digital Single Market and amending Directives 96/9/EC and 2001/29/EC. (OJ L 130,17.5.2019, p. 92)

8

9

10

11

12
13

14

15
16

12124/21
TREE.2.B

RB/ek

10

LIMITEEN

Parliament and of the Council (17), Directive (EU) 2019/1024 of the European Parliamentand of the Council (18), as well as Regulation 2018/858/EU of the European Parliament andof the Council (19), Directive 2010/40/EU of the European Parliament and of the Council (20)and Delegated Regulations adopted on its basis, Directive 2007/2/EC of the European
Parliament and of the Council21, Directive (EU) 2017/1132 of the European Parliamentand of the Council22, Directive (EU) 2015/849 of the European Parliament and of theCouncil23 and any other sector-specific Union legislation that organises the access to and reuse of data. This Regulation should be without prejudice to Union and national law on theaccess and use of data for the purpose of international cooperation in the context ofprevention, investigation, detection or prosecution of criminal offences or the execution of
criminal penalties, as well as international cooperation in this context. This Regulation
should be without prejudice to the competences of the Member States regarding
activities concerning public security, defence and national security. Re-use of dataprotected for such reasons and held by public sector bodies is should not be covered bythis Regulation. This should include data from procurement procedures falling within
the scope of Directive 2009/81/EC. A horizontal regime for the re-use of certain categories
of protected data held by public sector bodies, the provision of data sharing intermediation
services and of services based on data altruism in the Union should be established. Specificcharacteristics of different sectors may require the design of sectoral data-based systems,
while building on the requirements of this Regulation. Where a sector-specific Union legal
act requires public sector bodies, providers of data sharing intermediation services orregistered entities providing data altruism services to comply with specific additional
technical, administrative or organisational requirements, including through an authorisationor certification regime, those provisions of that sector-specific Union legal act should also
apply.

17
18
19

20

21

22
23

Directive 2004/48/EC of the European Parliament and of the Council of 29 April 2004 on the enforcement ofintellectual property rights. (OJ L 157, 30.4.2004).
Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and there-use of public sector information. (OJ L 172, 26.6.2019, p. 56).
Regulation (EU) 2018/858 of the European Parliament and of the Council of 30 May 2018 on the approval andmarket surveillance of motor vehicles and their trailers, and of systems, components and separate technicalunits intended for such vehicles, amending Regulations (EC) No 715/2007 and (EC) No 595/2009 andrepealing Directive 2007/46/EC (OJ L 151, 14.6.2018).
Directive 2010/40/EU of the European Parliament and of the Council of 7 July 2010 on the framework for the
deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modesof transport. (OJ L 207, 6.8.2010, p. 1)
Directive 2007/2/EC of the European Parliament and of the Council of 14 March 2007 establishing an
Infrastructure for Spatial Information in the European Community (INSPIRE) (OJ L 108, 25.4.2007, p.
1).
Directive (EU) 2017/1132 of the European Parliament and of the Council of 14 June 2017 relating tocertain aspects of company law (OJ L 169, 30.6.2017, p. 46).
Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on theprevention of the use of the financial system for the purposes of money laundering or terrorist financing,
amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing
Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive
2006/70.

12124/21
TREE.2.B

RB/ek

11

LIMITEEN

(3a)This Regulation is should be without prejudice to Regulation (EU) 2016/679 of theEuropean Parliament and of the Council, to Directive 2002/58/EC of the European
Parliament and of the Council and Directive (EU) 2016/680 of the European
Parliament and of the Council (24). This Regulation should in particular not be read as
creating a new legal basis for the processing of personal data for any of the regulated
activities, or as modifying information requirements under Regulation (EU) 2016/679.
Its implementation should not prevent cross-border transfers of data in accordancewith Chapter V of Regulation (EU) 2016/679 from taking place. In the event of conflict
between the provisions of this Regulation and Union law or national law on theprotection of personal data, the latter should prevail. Data protection authorities may
be should be able to be competent authorities under this Regulation. Where otherorganisations function as competent authorities under this Regulation, it should be
without prejudice to the supervisory powers and competences of data protection
authorities under Regulation (EU) 2016/679. Where personal and non-personal data ina data set are inextricably linked, this Regulation should not prejudice the applicationof Regulation (EU) 2016/679.

(4)

Action at Union level is necessary to increase trust in data sharing by establishingproper mechanisms for control by data subjects and data holders over the data that
relates to them and in order to address the other barriers to a well-functioning data-driven
economy and to create a Union-wide governance framework for data access, control anduse, in particular regarding the re-use of certain types of data held by the public sector, theprovision of services by data sharing intermediation service providers to business users andto data subjects, as well as the collection and processing of data made available for altruistic
purposes by natural and legal persons. This action is should be without prejudice toobligations and commitments in the international trade agreements concluded by theUnion.

24

Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on theprotection of natural persons with regard to the processing of personal data by competent authorities
for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, and on the free movement of such data, and repealing Council
Framework Decision 2008/977/JHA. (OJ L 119, 4.5.2016, p. 89)

12124/21
TREE.2.B

RB/ek

12

LIMITEEN

(5)The idea that data that has been generated or collected by public sector bodies or otherentities generated at the expense of public budgets should benefit society has been part ofUnion policy for a long time. Directive (EU) 2019/1024 as well as sector-specific legislation
ensure that the public sector makes more of the data it produces easily available for use andre-use. However, certain categories of data (commercially confidential data, data subject tostatistical confidentiality, data protected by intellectual property rights of third parties,
including trade secrets and personal data not accessible on the basis of specific national orUnion legislation, such as Regulation (EU) 2016/679 and Directive (EU) 2016/680) in
public databases is often not made available, not even for research or innovative activities.
Due to the sensitivity of this data, certain technical and legal procedural requirements must
be met before they are made available, in order to ensure the respect of rights others haveover such data. Such requirements are usually time- and knowledge-intensive to fulfil. This
has led to the underutilisation of such data. While some Member States are setting up
structures, processes and sometimes legislate to facilitate this type of re-use, this is not thecase across the Union.

(6)

There are techniques enabling privacy-friendly analyses on databases that contain personaldata, such as anonymisation, pseudonymisation, differential privacy, generalisation, or
suppression, and randomisation, use of synthetic data or other such methods. Applicationof these privacy-enhancing technologies, together with comprehensive data protection
approaches, in line with the rules on personal data processing, should ensure the safe reuse of certain categories of protected data, for example personal data and commerciallyconfidential business data for research, innovation and statistical purposes. In many cases
this implies that the data use and re-use in this context can only be done in a secure
processing environment set in place and supervised by the public sector. There is experienceat Union level with such secure processing environments that are used for research on
statistical microdata on the basis of Commission Regulation (EU) 557/2013 (25). The public
sector body should be able to impose a condition whereby the re-use is restricted tomachine-processing of data or to processing with limited human involvement. In
general, Iinsofar as personal data are concerned, the processing of personal data should rely
upon one or more of the grounds for processing provided in Articles 6 and 9 of Regulation(EU) 2016/679.

25

Commission Regulation (EU) 557/2013 of 17 June 2013 implementing Regulation (EC) No 223/2009 of theEuropean Parliament and of the Council on European Statistics as regards access to confidential data forscientific purposes and repealing Commission Regulation (EC) No 831/2002 (OJ L 164, 18.6.2013, p. 16).

12124/21
TREE.2.B

RB/ek

13

LIMITEEN(7)The categories of data held by public sector bodies which should be subject to re-use under
this Regulation fall outside the scope of Directive (EU) 2019/1024 that excludes data which
is not accessible due to commercial and statistical confidentiality and data that is included
in works or other subject matter over for which third parties have intellectual property
rights. Commercially confidential data includes data protected by trade secrets,
protected know-how and any other information the undue disclosure of which would
have an impact on the market position or financial health of the business. This
Regulation should apply to pPersonal data that fall outside the scope of Directive (EU)2019/1024 insofar as the access regime excludes or restricts access to such data for reasonsof data protection, privacy and the integrity of the individual, in particular in accordancewith data protection rules. The re-use of data, which may contain trade secrets, should takeplace without prejudice to Directive (EU) 2016/94326, which sets the framework for the
lawful acquisition, use or disclosure of trade secrets. This Regulation should not create an
obligation to allow re-use of public sector data. In particular, each Member Stateshould therefore be able to decide whether data is made accessible for re-use, also interms of the purposes and scope of such access. This RegulationIt should be is without
prejudice and complementary to more specific obligations on public sector bodies to allow
re-use of data laid down in sector-specific Union or national law. Public access to official
documents may be considered to be in the public interest. Taking into account the roleof public access to official documents and transparency in a democratic society, thisRegulation is also without prejudice to national law on granting access to anddisclosing official documents. Access to official documents may in particular be
granted in accordance with national law without imposing specific conditions or by
imposing specific conditions that are not provided by this Regulation.

26

OJ L 157, 15.6.2016, p. 1–18.

12124/21
TREE.2.B

RB/ek

14

LIMITEEN

(8)The re-use regime provided for in this Regulation should apply to data the supply of whichforms part of the public tasks of the public sector bodies concerned, as defined by law or byother binding rules in the Member States. In the absence of such rules the public tasks
should be defined in accordance with common administrative practice in the Member States,
provided that the scope of the public tasks is transparent and subject to review. The publictasks could be defined generally or on a case-by-case basis for individual public sector
bodies. As public undertakings are not covered by the definition of public sector body, thedata they hold should not be subject to this Regulation. Data held by cultural
establishments, such as libraries, archives and museums, as well as orchestras, operas,ballets, and theatres, and educational establishments, for which intellectual property rights
are not incidental, but which are predominantly contained in works and other documents
protected by such intellectual property rights, should not be are not covered by thisRegulation since the works and other documents they hold are predominantly coveredby third party intellectual property rights. Research performing organisations andresearch funding organisations could also be organised as public sector bodies and/or
bodies governed by public law. This Regulation should apply to such hybridorganisations only in their capacity as research performing organisations. If such a
research performing organisation holds data as a part of a specific public-private
association with private sector organisations or other public bodies, bodies governedby public law or hybrid research performing organisations (i.e. organised as bothpublic sector bodies or public undertakings) with the main purpose of pursuingresearch, these data should also not be covered by this Regulation. Where relevant,Member States should be able to apply the requirements of this Regulation to public
undertakings or private undertakings, such as those that exercise public sector duties
or provide services of general interest. The exchange of data among public sector
bodies, or between public sector bodies and public sector bodies in third countries orinternational organizations, purely in pursuit of their public tasks, including theexchange of data between researchers for non-commercial scientific research purposes,
should not be subject to the provisions of this Regulation concerning the re-use ofcertain categories of protected data held by public sector bodies.

12124/21
TREE.2.B

RB/ek

15

LIMITEEN

(9)Public sector bodies should comply with competition law when establishing the principles
for re-use of data they hold, avoiding as far as possible the conclusion of agreements, whichmight have as their objective or effect the creation of exclusive rights for the re-use ofcertain data. Such agreement should be only possible when justified and necessary for theprovision of a service of general interest. This may be the case when exclusive use of thedata is the only way to maximise the societal benefits of the data in question, for example
where there is only one entity (which has specialised in the processing of a specific dataset)capable of delivering the service or the product which allows the public sector body toprovide an advanced digital service in the general interest. Such arrangements should,
however, be concluded in compliance with public procurement rules and be subject toregular review based on a market analysis in order to ascertain whether such exclusivity
continues to be necessary. In addition, such arrangements should comply with the relevant
State aid rules, as appropriate, and should be concluded for a limited period, which should
not exceed three years. In order to ensure transparency, such exclusive agreements should be
published online, in a form that is in accordance with Union law on public procurement,
where relevant. regardless of a possible publication of an award of a public procurement
contract. Where an exclusive right to re-use data does not meet the conditions set out inthis Regulation, the exclusive right should be invalid.

(10)

Prohibited exclusive agreements and other practices or arrangements between data subjects
and data holders on the one hand, and data re-users on the other hand, which do not
expressly grant exclusive rights but which can reasonably be expected to restrict theavailability of data for re-use that have been concluded or have been already in place before
the entry into force of this Regulation should not be renewed after the expiration of theirterm. In the case of indefinite or longer-term agreements, they should be terminated within
three years from the date of entry into force of this Regulation.

12124/21
TREE.2.B

RB/ek

16

LIMITEEN

(11)Conditions for re-use of protected data that apply to public sector bodies, which aredesignated as competent under national law to allow re-use, and which should be without
prejudice to rights or obligations concerning access to such data, should be laid down. Thoseconditions should be non-discriminatory, proportionate and objectively justified, while not
restricting competition. The conditions for re-use should be designed in a mannerpromoting scientific research, e.g. privileging research should be considered nondiscriminatory. In particular, Ppublic sector bodies allowing re-use should have in place
the technical means necessary to ensure the protection of rights and interests of third parties.
Conditions attached to the re-use of data should be limited to what is necessary to preserve
the rights and interests of others in the data and the integrity of the information technology
and communication systems of the public sector bodies. Public sector bodies should apply
conditions which best serve the interests of the re-user without leading to a disproportionate
effort burden for the public sector. Depending on the case at hand, before its transmission,
personal data should be fully anonymised, so as to definitively not allow the identification of
the data subjects, or data containing commercially confidential information modified in sucha way that no confidential information is disclosed. Where provision of anonymised or
modified data would not respond to the needs of the re-user Alternatively, on-premise or
remote re-use of the data, for example pseudonymised data, within a secure processing
environment could be permitted. Data analyses in such secure processing environments
should be supervised by the public sector body, so as to protect the rights and interests ofothers. In particular, personal data should only be transmitted for re-use to a third party
where a legal basis under data protection legislation allows such transmission. Thisshould also apply to pseudonymised data which remain personal data within themeaning of Regulation (EU) 2016/679. In the event of reidentification of data subjects,
the obligation to notify such a data breach to the public sector body should apply in
addition to the obligation to notify such a data breach to a supervisory authority and to
the data subject in accordance with Regulation (EU) 2016/679. The public sector body
could make the use of such secure processing environment conditional on the signature by
the re-user of a confidentiality agreement that prohibits the disclosure of any informationthat jeopardises the rights and interests of third parties that the re-user may have acquired
despite the safeguards put in place. The public sector bodies, where relevant, should
facilitate the re-use of data on the basis of consent of data subjects or permissions of legal
persons on the re-use of data pertaining to them through adequate technical means. In thisrespect, the public sector body should could support provide assistance to potential re-users
in seeking such consent by establishing technical mechanisms that permit transmitting
requests for consent from re-users, where practically feasible. No contact information should
be given that allows re-users to contact data subjects or data holders companies directly.
When transmitting the request to consent, the public sector body should ensure thatthe data subject is clearly informed of the possibility to refuse such a request.

12124/21
TREE.2.B

RB/ek

17

LIMITEEN

(12) The intellectual property rights of third parties should not be affected by this Regulation. This
Regulation should neither affect the existence or ownership of intellectual property rights ofpublic sector bodies, nor should it limit the exercise of these rights in any way beyond theboundaries set by this Regulation. The obligations imposed in accordance with thisRegulation should apply only insofar as they are compatible with international agreements on
the protection of intellectual property rights, in particular the Berne Convention for theProtection of Literary and Artistic Works (Berne Convention), the Agreement on TradeRelated Aspects of Intellectual Property Rights (TRIPS Agreement) and the WIPO CopyrightTreaty (WCT) and Union or national law governing intellectual property. Public sector
bodies should, however, exercise their copyright in a way that facilitates re-use.
(13)

Data subject to intellectual property rights as well as trade secrets should only be transmitted
to a third party where such transmission is lawful by virtue of Union or national law or withthe agreement of the rightholder. Where public sector bodies are holders of the rightprovided for in Article 7(1) of Directive 96/9/EC of the European Parliament and of theCouncil (27) they should not exercise that right in order to prevent the re-use of data or to
restrict re-use beyond the limits set by this Regulation.

(14)

Companies and data subjects should be able to trust that the re-use of certain categories ofprotected data, which are held by the public sector, will take place in a manner that respects
their rights and interests. Additional safeguards should thus be put in place for situations inwhich the re-use of such public sector data is taking place on the basis of a processing of thedata outside the public sector. Such an additional safeguard could be found in therequirement that public sector bodies should take fully into account the rights and interestsof natural and legal persons (in particular the protection of personal data, commerciallysensitive data and the protection of intellectual property rights) in case such data istransferred to third countries.

(15)

Furthermore, it is important to safeguard protected commercially sensitive data of nonpersonal nature, notably trade secrets, but also non-personal data representing content
protected by intellectual property rights from unlawful access that may lead to IP theft orindustrial espionage. In order to ensure the protection of fundamental rights or interests ofdata subjects and data holders, non-personal data which is to be protected from unlawful or
unauthorised access under Union or national law, and which is held by public sector bodies,should can be transferred only to third-countries only when where appropriate safeguards
for the use of data are provided. Such appropriate safeguards should include the public
sector body only transmitting protected data to a re-user, if the re-user undertakes
obligations in the interest of the protection of the data. The re-user that intends totransfer the data to such third country should commit to comply with the obligations
laid out in this Regulation even after the data has been transferred to the third
country. To ensure the proper enforcement of such obligations, the re-user should also
accept the jurisdiction of the Member State of the public sector body that allowed there-use for the judicial settlement of disputes. In addition, the public sector body andthe re-user may rely on model contractual clauses adopted by the Commission.

27

Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of
databases (OJ L 77, 27.3.1996, p. 20).

12124/21
TREE.2.B

RB/ek

18

LIMITEEN

(16)Appropriate safeguards should also be considered to exist be implemented when in thatthird-country there are equivalent measures in place which ensure that non-personal data
benefits from a level of protection similar to that applicable by means of Union or nationallaw in particular as regards the protection of trade secrets and the protection of intellectual
property rights. To that end, the Commission may adopt implementing acts, when justified
by a substantial number of requests, across the Union, concerning the re-use of nonpersonal data in specific third countries, that declare that a third country provides a levelof protection that is essentially equivalent to those provided by Union or national law. The
Commission should assess the necessity of the adoption of such implementing acts
based on the information provided by the Member States through the European Data
Innovation Board. Such implementing acts would reassure public sector bodies that reuse of publicly held data in the concerned third-country would not compromise theprotected nature of the data. The assessment of the level of protection afforded in suchthird-country should, in particular, take into consideration the relevant legislation, bothgeneral and sectoral, including on concerning public security, defence, national security andcriminal law concerning the access to and protection of non-personal data, any access by the
public authorities of that third country to the data transferred, the existence and effectivefunctioning of one or more independent supervisory authorities in the third country withresponsibility for ensuring and enforcing compliance with the legal regime ensuring accessto such data, or the third countries’ international commitments regarding the protection ofdata the third country concerned has entered into, or other obligations arising from legallybinding conventions or instruments as well as from its participation in multilateral orregional systems. The existence of effective legal remedies for data holders subjects anddata holders, public sector bodies or data sharing intermediation service providers in thethird country concerned is of particular importance in the context of the transfer of nonpersonal data to that third country. Such safeguards should therefore include the availabilityof enforceable rights and of effective legal remedies. Such implementing acts are without
prejudice to any legal obligation or contractual arrangements already undertaken by are-user in the interest of the protection of non-personal data, in particular industrial
data, and to the public sector bodies' right to oblige re-users to comply with conditions
for re-use, in accordance with this Regulation.

(16)

In cases where there is no implementing act adopted by the Commission in relation to a third
country declaring that it provides a level of protection, in particular as regards the protectionof commercially sensitive data and the protection of intellectual property rights, which isessentially equivalent to that provided by Union or national law, the public sector bodyshould only transmit protected data to a re-user, if the re-user undertakes obligations in theinterest of the protection of the data. The re-user that intends to transfer the data to suchthird country should commit to comply with the obligations laid out in this Regulation evenafter the data has been transferred to the third country. To ensure the proper enforcement ofsuch obligations, the re-user should also accept the jurisdiction of the Member State of the
public sector body that allowed the re-use for the judicial settlement of disputes.

12124/21
TREE.2.B

RB/ek

19

LIMITEEN

(17)Some third countries adopt laws, regulations and other legal acts which aim at directlytransferring or providing governmental access to non-personal data in the Union under thecontrol of natural and legal persons under the jurisdiction of the Member States. Judgmentsof courts or tribunals or decisions of administrative authorities in third countries requiringsuch transfer or access to non-personal data should be enforceable when based on aninternational agreement, such as a mutual legal assistance treaty, in force between therequesting third country and the Union or a Member State. In some cases, situations may
arise where the obligation to transfer or provide access to non-personal data arising from athird country law conflicts with a competing obligation to protect such data under Union or
national law, in particular as regards the protection of fundamental rights of theindividual or the fundamental interests of a Member State related to national security
or defence, the protection of commercially sensitive data and the protection of intellectual
property rights, and including its contractual undertakings regarding confidentiality inaccordance with such law. In the absence of international agreements regulating suchmatters, transfer or access should only be allowed under certain conditions, in particularafter verifying that the third-country’s legal system requires the reasons and proportionalityof the decision to be set out, that the court order or the decision is specific in character, andthe reasoned objection of the addressee is subject to a review by a competent court in thethird country, which is empowered to take duly into account the relevant legal interests ofthe provider of such data. Moreover, public sector bodies, natural or legal persons towhich the right to re-use data was granted, data intermediation service providers andentities entered in the register of recognised data altruism organisations should ensure,when signing contractual agreements with other private parties, that non-personal
data held in the Union are only accessed in or transferred to third countries incompliance with the law of the Union or the law of the relevant Member State.

(18)

In order to prevent unlawful access to non-personal data, public sector bodies, natural or
legal persons to which the right to re-use data was granted, data sharing providers andentities entered in the register of recognised data altruism organisations should take allreasonable measures to prevent access to the systems where non-personal data is stored,
including encryption of data or corporate policies.

12124/21
TREE.2.B

RB/ek

20

LIMITEEN

(18a) To foster further trust in the data economy of the Union, it is essential that thesafeguards in relation to Union citizens, the public sector and businesses that ensurethat control over their strategic and sensitive data are respected implemented and that
Union law, values and standards are upheld in terms of , but not limited to, security,
data protection and consumer protection. In order to prevent unlawful access to nonpersonal data, public sector bodies, natural or legal persons to which the right to re-use
data was granted, data intermediation service providers and entities entered in anational register of recognised data altruism organisations should take all reasonablemeasures to prevent access to the systems where non-personal data is stored, including
encryption of data or corporate policies. To these ends, it has to be ensured that public
sector bodies, natural or legal persons to which the right to re-use data was granted,
data intermediation service providers and entities entered in the register of recognizeddata altruism organisations should adhere to all relevant technical standards, codes ofconduct and certifications at Union level.
(19)

In order to build trust in re-use mechanisms, it may be necessary to attach stricter conditions
for certain types of non-personal data that may be have been identified as highly sensitive infuture specific Union acts adopted in accordance with a legislative procedure, as
regards the transfer to third countries, if such transfer could jeopardise public policy
objectives, in line with international commitments. For example, in the health domain,certain datasets held by actors in the public health system, such as public hospitals, could be
identified as highly sensitive health data. Other relevant sectors could be transport,
energy, environment and finance. In order to ensure harmonised practices across theUnion, such types of highly sensitive non-personal public data should be defined by Union
law, for example in the context of the European Health Data Space or other sectoral
legislation. The conditions attached to the transfer of such data to third countries should belaid down in delegated implementing acts. Conditions should be proportionate, nondiscriminatory and necessary to protect legitimate public policy objectives identified, suchas the protection of public health, public order, safety, the environment, public morals,
consumer protection, privacy and personal data protection. The conditions should
correspond to the risks identified in relation to the sensitivity of such data, including interms of the risk of the re-identification of individuals. These conditions could include terms
applicable for the transfer or technical arrangements, such as the requirement of using asecure processing environment, limitations as regards the re-use of data in third-countries or
categories of persons which are entitled to transfer such data to third countries or who canaccess the data in the third country. In exceptional cases they could also include restrictions
on transfer of the data to third countries to protect the public interest.

12124/21
TREE.2.B

RB/ek

21

LIMITEEN

(20)Public sector bodies should be able to charge fees for the re-use of data but should also beable to decide to make the data available allow re-use at lower or no cost, for example forcertain categories of re-uses such as non-commercial re-use, for scientific research
purposes, or re-use by small and medium-sized enterprises, so as to incentivise such re-use
in order to stimulate research and innovation and support companies that are an importantsource of innovation and typically find it more difficult to collect relevant data themselves,in line with State aid rules. In this specific context, scientific research purposes should beunderstood to include any type of research related purpose regardless of theorganizational or financial structure of the research institution in question, with the
exception of research that is being conducted by a company aiming exclusively at thedevelopment, enhancement or optimisation of products or services. Such fees should bereasonable, transparent, published online and non-discriminatory.

(21)

In order to incentivise the re-use of these categories of data, Member States should establish
a single information point to act as the primary an interface for re-users that seek to re-use
such data held by the public sector bodies. It should have a cross-sector remit, and should
complement, if necessary, arrangements at the sectoral level. The single information pointshould be able to rely on automated means when transmitting enquiries or requests forthe re-use. Sufficient human oversight should be ensured in the transmission process.
Already existing practical arrangements such as Open Data Portals could be used forthis purpose. It should have an asset list containing all available data sources,
including, where relevant, those available at sectoral, regional and local information
points, with relevant information describing the data. In addition, Member States should
designate, establish or facilitate the establishment of competent bodies to support theactivities of public sector bodies allowing re-use of certain categories of protected data.
Their tasks may include granting access to data, where mandated in sectoral Union orMember States legislation. Those competent bodies should provide support to public sector
bodies with state-of-the-art techniques, including secure data processing environments,
which allow data analysis in a manner that preserves the privacy of the information and act
in accordance with the instructions received from the public sector body. Such support
structure could support the data holders subjects and data holders with management of theconsent or permission to re-use, including consent to certain areas of scientific researchwhen in keeping with recognised ethical standards for scientific research. The competentbodies should not have a supervisory function, which is reserved for supervisory
authorities under Regulation (EU) 2016/679. Without prejudice to the supervisory
powers of data protection authorities, dData processing should be performed under the
responsibility of the public sector body responsible for the register containing the data, who
remains a data controller in the sense within the meaning of Regulation (EU) 2016/679
insofar as personal data are concerned. Member States may have in place one or several
competent bodies, which could act in different sectors. Internal services of public sector
bodies could act as competent bodies. A competent body can be a public sector bodysupporting other public sector bodies in allowing re-use of data, where relevant, or apublic sector body allowing re-use itself. Supporting other public sector bodies entails
informing them, upon request, about best practices on how to fulfil the requirements
established by this Regulation such as the technical means to make a secure processing
environment available or the technical means to ensure privacy and confidentiality
when providing access to data within the scope of this Regulation.

12124/21
TREE.2.B

RB/ek

22

LIMITEEN

(22)Providers of data sharing intermediation services (data intermediaries) are expected to playa key role in the data economy, in particular in supporting and promoting voluntary
data sharing practices between companies or facilitating data sharing obligations set
by Union or national law. They could become a as a tool to facilitate the aggregation andexchange of substantial amounts of relevant data. Data intermediaries offering services thatconnect the different actors have the potential to contribute to the efficient pooling of data as
well as to the facilitation of bilateral data sharing. Specialised data intermediaries that are
independent from both data subjects and data holders, and from data users, can could havea facilitating role in the emergence of new data-driven ecosystems independent from any
player with a significant degree of market power. This will be particularly important in
the context of the establishment of common European data spaces. Such data spaces
could require an entity to structure and organise (‘orchestrate’) such data spaces. Dataintermediation services could include inter alia bilateral or multilateral sharing of dataor the creation of platforms or databases enabling the sharing or joint use of data, as
well as the establishment of a specific infrastructure for the interconnection of dataholders, data subjects and data users.

(22a) This Regulation should only cover entities that provide information society services
within the meaning of Article 1(1)b) of Directive (EU) 2015/1535 and which providers ofdata sharing services that have as a main objective the establishment of a direct legal or
business, a or legal and/or potentially also technical relationships, or both, relation
between data holders, including data subjects and data holders, on the one hand, andpotential users on the other hand, and assist both parties in a transaction of data assets
between the two. This would include, inter alia, data marketplaces on which companies
could publish information on data the use of which they would be willing to license toothers, ecosystem orchestrators that ensure the proper functioning of data sharing
ecosystems that are open to all interested parties, for instance in the context of common
European data spaces, as well as data pools established jointly by several companies
with the intention to license the use of such pool to all interested parties in a mannerthat all companies contributing to the pool would receive direct reward for theircontribution to the pool. This would exclude service providers that obtain data fromdata subjects and data holders, aggregate, enrich or transform the data and licence theuse of the resulting data to data users, without establishing a direct legal or business
relationship between data subjects and data holders, on the one hand, and data users
on the other hand, for example advertisement or data brokers, data consultancies,
providers of data products resulting from value added to the data by the service
provider. It This Regulation should only cover services aiming at intermediating between
an indefinite undefined number of data subjects and data holders, on the one hand,
holders and data users on the other hand, inter alia situations where the dataintermediation service is provided to all interested parties. This would be excluding data
sharing intermediation services that are meant to be used by a closed group of data
subjects and data holders, and users, i.e. a situation where a data sharing service was set
up for a definite number of data subjects, data holders and data users, and access tosuch service is dependent on the agreement by the members of the group. In suchclosed arrangements, there is sufficient trust of the parties in the service provider thatis used for the sharing of data. The provision of cloud infrastructure, or of data sharing
software, the provision of web browsers or browser plug-ins, or an email service should
not be considered data intermediation services in the sense of this Regulation as suchservices only provide technical tools for data subjects or data holders to share datawith others, but are neither aiming to establish a direct legal or business relationship12124/21
TREE.2.B

RB/ek

23

LIMITEENbetween them and data users, nor are through the provision of such acquiring any
information on the establishment of such relationship. Providers of cloud services should
be excluded, as well as service providers that obtain data from data holders, aggregate,enrich or transform the data and licence the use of the resulting data to data users, withoutestablishing a direct relationship between data holders and data users, for example
advertisement or data brokers, data consultancies, providers of data products resulting fromvalue added to the data by the service provider. At the same time, dData sharing
intermediation service providers should be allowed to offer certain services, e.g. makinge
adaptations to the data exchanged, to the extent that such services are intrinsically linked
with the sharing of the data and that this improves the usability of the data by the data
user, where the data user desires this, such as to convert it into specific formats. In addition,
services that focus on the intermediation of content, in particular on copyright-protected
content, such as online content sharing service providers in the meaning of Article 2(6)of Directive (EU) 2019/790 should not be covered by this Regulation. Data exchange
platforms that are exclusively used by one data holder in order to enable the use of data theyhold as well as platforms, developed and exclusively offered by manufacturers in thecontext of objects and devices connected to the Internet-of-Things, which that have as theirmain objective to ensure functionalities of the connected object or device and to allow value
added services, should not be covered by this Regulation. ‘Consolidated tape providers’ as
defined in the sense of Article 4 (1) point 53 of Directive 2014/65/EU of the European
Parliament and of the Council28 fall outside the scope of the definition of dataintermediation services. Additionally, as well as ‘account information service providers’as defined in the sense of Article 4 point 19 of Directive (EU) 2015/2366 of the European
Parliament and of the Council29 should not be considered as data sharing intermediation
service providers for the purposes of this Regulation. Public sector bodies that offer dataintermediation services on a non-commercial basis are not covered by Chapter III ofthis Regulation. Member States may determine whether public sector bodies canprovide data intermediation services on a commercial basis. Entities which restrict theiractivities to facilitating use of data made available on the basis of data altruism and that
operate on a not-for-profit basis should not be covered by Chapter III of this Regulation, as
this activity serves objectives of general interest by increasing the volume of data available
for such purposes.

28
29

Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial
instruments and amending Directive 2002/92/EC and Directive 2011/61/EU, OJ L 173/349.
Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment
services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU andRegulation (EU) No 1093/2010, and repealing Directive 2007/64/EC.

12124/21
TREE.2.B

RB/ek

24

LIMITEEN

(23)A specific category of data intermediaries includes providers of data sharing intermediation
services that offer their services to data subjects in the sense within the meaning ofRegulation (EU) 2016/679. Such providers focus exclusively on personal data and seek toenhance individual agency, and in particular the individuals’ control over the data
pertaining relating to them. They would assist individuals in exercising their rights under
Regulation (EU) 2016/679, in particular managing their consent to data processing, the rightof access to their own data, the right to the rectification of inaccurate personal data, the rightof erasure or right ‘to be forgotten’, the right to restrict processing and the data portability
right, which allows data subjects to move their personal data from one controller to theother. In this context, it is important that their business model ensures that there are no
misaligned incentives that encourage individuals to use such services to make more data
relating to them available for processing than what is in the individuals’ own interest. This
could include advising individuals on uses of their data they could allow and making due
diligence checks on data users before allowing them to contact data subjects, in order toavoid fraudulent practices. In certain situations, it could be desirable to collate actual data
within a personal data storage space, or ‘personal data space’ so that processing can happen
within that space without personal data being transmitted to third parties in order tomaximise the protection of personal data and privacy. Such ‘personal data spaces’ may
contain static personal data such as name, address or date of birth as well as dynamic
data that an individual generates e.g. through the use of an online service or an object
connected to the Internet-of-Things. They may also be used to store verified identity
information (passport number, social security information) as well as proof of personal
attributes (e.g. driving licence, diplomas or bank account information).

(24)

Data cooperatives seek to strengthen the position of individuals in making informed choices
before consenting to data use, influencing the terms and conditions of data userorganisations attached to data use or potentially solving disputes between members of agroup on how data can be used when such data pertain to several data subjects within thatgroup. In this context it is important to acknowledge that the rights under Regulation (EU)2016/679 can only be exercised by each individual and cannot be conferred or delegated to adata cooperative are personal rights of the data subject and that data subjects cannot
relinquish such rights. Data cooperatives could also provide a useful means for one-personcompanies, micro, small and medium-sized enterprises that in terms of knowledge of data
sharing, are often comparable to individuals.

12124/21
TREE.2.B

RB/ek

25

LIMITEEN

(25)In order to increase trust in such data sharing intermediation services, in particular related
to the use of data and the compliance with the conditions imposed by data holders subjects
and data holders, it is necessary to create a Union-level regulatory framework, which
would sets out highly harmonised requirements related to the trustworthy provision of suchdata sharing intermediation services, and which is implemented by the national
competent authorities. This will contribute to ensuring that data subjects and dataholders, as well as and data users, have better control over the access to and use of theirdata, in accordance with Union law. The Commission could also encourage and facilitate
the development of self-regulatory codes of conduct at Union level, involving relevant
stakeholders, in particular on interoperability. Both in situations where data sharing
occurs in a business-to-business context and where it occurs in a business-to-consumer
context, data sharing intermediation service providers should offer a novel, ‘European’
way of data governance, by providing a separation in the data economy between data
provision, intermediation and use. Providers of data sharing intermediation services may
could also make available specific technical infrastructure for the interconnection of dataholders subjects and data holders and with data users.

(26)

A key element to bring trust in data intermediation services and more control for dataholder subjects and data holders, as well as for and data users, in data sharing services isthe neutrality of data sharing intermediation service providers as regards the dataexchanged between data holders subjects and data holders, on the one hand, and data users
on the other hand. It is therefore necessary that data sharing intermediation service
providers act only as intermediaries in the transactions, and do not use the data exchanged
for any other purpose. This will also require structural separation between the data sharing
intermediation service and any other services provided, so as to avoid issues of conflict ofinterest. This means that the data sharing intermediation service should be provided
through a legal entity person that is separate from the other activities of that data sharing
intermediation service provider. As an exception to this, the data intermediation service
providers should be able to use the data provided by the data holder for the
improvement of their data intermediation services. In addition to that the providers
could offer additional specific services to improve the usability of the data andancillary services that facilitate the sharing of data, such as storage, curation,
pseudonymisation and anonymisation. Data sharing intermediation service providers
that intermediate the exchange of data between individuals as data holders subjects andlegal persons entities as data users should, in addition, bear fiduciary duty towards theindividuals, to ensure that they act in the best interest of the data holders subjects.
Questions of liability for all material and immaterial damages and detriments resulting
from any conduct of the data intermediation service provider could be addressed in therelevant contract, based on the national liability regimes.

12124/21
TREE.2.B

RB/ek

26

LIMITEEN

(26a) Data intermediation service providers should take reasonable measures to ensureinteroperability within a sector and between different sectors to ensure the proper
functioning of the market. Reasonable measures could include following the existing,commonly-used standards in the sector where the data service provider operates. The
European Data Innovation Board should facilitate the emergence of additional
industry standards, where necessary. Data intermediation service providers should
implement in due time the measures for interoperability between the dataintermediation services set out by the European Data Innovation Board.
(27)

In order to ensure the compliance of the providers of data sharing intermediation services
with the conditions set out in this Regulation, such providers should have a place of
establishment in the Union. Alternatively, where a provider of data sharing intermediation
services not established in the Union offers services within the Union, it should designate a
representative. Designation of a representative is necessary, given that such providers ofdata sharing intermediation services handle personal data as well as commerciallyconfidential data, which necessitates the close monitoring of the compliance of such service
providers with the conditions laid out in this Regulation. In order to determine whether sucha provider of data sharing intermediation services is offering services within the Union, it
should be ascertained whether it is apparent that the provider of data sharing intermediation
services is planning to offer services to persons in one or more Member States. The mere
accessibility in the Union of the website or of an email address and of other contact detailsof the provider of data sharing intermediation services, or the use of a language generally
used in the third country where the provider of data sharing intermediation services isestablished, should be considered insufficient to ascertain such an intention. However,factors such as the use of a language or a currency generally used in one or more Member
States with the possibility of ordering services in that other language, or the mentioning ofusers who are in the Union, may could make it apparent that the provider of data sharing
intermediation services is planning to offer services within the Union. The representative
should act on behalf of the provider of data sharing intermediation services and it should bepossible for competent authorities to contact the representative. The representative should bedesignated by a written mandate of the provider of data sharing intermediation services toact on the latter's behalf with regard to the latter's obligations under this Regulation.

(28)

This Regulation should be without prejudice to the obligation of providers of data sharing
intermediation services to comply with Regulation (EU) 2016/679 and the responsibility ofsupervisory authorities to ensure compliance with that Regulation. When providers of dataintermediation services process personal data, this Regulation does not affect theprotection of personal data. Where the data sharing intermediation service providers aredata controllers or processors as defined in the sense of Regulation (EU) 2016/679 they arebound by the rules of that Regulation. This Regulation should be also without prejudice tothe application of competition law.

12124/21
TREE.2.B

RB/ek

27

LIMITEEN

(29)This Regulation should be also without prejudice to the application of competition law.
Providers of data sharing intermediation services should also take measures to ensurecompliance with competition law and have procedures in place to this effect. Data sharing
could may generate various types of efficiencies but could may also lead to restrictions ofcompetition, in particular where it includes the sharing of competitively sensitive
information. This applies in particular in situations where data sharing enables businesses tobecome aware of market strategies of their actual or potential competitors. Competitively
sensitive information typically includes information on customer data, future prices,
production costs, quantities, turnovers, sales or capacities.

(30)

A notification procedure for data sharing intermediation services should be established inorder to ensure a data governance within the Union based on trustworthy exchange of data.
The benefits of a trustworthy environment would be best achieved by imposing a number ofrequirements for the provision of data sharing intermediation services, but without
requiring any explicit decision or administrative act by the competent authority for theprovision of such services.

(31)

In order to support effective cross-border provision of services, the data sharing
intermediation service provider should be requested to send a notification only to thedesignated competent authority from the Member State where its main establishment islocated or where its legal representative is located. Such a notification should not entail
more than a mere declaration of the intention to provide such services and should becompleted only by the information set out in this Regulation.

(32)

The main establishment of a provider of data sharing intermediation services in the Union
should be the Member State with the place of its central administration in the Union. The
main establishment of a provider of data sharing intermediation services in the Union
should be determined according to objective criteria and should imply the effective and real
exercise of management activities. Activities of a provider of data intermediation
services should also be in line with national law of the Member State in which it has its
main establishment.

(33)

The competent authorities designated to monitor compliance of data sharing intermediation
services with the requirements in this Regulation should be chosen on the basis of theircapacity and expertise regarding horizontal or sectoral data sharing, and they should be
independent of any provider of data intermediation services as well as transparent andimpartial in the exercise of their tasks. Member States should notify the Commission of theidentity of the designated competent authorities. The powers and competences of thedesignated competent authorities should be without prejudice to the powers of the dataprotection authorities. In particular, for any question requiring an assessment ofcompliance with Regulation (EU) 2016/679, the competent authority should seek,
where relevant, an opinion or decision by the competent supervisory authority
established pursuant to that Regulation.

12124/21
TREE.2.B

RB/ek

28

LIMITEEN(34)The notification framework laid down in this Regulation should be without prejudice tospecific additional rules for the provision of data sharing intermediation services applicableby means of sector-specific legislation.

(35)

There is a strong potential in the use of data made available voluntarily by data subjects
based on their informed consent or, where it concerns non-personal data, made available bylegal persons, for purposes objectives of general interest. Such purposes objectives would
include healthcare, combating climate change, improving mobility, facilitating thedevelopment, production and dissemination of European statistics the establishment ofofficial statistics or improving the provision of public services. Support to scientificresearch, including for example technological development and demonstration, fundamental
research, applied research and privately funded research, should be considered as well
purposes objectives of general interest. This Regulation should aims at contributing to theemergence of pools of data made available on the basis of data altruism that have a sufficient
size in order to enable data analytics and machine learning, including across borders in theUnion. In order to achieve this objective, Member States could have organizational or
technical arrangements in place, which would facilitate data altruism. Sucharrangements could include the availability of easily useable tools for data subjects ordata holders for giving consent or permission for the altruistic use of their data, theorganization of awareness campaigns, or a structured exchange between publicauthorities on how public policies benefit from data altruism (e.g. improving traffic,
public health, combating climate change). In support of this, Member States could also
define national policies for data altruism. Data subjects should be able to receive
compensation related only to the costs they incur making their data available forobjectives of general interest.

(36)

Legal entities that seek to support purposes objectives of general interest by making
available relevant data based on data altruism at scale and meet certain requirements, shouldbe able to register as ‘data altruism organisations recognised in the Union’. This could leadto the establishment of data repositories. As registration in a Member State would be valid
across the Union, and this should facilitate cross-border data use within the Union and theemergence of data pools covering several Member States. Data subjects in this respect
would consent to specific purposes of data processing, but could also consent to dataprocessing in certain areas of research or parts of research projects as it is often not possible
to fully identify the purpose of personal data processing for scientific research purposes at
the time of data collection. Legal persons could give permission to the processing of their
non-personal data for a range of purposes not defined at the moment of giving thepermission. The voluntary compliance of such registered entities with a set of requirements
should bring trust that the data made available on altruistic purposes is serving a generalinterest purpose. Such trust should result in particular from a place of establishment or alegal representative within the Union , as well as from the requirement that registeredentities have a not-for-profit character, from transparency requirements and from specificsafeguards in place to protect rights and interests of data subjects and companies. Further
safeguards should include making it possible to process relevant data within a secure
processing environment operated by the registered entity, oversight mechanisms such as
ethics councils or boards to ensure that the data controller maintains high standards ofscientific ethics, effective technical means to withdraw or modify consent at any moment,
based on the information obligations of data processors under Regulation (EU) 2016/679 as

12124/21
TREE.2.B

RB/ek

29

LIMITEEN

well as means for data subjects to stay informed about the use of data they made available.
Registration as a recognised data altruism organisation should not be a precondition
for exercising data altruism activities. The Commission should, by way of
implementing acts, adopt codes of conduct developed in close cooperation with data
altruism organisations and relevant stakeholders, making compliance with those codesa requirement for registration as a recognised data altruism organisations inaccordance with this Regulation.
(37)

This Regulation is without prejudice to the establishment, organisation and functioning ofentities that seek to engage in data altruism pursuant to national law. It builds on nationallaw requirements to operate lawfully in a Member State as a not-for-profit organisation.
Entities which meet the requirements in of this Regulation should be able to use the title of‘data altruism organisations recognised in the Union’.

(38)

Data altruism organisations recognised in the Union should be able to collect relevant data
directly from natural and legal persons or to process data collected by others. Data altruism
organisations may process the collected data for purposes which they define themselvesor permit the processing by third parties. Where recognised data altruism
organisations are data controllers or processors within the meaning of Regulation (EU)2016/679 they are bound by the rules of that Regulation. Typically, data altruism would
rely on consent of data subjects in the sense of Article 6(1)(a) and 9(2)(a) of Regulation(EU) 2016/679 and that should be in compliance with requirements for lawful consent inaccordance with Article 7 of that Regulation (EU) 2016/679. In accordance with Regulation(EU) 2016/679, scientific research purposes can be supported by consent to certain areas ofscientific research when in keeping with recognised ethical standards for scientific researchor only to certain areas of research or parts of research projects. Article 5(1)(b) ofRegulation (EU) 2016/679 specifies that further processing for scientific or historicalresearch purposes or statistical purposes should, in accordance with Article 89(1) ofRegulation (EU) 2016/679, not be considered to be incompatible with the initial purposes.
For non-personal data the usage limitations should be found in the permission given by
the data holder.

(38a) The competent authorities designated to monitor compliance of recognised data
altruism organisations with the requirements of this Regulation should be chosen on
the basis of their capacity and expertise, and they should be independent of any data
altruism organisation as well as transparent and impartial in the exercise of theirtasks. Member States should notify the Commission of the identity of the designatedcompetent authorities. The powers and competences of the designated competentauthorities should be without prejudice to the powers of the data protection
authorities. In particular, for any question requiring an assessment of compliance with
Regulation (EU) 2016/679, the competent authority should seek, where relevant, an
opinion or decision by the competent supervisory authority established pursuant tothat Regulation.

12124/21
TREE.2.B

RB/ek

30

LIMITEEN

(39)To bring additional legal certainty to granting and withdrawing of consent, in particular in
the context of scientific research and statistical use of data made available on an altruistic
basis, a European data altruism consent form should be developed and used in the context of
altruistic data sharing. Such a form should contribute to additional transparency for data
subjects that their data will be accessed and used in accordance with their consent and also
in full compliance with the data protection rules. It could also be used to streamline data
altruism performed by companies and provide a mechanism allowing such companies towithdraw their permission to use the data. In order to take into account the specificities ofindividual sectors, including from a data protection perspective, there should be a possibility
for sectoral adjustments of the European data altruism consent form.

(40)

In order to successfully implement the data governance framework, a European Data
Innovation Board should be established, in the form of an expert group. The Board should
consist of representatives of the Member States, the Commission and representatives of
relevant data spaces and specific sectors (such as health, environment, agriculture, andtransportand statistics), as well as representatives of academia, research, standard
setting organisations and bodies with specific expertise such as national statistical
offices, where relevant. Balanced representation of different geographical areas should
be ensured. The determination of the membership should also aim to ensure theefficient functioning of the Board. The European Data Protection Board should be invited
to appoint a representative to the European Data Innovation Board.

(41)

The European Data Innovation Board should support the Commission in coordinating
national practices and policies on the topics covered by this Regulation, and in supporting
cross-sector data use by adhering to the European Interoperability Framework (EIF)
principles and through the utilisation of standards and specifications (such as the Core
Vocabularies30 and the CEF Building Blocks31), without prejudice to standardisation work
taking place in specific sectors or domains. Work on technical standardisation could may
include the identification of priorities for the development of standards and establishing andmaintaining a set of technical and legal standards for transmitting data between two
processing environments that allows data spaces to be organised without making recourse to
an intermediary. The European Data Innovation Board should cooperate with sectoral
bodies, networks or expert groups, or other cross-sectoral organisations dealing with re-useof data. Regarding data altruism, the European Data Innovation Board should assist theCommission in the development of the data altruism consent form, in consultation with theEuropean Data Protection Board.

30

https://joinup.ec.europa.eu/collection/semantic-interoperability-community-semic/core-vocabularies
https://joinup.ec.europa.eu/collection/connecting-europe-facility-cef

31

12124/21
TREE.2.B

RB/ek

31

LIMITEEN(42)In order to ensure uniform conditions for the implementation of this Regulation,
implementing powers should be conferred on the Commission to develop the European data
altruism consent form, to declare that the legal, supervisory and enforcement
arrangements of a third country are adequate, to lay down special conditions
applicable for transfers to third-countries of certain non-personal data categories
deemed to be highly sensitive in specific Union acts adopted through a legislative
procedure, and to support public sector bodies and re-users in their compliance withconditions for re-use set out in this Regulation by providing model contractual clauses.
Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of theEuropean Parliament and of the Council32.

(43)

In order to provide for an efficient enforcement of this Regulation and to ensure thatproviders of data intermediation services as well as entities who wish to register asrecognised data altruism organisations can access and complete the procedures of
notification and registration fully online and in a cross-border manner, suchprocedures should be offered through the single digital gateway established pursuant
to Regulation (EU) 2018/1724.33 These procedures should be added to the list ofprocedures included in Annex II of Regulation (EU) 2018/1724.

(43)

In order to take account of the specific nature of certain categories of data, the power toadopt acts in accordance with Article 290 TFEU should be delegated to the Commission tolay down special conditions applicable for transfers to third-countries of certain nonpersonal data categories deemed to be highly sensitive in specific Union acts adopted thougha legislative procedure. It is of particular importance that the Commission carry out
appropriate consultations during its preparatory work, including at expert level, and thatthose consultations be conducted in accordance with the principles laid down in theInterinstitutional Agreement of 13 April 2016 on Better Law-Making. In particular, toensure equal participation in the preparation of delegated acts, the European Parliament andthe Council receive all documents at the same time as Member States’ experts, and theirexperts systematically have access to meetings of Commission expert groups dealing withthe preparation of delegated acts.

(44)This Regulation should not affect the application of the rules on competition, and inparticular Articles 101 and 102 of the Treaty on the Functioning of the European Union. The
measures provided for in this Regulation should not be used to restrict competition in amanner contrary to the Treaty on the Functioning of the European Union. This concerns inparticular the rules on the exchange of competitively sensitive information between actual or
potential competitors through data sharing intermediation services.

32

Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying
down the rules and general principles concerning mechanisms for control by the Member States of theCommission's exercise of implementing powers (OJ L 55, 28.2.2011, p.13).
Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October 2018
establishing a single digital gateway to provide access to information, to procedures and to assistanceand problem-solving services and amending Regulation (EU) No 2014/2012 (OJ L 295, 21.11.2018, p.1).

3312124/21
TREE.2.B

RB/ek

32

LIMITEEN(45)The European Data Protection Supervisor and the European Data Protection Board wereconsulted in accordance with Article 42 of Regulation (EU) 2018/1725 of the European
Parliament and of the Council (34)and delivered an opinion on 10 March 202135[…].

(46)

This Regulation respects the fundamental rights and observes the principles recognised inparticular by the Charter, including the right to privacy, the protection of personal data, thefreedom to conduct a business, the right to property and the integration of persons withdisabilities. In the context of the latter, the public service bodies and services under thisRegulation should, where relevant, comply with Directive (EU) 2019/88236 andDirective (EU) 2016/210237. Furthermore, Design for All in the context of informationand communications technology, which is the conscious and systematic effort toproactively apply principles, methods and tools to promote universal design incomputer-related technologies, including Internet-based technologies, thus avoiding
the need for a posteriori adaptations, or specialised design, should be taken into
account.

(47)

Since the objectives of this Regulation, namely the re-use, within the Union, of certain
categories of data held by public sector bodies as well as establishing a notification andsupervisory framework for the provision of data sharing intermediation services and aframework for voluntary registration of entities which make data available foraltruistic purposes, cannot be sufficiently achieved by the Member States, but canrather, by reason of its scale and effects, be better achieved at Union level, the Union
may adopt measures, in accordance with the principle of subsidiarity as set out in
Article 5 of the Treaty on European Union. In accordance with the principle ofproportionality as set out in that Article, this Regulation does not go beyond what isnecessary in order to achieve those objectives,

HAVE ADOPTED THIS REGULATION:

34

35
36
37

Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on theprotection of natural persons with regard to the processing of personal data by the Union institutions, bodies,
offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 andDecision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).
EDPB-EDPS Joint Opinion on the proposal for a regulation of the European Parliament and of theCouncil on European data governance (Data Governance Act).
Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on theaccessibility requirements for products and services (OJ L 151, 7.6.2019, p. 70).
Directive (EU) 2016/2102 of the European Parliament and of the Council of 26 October 2016 on theaccessibility of the websites and mobile applications of public sector bodies (OJ L 327, 2.12.2016, p. 1).

12124/21
TREE.2.B

RB/ek

33

LIMITEENCHAPTER I
GENERAL PROVISIONS

Article 1
Subject matter and scope(1)

This Regulation lays down:(a)conditions for the re-use, within the Union, of certain categories of data held by
public sector bodies;(b)a notification and supervisory framework for the provision of data sharing
intermediation services;(c)a framework for voluntary registration of entities which collect and process data
made available for altruistic purposes.

(2)This Regulation does not create any obligation on public sector bodies to allow re-useof data nor does it release public sector bodies from their confidentiality obligations
under Union or national law. This Regulation is without prejudice to specific provisions
in other Union legal acts or national law regarding access to or re-use of certain categoriesof data, in particular regarding granting of access to and disclosure of official
documents. This Regulation is also without prejudice to obligations of public sector
bodies under Union and national law to allow the re-use of data or to requirements
related to processing of personal or non-personal data. Where a sector-specific Union legal
act or national law requires public sector bodies, providers of data sharing
intermediation services or registered entities providing data altruism services to comply
with specific additional technical, administrative or organisational requirements, including
through an authorisation or certification regime, those provisions of that sector-specificUnion legal act or national law shall also apply. Any additional requirements shall be
non-discriminatory, proportionate and objectively justified.

(3)

Union and national law on the protection of personal data shall apply to any personal
data processed in connection with this Regulation. In particular, this Regulation shallbe without prejudice to Regulation (EU) 2016/679 and Directive 2002/58/EC,
including the powers and competences of supervisory authorities. In the event ofconflict between the provisions of this Regulation and Union or national law on theprotection of personal data, Union or national law prevails. This Regulation does notcreate a legal basis for the processing of personal data and does not alter any
obligations and rights set out in Regulation (EU) 2016/679 or Directive 2002/58/EC.

(4)This Regulation is without prejudice to the competences of the Member States
regarding activities concerning public security, defence and national security.

12124/21
TREE.2.B

RB/ek

34

LIMITEEN

Article 2
Definitions
For the purposes of this Regulation, the following definitions apply:(1)‘data’ means any digital representation of acts, facts or information and any compilation ofsuch acts, facts or information, including in the form of sound, visual or audiovisual
recording;(2)‘re-use’ means the use by natural or legal persons of data held by public sector bodies, forcommercial or non-commercial purposes other than the initial purpose within the publictask for which the data were produced, except for the exchange of data between public
sector bodies purely in pursuit of their public tasks;(2a)‘data intermediation service’ means a commercial service, which, through theprovision of technical, legal and or other services means has as a main objective toestablishes direct legal or business relationships for the purpose of data sharing,
through technical, legal or other means, between an undefined number of data
subjects and data holders, on the one hand, and data users on the other hand, for theexchange purpose of data sharing, in particular for the exercise of data subjects'
rights in relation to personal data. The following shall, inter alia, not be considered to
be data intermediation services:(a) services that obtain data from data holders, aggregate, enrich or transform thedata and license the use of the resulting data to data users, without establishing a
direct relationship between data holders and data users;(b) services that focus on the intermediation of content, in particular on copyrightprotected content;(c) services of data exchange platforms that are exclusively used by one data holder inorder to enable the use of data they hold as well as platforms developed andexclusively offered by manufacturers of objects and devices connected to the Internetof-Things, which have as their main objective to ensure functionalities of theconnected object or device and to allow value added services;(d) public sector bodies that offer data sharing intermediation facilities on a noncommercial basis;(2b)'personal data' means data as defined in point (1) of Article 4 of Regulation (EU)2016/679;(3)‘non-personal data’ means data other than personal data as defined in point (1) of Article 4
of Regulation (EU) 2016/679;(3a)‘consent’ means consent as defined in point (11) of Article 4 of Regulation (EU)2016/679;(3aa)'permission' means the right given by a legal person to another natural or legal
person to process non-personal data as well as personal data insofar as there is a legal
basis that allows such processing;12124/21
TREE.2.B

RB/ek

35

LIMITEEN(3b)'data subject' means data subject as referred to in point (1) of Article 4 of Regulation(EU) 2016/679;(4)‘metadata’ means data collected on any activity of a natural or legal person for the
purposes of the provision of a data sharing service, including the date, time andgeolocation data, duration of activity, connections to other natural or legal persons
established by the person who uses the service;(5)‘data holder’ means a legal person, or a natural person who is not a data subject for the
purpose of a specific data processing operation, person or data subject who which, in
accordance with applicable Union or national law, has the right to grant access to or toshare certain personal or non-personal data under its control;(6)‘data user’ means a natural or legal person who has lawful access to certain personal or
non-personal data and is authorised has the right, including under Regulation (EU)2016/679 in the case of personal data, to use that data for commercial or non-commercial
purposes;(6a)'data re-user' means a natural or legal person who re-uses data;(7)‘data sharing’ means the provision of data by a data holder subject or a data holder ofdata to a data user for the purpose of joint or individual use of the shared such data, basedon voluntary agreements or Union or national law, directly or through an intermediary,for example under open or commercial licenses, for free or against remuneration;(7a)‘processing’ means processing as defined in point (2) of Article 4 of Regulation (EU)2016/679;(8)‘access’ means data processing use by a data user of data that has been provided by a dataholder, in accordance with specific technical, legal, or organisational requirements, without
necessarily implying the transmission or downloading of such data;(9)‘main establishment’ of a legal entity person means the place of its central administrationin the Union;(9a)'data cooperative' means an organisation providing data intermediation services andsupporting its members, who are data subjects or small and medium-sized enterprises
or one-person undertakings, in making informed choices before consenting to dataprocessing, or in negotiating terms and conditions for data processing;(10)‘data altruism’ means voluntary sharing of data by data subjects or data holders
without seeking a reward, for objectives of general interest the consent by data subjects
to process personal data pertaining to them, or permissions of other data holders to allow
the use of their non-personal data without seeking a reward, for purposes of generalinterest defined in accordance with national law where applicable, such as scientificresearch purposes, policy making or improving public services;(11)‘public sector body’ means the State, regional or local authorities, bodies governed bypublic law or associations formed by one or more such authorities or one or more suchbodies governed by public law;(12)

‘bodies governed by public law’ means bodies that have the following characteristics:

12124/21
TREE.2.B

RB/ek

36

LIMITE

EN

(13)

(a)

they are established for the specific purpose of meeting needs in the general interest,and do not have an industrial or commercial character;(b)they have legal personality;(c)they are financed, for the most part, by the State, regional or local authorities, or byother bodies governed by public law; or are subject to management supervision by
those authorities or bodies; or have an administrative, managerial or supervisoryboard, more than half of whose members are appointed by the State, regional or local
authorities, or by other bodies governed by public law;

‘public undertaking’ means any undertaking over which the public sector bodies may
exercise directly or indirectly a dominant influence by virtue of their ownership of it, theirfinancial participation therein, or the rules which govern it; for the purpose of thisdefinition, a dominant influence on the part of the public sector bodies shall be presumed
in any of the following cases in which those bodies, directly or indirectly:(a)hold the majority of the undertaking's subscribed capital;(b)control the majority of the votes attaching to shares issued by the undertaking;(c)can appoint more than half of the undertaking’s administrative, management or
supervisory body;(14)‘secure processing environment’ means the physical or virtual environment andorganisational means to provide the opportunity to re-use data in a manner ensuring
compliance with the requirements of Regulation (EU) 2016/679, in particular data
subjects' rights, intellectual property rights, and commercial and statisticalconfidentiality privacy-preserving way, ensuring compliance with applicable Unionand national law, a manner that allows for the operator of the and allowing the entity
providing the secure processing environment to determine and supervise all dataprocessing actions, including to display, storage, download, export of the data andcalculation of derivative data through computational algorithms.

(15)‘representative’ means any natural person or any legal person established in theUnion explicitly designated to act on behalf of a provider of data sharing intermediation
services or an entity that collects data for objectives of general interest made available bynatural or legal persons on the basis of data altruism not established in the Union, which
may be addressed by a national competent authority instead of the provider of data sharing
intermediation services or entity with regard to the obligations of that provider of data
sharing intermediation services or entity set up by this Regulation.

12124/21
TREE.2.B

RB/ek

37

LIMITEENCHAPTER II
RE-USE OF CERTAIN CATEGORIES OF PROTECTED DATA HELD BY
PUBLIC SECTOR BODIESArticle 3
Categories of data
(1)

(2)

(3)

This Chapter applies to data held by public sector bodies which are protected on groundsof:(a)commercial confidentiality including business, professional and company secrets;(b)statistical confidentiality;(c)protection of intellectual property rights of third parties; or(d)protection of personal data, insofar as such data fall outside the scope of Directive(EU) 2019/1024.

This Chapter does not apply to:(a)data held by public undertakings;(b)data held by public service broadcasters and their subsidiaries, and by other bodies ortheir subsidiaries for the fulfilment of a public service broadcasting remit;(c)data held by cultural establishments and educational establishments;(d)data held by public sector bodies which are protected for reasons of national
security, defence or public security; or(e)data the supply of which is an activity falling outside the scope of the public task ofthe public sector bodies concerned as defined by law or by other binding rules in theMember State concerned, or, in the absence of such rules, as defined in accordancewith common administrative practice in that Member State, provided that the scopeof the public tasks is transparent and subject to review.

The provisions of tThis Chapter does not create any obligation on public sector bodies toallow re-use of data nor does it they release public sector bodies from their confidentiality
obligations under Union or national law. This Chapter is without prejudice to Union andnational law or international agreements to which the Union or Member States are parties
on the protection of categories of data provided in paragraph 1. This Chapter is without
prejudice to Union and national law on access to documents and to obligations of public
sector bodies under Union and national law to allow the re-use of data.

12124/21
TREE.2.B

RB/ek

38

LIMITEEN

Article 4
Prohibition of exclusive arrangements(1)

Agreements or other practices pertaining to the re-use of data held by public sector bodies
containing categories of data referred to in Article 3 (1) which grant exclusive rights or
which have as their object or effect to grant such exclusive rights or to restrict theavailability of data for re-use by entities other than the parties to such agreements or otherpractices shall be prohibited.

(2)

By way of derogation from paragraph 1, an exclusive right to re-use data referred to in thatparagraph may be granted to the extent necessary for the provision of a service or the
supply of a product in the general interest that would have otherwise not be possible.

(3)

Such An exclusive right according to paragraph 2 shall be granted in the context of a
relevant service or concession contract in compliance with applicable Union and national
public procurement and concession award rules, or, in the case of a contract of a value forwhich neither Union nor national public procurement and concession award rules areapplicable, in compliance with the principles of transparency, equal treatment and nondiscrimination on grounds of nationality.

(4)

In all cases not covered by paragraph 3 and where the general interest purpose cannot be
fulfilled without granting an exclusive right, the principles of transparency, equal treatment
and non-discrimination on grounds of nationality shall apply.

(5)

The period of exclusivity of the right to re-use data shall not exceed three years. Where acontract is concluded, the duration of the contract awarded shall be as aligned with theperiod of exclusivity.

(6)

The award of an exclusive right pursuant to paragraphs (2) to (5), including the reasons
why it is necessary to grant such a right, shall be transparent and be made publicly
available online, where relevant, in a form that is in accordance with Union law onpublic procurement. regardless of a possible publication of an award of a public
procurement and concessions contract.

(7)

Agreements or other practices falling within the scope of the prohibition in paragraph 1,
which do not meet the conditions set out in paragraphs 2 and 3, and which were concluded
before the date of entry into force of this Regulation shall be terminated at the end of thecontract and in any event at the latest within three years after the date of entry into force of
this Regulation.
Article 5
Conditions for re-use(1)

Public sector bodies which are competent under national law to grant or refuse access forthe re-use of one or more of the categories of data referred to in Article 3 (1) shall makepublicly available the conditions for allowing such re-use. In that task, they may beassisted by the competent bodies referred to in Article 7 (1).

(2)

Conditions for re-use shall be non-discriminatory, proportionate and objectively justified
with regard to categories of data and purposes of re-use and the nature of the data forwhich re-use is allowed. These conditions shall not be used to restrict competition.

12124/21
TREE.2.B

RB/ek

39

LIMITEEN

(3)Public sector bodies may shall, in accordance with Union and national law, impose theconditions necessary for preserving the protected nature of the data and taking into
account the risks related to its processing. Such conditions may, inter alia, consist of
the following:(a) an obligation to re-use only pre-processed data where such pre-processing aims to toaccess and re-use data that the public sector body or the competent body upon therequest of the re-user anonymizes or pseudonymises in the case of personal data, ordelete modifies, aggregates, or treats by any other method of disclosure control in thecase of commercially confidential information, including trade secrets and confidential
statistical data, or content protected by intellectual property rights;.
(4)

Public sector bodies may impose obligations(ba) to access and re-use the data remotely within a secure processing environment
provided and controlled by the public sector; or(cb) to access and re-use the data within the physical premises in which the secure
processing environment is located, if remote access cannot be allowed without
jeopardising the rights and interests of third parties.
(5)

In the case of re-use allowed according to paragraph 3 points (b) and (c) tThe public
sector bodies shall impose conditions that preserve the integrity of the functioning of thetechnical systems of the secure processing environment used. The public sector body shallreserve the right be able to verify the process, the means and any results of processingof data undertaken by the re-user to preserve the integrity of the protection of the data
and reserve the right to prohibit the use of results that contain information jeopardising therights and interests of third parties.

(5a)Unless national law includes specific safeguards on applicable confidentiality
obligations relating to the re-use of data covered in Article 3(1), the public sector
body shall make the use of data provided in accordance with paragraph 3 conditionalon the adherence by the re-user to a confidentiality obligation that prohibits thedisclosure of any information that jeopardises the rights and interests of third parties
that the re-user may have acquired despite the safeguards put in place. Re-users shallbe prohibited from re-identifying any data subject to whom the data relates and shallbe required to assess on an on-going basis the risks of re-identification and to notify
any data breach resulting in the re-identification of the individuals data subjects
concerned to the public sector body. The re-user shall without undue delay, whereappropriate with the assistance of the public sector body, inform the legal persons
whose rights may be affected in case an unauthorised re-use of non-personal data
occurs.

(6)

Where the re-use of data cannot be granted in accordance with the obligations laid down inparagraphs 3 to 5 and there is no other legal basis for transmitting the data under
Regulation (EU) 2016/679, the public sector body shall may, insofar as allowed by Unionand national law, support provide assistance to potential re-users in seeking consent of
the data subjects and/or permission from the data holders legal entities whose rights andinterests may be affected by such re-use, where it is feasible without disproportionate costburden for the public sector body. In that task it they may be assisted by the competentbodies referred to in Article 7 (1).

12124/21
TREE.2.B

RB/ek

40

LIMITEEN

(7)Re-use of data shall only be allowed in compliance with intellectual property rights. The
right of the maker of a database as provided for in Article 7(1) of Directive 96/9/EC shallnot be exercised by public sector bodies in order to prevent the re-use of data or to restrict
re-use beyond the limits set by this Regulation.

(8)

When data requested is considered confidential, in accordance with Union or national law
on commercial confidentiality, the public sector bodies shall ensure that the confidential
information is not disclosed as a result of the re-use. When data requested, or part
thereof, is considered to be confidential information under Article 3 (1) (a) and (b), in
accordance with Union or national law on commercial or statistical confidentiality,
the re-use of such data shall only be allowed in case the confidential information is
not disclosed as a result of allowing such re-use, unless such re-use is allowed inaccordance with paragraph (6).

(9)

The Commission may adopt implementing acts declaring that the legal, supervisory andenforcement arrangements of a third country:(a)ensure protection of intellectual property and trade secrets in a way that is essentiallyequivalent to the protection ensured under Union law;(b)

are being effectively applied and enforced; and(c)provide effective judicial redress.

Those implementing acts shall be adopted in accordance with the advisory procedurereferred to in Article 29 (2).
(8a)

Where a re-user intends to transfer non-personal data protected on the grounds set
out in Article 3(1) to a third country, it shall inform the public sector body of its
intention as well as of the purpose of the transfer at the time of requesting the re-use.
In the case of re-use in accordance with paragraph 6, the re-user shall, whereappropriate with the assistance of the public sector body, inform the legal person
whose rights and interests may be affected of that intention, and purpose and theappropriate safeguards, and the public sector body shall not allow the re-use unlessthe legal person gives the permission for the transfer.

(10)

Public sector bodies shall The re-user shall only not to transmit transfer non-personal
data protected on grounds set out in Article 3 confidential data or data protected byintellectual property rights to a re-user which intends to transfer the data to a third country
other than a country designated in accordance with paragraph 910a unless if the re-user
undertakes:(a)to comply with the obligations imposed in accordance with paragraphs 7 and to 8
even after the data is transferred to the third country; and(b)to accept the jurisdiction of the courts of the Member State of the public sector bodyas regards any dispute related to the compliance with the obligation in point a).

(10aa) In order to support public sector bodies and re-users, the Commission may adopt
implementing acts providing model contractual clauses for complying with the
obligations referred to in paragraph (10) points (a) and (b). Those implementing acts

12124/21
TREE.2.B

RB/ek

41

LIMITEEN

shall be adopted in accordance with the examination procedure referred to in Article
29(3).
(10a)

When justified by a substantial number of requests across the Union concerning there-use of non-personal data in specific third countries, the Commission may adopt
implementing acts declaring that the legal, supervisory and enforcement
arrangements of a third country:(a)ensure protection of intellectual property and trade secrets in a way that isessentially equivalent to the protection ensured under Union law;(b)

are being effectively applied and enforced; and(c)provide effective judicial redress.

Those implementing acts shall be adopted in accordance with the advisory
examination procedure referred to in Article 29 (23).
(11)

Where Sspecific Union acts adopted in accordance with a legislative procedure may
establish that deem certain non-personal data categories held by public sector bodies shallbe deemed to be highly sensitive for the purposes of this Article where their transfer tothird countries may put at risk Union policy objectives, such as safety and publichealth, or may lead to the risk of re-identification of non-personal, anonymised data.
Where such an act is adopted, tThe Commission shall lay down conditions applicableto the transfer to third-countries of such data by way of be empowered to adopt
delegated implementing acts in accordance with Article 28 supplementing this Regulation
by laying down special conditions applicable for transfers to third-countries.
The Those conditions for the transfer to third-countries shall be based on the nature of
non-personal data categories identified in the specific Union act and on the grounds fordeeming them highly sensitive, non-discriminatory and limited to what is necessary toachieve the public policy objectives identified in the Union law act, such as safety andpublic health, as well as risks of re-identification of anonymized data for data subjects, inaccordance with the Union’s international obligations.
They If specific Union acts under the first subparagraph require so, such conditions
may include terms applicable for the transfer or technical arrangements in this regard,
limitations as regards the re-use of data in third-countries or categories of persons which
are entitled to transfer such data to third countries or, in exceptional cases, restrictions as
regards transfers to third-countries.
Those implementing acts shall be adopted in accordance with the examination
procedure referred to in Article 29(3).

(12)

The natural or legal person to which the right to re-use non-personal data was granted may
transfer the data only to those third-countries for which the requirements in paragraphs 910
to 11 are met.

(13)

Where the re-user intends to transfer non-personal data to a third country, the public sector
body shall inform the data holder about the transfer of data to that third country.

12124/21
TREE.2.B

RB/ek

42

LIMITEEN

Article 6
Fees
(1)

Public sector bodies which allow re-use of the categories of data referred to in Article 3 (1)may charge fees for allowing the re-use of such data.

(2)

Any fees shall be non-discriminatory, proportionate and objectively justified and shall not
restrict competition.

(3)

Public sector bodies shall ensure that any fees can be paid online through widely available
cross-border payment services, without discrimination based on the place of establishmentof the payment service provider, the place of issue of the payment instrument or thelocation of the payment account within the Union.

(4)

Where they apply fees, public sector bodies shall take measures to incentivise the re-use of
the categories of data referred to in Article 3 (1) for non-commercial purposes such as
scientific research purposes and by small and medium-sized enterprises in line with Stateaid rules. This may include allowing re-use at lower or no fee.

(5)

Fees shall be derived from the costs related to the processing of requests for re-use of thecategories of data referred to in Article 3 (1). Any fees shall be limited to the necessary
costs incurred for the reproduction, provision and dissemination of data, rights’clearance, costs for anonymisation or other forms or preparation of personal andconfidential data as provided for in Article 5(3), costs for the maintenance of the
secure processing environment, costs in relation to the acquisition of the right topermit re-use in accordance with this Chapter from third parties outside the public
sector, as well as any costs in relation to supporting re-users in seeking consent offrom data subjects and permission from data holders whose rights and interests may
be affected by such re-use. The methodology for calculating fees shall be published inadvance.

(6)

The criteria and methodology for calculating fees shall be laid down by the Member
States and published in advance. The public sector body shall publish a description of
the main categories of costs and the rules used for the allocation of costs.
Article 7Competent bodies(1)

For the tasks mentioned in this Article, Member States shall designate one or morecompetent bodies, which may be sectoral, to support the public sector bodies which grant
access to the re-use of the categories of data referred to in Article 3 (1) in the exercise ofthat task. Member States may either establish one or more new competent bodies orrely on existing public sector bodies or on internal services of public sector bodies
that fulfil the conditions set out by this Regulation.

(1a)

The competent bodies may also be entrusted, pursuant to Union or national law
which provides for such access to be given, to grant access for the re-use of thecategories of data referred to in Article 3 (1). While performing their function to
grant or refuse access for re-use, Articles 4, 5, 6 and 8a shall apply in regard to suchcompetent bodies.

12124/21
TREE.2.B

RB/ek

43

LIMITEEN

(1b)The competent bodies shall have adequate legal, financial and technical resources tobe able to comply with relevant Union or national law concerning the access regimes
for the categories of data referred to in Article 3 (1).

(2)

The support provided for in paragraph 1 shall include, where necessary:(a)providing technical support by making available a secure processing environment forproviding access for the re-use of data;(b)providing technical support for in the application of tested techniques ensuring dataprocessing in a manner that preserves privacy and confidentiality of the information
contained in the data for which re-use is allowed, including techniques forpseudonymisation, anonymisation, generalisation, suppression and randomisation of
personal data;(c)where relevant, assisting the public sector bodies to provide assistance to re-users,
where relevant, in obtaining consent for re-use from data subjects or permission
from data holders by re-users for re-use for altruistic and other purposes in line with
their specific decisions of data holders, including on the jurisdiction or jurisdictions
in which the data processing is intended to take place;(d)providing public sector bodies with assistance on the adequacy of undertakings madeby a re-user, pursuant to Article 5 (10).

(3)

The competent bodies may also be entrusted, pursuant to Union or national law which
provides for such access to be given, to grant access for the re-use of the categories of data
referred to in Article 3 (1). While performing their function to grant or refuse access for reuse, Articles 4, 5, 6 and 8 (3) shall apply in regard to such competent bodies.

(4)

The competent body or bodies shall have adequate legal, and technical capacities andexpertise to be able to comply with relevant Union or national law concerning the accessregimes for the categories of data referred to in Article 3 (1).

(5)

The Member States shall communicate to the Commission the identity of the competentbodies designated pursuant to paragraph 1 by [date of application of this Regulation]. They
shall also communicate to the Commission any subsequent modification of the identity of
those bodies.
Article 8Single information point(1)

Member States shall ensure that all relevant information concerning the application of
Articles 5 and 6 is available through a single information point which may be linked to
sectoral, regional or local information points. Functions of a single information point
may be automated provided that adequate support by a public sector body is ensured.
Member States may either establish a new information point or rely on an existing
structure.

(2)

The single information point shall be competent to receive enquiries or requests for the
re-use of the categories of data referred to in Article 3 (1) and shall transmit them to thecompetent public sector bodies, or the competent bodies referred to in Article 7 (1), where

12124/21
TREE.2.B

RB/ek

44

LIMITEEN

relevant, and where possible and appropriate, by automated means. The single
information point shall make available by electronic means a register an asset list
containing an overview of of all available data resources, including, where relevant,those data resources available at sectoral, regional or local information points,
containing with relevant information describing the nature of available data.
Article 8a
Processing of requests for re-use(1) (3) Unless shorter time limits have been established in accordance with national law, adecision on the rRequests for the re-use of the categories of data referred to in Article 3(1) shall be adopted granted or refused by the competent public sector bodies or thecompetent bodies referred to in Article 7 (1) within a reasonable time, and in any casewithin two months from the date of the receipt of the request.
(2)

In the case of exceptionally extensive and complex requests this period may be
extended by no more than 30 days. In such cases the applicant shall be notified assoon as possible that more time is needed to process the request and the reasons why.

(2) (4) Any natural or legal person directly affected by a decision of a public sector body or of acompetent body adopted in accordance with paragraph 1, as the case may be, shall havean effective right of redress the right to an effective judicial remedy against such decision
before the courts in of the Member State where the relevant body is located. Such right ofredress shall be laid down in national law and shall include the possibility of review
by an impartial review body with the appropriate expertise, such as the national
competition authority, the relevant access to documents authority, the supervisory
authority established in accordance with Regulation (EU) 2016/679 or a national
judicial authority, whose decisions are binding upon the public sector bodyconcerned.

12124/21
TREE.2.B

RB/ek

45

LIMITEENCHAPTER III
REQUIREMENTS APPLICABLE TO DATA SHARING INTERMEDIATIONSERVICES

Article 9
Providers of Ddata intermediation sharing services
(1)

(2)

The provision of the following data sharing intermediation services shall comply withthe requirements of Article 11 and shall be subject to a notification procedure:(a)intermediation services between data holders which are legal persons and potential
data users, including making available the technical or other means to enable suchservices; those services may include bilateral or multilateral exchanges of data or thecreation of platforms or databases enabling the exchange or joint exploitation use ofdata, as well as the establishment of a specific infrastructure for the interconnectionof data holders and data users;(b)intermediation services between data subjects that seek to make their personal data
available or natural persons that seek to make other data available, and potential
data users, including making available the technical or other means to enable suchservices, including in the exercise of the rights provided in Regulation (EU)2016/679;(c)services of data cooperatives. , that is to say services supporting data subjects or oneperson companies or micro, small and medium-sized enterprises, who are membersof the cooperative or who confer the power to the cooperative to negotiate terms andconditions for data processing before they consent, in making informed choices
before consenting to data processing, and allowing for mechanisms to exchange
views on data processing purposes and conditions that would best represent theinterests of data subjects or legal persons.

This Chapter shall be without prejudice to the application of other Union and national law
to providers of data sharing services, including powers of supervisory authorities to ensurecompliance with applicable law, in particular as regard the protection of personal data andcompetition law.

12124/21
TREE.2.B

RB/ek

46

LIMITEEN

Article 10
Notification of data sharing intermediation service providers(1)

Any provider of data sharing intermediation services who intends to provide the services
referred to in Article 9 (1) shall submit a notification to the competent authority for dataintermediation services referred to in Article 12.

(2)

For the purposes of this Regulation, a provider of data sharing intermediation services
with establishments in more than one Member State, shall be deemed to be under thejurisdiction of the Member State in which it has its main establishment.

(3)

A provider of data sharing intermediation services that is not established in the Union, butoffers the services referred to in Article 9 (1) within the Union, shall appoint a legal
representative in one of the Member States in which those services are offered. The
provider shall be deemed to be under the jurisdiction of the Member State in which thelegal representative is established located. The representative shall be mandated by theprovider of data intermediation services to be addressed in addition to or instead of itby, in particular, competent authorities, data subjects and data holders as well as
data users, on all issues related to the intermediation services, for the purposes of
ensuring compliance with this Regulation. The designation of a representative by theprovider of data intermediation services shall be without prejudice to legal actions
which could be initiated against the provider of data intermediation services
themselves.

(4)

Upon After having submitted a notification in accordance with paragraph 1, theprovider of data sharing intermediation services may start the activity subject to theconditions laid down in this Chapter.

(5)

The notification shall entitle the provider to provide data sharing intermediation services
in all Member States.

(6)

The notification shall include the following information:(a)the name of the provider of data sharing intermediation services;(b)the provider’s legal status, form and registration number, where the provider isregistered in trade or in another similar public register;(c)the address of the provider’s main establishment in the Union, if any, and, whereapplicable, any secondary branch in another Member State or that of the legal
representative designated pursuant to paragraph 3;(d)a website where information on the provider and the activities can be found, whereapplicable, including as a minimum the information as referred to in points
letters (a), (b), (c) and (f);12124/21
TREE.2.B

RB/ek

47

LIMITEEN(e)the provider’s contact persons and contact details;(f)a description of the service the provider intends to provide, and indicate anindication under which of the categories under Article 9 (1) such services fall,and how the conditions set in Article 11 are fulfilled;(g)the estimated date for starting the activity, if this is different from the date of thenotification;.

(h)the Member States where the provider intends to provide services.

(7)

At the request of the provider, the competent authority for data intermediation services
shall, within one week of duly and fully completed notification, issue a standardised
declaration, confirming that the provider has submitted the notification referred to inparagraph 4.

(8)

The competent authority shall forward each notification to the national competentauthorities of the Member States by electronic means, without delay.

(9)

The competent authority for data intermediation services shall notify the Commission ofeach new notification. The Commission shall keep a public register of all providers of data
sharing intermediation services providing services in the Union, which shall makeavailable the information referred to in points (a), (b), (c), (d) and (g) of paragraph 6,
as well as in point (f) with regard to the description of the service the provider intends
to provide and the categories listed in Article 9 (1) under which such services fall.

(10)

The competent authority for data intermediation services may charge fees for the
notification, as defined by national law. Such fees shall be proportionate and objective
and be based on the administrative costs related to the monitoring of compliance and othermarket control activities of the competent authorities in relation to notifications of data
sharing intermediation services.

(11)

Where a provider of data sharing intermediation services ceases its activities, it shallnotify the relevant competent authority for data intermediation services determined
pursuant to paragraphs 1, 2 and 3 within 15 days. The competent authority shall forward
inform the Commission by electronic means without delay of each such notification
without delay. to the national competent authorities in the Member States and to theCommission by electronic means.

12124/21
TREE.2.B

RB/ek

48

LIMITEEN

Article 11
Conditions for providing data sharing intermediation services
The provision of data sharing intermediation services referred in Article 9 (1) shall be subject tothe following conditions:(1)the provider may not use the data for which it provides services for other purposes
than to put them at the disposal of data users and shall provide data sharing
intermediation services through a legally separate structure shall be placed in a
separate legal entity;(2)

the metadata data collected on any activity of a natural or legal person for the
purposes of the provision of a data intermediation service, including the date,time and geolocation data, duration of activity, connections to other natural or
legal persons established by the person who uses the service from the provision of
the data sharing service may be used only for the purpose of development of that
service;(3)

the provider shall ensure that the procedure for access to its service is fair,transparent and non-discriminatory for both data holders and data users, including as
regards prices;(4)

the provider shall facilitate the exchange of the data in the format in which it receives
it from the a data holder subject or a data holder and shall convert the data into
specific formats only to enhance interoperability within and across sectors or if
requested by the data user or where mandated by Union law or to ensureharmonisation with international or European data standards,. Where this request is
made by the data user, the provider shall inform the data holder, who may
oppose the conversion of such data;(4a) the provider may offer additional specific services to data subjects and dataholders facilitating the exchange of the data, such as storage, curation,
pseudonymisation and anonymisation;(4b) the provider shall ensure that the procedure for access to its service is fair,transparent and non-discriminatory for both data subjects and data holders, aswell as for data users, including as regards prices;(5)

the provider shall have procedures in place to prevent fraudulent or abusive practices
in relation to access to data from parties seeking access through their services;(6)

the provider shall ensure a reasonable continuity of provision of its services and, inthe case of services which ensure storage of data, shall have sufficient guarantees inplace that allow data holders subjects and data holders, as well as and data users,
to obtain access to their data in case of insolvency of the provider;(6a) the provider shall take reasonable measures to ensure interoperability withother data intermediation services, among others, by means of commonly-used
12124/21
TREE.2.B

RB/ek

49

LIMITEEN

standards in the sector in which the data intermediation service providers
operate;(7)

the provider shall put in place adequate technical, legal and organisational measuresin order to prevent transfer or access to non-personal data that is unlawful under
Union law or national law of the relevant Member State;(7a) the provider shall without undue delay inform data holders in case of anunauthorised transfer, access or use of the non-personal data that it has shared;(8)

the provider shall take measures to ensure a high an appropriate level of security
for the storage and transmission of non-personal data;(9)

the provider shall have procedures in place to ensure compliance with the Union andnational rules on competition;(10) the provider offering services to data subjects shall act in the data subjects’ bestinterest when facilitating the exercise of their rights, in particular by informing and,
where appropriate, advising data subjects in a concise, transparent, intelligible
and easily accessible form about intended data uses by third parties andstandard terms and conditions attached to such uses, before data subjects giveconsent advising data subjects on potential data uses and standard terms andconditions attached to such uses;(11) where a provider provides tools for obtaining consent from data subjects or
permissions to process data made available by data holders legal persons, it shall,where relevant, specify the jurisdiction or jurisdictions outside the Union in which
the data use is intended to take place and provide data subjects with tools to bothgive and withdraw consent and data holders with tools to both give andwithdraw permissions to process data;.
(12) the provider shall maintain a log record of the intermediation activity.

12124/21
TREE.2.B

RB/ek

50

LIMITEEN

Article 12Competent authorities(1)

Each Member State shall designate in its territory one or more authorities competent tocarry out the tasks related to the notification framework for data intermediation services
and shall communicate to the Commission the identity of those designated authorities by[date of application of this Regulation]. It shall also communicate to the Commission any
subsequent modification.

(2)

The designated competent authorities for data intermediation services shall comply with
Article 23.

(3)

The powers of the designated competent authorities are without prejudice to thepowers The designated competent authorities, of the data protection authorities, thenational competition authorities, the authorities in charge of cybersecurity, and otherrelevant sectorial authorities. These authorities shall exchange the information which isnecessary for the exercise of their tasks and cooperate in view of enforcement in relation
to data sharing intermediation service providers.
Article 13
Monitoring of compliance(1)

The competent authority for data intermediation services shall monitor and supervise
compliance with this Chapter. The competent authority may also monitor andsupervise the compliance of such data intermediation services based on the request ofnatural or legal persons.

(2)

The competent authority for data intermediation services shall have the power to requestfrom providers of data sharing intermediation services all the information that isnecessary to verify compliance with the requirements laid down in Articles 10 and 11 of
this Chapter. Any request for information shall be proportionate to the performance of thetask and shall be reasoned.

(3)

Where the competent authority for data intermediation services finds that a provider ofdata sharing intermediation services does not comply with one or more of therequirements laid down in Article 10 or 11 of this Chapter, it shall notify that provider of
those findings and give it the opportunity to state its views, within a reasonable time limit
30 days.

12124/21
TREE.2.B

RB/ek

51

LIMITEEN(4)The competent authority for data sharing intermediation services shall have the power
to require the cessation of the breach referred to in paragraph 3 either immediately or
within a reasonable time limit and shall take appropriate and proportionate measures aimed
at ensuring compliance. In this regard, the competent authorities shall be able, whereappropriate:(a)to impose, through administrative procedures, dissuasive financial penalties which
may include periodic penalties and penalties with retroactive effect, or to initiate
legal proceedings for the imposition of fines, or both;(b)to require cessation or postponement of the provision of the data sharing
intermediation service due to serious or substantial breaches that have not beencorrected despite prior notification or warning or suspension of the provision ofsuch a service until modifications of its conditions, as requested by thecompetent authority, are made; the competent authority for dataintermediation services shall request the Commission to remove the provider ofthe data intermediation service from the register of providers of dataintermediation services once it has ordered the cessation of the service. If a
provider of data intermediation service corrects the breaches, a provider shallre-notify the competent authority. The competent authority shall notify theCommission of each new re-notification.

(5)

The competent authorities for data intermediation services shall communicate themeasures imposed pursuant to paragraph 4 and the reasons on which they are based to theentity concerned without delay and shall stipulate a reasonable period, not longer than 30days, for the entity to comply with the measures.

(6)

If a provider of data sharing intermediation services has its main establishment or legal
representative in a Member State, but provides services in other Member States, thecompetent authority of the Member State of the main establishment or where the legal
representative is located and the competent authorities of those other Member States shallcooperate and assist each other. Such assistance and cooperation may cover informationexchanges between the competent authorities concerned for the purposes of their tasks
under this Regulation and requests to take the measures referred to in this Article. Wherea competent authority for data intermediation services in one Member State requests
assistance from another Member State, it shall submit a duly justified request. The
competent authority for data intermediation services so requested shall, without
undue delay and within a timeframe proportionate to the urgency of the request,
provide a response. Any information exchanged in the context of assistance requested
and provided under this paragraph shall be used only in respect of the matter forwhich it was requested.

12124/21
TREE.2.B

RB/ek

52

LIMITEEN

Article 14
Exceptions
This Chapter shall not apply to recognised data altruism organisations and other not-for-profit
entities insofar as their whose activities consist only in seeking to collect data for objectives ofgeneral interest, made available by natural or legal persons on the basis of data altruism.

12124/21
TREE.2.B

RB/ek

53

LIMITEENCHAPTER IVDATA ALTRUISM

Article 14a
National arrangements Policies for dData aAltruism(1)

Member States may have in place organisational and/or technical arrangements tofacilitate data altruism. In support of this Member States may define national policies
for data altruism. These national policies may in particular support data subjects inmaking personal data related to them held by public sector bodies available
voluntarily for data altruism, and set out the necessary information that is required
to be provided to data subjects concerning the re-use of their data in the generalinterest. If a Member State develops such national policies, it shall inform theCommission.

(2)

The European Data Innovation Board shall advise and assist in developing aconsistent practice for data altruism across the Union.
Article 15
Register of recognised data altruism organisations(1)

Each competent authority for the registration of data altruism organisations designatedpursuant to Article 20 shall keep a public national register of recognised data altruism
organisations.

(2)

An entity registered in a national register of data altruism organisations inaccordance with Article 16 may refer to itself as a ‘data altruism organisation
recognised in the Union’ in its written and spoken communication. The Commission
shall maintain a Union register of recognised data altruism organisations.

(3)

The Commission shall maintain a public Union register of recognised data altruism
organisations for information purposes. An entity registered in the register inaccordance with Article 16 may refer to itself as a ‘data altruism organisation recognised in
the Union’ in its written and spoken communication.

12124/21
TREE.2.B

RB/ek

54

LIMITEEN

Article 16
General requirements for registration
In order to qualify for registration in a national register of recognised data altruism
organisations, an entity the data altruism organisation shall:(-a)

perform data altruism activities;(a)be a legal entity person established pursuant to national law constituted to meet
objectives of general interest, in line with national law, where applicable;(b)

operate on a not-for-profit basis and be independent from any entity that operates on a forprofit basis;(c)

perform the activities related to data altruism take place through a structure that is legallyfunctionally independent separate structure, separate from its other activities it has
undertaken.

(d)comply with codes of conduct adopted in accordance with Article 19a(2), at the latest
by [date of entry into force of the implementing act + 18 months].
Article 17
Registration of recognised data altruism organisations(1)

Any entity which meets the requirements of Article 16 may request to be entered in thenational register of recognised data altruism organisations in the Member State in which
it is established referred to in Article 15 (1).

(2)

For the purposes of this Regulation, aAn entity which meets the requirements of Article
16 and engaged in activities based on data altruism with has establishments in more than
one Member State, may request to be entered in the national register of recognised
data altruism organisations shall register in the Member State in which it has its mainestablishment.

(3)

An entity which meets the requirements in Article 16, but that is not established in theUnion, but meets the requirements in Article 16, shall appoint a legal representative in oneof the Member States where it intends to collect data based on data altruism. For the
purpose of compliance with this Regulation, that entity shall be deemed to be under thejurisdiction of the Member State where the legal representative is located. Such an entity
may request to be entered in the national register of recognised data altruism
organisations in that Member State.

12124/21
TREE.2.B

RB/ek

55

LIMITEEN

(4)Applications for registration shall contain the following information:(a)name of the entity;(b)the entity’s legal status, form and registration number, where the entity is registeredin a public register;(c)the statutes of the entity, where appropriate;(d)the entity’s main sources of income;(e)the address of the entity’s main establishment in the Union, if any, and, whereapplicable, any secondary branch in another Member State or that of the legal
representative designated pursuant to paragraph (3);(f)

a website where information on the entity and the activities can be found, including
as a minimum the information as referred to in points letters (a), (b), (d), (e) and
(h);

(g)

the entity’s contact persons and contact details;(h)the purposes objectives of general interest it intends to promote when collecting
data;

(i)

any other documents which demonstrate that the requirements of Article 16 are met.

(5)

Where the entity has submitted all necessary information pursuant to paragraph 4 and thecompetent authority for the registration of data altruism organisations considers thatthe entity complies with the requirements of Article 16, it shall enter register the entity inthe its national register of recognised data altruism organisations within twelve weeks
from the date of application. The registration shall be valid in all Member States. Anyregistration shall be communicated to the Commission, for inclusion The competentauthority for the registration of data altruism organisations shall communicate any
registration to the Commission, which shall include that registration in the Union
register of recognised data altruism organisations.

(6)

The information referred to in paragraph 4, points (a), (b), (f), (g), and (h) shall be
published in the relevant national register of recognised data altruism organisations.

(7)

Any entity entered in the a national register of recognised data altruism organisations shallsubmit notify the competent authority for the registration of data altruism
organisations of any changes of the information provided pursuant to paragraph 4 to thecompetent authority within 14 calendar days from the day on which the change takes place.
The competent authority shall inform the Commission by electronic means of eachsuch notification without delay. Based on such notification, the Commission shallupdate the Union register of recognised data altruism organisations without delay.

12124/21
TREE.2.B

RB/ek

56

LIMITEEN

Article 18
Transparency requirements
(1)

(2)

Any entity entered in the a national register of recognised data altruism organisations shallkeep full and accurate records concerning:(a)

all natural or legal persons that were given the possibility to process data held by that
entity, and their contact details;(b)

the date or duration of such processing of personal data or use of non-personal data;(c)the purpose of such processing as declared by the natural or legal person that wasgiven the possibility of processing;(d)the fees paid by natural or legal persons processing the data, if any.

Any entity entered in the a register of recognised data altruism organisations shall draw up
and transmit to the relevant competent national authority for the registration of data
altruism organisations an annual activity report which shall contain at least the following:(a)information on the activities of the entity;(b)a description of the way in which the general interest purposes for which data wascollected have been promoted during the given financial year;(c)a list of all natural and legal persons that were allowed to use process data it holds,
including a summary description of the general interest purposes pursued by suchdata use processing and the description of the technical means used for it, including
a description of the techniques used to preserve privacy and data protection;(d)a summary of the results of the data uses processing allowed by the entity, whereapplicable;(e)information on sources of revenue of the entity, in particular all revenue resulted
from allowing access to the data, and on expenditure.

Article 19
Specific requirements to safeguard rights and interests of data subjects and data holders legal
entities as regards their data
(1)

Any entity entered in the a national register of recognised data altruism organisations shallinform data subjects and data holders prior to any processing of their data(a)about the purposes objectives of general interest and, if applicable, the specified,
explicit and legitimate purpose for which personal data will be processed, forwhich it permits the processing of their data by a data user in an easy-to-understandmanner;12124/21
TREE.2.B

RB/ek

57

LIMITEEN

(b)about the location of any processing performed outside the Union, in case theprocessing is performed by the entity entered in a national register ofrecognised data altruism organisations itself.

(2)

The entity shall also ensure that the data is not be used for other purposes objectives thanthose of general interest for which it the data subject or data holder permits theprocessing.

(2a)The entity shall provide tools for obtaining consent from data subjects or permissions
to process data made available by data holders. The entity shall also provide tools foreasy withdrawal of such consent or permission.

(2b)

The entity shall take measures to ensure an appropriate level of security for the
storage and processing of non-personal data that it has collected based on data
altruism.

(2c)

The entity shall without undue delay inform data holders in case of an unauthorised
transfer, access or use of the non-personal data that it has shared.

(3)

Where an the entity entered in the register of recognised data altruism organisations
facilitates data processing by third parties, including by providinges tools for obtaining
consent from data subjects or permissions to process data made available by data holders
legal persons, it shall, where relevant, specify the jurisdiction or jurisdictions outside theUnion in which the data use is intended to take place.

Article 19a
Codes of conduct(1)

The Commission shall, by way of implementing acts, adopt codes of conduct
developed in close cooperation with data altruism organisations and relevant
stakeholders laying down:a) appropriate information requirements to ensure that data holders and data
subjects are provided, before a consent or permission for data altruism isgiven, with sufficiently detailed, clear and transparent information regarding
the use of data, the tools for the giving and withdrawal of the consent, and themeasures taken to avoid misuse of the data shared with the data altruism
organisation;b) appropriate technical and security requirements to ensure the appropriate
level of security for the storage and processing of data, as well as for the tools
for obtaining and withdrawing consent and permission;

12124/21
TREE.2.B

RB/ek

58

LIMITEENc) communication roadmaps taking a multi-disciplinary approach to raiseawareness of data altruism, of the designation as a data altruism organisation
recognised in the Union and of the codes of conduct among relevant
stakeholders, in particular data holders and data subjects that would
potentially share their data;d) recommendations on relevant interoperability standards.
(2)

Those implementing acts shall be adopted in accordance with the examination
procedure set out in Article 29 (3).
Article 20
Competent authorities for the registration of data altruism organisations registration(1)

Each Member State shall designate one or more competent authorities responsible for thetheir national register of recognised data altruism organisations and for the monitoring ofcompliance with the requirements of this Chapter. The designated competent authorities
for the registration of data altruism organisations shall meet the requirements of Article
23.

(2)

Each Member State shall inform the Commission of the identity of the their designatedcompetent authorities for the registration of data altruism organisations.

12124/21
TREE.2.B

RB/ek

59

LIMITEEN(3)The competent authority for the registration of data altruism organisations of a
Member State shall undertake its tasks in cooperation with the relevant data protection
authority, where such tasks are related to processing of personal data, and with relevant
sectoral bodies of the same that Member State. For any question requiring an assessmentof compliance with Regulation (EU) 2016/679, the competent authority shall first seek an
opinion or decision by the competent supervisory authority established pursuant to that
Regulation and comply with that opinion or decision.
Article 21
Monitoring of compliance(1)

The competent authority for the registration of data altruism organisations shallmonitor and supervise compliance of entities entered in the its national register ofrecognised data altruism organisations with the conditions laid down in this Chapter. The
competent authority for the registration of data altruism organisations may also
monitor and supervise the compliance of such entities based on the request of naturalor legal persons.

(2)

The competent authority shall have the power to request information from entities includedin the its national register of recognised data altruism organisations that is necessary toverify compliance with the provisions of this Chapter. Any request for information shall be
proportionate to the performance of the task and shall be reasoned.

(3)

Where the competent authority finds that an entity does not comply with one or more of
the requirements of this Chapter it shall notify the entity of those findings and give it theopportunity to state its views, within 30 days a reasonable time limit.

(4)

The competent authority shall have the power to require the cessation of the breachreferred to in paragraph 3 either immediately or within a reasonable time limit and shalltake appropriate and proportionate measures aimed at ensuring compliance.

(5)

If an entity does not comply with one or more of the requirements of this Chapter evenafter having been notified in accordance with paragraph 3 by the competent authority, theentity shall:

12124/21
TREE.2.B

RB/ek

60

LIMITE

EN

(6)

(a)

lose its right to refer to itself as a ‘data altruism organisation recognised in theUnion’ in any written and spoken communication;(b)

be removed from the relevant national register of recognised data altruism
organisations, and the Union register of recognised data altruism organisations.

If an entity included in the a national register of recognised data altruism organisations has
its main establishment or legal representative in a Member State but is active in otherMember States, the competent authority of the Member State of the main establishment or
where the legal representative is located and the competent authorities of those otherMember States shall cooperate and assist each other as necessary. Such assistance andcooperation may cover information exchanges between the competent authorities
concerned and requests to take the supervisory measures referred to in this Article. Wherea competent authority in one Member State requests assistance from anotherMember State, it shall submit a duly justified request. The competent authority shall,
upon such a request, provide a response without undue delay and within a timeframe
proportionate to the urgency of the request. Any information exchanged in thecontext of assistance requested and provided under this paragraph shall be used only
in respect of the matter for which it was requested.
Article 22
European data altruism consent form

(1)

In order to facilitate the collection of data based on data altruism, the Commission may
shall adopt implementing acts establishing and developing a European data altruism
consent form, after consultation of the European Data Protection Board, and duly
involving relevant stakeholders. The form shall allow the collection of consent acrossMember States in a uniform format. Those implementing acts shall be adopted inaccordance with the advisory procedure referred to in Article 29(2).

(2)

The European data altruism consent form shall use a modular approach allowing
customisation for specific sectors and for different purposes.

(3)

Where personal data are provided, the European data altruism consent form shall ensurethat data subjects are able to give consent to and withdraw consent from a specific dataprocessing operation in compliance with the requirements of Regulation (EU) 2016/679.

(4)

The form shall be available in a manner that can be printed on paper and is easily
understandable and read by humans as well as in an electronic, machine-readable form.

12124/21
TREE.2.B

RB/ek

61

LIMITEENCHAPTER VCOMPETENT AUTHORITIES AND PROCEDURAL PROVISIONS

Article 23
Requirements relating to competent authorities(1)

The competent authorities designated pursuant to Article 12 and Article 20 shall be legallydistinct from, and functionally independent of any provider of data sharing intermediation
services or entity included in the a national register of recognised data altruism
organisations. The functions of the competent authorities designated pursuant to
Article 12 and Article 20 may be performed by the same entity. Member States mayeither establish one or more new entities or rely on existing ones.

(2)

Competent authorities shall exercise their tasks in an impartial, transparent, consistent,
reliable and timely manner.

(3)

The top-management and the personnel responsible for carrying out the relevant tasks ofthe competent authority authorities provided for in this Regulation cannot be the designer,
manufacturer, supplier, installer, purchaser, owner, user or maintainer of the services
which they evaluate, nor the authorised representative of any of those parties or represent
them. This shall not preclude the use of evaluated services that are necessary for theoperations of the a competent authority or the use of such services for personal purposes.

(4)Top-management and personnel of the competent authorities shall not engage in any
activity that may conflict with their independence of judgment or integrity in relation toevaluation activities entrusted to them.

(5)

The competent authorities shall have at their disposal the adequate financial and humanresources to carry out the tasks assigned to them, including the necessary technicalknowledge and resources.

(6)

The competent authorities of a Member State shall provide the Commission and competentauthorities from other Member States, on reasoned request and without undue delay, with
the information necessary to carry out their tasks under this Regulation. Where a national
competent authority considers the information requested to be confidential in accordancewith Union and national rules on commercial and professional confidentiality, theCommission and any other competent authorities concerned shall ensure suchconfidentiality.

12124/21
TREE.2.B

RB/ek

62

LIMITEEN

Article 24
Right to lodge a complaint(1)

Any affected Nnatural and legal persons shall have the right to lodge a complaint with therelevant national competent authority against a provider of data sharing intermediation
services or an entity entered in the a national register of recognised data altruism
organisations in relation to any matter falling within the scope of this Regulation.

(2)

The competent authority with which the complaint has been lodged shall inform thecomplainant of the progress of the proceedings and of the decision taken, and shall informthe complainant of the right to an effective judicial the remedyies provided for in Article
25.
Article 25
Right to an effective judicial remedy(1)

Notwithstanding any administrative or other non-judicial remedies, any affected naturaland legal persons shall have the right to an effective judicial remedy with regard to:(a)a failure to act on a complaint lodged with the competent authority referred to in Articles
12 and 20;(b)legally binding decisions of the competent authorities referred to in Articles 13, 17 and 21
taken in the management, control and enforcement of the notification regime for providersof data sharing intermediation services and the monitoring of entities entered into the anational register of recognised data altruism organisations.

(2)

Proceedings pursuant to this Article shall be brought before the courts of the Member Statein which the of the competent authority against which the judicial remedy is sought islocated individually or, where relevant, by the representatives of one or more naturalor legal persons.

(3)

When a competent authority fails to act on a complaint, any affected natural andlegal persons shall either have the right to effective judicial remedy or access toreview by an impartial body with the appropriate expertise.

12124/21
TREE.2.B

RB/ek

63

LIMITEENCHAPTER VI
EUROPEAN DATA INNOVATION BOARD

Article 26
European Data Innovation Board(1)

The Commission shall establish a European Data Innovation Board (“the Board”) in theform of an Expert expert Group group, consisting of the representatives of the competentauthorities of all the Member States pursuant to Article 12 and Article 20, the European
Data Protection Board, the Commission, relevant data spaces and other representatives ofcompetent authorities relevant bodies in specific sectors as well as bodies with specificexpertise.

(1a)

The Board shall consist of at least one sub-group composed of the competentauthorities referred to in Article 12 and Article 20, with a view of carrying out thetasks pursuant to Article 27 point (a), (b), (e) and (f), as well as at least one sub-groupfor technical discussions on standardisation and interoperability pursuant to Article
27 point (c) and (d).

(2)

Stakeholders and relevant third parties may shall be invited to attend meetings of theBoard and to participate in its work, where relevant.

(3)

The Commission shall chair the meetings of the Board.

(4)

The Board shall be assisted by a secretariat provided by the Commission.

12124/21
TREE.2.B

RB/ek

64

LIMITEEN

Article 27
Tasks of the European Data Innovation Board
The Board shall have the following tasks:(a)to advise and assist the Commission in developing a consistent practice of public sector
bodies and competent bodies referred to in Article 7 (1) in processing requests for the reuse of the categories of data referred to in Article 3 (1);(b)

to advise and assist the Commission in developing a consistent practice of the competentauthorities referred to in Article 12 and Article 20 in the application of requirements
applicable to data sharing intermediation service providers and entities performing
activities related to data altruism, respectively;(c)to advise and assist the Commission on the prioritisation of cross-sector standards to be
used and developed for data use and cross-sector data sharing, cross-sectoral comparisonand exchange of best practices with regards to sectoral requirements for security, accessprocedures, while taking into account sector-specific standardisations activities;(d)to advise and assist the Commission in enhancing the interoperability of data as well as
data sharing intermediation services between different sectors and domains, building on
existing European, international or national standards;(e)

to facilitate the cooperation between national competent authorities referred to in Article
12 and Article 20 under this Regulation through capacity-building and the exchange of
information, in particular by establishing methods for the efficient exchange of information
relating to the notification procedure for data sharing intermediation service providers andthe registration and monitoring of recognised data altruism organisations, including
coordination regarding the setting of fees or penalties, as well as facilitate cooperation
between competent authorities regarding international access and transfer of data;.

(f)advise and assist the Commission in evaluating whether implementing acts inaccordance with Articles 5(10a) and 5(10aa) should be adopted.

12124/21
TREE.2.B

RB/ek

65

LIMITEENCHAPTER VII
COMMITTEE PROCEDURE AND DELEGATION

Article 28
Exercise of the Delegation(1)

The power to adopt delegated acts is conferred on the Commission subject to theconditions laid down in this Article.

(2)

The power to adopt delegated acts referred to in Article 5 (11) shall be conferred on theCommission for an indeterminate period of time from […].

(3)

The delegation of power referred to in Article 5 (11) may be revoked at any time by theEuropean Parliament or by the Council. A decision to revoke shall put an end to thedelegation of the power specified in that decision. It shall take effect the day following the
publication of the decision in the Official Journal of the European Union or at a later datespecified therein. It shall not affect the validity of any delegated acts already in force.

(4)

Before adopting a delegated act, the Commission shall consult experts designated by each
Member State in accordance with the principles laid down in the Interinstitutional
Agreement of 13 April 2016 on Better Law-Making.

(5)

As soon as it adopts a delegated act, the Commission shall notify it simultaneously to theEuropean Parliament and to the Council.

(6)

A delegated act adopted pursuant to Article 5 (11) shall enter into force only if noobjection has been expressed either by the European Parliament or by the Council within aperiod of three months of notification of that act to the European Parliament and to theCouncil or if, before the expiry of that period, the European Parliament and the Council
have both informed the Commission that they will not object. That period shall be
extended by three months at the initiative of the European Parliament or of the Council.

12124/21
TREE.2.B

RB/ek

66

LIMITEEN

Article 29
Committee procedure(1)

The Commission shall be assisted by a committee. That committee shall be a committee
within the meaning of Regulation (EU) No 182/2011.

(2)

Where reference is made to this paragraph, Article 4 of Regulation (EU) No 182/2011 shallapply.

(3)

Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011
shall apply.

(3)

Where the opinion of the committee is to be obtained by written procedure, that procedure
shall be terminated without result when, within the time-limit for delivery of the opinion,
the chair of the committee so decides or a committee member so requests. In such a case,the chair shall convene a committee meeting within a reasonable time.

12124/21
TREE.2.B

RB/ek

67

LIMITEENCHAPTER VIIIFINAL PROVISIONS

Article 30
International access and transfer(1)

The public sector body, the natural or legal person to which the right to re-use data was
granted under Chapter 2, the data sharing intermediation service provider or the entity
entered in the a national register of recognised data altruism organisations, as the casemay be, shall take all reasonable technical, legal and organisational measures, including
contractual arrangements, in order to prevent international transfer or governmental
access to non-personal data held in the Union where such transfer or governmental accesswould create a conflict with Union law or the national law of the relevant Member State,
unless the transfer or access are in line with without prejudice to paragraph 2 or 3.

(2)

Any judgment of a court or tribunal and any decision of an administrative authority of athird country requiring a public sector body, a natural or legal person to which the right tore-use data was granted under Chapter 2, a data sharing intermediation service provider
or entity entered in the a national register of recognised data altruism organisations totransfer from or give access to non-personal data subject to within the scope of thisRegulation in the Union may only be recognised or enforceable in any manner if based on
an international agreement, such as a mutual legal assistance treaty, in force between therequesting third country and the Union or any such agreement between the requesting third
country and a Member State concluded before [the entry into force of this Regulation].

(3)

In the absence of such an international agreement, wWhere a public sector body, anatural or legal person to which the right to re-use data was granted under Chapter 2, a data
sharing intermediation service provider or entity entered in the a national register ofrecognised data altruism organisations is the addressee of a decision of a court or of an
administrative authority of a third country to transfer from or give access to non-personal
data within the scope of this Regulation held in the Union and compliance with such a
decision would risk putting the addressee in conflict with Union law or with the nationallaw of the relevant Member State, transfer to or access to such data by that third-country
authority shall take place only:(a)where the third-country system requires the reasons and proportionality of thedecision to be set out, and it requires the court order or the decision, as the case may
be, to be specific in character, for instance by establishing a sufficient link to certain
suspected persons, or infringements;

12124/21
TREE.2.B

RB/ek

68

LIMITEEN(b)the reasoned objection of the addressee is subject to a review by a competent court in
the third-country; and(c)in that context, the competent court issuing the order or reviewing the decision of an
administrative authority is empowered under the law of that third country to takeduly into account the relevant legal interests of the provider of the data protected byUnion law or national law of the relevant the applicable Member State law.

The addressee of the decision shall ask the opinion of the relevant competent bodies or authorities,
pursuant to this Regulation, in order to determine if these conditions are met.
(4)

If the conditions in paragraph 2, or 3 are met, the public sector body, the natural or legal
person to which the right to re-use data was granted under Chapter 2, the data sharing
intermediation service provider or the entity entered in the a national register ofrecognised data altruism organisations, as the case may be, shall provide the minimum
amount of data permissible in response to a request, based on a reasonable interpretation of
the request.

(5)

The public sector body, the natural or legal person to which the right to re-use data was
granted under Chapter 2, the data sharing intermediation service provider and the entity
entered in a national register of recognised providing data altruism organisations shallinform the data holder subject or the data holder about the existence of a request of an
administrative authority in a third-country to access its data, except in cases where therequest serves law enforcement purposes and for as long as this is necessary to preserve theeffectiveness of the law enforcement activity.
Article 31
Penalties

Member States shall lay down the rules on penalties applicable to infringements of the obligations
regarding transfers of non-personal data to third countries pursuant to Article 5 (12) and
Article 30, the obligation of data intermediation service providers to notify pursuant to Article
10, the conditions for providing services pursuant to Article 11, conditions for the registration
as a recognised data altruism organisation pursuant to Articles 18 and 19 of this Regulationand shall take all measures necessary to ensure that they are implemented. The penalties provided
for shall be effective, proportionate and dissuasive. Member States shall by … [date of applicationof this Regulation] notify the Commission of those rules and of those measures by [date ofapplication of the Regulation] and shall notify it the Commission without delay of any subsequent
amendment affecting them.

12124/21
TREE.2.B

RB/ek

69

LIMITEEN

Article 32
Evaluation and review
By [four years 48 months after the date of application of this Regulation], the Commission shallcarry out an evaluation of this Regulation, and submit a report on its main findings to the European
Parliament and to the Council as well as to the European Economic and Social Committee. Member
States shall provide the Commission with the information necessary for the preparation of thatreport.
Article 33
Amendment to Regulation (EU) No 2018/1724
In Annex II to Regulation (EU) No 2018/1724, the following line information is added under to“Starting, running and closing a business”:
Starting, running and closing
a business

Notification as a provider ofdata sharing intermediation
services

Confirmation of the receipt
of notification

Registration as a European
data altruism organisation
recognised in the Union

Confirmation of theregistration

Article 34
Transitional arrangements
Entities providing the data sharing intermediation services provided for in Article 9(1) on …[thedate of entry into force of this Regulation] shall comply with the obligations set out in Chapter III
by [date - 2 years 24 months after the start date of the application of the this Regulation] at thelatest.

12124/21
TREE.2.B

RB/ek

70

LIMITEEN

Article 35
Entry into force and application
This Regulation shall enter into force on the twentieth day following that of its publication in the
Official Journal of the European Union.
It shall apply from [182 months after the date of its entry into force of this Regulation].

This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Brussels,

For the European Parliament
The President

For the Council
The President

12124/21
TREE.2.B

RB/ek

71

LIMITE

EN