### (32) to ensure the fullest possible transparency and comparability of offers , pre-contractual information should , in particular , include the annual percentage rate of charge applicable to the credit , determined in the same way throughout the union. as the annual percentage rate of charge can at this stage be indicated only through an example , such example should be representative. therefore , it should correspond , for instance , to the average duration and total amount of credit granted for the type of credit agreement or crowdfunding credit services under consideration and , if applicable , to the goods purchased. when determining the representative example , the frequency of certain types of credit agreement or crowdfunding credit services in a specific market should also be taken into account. as regards the borrowing rate , the frequency of instalments and the capitalisation of interest , creditors should use their usual method of calculation for the consumer credit concerned. in case pre-contractual information is provided less than one day before the consumer is bound by any credit agreement or agreement for the provision of crowdfunding credit services , the creditor and , where applicable , the credit intermediary or providers of crowdfunding credit services should remind consumers , one day after conclusion of the contract , of the possibility to withdraw from the credit agreement. ### (32) to ensure the fullest possible transparency and comparability of offers , pre-contractual information should , in particular , include the annual percentage rate of charge applicable to the credit , determined in the same way throughout the union. as the annual percentage rate of charge can at this stage be indicated only through an example , such example should be representative. therefore , it should correspond , for instance , to the average duration and total amount of credit granted for the type of credit agreement or crowdfunding credit services under consideration and , if applicable , to the goods purchased. when determining the representative example , the frequency of certain types of credit agreement or crowdfunding credit services in a specific market should also be taken into account. as regards the borrowing rate , the frequency of instalments and the capitalisation of interest , creditors should use their usual method of calculation for the consumer credit concerned.


### (40) as highlighted in the commission proposal for a regulation laying down harmonised rules on artificial intelligence (artificial intelligence act)31 , artificial intelligence (ai) systems can be easily deployed in multiple sectors of the economy and society , including cross border , and can circulate throughout the union. in this context , creditors , credit intermediaries and providers of crowdfunding credit services should be allowed to personalise the price of their offers for specific consumers or specific categories of consumer based on automated decision-making and profiling of consumer behaviour allowing them to assess the consumer’s purchasing power. consumers should therefore be clearly informed when the price presented to them is personalised on the basis of automated processing , so that they can take into account the potential risks in their purchasing decision. ### (40) as highlighted in the commission proposal for a regulation laying down harmonised rules on artificial intelligence (artificial intelligence act)31 , artificial intelligence (ai) systems can be easily deployed in multiple sectors of the economy and society , including cross border , and can circulate throughout the union. in this context , creditors , credit intermediaries and providers of crowdfunding credit services should be allowed to personalise the price of their offers for specific consumers or specific categories of consumer based on automated decision-making and profiling of consumer behaviour allowing them to assess the consumer’s purchasing power. consumers should therefore be clearly informed when the price presented to them is personalised on the basis of automated processing in line with the regulation (eu) 2016/679 , so that they can take into account the potential risks in their purchasing decision.


### (43) providing advice in the form of a personalised recommendation (‘advisory services’) is an activity which may be combined with other aspects of granting or intermediating credit. therefore , in order to be in a position to understand the nature of the services provided to them , consumers should be made aware of what constitutes such advisory services and of whether advisory services are being , or can be , provided or not. given the importance which consumers attach to the use of the terms ‘advice’ and ‘advisors’ , member states should be allowed to prohibit the use of the those terms , or similar terms , when advisory services are being provided to consumers by creditors , credit intermediaries or providers of crowdfunding credit services. it is appropriate to ensure that member states impose safeguards where advice is described as independent to ensure that the range of products considered and remuneration arrangements are commensurate with consumers’ expectations of such advice. when providing advisory services , the creditor , credit intermediary or provider of crowdfunding credit services should provide an indication of whether the recommendation will be based on only their own product range or on a wide range of products from across the market , so that the consumer can understand the basis on which the recommendation is made. moreover , the creditor , credit intermediary or provider of crowdfunding credit services should provide an indication of the fee payable by the consumer for the advisory services or , where the amount cannot be ascertained at the time of disclosure , the method used for its calculation. ### (43) providing advice in the form of a personalised recommendation (‘advisory services’) is an activity which may be combined with other aspects of granting or intermediating credit. therefore , in order to be in a position to understand the nature of the services provided to them , consumers should be made aware of what constitutes such advisory services and of whether advisory services are being , or can be , provided or not. given the importance which consumers attach to the use of the terms ‘advice’ and ‘advisors’ , member states should be allowed to prohibit the use of those terms , or similar terms , when advisory services are being provided to consumers by creditors , credit intermediaries or providers of crowdfunding credit services. it is appropriate to ensure that member states impose safeguards where advice is described as independent to ensure that the range of products considered and remuneration arrangements are commensurate with consumers’ expectations of such advice. when providing advisory services , the creditor , credit intermediary or provider of crowdfunding credit services should provide an indication of whether the recommendation will be based on only their own product range or on a wide range of products from across the market , so that the consumer can understand the basis on which the recommendation is made. moreover , the creditor , credit intermediary or provider of crowdfunding credit services should provide an indication of the fee payable by the consumer for the advisory services or , where the amount cannot be ascertained at the time of disclosure , the method used for its calculation.


### (45) member states should take appropriate measures to promote responsible practices during all phases of the credit relationship , taking into account the specific features of their credit market. those measures may include , for instance , the provision of information to , and the education of , consumers , including warnings about the risks attaching to default on payment and to over-indebtedness. in the expanding credit market , in particular , it is important that creditors should not engage in irresponsible lending or give out credit without prior assessment of creditworthiness. member states should carry out the necessary supervision to avoid such behaviour of creditors and should determine the necessary means to sanction such behaviour. without prejudice to the provisions on credit risk of directive 2013/36/eu of the european parliament and of the council32 , creditors or providers of crowdfunding credit services should bear the responsibility of checking individually the creditworthiness of the consumer. to that end , creditors or providers of crowdfunding credit services should be allowed to use information provided by the consumer not only during the preparation of the credit agreement or of the agreement for the provision of crowdfunding credit services in question , but also during a long standing commercial relationship. consumers should also act with prudence and respect their contractual obligations. ### (45) member states should take appropriate measures to promote responsible practices during all phases of the credit relationship , taking into account the specific features of their credit market. those measures may include , for instance , the provision of information to , and the education of , consumers , including warnings about the risks attaching to default on payment and to over-indebtedness. in the expanding credit market , in particular , it is important that creditors should not engage in irresponsible lending or give out credit without prior assessment of creditworthiness. member states should carry out the necessary supervision to avoid such behaviour of creditors and should determine the necessary means to sanction such behaviour. without prejudice to the provisions on credit risk of directive 2013/36/eu of the european parliament and of the council32 , creditors or providers of crowdfunding credit services should bear the responsibility of checking individually and proportionally the creditworthiness of the consumer. to that end , creditors or providers of crowdfunding credit services should be allowed to use information provided by the consumer not only during the preparation of the credit agreement or of the agreement for the provision of crowdfunding credit services in question , but also during a long standing commercial relationship. consumers should also act with prudence and respect their contractual obligations.


### (46) it is essential that the consumer’s ability and propensity to repay the credit is assessed and verified before a credit agreement or an agreement for the provision of crowdfunding credit services is concluded. that assessment of creditworthiness should be done in the interest of the consumer , to prevent irresponsible lending practices and over-indebtedness , and should take into consideration all necessary and relevant factors that could influence a consumer’s ability to repay the credit. member states should be able to issue additional guidance on additional criteria and methods to assess a consumer’s creditworthiness , for example by setting limits on loan-to-value or loan-to-income ratios. ### (46) it is essential that the consumer’s ability and propensity to repay the credit is assessed and verified before a credit agreement or an agreement for the provision of crowdfunding credit services is concluded. that assessment of creditworthiness should be done in the interest of the consumer , to prevent irresponsible lending practices and over-indebtedness , and should take into consideration necessary and relevant factors that could influence a consumer’s ability to repay the credit. the assessment should be proportionate considering the risk-based approach , data minimalisation principle and cost-effectiveness. member states should be able to issue additional guidance on additional criteria and methods to assess a consumer’s creditworthiness , for example by setting limits on loan-to-value or loan-to-income ratios.


### (47) the assessment of creditworthiness should be based on information on the financial and economic situation , including income and expenses , of the consumer. the european banking authority guidelines on loan origination and monitoring (eba/gl/2020/06) provide guidelines on what categories of data may be used for the processing of personal data for creditworthiness purposes , which include evidence of income or other sources of repayment , information on financial assets and liabilities , or information on other financial commitments. personal data , such as personal data found on social media platforms or health data , including cancer data , should not be used when conducting a creditworthiness assessment. consumers should provide information about their financial and economic situation in order to facilitate the creditworthiness assessment. in principle , credit should only made available to the consumer where the result of the creditworthiness assessment indicates that the obligations resulting from the credit agreement or the agreement for the provision of crowdfunding credit services are likely to be met in the manner required under that agreement. however , should such assessment be negative , the creditor or the provider of crowdfunding credit services can exceptionally make credit available in specific and justified circumstances such as when they have a long-standing relationship with the consumer , or in case of loans to fund exceptional healthcare expenses , students loans or loans for consumers with disabilities. in such case , when deciding on whether or not to make the credit available to the consumer , the creditor or the provider of crowdfunding credit services should take into account the amount and the purpose of the credit , and the likelihood that the obligations resulting from the agreement will be met. ### (47) the assessment of creditworthiness should be based on information on the financial and economic situation , including income and expenses , of the consumer. the european banking authority guidelines on loan origination and monitoring (eba/gl/2020/06) provide guidelines on what categories of data may be used for the processing of personal data for creditworthiness purposes , which include evidence of income or other sources of repayment , information on financial assets and liabilities , or information on other financial commitments. personal data , such as personal data found on social media platforms or health data , including cancer data , should not be used when conducting a creditworthiness assessment. consumers should provide information about their financial and economic situation in order to facilitate the creditworthiness assessment. in principle , credit should only be made available to the consumer where the result of the creditworthiness assessment indicates that the obligations resulting from the credit agreement or the agreement for the provision of crowdfunding credit services are likely to be met in the manner required under that agreement. however , should such assessment be negative , the creditor or the provider of crowdfunding credit services can exceptionally make credit available in specific and justified circumstances such as when they have a long-standing relationship with the consumer , or in case of loans to fund exceptional healthcare expenses , students loans or loans for consumers with disabilities. in such case , when deciding on whether or not to make the credit available to the consumer , the creditor or the provider of crowdfunding credit services should take into account the amount and the purpose of the credit , and the likelihood that the obligations resulting from the agreement will be met.


### (48) the proposal for a regulation laying down harmonised rules on artificial intelligence (artificial intelligence act) , establishes that ai systems used to evaluate the credit score or creditworthiness of natural persons should be classified as high-risk ai systems , since they determine those persons’ access to financial resources or essential services such as housing , electricity , and telecommunication services. in view of those high stakes , whenever the creditworthiness assessment involves automated processing , the consumer should have a right to obtain human intervention on the part of the creditor or providers of crowdfunding credit services. the consumer should also have the right to obtain a meaningful explanation of the assessment made and of the functioning of the automated processing used , including among others the main variables , the logic and risks involved , as well as a right to express his or her point of view and to contest the assessment of the creditworthiness and the decision. ### (48) the proposal for a regulation laying down harmonised rules on artificial intelligence (artificial intelligence act) , establishes that ai systems used to evaluate the credit score or creditworthiness of natural persons should be classified as high-risk ai systems , since they determine those persons’ access to financial resources or essential services such as housing , electricity , and telecommunication services. in view of those high stakes , whenever the creditworthiness assessment involves automated processing , the consumer should have a right to obtain human intervention on the part of the creditor or providers of crowdfunding credit services. the consumer should also have the right to obtain a meaningful explanation of the assessment made and of the functioning of the automated processing used , including among others the main variables , the logic and risks involved.


### (57) where a consumer withdraws from a credit agreement or an agreement for the provision of crowdfunding credit services in connection with which the consumer has received goods , in particular from a purchase in instalments or from a hiring or leasing agreement providing for an obligation to purchase , this directive should be without prejudice to any regulation by member states of questions concerning the return of the goods or any related questions. ### (57) where a consumer withdraws from a credit agreement or an agreement for the provision of crowdfunding credit services in connection with which the consumer has received goods , in particular from a purchase in instalments , this directive should be without prejudice to any regulation by member states of questions concerning the return of the goods or any related questions.


### (65) the fixing of caps on interest rates , on annual percentage rates of charge and or the total cost of the credit to the consumer is a common practice in a number of member states. such capping has proved beneficial for consumers. in that context , member states should be able to maintain their current legal regime. however , in an effort to increase consumer protection without imposing unnecessary limits on member states , caps on interest rates , on annual percentage rates of charge and or on the total cost of the credit to the consumer should be introduced throughout the union. ### (65) the fixing of caps on interest rates , on annual percentage rates of charge and or the total cost of the credit to the consumer is a common practice in a number of member states. in that context , member states should be able to maintain their current legal regime.


### (87) member states should apply the measures necessary to comply with this directive from [op: please insert date: six months from the transposition deadline]. however , taking into account the difficult economic circumstances created by the covid-19 pandemic and the specific challenges faced by micro , small and medium undertakings , such undertakings should be provided with sufficient time to prepare for the application of this directive. hence , as regards micro , small and medium undertakings , member states should apply the measures necessary to comply with this directive from [op: please insert date: 18 months from the transposition deadline]. ### (87) member states should apply the measures necessary to comply with this directive from [op: please insert date: twenty-four months from the transposition deadline]. however , taking into account the difficult economic circumstances created by the covid-19 pandemic and the specific challenges faced by micro , small and medium undertakings , such undertakings should be provided with sufficient time to prepare for the application of this directive. hence , as regards micro , small and medium undertakings , member states should apply the measures necessary to comply with this directive from [op: please insert date: 30 months from the transposition deadline].


### (3) ‘credit agreement’ means an agreement whereby a creditor grants or promises to grant to a consumer credit in the form of a deferred payment , loan or other similar financial accommodation , except for agreements for the provision on a continuing basis of services or for the supply of goods of the same kind , where the consumer pays for such services or goods for the duration of their provision by means of instalments; ### (3) ‘credit agreement’ means an agreement whereby a creditor grants or promises to grant to a consumer credit in the form of a deferred payment , loan or other similar financial accommodation , except for agreements for the provision on a continuing basis of services or for the supply of goods of the same kind , where the consumer pays for such services or goods for the duration of their provision by means of instalments and except of hiring or leasing agreements where an obligation to purchase the object of the agreement is not laid down either by the agreement itself or by any separate agreement;


### (4) ‘crowdfunding credit services’ means services provided by a crowdfunding platform to facilitate the granting of consumer credit; ### (4) ‘crowdfunding credit services’ means services provided by a crowdfunding platform to facilitate the granting of consumer credit which falls outside of the scope of regulation (eu) 2020/1503;


### (18) ‘advisory services’ means personal recommendations to a consumer in respect of one or more transactions relating to credit agreements or crowdfunding credit services and that constitute a separate activity from the granting of a credit and from the and from the activities of credit intermediary as defined in point (12); ### (18) ‘advisory services’ means personal paid recommendations to a consumer in respect of one or more transactions relating to credit agreements or crowdfunding credit services and that constitute a separate activity from the granting of a credit and from the and from the activities of credit intermediary as defined in point (12);


### 2. the standard information shall be easily legible or clearly audible , as appropriate , and adapted to the technical constraints of the medium used for advertising and shall specify in a clear , concise and prominent way , by means of a representative example , all of the following elements: ### 2. the standard information shall be easily legible or clearly audible , as appropriate , and adapted to the technical constraints of the medium used for advertising and shall , if feasible , specify in a clear , concise and prominent way , by means of a representative example , all of the following elements:


### in specific and justified cases where the medium used to communicate the standard information referred to in the first subparagraph does not allow the information to be visually displayed , points (e) and (f) in that subparagraph shall not apply. ### in specific and justified cases where the medium used to communicate the standard information referred to in the first subparagraph does not allow the information to be visually displayed , points (e) and (f) in that subparagraph shall not apply. in cases of website pop-ups/banners , social networks advertising , and similar digital forms of advertising points (a) , (e) and (f) in that subparagraph shall not apply and these information shall be included in a web page directly linked to such advertisements.


### a representative example of the total amount of credit , the total cost of the credit to the consumer , the total amount payable by the consumer and the annual percentage rate of charge; ### deleted


### 1. member states shall require that the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services provide the consumer with the pre-contractual information needed to compare different offers in order to take an informed decision on whether to conclude a credit agreement or crowdfunding credit services on the basis of the credit terms and conditions offered by the creditor or by the provider of crowdfunding credit services and , where applicable , the preferences expressed and information supplied by the consumer. such pre-contractual information shall be provided to the consumer at least one day before he or she is bound by any credit agreement or offer , or by any agreement or offer for the provision of crowdfunding credit services. ### 1. member states shall require that the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services provide the consumer with the pre-contractual information needed to compare different offers in order to take an informed decision on whether to conclude a credit agreement or crowdfunding credit services on the basis of the credit terms and conditions offered by the creditor or by the provider of crowdfunding credit services and , where applicable , the preferences expressed and information supplied by the consumer. such pre-contractual information shall be provided to the consumer before he or she is bound by any credit agreement or offer , or by any agreement or offer for the provision of crowdfunding credit services.


### in case the pre-contractual information referred to in the first subparagraph is provided less than one day before the consumer is bound by the credit agreement or offer , or by any agreement or offer for the provision of crowdfunding credit services , member states shall require that the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services send a reminder , on paper or on another durable medium , to the consumer of the possibility to withdraw from the credit agreement or crowdfunding credit services and of the procedure to follow for withdrawing , in accordance with article 26. that reminder shall be provided to the consumer , at the latest , one day after the conclusion of the credit agreement , of the agreement for the provision of crowdfunding credit services , or the acceptance of the credit offer. ### deleted


### the annual percentage rate of charge and the total amount payable by the consumer , illustrated by means of a representative example mentioning all the assumptions used in order to calculate that rate; where the consumer has informed the creditor or the provider of crowdfunding credit services of one or more components of his or her preferred credit , such as the duration of the credit agreement or of the agreement for the provision of crowdfunding credit services and the total amount of credit , the creditor or the provider of crowdfunding credit services shall take those components into account; ### the annual percentage rate of charge and the total amount payable by the consumer;


### 4. at the same time as the standard european consumer credit information form is provided to the consumer , the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services , shall provide the consumer with the standard european consumer credit overview form set out in annex ii , containing the following pre-contractual information: ### deleted


### 5. information displayed in the standard european consumer credit information form and in the standard european consumer credit overview form shall be consistent. it shall be clearly legible and take into account the technical constraints of the medium on which it is displayed. information shall be displayed in an adequate and suitable way on the different channels. ### 5. information displayed in the standard european consumer credit information form shall be consistent. it shall be clearly legible and take into account the technical constraints of the medium on which it is displayed. information shall be displayed in an adequate and suitable way on the different channels.


### any additional information which the creditor may provide to the consumer shall be given in a separate document which may be annexed to the standard european consumer credit information form or the standard european consumer credit overview form. ### any additional information which the creditor may provide to the consumer shall be given in a separate document which may be annexed to the standard european consumer credit information form.


### 7. if the agreement has been concluded at the consumer's request using a means of distance communication which does not enable the information to be provided in accordance with this article , the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services shall provide the consumer with the standard european consumer credit information form and the standard european consumer credit overview form immediately after the conclusion of the credit agreement or of the agreement for the provision of crowdfunding credit services. ### 7. if the agreement has been concluded at the consumer's request using a means of distance communication which does not enable the information to be provided in accordance with this article , the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services shall provide the consumer with the standard european consumer credit information form immediately after the conclusion of the credit agreement or of the agreement for the provision of crowdfunding credit services.


### 8. upon request from the consumer , the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services shall , in addition to the standard european consumer credit information form and the standard european consumer credit overview form , provide the consumer free of charge with a copy of the draft credit agreement , or of the draft agreement for the provision of crowdfunding credit services , provided that the creditor at the time of the request is willing to proceed to the conclusion of the credit agreement or of the agreement for the provision of crowdfunding credit services with the consumer. ### 8. upon request from the consumer , the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services shall , in addition to the standard european consumer credit information form , provide the consumer free of charge with a copy of the draft credit agreement , or of the draft agreement for the provision of crowdfunding credit services , provided that the creditor at the time of the request is willing to proceed to the conclusion of the credit agreement or of the agreement for the provision of crowdfunding credit services with the consumer.


### 3. at the same time as the european consumer credit information form is provided to the consumer , the creditor and , where applicable , the credit intermediary , shall provide the consumer with the standard european consumer credit overview form set out in annex ii. ### deleted


### 4. information displayed in the european consumer credit information form and in the standard consumer credit overview form shall be consistent. it shall be clearly legible and take into account the technical constraints of the medium on which it is displayed. information shall be displayed in an adequate and suitable way on the different channels. ### 4. information displayed in the european consumer credit information form shall be consistent. it shall be clearly legible and take into account the technical constraints of the medium on which it is displayed. information shall be displayed in an adequate and suitable way on the different channels.


### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services. ### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. the term to ‘make data available’ under this regulation should be understood also as to ‘export data permanently’. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services.


### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services. ### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need in the context of a public emergency , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services.


### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services. ### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between cloud computing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services.


### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services. ### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services.


### (7) the fundamental right to the protection of personal data is safeguarded in particular under regulation (eu) 2016/679 and regulation (eu) 2018/1725. directive 2002/58/ec additionally protects private life and the confidentiality of communications , including providing conditions to any personal and non-personal data storing in and access from terminal equipment. these instruments provide the basis for sustainable and responsible data processing , including where datasets include a mix of personal and non-personal data. this regulation complements and is without prejudice to union law on data protection and privacy , in particular regulation (eu) 2016/679 and directive 2002/58/ec. no provision of this regulation should be applied or interpreted in such a way as to diminish or limit the right to the protection of personal data or the right to privacy and confidentiality of communications. ### (7) the fundamental right to the protection of personal data is safeguarded in particular under regulation (eu) 2016/679 and regulation (eu) 2018/1725. directive 2002/58/ec additionally protects private life and the confidentiality of communications , including providing conditions to any personal and non-personal data storing in and access from terminal equipment. these instruments provide the basis for sustainable and responsible data processing , including where datasets include a mix of personal and non-personal data. this regulation complements and is without prejudice to union law on data protection and privacy , in particular regulation (eu) 2016/679 and directive 2002/58/ec. no provision of this regulation should be applied or interpreted in such a way as to diminish or limit the right to the protection of personal data or the right to privacy and confidentiality of communications. when a conflict between this regulation and union law on the protection of personal data and privacy or national laws adopted in accordance with relevant union law arises , the relevant union or national laws on the protection of personal data and privacy should prevail.


### (14) physical products that obtain , generate or collect , by means of their components , data concerning their performance , use or environment and that are able to communicate that data via a publicly available electronic communications service (often referred to as the internet of things) should be covered by this regulation. electronic communications services include land-based telephone networks , television cable networks , satellite-based networks and near-field communication networks. such products may include vehicles , home equipment and consumer goods , medical and health devices or agricultural and industrial machinery. the data represent the digitalisation of user actions and events and should accordingly be accessible to the user , while information derived or inferred from this data , where lawfully held , should not be considered within scope of this regulation. such data are potentially valuable to the user and support innovation and the development of digital and other services protecting the environment , health and the circular economy , in particular though facilitating the maintenance and repair of the products in question. ### (14) physical products that obtain , generate or collect , by means of their components , data concerning their performance , use or environment and that are able to communicate that data via a publicly available electronic communications service (often referred to as the internet of things) should be covered by this regulation. electronic communications services include land-based telephone networks , television cable networks , satellite-based networks and near-field communication networks. such products may include vehicles , home equipment and consumer goods , medical and health devices or agricultural and industrial machinery. the data represent the digitalisation of user actions and events and should accordingly be accessible to the user. such data are potentially valuable to the user and support innovation and the development of digital and other services protecting the environment , health and the circular economy , in particular though facilitating the maintenance and repair of the products in question.


### (14) physical products that obtain , generate or collect , by means of their components , data concerning their performance , use or environment and that are able to communicate that data via a publicly available electronic communications service (often referred to as the internet of things) should be covered by this regulation. electronic communications services include land-based telephone networks , television cable networks , satellite-based networks and near-field communication networks. such products may include vehicles , home equipment and consumer goods , medical and health devices or agricultural and industrial machinery. the data represent the digitalisation of user actions and events and should accordingly be accessible to the user , while information derived or inferred from this data , where lawfully held , should not be considered within scope of this regulation. such data are potentially valuable to the user and support innovation and the development of digital and other services protecting the environment , health and the circular economy , in particular though facilitating the maintenance and repair of the products in question. ### (14) physical products that obtain , generate or collect , by means of their components , data concerning their performance , use or environment and that are able to communicate that data via a publicly available electronic communications service (often referred to as the internet of things) should be covered by this regulation. metadata under chapter ii means the metadata that the data holder uses for its own purpose , without any obligation to register or store metadata additionally. electronic communications services include land-based telephone networks , television cable networks , satellite-based networks and near-field communication networks. such products may include vehicles , home equipment and consumer goods , medical and health devices or agricultural and industrial machinery. conversely , products related with services subject to specific union law setting out rights and obligations on data access , such as directive (eu) 2015/2366 should not be covered by chapter ii of this regulation. the data represent the digitalisation of user actions and events and should accordingly be accessible to the user , while volatile and only locally processed data and information derived or inferred from data that falls under the scope of this regulation , where lawfully held , should not be considered within scope of this regulation. such data are potentially valuable to the user and support innovation and the development of digital and other services protecting the environment , health and the circular economy , in particular though facilitating the maintenance and repair of the products in question. information derived or inferred from this data , where lawfully held , should not be considered within the scope of this regulation.


### (15) in contrast , certain products that are primarily designed to display or play content , or to record and transmit content , amongst others for the use by an online service should not be covered by this regulation. such products include , for example , personal computers , servers , tablets and smart phones , cameras , webcams , sound recording systems and text scanners. they require human input to produce various forms of content , such as text documents , sound files , video files , games , digital maps. ### (15) in contrast , certain products that are primarily designed to display or play content , or to record and transmit content , amongst others for the use by an online service should not be covered by this regulation. such products include , for example , personal computers , servers , tablets and smart phones , consoles and peripherals , cameras , webcams , sound recording systems and text scanners. they require human input to produce various forms of content , such as text documents , sound files , video files , games , digital maps.


### (20) in case several persons or entities own a product or are party to a lease or rent agreement and benefit from access to a related service , reasonable efforts should be made in the design of the product or related service or the relevant interface so that all persons can have access to data they generate. users of products that generate data typically require a user account to be set up. this allows for identification of the user by the manufacturer as well as a means to communicate to exercise and process data access requests. manufacturers or designers of a product that is typically used by several persons should put in place the necessary mechanism that allow separate user accounts for individual persons , where relevant , or the possibility for several persons to use the same user account. access should be granted to the user upon simple request mechanisms granting automatic execution , not requiring examination or clearance by the manufacturer or data holder. this means that data should only be made available when the user actually wants this. where automated execution of the data access request is not possible , for instance , via a user account or accompanying mobile application provided with the product or service , the manufacturer should inform the user how the data may be accessed. ### (20) in case several persons or entities own a product or are party to a lease or rent agreement and benefit from access to a related service , reasonable efforts should be made in the design of the product or related service or the relevant interface so that each user can have access to data they themselve generate. users of products that generate data typically require a user account to be set up. this allows for identification of the user by the manufacturer as well as a means to communicate to exercise and process data access requests. manufacturers or designers of a product that is typically used by several persons should put in place the necessary mechanism that allow separate user accounts for individual persons , where relevant , or the possibility for several persons to use the same user account. access should be granted to the user upon simple request mechanisms granting automatic execution , not requiring examination or clearance by the manufacturer or data holder. this means that data should only be made available when the user actually wants this. where automated execution of the data access request is not possible , for instance , via a user account or accompanying mobile application provided with the product or service , the manufacturer should inform the user how the data may be accessed.


### (21) products may be designed to make certain data directly available from an on-device data storage or from a remote server to which the data are communicated. access to the on-device data storage may be enabled via cable-based or wireless local area networks connected to a publicly available electronic communications service or a mobile network. the server may be the manufacturer’s own local server capacity or that of a third party or a cloud service provider who functions as data holder. they may be designed to permit the user or a third party to process the data on the product or on a computing instance of the manufacturer. ### (21) products may be designed to make certain data directly available from an on-device data storage or from a remote server to which the data are communicated. where on-device access is technically supported , the manufacturer should make this means of access also available to third-party service providers or the user. access to the on-device data storage may be enabled via cable-based or wireless local area networks connected to a publicly available electronic communications service or a mobile network. the server may be the manufacturer’s own local server capacity or that of a third party or a cloud service provider. they may be designed to permit the user or a third party to process the data on the product or on a computing instance of the manufacturer. where either option is available , the user or third party should choose their preferred method.


### (22) virtual assistants play an increasing role in digitising consumer environments and serve as an easy-to-use interface to play content , obtain information , or activate physical objects connected to the internet of things. virtual assistants can act as a single gateway in , for example , a smart home environment and record significant amounts of relevant data on how users interact with products connected to the internet of things , including those manufactured by other parties and can replace the use of manufacturer-provided interfaces such as touchscreens or smart phone apps. the user may wish to make available such data with third party manufacturers and enable novel smart home services. such virtual assistants should be covered by the data access right provided for in this regulation also regarding data recorded before the virtual assistant’s activation by the wake word and data generated when a user interacts with a product via a virtual assistant provided by an entity other than the manufacturer of the product. however , only the data stemming from the interaction between the user and product through the virtual assistant falls within the scope of this regulation. data produced by the virtual assistant unrelated to the use of a product is not the object of this regulation. ### (22) virtual assistants play an increasing role in digitising consumer environments and serve as an easy-to-use interface to play content , obtain information , or activate physical objects connected to the internet. virtual assistants can act as a single gateway in , for example , a smart home environment and record significant amounts of relevant data on how users interact with products connected to the internet , including those manufactured by other parties and can replace the use of manufacturer-provided interfaces such as touchscreens or smart phone apps. the user may wish to make available such data with third party manufacturers and enable novel smart home services. such virtual assistants should be covered by the data access right provided for in this regulation also regarding data recorded before the virtual assistant’s activation by the wake word and data generated when a user interacts with a product via a virtual assistant provided by an entity other than the manufacturer of the product. however , only the data stemming from the interaction between the user and product through the virtual assistant falls within the scope of this regulation. data produced by the virtual assistant unrelated to the use of a product is not the object of this regulation.


### (24) this regulation imposes the obligation on data holders to make data available in certain circumstances. insofar as personal data are processed , the data holder should be a controller under regulation (eu) 2016/679. where users are data subjects , data holders should be obliged to provide them access to their data and to make the data available to third parties of the user’s choice in accordance with this regulation. however , this regulation does not create a legal basis under regulation (eu) 2016/679 for the data holder to provide access to personal data or make it available to a third party when requested by a user that is not a data subject and should not be understood as conferring any new right on the data holder to use data generated by the use of a product or related service. this applies in particular where the manufacturer is the data holder. in that case , the basis for the manufacturer to use non-personal data should be a contractual agreement between the manufacturer and the user. this agreement may be part of the sale , rent or lease agreement relating to the product. any contractual term in the agreement stipulating that the data holder may use the data generated by the user of a product or related service should be transparent to the user , including as regards the purpose for which the data holder intends to use the data. this regulation should not prevent contractual conditions , whose effect is to exclude or limit the use of the data , or certain categories thereof , by the data holder. this regulation should also not prevent sector-specific regulatory requirements under union law , or national law compatible with union law , which would exclude or limit the use of certain such data by the data holder on well-defined public policy grounds. ### (24) this regulation imposes the obligation on data holders to make data available in certain circumstances. insofar as personal data are processed , the data holder should be a controller under regulation (eu) 2016/679. where users are data subjects , data holders should be obliged to provide them access to their data and to make the data available to third parties of the user’s choice in accordance with this regulation. however , this regulation does not create a legal basis under regulation (eu) 2016/679 for the data holder to provide access to personal data or make it available to a third party when requested by a user that is not a data subject and should not be understood as conferring any new right on the data holder to use data generated by the use of a product or related service. this applies in particular where the manufacturer is the data holder. in that case , the basis for the manufacturer to use non-personal data should be a contractual agreement between the manufacturer and the user. this agreement may be part of the sale , rent or lease agreement relating to the product. the user should be given a reasonable opportunity to reject this agreement. should a user chose to reject the contractual terms and conditions , this should not prevent him from using the relevant product of the service , unless the product of the service cannot function without the user's acceptance of the contractual terms. the user should have the right to cancel the contractual agreement at any time , without any financial consequences. withdrawal of consent should also not affect the use of the product or service , except for consequences that are the direct and unavoidable result of the withdrawal of the user's consent. furthermore , any contractual term in the agreement stipulating that the data holder may use the data generated by the user of a product or related service should be transparent to the user , including as regards the purpose for which the data holder intends to use the data. this regulation should not prevent contractual conditions , whose effect is to exclude or limit the use of the data , or certain categories thereof , by the data holder. this regulation should also not prevent sector-specific regulatory requirements under union law , or national law compatible with union law , which would exclude or limit the use of certain such data by the data holder on well-defined public policy grounds.


### (26) in contracts between a data holder and a consumer as a user of a product or related service generating data , directive 93/13/eec applies to the terms of the contract to ensure that a consumer is not subject to unfair contractual terms. for unfair contractual terms unilaterally imposed on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec63 , this regulation provides that such unfair terms should not be binding on that enterprise. ### (26) in contracts between a data holder and a consumer as a user of a product or related service generating data , directive 93/13/eec applies to the terms of the contract to ensure that a consumer is not subject to unfair contractual terms. for unfair contractual terms , which have not been individually negotiated by a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec63 , this regulation provides that such unfair terms should not be binding on that enterprise.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party such as the data marketplace , data sharing service provider referred to article 10 [data governance act] or offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. this regulation should be interpreted in a manner that preserves the protection awarded to trade secrets under eu and national legislation. for this reason , data holders should be able to require the user or third parties of the users' choice to preserve the secrecy of data considered as trade secrets , including through technical means. however , data holders should not be able to refuse a data access request under this regulation on the grounds that certain data is considered to be a trade secret as this would contradict the main objective of this regulation. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data and where relevant protected by contractual instruments. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering a service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should make all reasonable efforts to ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be fully respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product.


### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon request of the user should only process the data for the purposes agreed with the user and share it with another third party only if this is necessary to provide the service requested by the user. ### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon request of the user should only process the data for the purposes agreed with the user and share it with another third party only if this is authorised by the user and necessary to provide the service requested by the user.


### (35) the third party should also refrain from using the data to profile individuals unless these processing activities are strictly necessary to provide the service requested by the user. the requirement to delete data when no longer required for the purpose agreed with the user complements the right to erasure of the data subject pursuant to article 17 of regulation 2016/679. where the third party is a provider of a data intermediation service within the meaning of [data governance act] , the safeguards for the data subject provided for by that regulation apply. the third party may use the data to develop a new and innovative product or related service but not to develop a competing product. ### (35) the third party should also refrain from using the data to profile individuals unless these processing activities are strictly necessary to provide the service requested by the user. the requirement to delete data when no longer required for the purpose agreed with the user complements the right to erasure of the data subject pursuant to article 17 of regulation 2016/679. where the third party is a provider of a data intermediation service within the meaning of [data governance act] , the safeguards for the data subject provided for by that regulation apply. that third party may use the data to develop a new and innovative product or related service but not to develop a competing product.


### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means. ### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities might struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure to exploit them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means.


### (41) in order to compensate for the lack of information on the conditions of different contracts , which makes it difficult for the data recipient to assess if the terms for making the data available are non-discriminatory , it should be on the data holder to demonstrate that a contractual term is not discriminatory. it is not unlawful discrimination , where a data holder uses different contractual terms for making data available or different compensation , if those differences are justified by objective reasons. these obligations are without prejudice to regulation (eu) 2016/679. ### (41) in order to compensate for the lack of information on the conditions of different contracts , which makes it difficult for the data recipient to assess if the terms for making the data available are non-discriminatory , it should be on the data holder to demonstrate that a contractual term is not discriminatory. the commission , while involving all affected stakeholders , should establish guidelines on how a data holder can better distinguish between discriminatory and non-discriminatory terms. emphasised is however , that it is not unlawful discrimination , where a data holder uses different contractual terms for making data available or different compensation , if those differences are justified by objective reasons. these obligations are without prejudice to regulation (eu) 2016/679.


### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available. ### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the direct costs incurred and investment required for making the data available.


### (43) in justified cases , including the need to safeguard consumer participation and competition or to promote innovation in certain markets , union law or national legislation implementing union law may impose regulated compensation for making available specific data types. ### deleted


### (44) to protect micro , small or medium-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models , the compensation for making data available to be paid by them should not exceed the direct cost of making the data available and be non-discriminatory. ### (44) to protect micro , small or medium-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models , the compensation for making data available to be paid by them should not exceed the direct cost incurred and investment required for making the data available and be non-discriminatory.


### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on micro , small or medium-sized enterprises when they have been unilaterally imposed on them. ### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on micro , small or medium-sized enterprises when there was no meaningful negotiation about them.


### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed on micro , small and medium-sized enterprises. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the micro , small or medium-sized enterprise cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the micro , small or medium-sized enterprise or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed. ### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed on micro , small and medium-sized enterprises. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the micro , small or medium-sized enterprise cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is negotiated and subsequently accepted by the micro , small or medium-sized enterprise whether or not in an amended way between contracting parties should not be considered as unilaterally imposed.


### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. ### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations and should be guided by the definition of public emergency in this regulation.


### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. ### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to identified public sector bodies or to identified union institutions , agencies or bodies upon their request and within the remit of their activities. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations.


### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. ### (57) in case of public emergencies , such as major public health emergencies , emergencies resulting from environmental degradation and major natural disasters as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data could potentially outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to identified public sector bodies and within the remit of their activities.. the existence of a public emergency is determined according to the respective procedures in the member states. an exceptional need may also arise when a national public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question.