### (3) it is necessary to improve the conditions for data sharing in the internal market , by creating a harmonised framework for data exchanges. sector-specific legislation can develop , adapt and propose new and complementary elements , depending on the specificities of the sector , such as the envisaged legislation on the european health data space25 and on access to vehicle data. moreover , certain sectors of the economy are already regulated by sector-specific union law that include rules relating to cross-border or union wide sharing or access to data26 . this regulation is therefore without prejudice to regulation (eu) 2016/679 of the european parliament and of the council (27 ) , and in particular the implementation of this regulation shall not prevent cross border transfers of data in accordance with chapter v of regulation (eu) 2016/679 from taking place , directive (eu) 2016/680 of the european parliament and of the council (28 ) , directive (eu) 2016/943 of the european parliament and of the council (29 ) , regulation (eu) 2018/1807 of the european parliament and of the council (30 ) , regulation (ec) no 223/2009 of the european parliament and of the council (31 ) , directive 2000/31/ec of the european parliament and of the council (32 ) , directive 2001/29/ec of the european parliament and of the council (33 ) , directive (eu) 2019/790 of the european parliament and of the council (34 ) , directive 2004/48/ec of the european parliament and of the council (35 ) , directive (eu) 2019/1024 of the european parliament and of the council (36 ) , as well as regulation 2018/858/eu of the european parliament and of the council (37 ) , directive 2010/40/eu of the european parliament and of the council (38 ) and delegated regulations adopted on its basis , and any other sector-specific union legislation that organises the access to and re-use of data. this regulation should be without prejudice to the access and use of data for the purpose of international cooperation in the context of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties. a horizontal regime for the re-use of certain categories of protected data held by public sector bodies , the provision of data sharing services and of services based on data altruism in the union should be established. specific characteristics of different sectors may require the design of sectoral data-based systems , while building on the requirements of this regulation. where a sector-specific union legal act requires public sector bodies , providers of data sharing services or registered entities providing data altruism services to comply with specific additional technical , administrative or organisational requirements , including through an authorisation or certification regime , those provisions of that sector-specific union legal act should also apply. ### (3) it is necessary to improve the conditions for data sharing in the internal market , by creating a harmonised framework for data exchanges. sector-specific legislation can develop , adapt and propose new and complementary elements , depending on the specificities of the sector , such as the envisaged legislation on the european health data space25 and on access to vehicle data. moreover , certain sectors of the economy are already regulated by sector-specific union law that include rules relating to cross-border or union wide sharing or access to data26 . this regulation is therefore without prejudice to regulation (eu) 2016/679 of the european parliament and of the council (27 ) , and in particular the implementation of this regulation shall not prevent cross border transfers of data in accordance with chapter v of regulation (eu) 2016/679 from taking place , directive (eu) 2016/680 of the european parliament and of the council (28 ) , directive (eu) 2016/943 of the european parliament and of the council (29 ) , regulation (eu) 2018/1807 of the european parliament and of the council (30 ) , regulation (ec) no 223/2009 of the european parliament and of the council (31 ) , directive 2000/31/ec of the european parliament and of the council (32 ) , directive 2001/29/ec of the european parliament and of the council (33 ) , directive (eu) 2019/790 of the european parliament and of the council (34 ) , directive 2004/48/ec of the european parliament and of the council (35 ) , directive (eu) 2019/1024 of the european parliament and of the council (36 ) , as well as regulation 2018/858/eu of the european parliament and of the council (37 ) , directive 2010/40/eu of the european parliament and of the council (38 ) and delegated regulations adopted on its basis , and any other sector-specific union legislation that organises the access to and re-use of data. this regulation should be without prejudice to the access and use of data for the purpose of international cooperation in the context of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties. a horizontal regime for the re-use of certain categories of protected data held by public sector bodies , the provision of data sharing services and of services based on data altruism in the union should be established. specific characteristics of different sectors may require the design of sectoral data-based systems , while building on the requirements of this regulation. where a sector-specific union legal act requires public sector bodies , providers of data intermediation services or registered entities providing data altruism services to comply with specific additional technical , administrative or organisational requirements , including through an authorisation or certification regime , those provisions of that sector-specific union legal act should also apply.


### (4) action at union level is necessary in order to address the barriers to a well-functioning data-driven economy and to create a union-wide governance framework for data access and use , in particular regarding the re-use of certain types of data held by the public sector , the provision of services by data sharing providers to business users and to data subjects , as well as the collection and processing of data made available for altruistic purposes by natural and legal persons. ### (4) action at union level is necessary in order to foster trust in data sharing , address the barriers to a well-functioning data-driven economy and to create a union-wide governance framework for data access and use , in particular regarding the re-use of certain types of data held by the public sector , the provision of services by data sharing providers to business users and to data subjects , as well as the collection and processing of data made available for altruistic purposes by natural and legal persons.


### (4) action at union level is necessary in order to address the barriers to a well-functioning data-driven economy and to create a union-wide governance framework for data access and use , in particular regarding the re-use of certain types of data held by the public sector , the provision of services by data sharing providers to business users and to data subjects , as well as the collection and processing of data made available for altruistic purposes by natural and legal persons. ### (4) action at union level is necessary in order to address the barriers to a well-functioning data-driven economy. a union-wide governance framework should be built in a way as to enable individuals , businesses - especially smes and start-ups - as well as civil society actors to thrive , ensuring trust , transparency , interoperability , access , portability , security of data , and a level-playing field for all actors , with a view to enhancing the flow and re-use of non-personal and personal data that is fully compliant with the relevant instruments of eu and national law. it should allow for data access and use , in particular regarding the re-use of certain types of data held by the public sector , the provision of services by data intermediation providers to business users and to data subjects , as well as the collection and processing of data made available for altruistic purposes by natural and legal persons.


### (4) action at union level is necessary in order to address the barriers to a well-functioning data-driven economy and to create a union-wide governance framework for data access and use , in particular regarding the re-use of certain types of data held by the public sector , the provision of services by data sharing providers to business users and to data subjects , as well as the collection and processing of data made available for altruistic purposes by natural and legal persons. ### (4) action at union level , especially based on efficiency and firm responsibility , is necessary in order to address the barriers to a well-functioning data-driven economy and to create a union-wide governance framework for data access and use , in particular regarding the re-use of certain types of data held by the public sector , the provision of services by data sharing providers to business users and to data subjects , as well as the collection and processing of data made available for altruistic purposes by natural and legal persons.


### (5) the idea that data that has been generated at the expense of public budgets should benefit society has been part of union policy for a long time. directive (eu) 2019/1024 as well as sector-specific legislation ensure that the public sector makes more of the data it produces easily available for use and re-use. however , certain categories of data (commercially confidential data , data subject to statistical confidentiality , data protected by intellectual property rights of third parties , including trade secrets and personal data not accessible on the basis of specific national or union legislation , such as regulation (eu) 2016/679 and directive (eu) 2016/680) in public databases is often not made available , not even for research or innovative activities. due to the sensitivity of this data , certain technical and legal procedural requirements must be met before they are made available , in order to ensure the respect of rights others have over such data. such requirements are usually time- and knowledge-intensive to fulfil. this has led to the underutilisation of such data. while some member states are setting up structures , processes and sometimes legislate to facilitate this type of re-use , this is not the case across the union. ### (5) the idea that data that has been generated at the expense of public budgets should benefit society has been part of union policy for a long time. directive (eu) 2019/1024 as well as sector-specific legislation ensure that the public sector makes more of the data it produces or holds easily available for use and re-use. however , certain categories of data (commercially confidential data , data subject to statistical confidentiality , data protected by intellectual property rights of third parties , including trade secrets and personal data in public databases is often not made available despite this being possible in accordance with the applicable union law , notably regulation (eu) 2016/679 , directive (eu) 2002/680 and directive (eu) 2002/58 , not even for research or innovation activities. due to the sensitivity of this data , certain technical and legal procedural requirements must be met before they are made available , not at last in order to ensure the respect of rights others have over such data. such requirements are usually time- and knowledge-intensive to fulfil. this has led to the underutilisation of such data. while some member states are setting up structures , processes and sometimes legislate to facilitate this type of re-use , this is not the case across the union.


### (6) there are techniques enabling privacy-friendly analyses on databases that contain personal data , such as anonymisation , pseudonymisation , differential privacy , generalisation , or suppression and randomisation. application of these privacy-enhancing technologies , together with comprehensive data protection approaches should ensure the safe re-use of personal data and commercially confidential business data for research , innovation and statistical purposes. in many cases this implies that the data use and re-use in this context can only be done in a secure processing environment set in place and supervised by the public sector. there is experience at union level with such secure processing environments that are used for research on statistical microdata on the basis of commission regulation (eu) 557/2013 (39 ). in general , insofar as personal data are concerned , the processing of personal data should rely upon one or more of the grounds for processing provided in article 6 of regulation (eu) 2016/679. ### (6) there are techniques enabling privacy-friendly analyses on databases that contain personal data , such as anonymisation , pseudonymisation , differential privacy , generalisation , suppression , randomisation or other state-of-the-art privacy preserving methods. the application of these privacy-enhancing techniques , together with other comprehensive data protection safeguards should ensure the safe re-use of personal data and commercially confidential business data for research , innovation and statistical purposes. in many cases this implies that the data use and re-use in this context can only be done in a secure processing environment and subject to supervision by the public sector body. there is experience at union level with such secure processing environments that are used for research on statistical microdata on the basis of commission regulation (eu) 557/2013 (39 ). insofar as personal data are concerned , this regulation should not be read as creating a new legal basis for processing of such data. the processing of personal data should rely upon one or more of the grounds for processing provided in article 6 and 9 of regulation (eu) 2016/679.


### (6) there are techniques enabling privacy-friendly analyses on databases that contain personal data , such as anonymisation , pseudonymisation , differential privacy , generalisation , or suppression and randomisation. application of these privacy-enhancing technologies , together with comprehensive data protection approaches should ensure the safe re-use of personal data and commercially confidential business data for research , innovation and statistical purposes. in many cases this implies that the data use and re-use in this context can only be done in a secure processing environment set in place and supervised by the public sector. there is experience at union level with such secure processing environments that are used for research on statistical microdata on the basis of commission regulation (eu) 557/2013 (39 ). in general , insofar as personal data are concerned , the processing of personal data should rely upon one or more of the grounds for processing provided in article 6 of regulation (eu) 2016/679. ### (6) there are techniques enabling privacy-friendly analyses on databases that contain personal data , such as anonymisation , pseudonymisation , differential privacy , generalisation , or suppression and randomisation or other methods that effectively prevent the identification of data subjects. application of these privacy-enhancing technologies , together with comprehensive data protection approaches compliant with the rules on data processing should ensure the safe re-use of personal data and commercially confidential business data for research , innovation and statistical purposes. in many cases this implies that the data use and re-use in this context can only be done in a secure processing environment set in place and supervised by the public sector. there is experience at union level with such secure processing environments that are used for research on statistical microdata on the basis of commission regulation (eu) 557/2013 (39 ). in general , insofar as personal data are concerned , the processing of personal data should rely upon one or more of the grounds for processing provided in article 6 of regulation (eu) 2016/679.


### (7) the categories of data held by public sector bodies which should be subject to re-use under this regulation fall outside the scope of directive (eu) 2019/1024 that excludes data which is not accessible due to commercial and statistical confidentiality and data for which third parties have intellectual property rights. personal data fall outside the scope of directive (eu) 2019/1024 insofar as the access regime excludes or restricts access to such data for reasons of data protection , privacy and the integrity of the individual , in particular in accordance with data protection rules. the re-use of data , which may contain trade secrets , should take place without prejudice to directive (eu) 2016/94340 , which sets the framework for the lawful acquisition , use or disclosure of trade secrets. this regulation is without prejudice and complementary to more specific obligations on public sector bodies to allow re-use of data laid down in sector-specific union or national law. ### (7) the categories of data held by public sector bodies which should be subject to re-use under this regulation fall outside the scope of directive (eu) 2019/1024 that excludes data which is not accessible due to commercial and statistical confidentiality and data for which third parties have intellectual property rights. commercially confidential data includes data protected by trade secrets , confidential obligations and any other information the unauthorised disclosure of which would harm legitimate commercial interests in the business. personal data fall outside the scope of directive (eu) 2019/1024 insofar as the access regime excludes or restricts access to such data for reasons of data protection , privacy and the integrity of the individual , in particular in accordance with data protection rules. the re-use of data , which may contain trade secrets , should take place without prejudice to directive (eu) 2016/94340 , which sets the framework for the lawful acquisition , use or disclosure of trade secrets. this regulation is without prejudice and complementary to more specific obligations on public sector bodies to allow re-use of data laid down in sector-specific union or national law. it does not create an obligation to allow re-use of public sector data.


### (9) public sector bodies should comply with competition law when establishing the principles for re-use of data they hold , avoiding as far as possible the conclusion of agreements , which might have as their objective or effect the creation of exclusive rights for the re-use of certain data. such agreement should be only possible when justified and necessary for the provision of a service of general interest. this may be the case when exclusive use of the data is the only way to maximise the societal benefits of the data in question , for example where there is only one entity (which has specialised in the processing of a specific dataset) capable of delivering the service or the product which allows the public sector body to provide an advanced digital service in the general interest. such arrangements should , however , be concluded in compliance with public procurement rules and be subject to regular review based on a market analysis in order to ascertain whether such exclusivity continues to be necessary. in addition , such arrangements should comply with the relevant state aid rules , as appropriate , and should be concluded for a limited period , which should not exceed three years. in order to ensure transparency , such exclusive agreements should be published online , regardless of a possible publication of an award of a public procurement contract. ### (9) public sector bodies should comply with competition law when establishing the principles for re-use of data they hold , avoiding as far as possible the conclusion of agreements , which might have as their objective or effect the creation of exclusive rights for the re-use of certain data. such agreement should be only possible when justified and necessary for the provision of a service of general interest. this may be the case when exclusive use of the data is the only way to maximise the societal benefits of the data in question , for example where there is only one entity (which has specialised in the processing of a specific dataset) capable of delivering the service or the product which allows the public sector body to provide an advanced digital service in the general interest. such arrangements should , however , be concluded in compliance with public procurement rules and be subject to regular review based on a market analysis in order to ascertain whether such exclusivity continues to be necessary. in addition , such arrangements should comply with the relevant state aid rules , as appropriate , and should be concluded for a limited period , which should not exceed three years. in order to ensure transparency , such exclusive agreements should be published online at least two months before their entry into force , regardless of a possible publication of an award of a public procurement contract. this regulation should not be read as preventing data licensors to public sector bodies from concluding agreements , which limit the re-use of such licenced data , where a data license addresses the manner of delivery , maintenance and control of the data , as well as data security policies , practices and protocols , in particular where the data comprises personal or sensitive financial , technical or commercial information.


### (9) public sector bodies should comply with competition law when establishing the principles for re-use of data they hold , avoiding as far as possible the conclusion of agreements , which might have as their objective or effect the creation of exclusive rights for the re-use of certain data. such agreement should be only possible when justified and necessary for the provision of a service of general interest. this may be the case when exclusive use of the data is the only way to maximise the societal benefits of the data in question , for example where there is only one entity (which has specialised in the processing of a specific dataset) capable of delivering the service or the product which allows the public sector body to provide an advanced digital service in the general interest. such arrangements should , however , be concluded in compliance with public procurement rules and be subject to regular review based on a market analysis in order to ascertain whether such exclusivity continues to be necessary. in addition , such arrangements should comply with the relevant state aid rules , as appropriate , and should be concluded for a limited period , which should not exceed three years. in order to ensure transparency , such exclusive agreements should be published online , regardless of a possible publication of an award of a public procurement contract. ### (9) public sector bodies should comply with competition law when establishing the principles for re-use of data they hold , avoiding as far as possible the conclusion of agreements , which might have as their objective or effect the creation of exclusive rights for the re-use of certain data. such agreement should be only possible when justified and necessary for the provision of a service of general interest. this may be the case when exclusive use of the data is the only way to maximise the societal benefits of the data in question , for example where there is only one entity (which has specialised in the processing of a specific dataset) capable of delivering the service or the product which allows the public sector body to provide an advanced digital service in the general interest. such arrangements should , however , be concluded in compliance with public procurement rules and be subject to regular review based on a market analysis in order to ascertain whether such exclusivity continues to be necessary. in addition , such arrangements should comply with the relevant state aid rules , as appropriate , and should be concluded for a limited period , which should not exceed 12 months. that period may be extended by 12 months , subject to the approval of the competent body supporting the public sector body in question. in order to ensure transparency , such exclusive agreements should be published online , regardless of a possible publication of an award of a public procurement contract.


### (9) public sector bodies should comply with competition law when establishing the principles for re-use of data they hold , avoiding as far as possible the conclusion of agreements , which might have as their objective or effect the creation of exclusive rights for the re-use of certain data. such agreement should be only possible when justified and necessary for the provision of a service of general interest. this may be the case when exclusive use of the data is the only way to maximise the societal benefits of the data in question , for example where there is only one entity (which has specialised in the processing of a specific dataset) capable of delivering the service or the product which allows the public sector body to provide an advanced digital service in the general interest. such arrangements should , however , be concluded in compliance with public procurement rules and be subject to regular review based on a market analysis in order to ascertain whether such exclusivity continues to be necessary. in addition , such arrangements should comply with the relevant state aid rules , as appropriate , and should be concluded for a limited period , which should not exceed three years. in order to ensure transparency , such exclusive agreements should be published online , regardless of a possible publication of an award of a public procurement contract. ### (9) public sector bodies should comply with competition law when establishing the principles for re-use of data they hold , avoiding the conclusion of agreements , which might have as their objective or effect the creation of exclusive rights for the re-use of certain data. such agreement should be only possible , as exception , when justified and necessary for the provision of a service of general interest. this may be the case when exclusive use of the data is the only way to maximise the societal benefits of the data in question , for example where there is only one entity (which has specialised in the processing of a specific dataset) capable of delivering the service or the product which allows the public sector body to provide an advanced digital service in the general interest. such arrangements should , however , be concluded in compliance with public procurement rules and be subject to regular review based on a market analysis in order to ascertain whether such exclusivity continues to be necessary. in addition , such arrangements should comply with the relevant state aid rules , as appropriate , and should be concluded only for a limited period , which should not exceed three years. in order to ensure transparency and to ensure that there are no further violations of rights , such exclusive agreements should be completely motivated and published online , regardless of a possible publication of an award of a public procurement contract.


### (11) conditions for re-use of protected data that apply to public sector bodies competent under national law to allow re-use , and which should be without prejudice to rights or obligations concerning access to such data , should be laid down. those conditions should be non-discriminatory , proportionate and objectively justified , while not restricting competition. in particular , public sector bodies allowing re-use should have in place the technical means necessary to ensure the protection of rights and interests of third parties. conditions attached to the re-use of data should be limited to what is necessary to preserve the rights and interests of others in the data and the integrity of the information technology and communication systems of the public sector bodies. public sector bodies should apply conditions which best serve the interests of the re-user without leading to a disproportionate effort for the public sector. depending on the case at hand , before its transmission , personal data should be fully anonymised , so as to definitively not allow the identification of the data subjects , or data containing commercially confidential information modified in such a way that no confidential information is disclosed. where provision of anonymised or modified data would not respond to the needs of the re-user , on-premise or remote re-use of the data within a secure processing environment could be permitted. data analyses in such secure processing environments should be supervised by the public sector body , so as to protect the rights and interests of others. in particular , personal data should only be transmitted for re-use to a third party where a legal basis allows such transmission. the public sector body could make the use of such secure processing environment conditional on the signature by the re-user of a confidentiality agreement that prohibits the disclosure of any information that jeopardises the rights and interests of third parties that the re-user may have acquired despite the safeguards put in place. the public sector bodies , where relevant , should facilitate the re-use of data on the basis of consent of data subjects or permissions of legal persons on the re-use of data pertaining to them through adequate technical means. in this respect , the public sector body should support potential re-users in seeking such consent by establishing technical mechanisms that permit transmitting requests for consent from re-users , where practically feasible. no contact information should be given that allows re-users to contact data subjects or companies directly. ### (11) conditions for re-use of protected data that apply to public sector bodies competent under national law to allow re-use , and which should be without prejudice to rights or obligations concerning access to such data , should be laid down. those conditions should be non-discriminatory , proportionate and objectively justified , while not restricting competition. in particular , public sector bodies allowing re-use should have in place the technical means necessary to ensure the protection of rights and interests of third parties. conditions attached to the re-use of data should be limited to what is necessary to preserve the rights and interests of others in the data and the integrity of the information technology and communication systems of the public sector bodies. safeguards against the de-anonymization and identification of natural persons should be provided for. public sector bodies should apply conditions which best serve the interests of the re-user without leading to a disproportionate effort for the public sector. depending on the case at hand , before its transmission , personal data should be fully anonymised , so as to definitively not allow the identification of the data subjects , or data containing commercially confidential information modified in such a way that no confidential information is disclosed. where provision of anonymised or modified data would not respond to the needs of the re-user , on-premise or remote re-use of the data within a secure processing environment could be permitted. data analyses in such secure processing environments should be supervised by the public sector body , so as to protect the rights and interests of others. in particular , personal data should only be transmitted for re-use to a third party where a legal basis allows such transmission. the public sector body could make the use of such secure processing environment conditional on the signature by the re-user of a confidentiality agreement that prohibits the disclosure of any information that jeopardises the rights and interests of third parties that the re-user may have acquired despite the safeguards put in place. the public sector bodies , where relevant , should facilitate the re-use of data on the basis of consent of data subjects or permissions of legal persons on the re-use of data pertaining to them through adequate technical means. in this respect , the public sector body should support potential re-users in seeking such consent by establishing technical mechanisms that permit transmitting requests for consent from re-users , where practically feasible. no contact information should be given that allows re-users to contact data subjects or companies directly. commercially confidential data , which is not capable of protection by these measures , should not be made available for re-use.


### (11) conditions for re-use of protected data that apply to public sector bodies competent under national law to allow re-use , and which should be without prejudice to rights or obligations concerning access to such data , should be laid down. those conditions should be non-discriminatory , proportionate and objectively justified , while not restricting competition. in particular , public sector bodies allowing re-use should have in place the technical means necessary to ensure the protection of rights and interests of third parties. conditions attached to the re-use of data should be limited to what is necessary to preserve the rights and interests of others in the data and the integrity of the information technology and communication systems of the public sector bodies. public sector bodies should apply conditions which best serve the interests of the re-user without leading to a disproportionate effort for the public sector. depending on the case at hand , before its transmission , personal data should be fully anonymised , so as to definitively not allow the identification of the data subjects , or data containing commercially confidential information modified in such a way that no confidential information is disclosed. where provision of anonymised or modified data would not respond to the needs of the re-user , on-premise or remote re-use of the data within a secure processing environment could be permitted. data analyses in such secure processing environments should be supervised by the public sector body , so as to protect the rights and interests of others. in particular , personal data should only be transmitted for re-use to a third party where a legal basis allows such transmission. the public sector body could make the use of such secure processing environment conditional on the signature by the re-user of a confidentiality agreement that prohibits the disclosure of any information that jeopardises the rights and interests of third parties that the re-user may have acquired despite the safeguards put in place. the public sector bodies , where relevant , should facilitate the re-use of data on the basis of consent of data subjects or permissions of legal persons on the re-use of data pertaining to them through adequate technical means. in this respect , the public sector body should support potential re-users in seeking such consent by establishing technical mechanisms that permit transmitting requests for consent from re-users , where practically feasible. no contact information should be given that allows re-users to contact data subjects or companies directly. ### (11) conditions for re-use of protected data that apply to public sector bodies competent under national law to allow re-use , and which should be without prejudice to rights or obligations concerning access to such data provided in union or national law , should be laid down. those conditions should be non-discriminatory , proportionate and objectively justified , while not restricting competition. in particular , public sector bodies allowing re-use should have in place the technical means necessary to ensure the protection of rights and interests of third parties. conditions attached to the re-use of data should be limited to what is necessary to preserve the rights and interests of others in the data and the integrity of the information technology and communication systems of the public sector bodies. public sector bodies should apply conditions which best serve the interests of the re-user without leading to a disproportionate burden for the public sector. depending on the case at hand , before its transmission , personal data should be anonymised , so as to not allow the identification of the data subjects , or data containing commercially confidential information modified in such a way that no confidential information is disclosed. where the provision of anonymised or modified data would not respond to the needs of the re-user , on-premise or remote re-use of the data within a secure processing environment could be permitted. data analyses in such secure processing environments should be supervised by the public sector body , so as to protect the rights and interests of others. in particular , personal data should only be transmitted for re-use to a third party where a legal basis allows such transmission. in the event of any data breach resulting in the re-identification of the individuals concerned the re-users should report the breach to the competent supervisory authority in accordance with regulation (eu) 2016/679 and inform the public sector body. the public sector body could make the use of such secure processing environment conditional on the signature by the re-user of a confidentiality agreement that prohibits the disclosure of any information that jeopardises the rights and interests of third parties that the re-user may have acquired despite the safeguards put in place. the public sector bodies , where relevant , should facilitate the re-use of data on the basis of consent of data subjects on the re-use of data pertaining to them or permissions of data holders to allow the use of their non-personal data through adequate technical means. in this respect , the public sector body should support potential re-users in seeking such consent or permission by establishing technical mechanisms that permit transmitting requests for consent or permission from re-users , where practically feasible. no contact information should be given that allows re-users to contact data subjects or data holders directly. when transmitting the request for consent or permission , the public sector body should ensure that the data subject or data holder , as appropriate , is informed of the possibility to refuse such request.


### (11) conditions for re-use of protected data that apply to public sector bodies competent under national law to allow re-use , and which should be without prejudice to rights or obligations concerning access to such data , should be laid down. those conditions should be non-discriminatory , proportionate and objectively justified , while not restricting competition. in particular , public sector bodies allowing re-use should have in place the technical means necessary to ensure the protection of rights and interests of third parties. conditions attached to the re-use of data should be limited to what is necessary to preserve the rights and interests of others in the data and the integrity of the information technology and communication systems of the public sector bodies. public sector bodies should apply conditions which best serve the interests of the re-user without leading to a disproportionate effort for the public sector. depending on the case at hand , before its transmission , personal data should be fully anonymised , so as to definitively not allow the identification of the data subjects , or data containing commercially confidential information modified in such a way that no confidential information is disclosed. where provision of anonymised or modified data would not respond to the needs of the re-user , on-premise or remote re-use of the data within a secure processing environment could be permitted. data analyses in such secure processing environments should be supervised by the public sector body , so as to protect the rights and interests of others. in particular , personal data should only be transmitted for re-use to a third party where a legal basis allows such transmission. the public sector body could make the use of such secure processing environment conditional on the signature by the re-user of a confidentiality agreement that prohibits the disclosure of any information that jeopardises the rights and interests of third parties that the re-user may have acquired despite the safeguards put in place. the public sector bodies , where relevant , should facilitate the re-use of data on the basis of consent of data subjects or permissions of legal persons on the re-use of data pertaining to them through adequate technical means. in this respect , the public sector body should support potential re-users in seeking such consent by establishing technical mechanisms that permit transmitting requests for consent from re-users , where practically feasible. no contact information should be given that allows re-users to contact data subjects or companies directly. ### (11) conditions for re-use of protected data that apply to public sector bodies competent under national law to allow re-use , and which should be without prejudice to rights or obligations concerning access to such data , should be laid down. those conditions should be non-discriminatory , transparent , proportionate and objectively justified , while fostering competition , with a specific focus on promoting access to such data for smes , start-ups and civil society actors and promoting innovation and scientific research. in particular , public sector bodies allowing re-use should have in place the technical means necessary to ensure the protection of rights and interests of third parties and should be empowered to request the necessary information from the re-user. conditions attached to the re-use of data should be limited to what is necessary to preserve the rights and interests of others in the data and the integrity of the information technology and communication systems of the public sector bodies. public sector bodies should apply conditions which best serve the interests of the re-user without leading to a disproportionate burden for the public sector. depending on the case at hand , before its transmission , personal data should be fully anonymised , so as to definitively not allow the identification of the data subjects , or data containing commercially confidential information modified in such a way that no confidential information is disclosed. where provision of anonymised or modified data would not respond to the needs of the re-user , on-premise or remote re-use of the data within a secure processing environment could be permitted. data analyses in such secure processing environments should be supervised by the public sector body , so as to protect the rights and interests of others. in particular , personal data should only be transmitted for re-use to a third party where a legal basis allows such transmission. the public sector body should make the use of such secure processing environment conditional on the signature by the re-user of a confidentiality agreement that prohibits the disclosure of any information that jeopardises the rights and interests of third parties that the re-user may have acquired despite the safeguards put in place. the public sector bodies , where relevant , should facilitate the re-use of data on the basis of consent of data subjects or permissions of legal persons on the re-use of data pertaining to them through adequate technical means. in this respect , the public sector body should support potential re-users in seeking such consent by establishing technical mechanisms that permit transmitting requests for consent from re-users , where practically feasible. public sector bodies should focus in particular on seeking to ensure that smes , start-ups and civil society actors are able to compete fairly. no contact information should be given that allows re-users to contact data subjects or companies directly.


### (12) the intellectual property rights of third parties should not be affected by this regulation. this regulation should neither affect the existence or ownership of intellectual property rights of public sector bodies , nor should it limit the exercise of these rights in any way beyond the boundaries set by this regulation. the obligations imposed in accordance with this regulation should apply only insofar as they are compatible with international agreements on the protection of intellectual property rights , in particular the berne convention for the protection of literary and artistic works (berne convention) , the agreement on trade-related aspects of intellectual property rights (trips agreement) and the wipo copyright treaty (wct). public sector bodies should , however , exercise their copyright in a way that facilitates re-use. ### (12) the intellectual property rights of third parties should not be affected by this regulation. this regulation should neither affect the existence or ownership of intellectual property rights of public sector bodies , nor should it limit the exercise of these rights in any way beyond the boundaries set by this regulation. the obligations imposed in accordance with this regulation should apply only insofar as they are compatible with international agreements on the protection of intellectual property rights , in particular the berne convention for the protection of literary and artistic works (berne convention) , the agreement on trade-related aspects of intellectual property rights (trips agreement) and the wipo copyright treaty (wct) , and union intellectual property rules. public sector bodies should , however , exercise their copyright in a way that facilitates re-use.


### (12) the intellectual property rights of third parties should not be affected by this regulation. this regulation should neither affect the existence or ownership of intellectual property rights of public sector bodies , nor should it limit the exercise of these rights in any way beyond the boundaries set by this regulation. the obligations imposed in accordance with this regulation should apply only insofar as they are compatible with international agreements on the protection of intellectual property rights , in particular the berne convention for the protection of literary and artistic works (berne convention) , the agreement on trade-related aspects of intellectual property rights (trips agreement) and the wipo copyright treaty (wct). public sector bodies should , however , exercise their copyright in a way that facilitates re-use. ### (12) the intellectual property rights of third parties are not affected by this regulation. this regulation neither affects the existence or ownership of intellectual property rights of public sector bodies , nor does it limit the exercise of these rights in any way beyond the boundaries set by this regulation. the obligations imposed in accordance with this regulation should apply only insofar as they are compatible with international agreements on the protection of intellectual property rights , in particular the berne convention for the protection of literary and artistic works (berne convention) , the agreement on trade-related aspects of intellectual property rights (trips agreement) and the wipo copyright treaty (wct). public sector bodies should , however , exercise their copyright in a way that facilitates re-use.


### (13) data subject to intellectual property rights as well as trade secrets should only be transmitted to a third party where such transmission is lawful by virtue of union or national law or with the agreement of the rightholder. where public sector bodies are holders of the right provided for in article 7(1) of directive 96/9/ec of the european parliament and of the council (41 ) they should not exercise that right in order to prevent the re-use of data or to restrict re-use beyond the limits set by this regulation. ### (13) data subject to intellectual property rights as well as trade secrets should only be transmitted to a third party where such transmission is lawful by virtue of union or national law or with the agreement of the rightholder. this transmission should be previously completely motivated. where public sector bodies are holders of the right provided for in article 7(1) of directive 96/9/ec of the european parliament and of the council (41 ) they should not exercise that right in order to prevent the re-use of data or to restrict re-use beyond the limits set by this regulation.


### (15) furthermore , it is important to protect commercially sensitive data of non-personal nature , notably trade secrets , but also non-personal data representing content protected by intellectual property rights from unlawful access that may lead to ip theft or industrial espionage. in order to ensure the protection of fundamental rights or interests of data holders , non-personal data which is to be protected from unlawful or unauthorised access under union or national law , and which is held by public sector bodies , should be transferred only to third-countries where appropriate safeguards for the use of data are provided. such appropriate safeguards should be considered to exist when in that third-country there are equivalent measures in place which ensure that non-personal data benefits from a level of protection similar to that applicable by means of union or national law in particular as regards the protection of trade secrets and the protection of intellectual property rights. to that end , the commission may adopt implementing acts that declare that a third country provides a level of protection that is essentially equivalent to those provided by union or national law. the assessment of the level of protection afforded in such third-country should , in particular , take into consideration the relevant legislation , both general and sectoral , including concerning public security , defence , national security and criminal law concerning the access to and protection of non-personal data , any access by the public authorities of that third country to the data transferred , the existence and effective functioning of one or more independent supervisory authorities in the third country with responsibility for ensuring and enforcing compliance with the legal regime ensuring access to such data , or the third countries’ international commitments regarding the protection of data the third country concerned has entered into , or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems. the existence of effective legal remedies for data holders , public sector bodies or data sharing providers in the third country concerned is of particular importance in the context of the transfer of non-personal data to that third country. such safeguards should therefore include the availability of enforceable rights and of effective legal remedies. ### (15) furthermore , it is important to protect commercially sensitive data of non-personal nature , notably trade secrets , but also non-personal data representing content protected by intellectual property rights from unlawful access that may lead to ip theft or industrial espionage. in order to ensure the protection of fundamental rights or interests of data holders , non-personal data which is to be protected from unlawful or unauthorised access under union or national law , and which is held by public sector bodies , should be transferred only to third-countries where appropriate safeguards for the use of data are provided. such appropriate safeguards should be considered to exist when in that third-country there are equivalent measures in place which ensure that non-personal data benefits from a level of protection similar to that applicable by means of union or national law in particular as regards the protection of trade secrets and the protection of intellectual property rights. to that end , the commission may adopt implementing acts that declare that a third country provides a level of protection that is essentially equivalent to those provided by union or national law. in addition to that , should there be any worrying cases concerning the re-use of non-personalised data in third countries , the commission should take them into account when considering the adoption of implementing acts. the assessment of the level of protection afforded in such third-country should , in particular , take into consideration the relevant legislation , both general and sectoral , including concerning public security , defence , national security and criminal law concerning the access to and protection of non-personal data , any access by the public authorities of that third country to the data transferred , the existence and effective functioning of one or more independent supervisory authorities in the third country with responsibility for ensuring and enforcing compliance with the legal regime ensuring access to such data , or the third countries’ international commitments regarding the protection of data the third country concerned has entered into , or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems. the existence of effective legal remedies for data holders , public sector bodies or data sharing providers in the third country concerned is of particular importance in the context of the transfer of non-personal data to that third country. such safeguards should therefore include the availability of enforceable rights and of effective legal remedies.


### (15) furthermore , it is important to protect commercially sensitive data of non-personal nature , notably trade secrets , but also non-personal data representing content protected by intellectual property rights from unlawful access that may lead to ip theft or industrial espionage. in order to ensure the protection of fundamental rights or interests of data holders , non-personal data which is to be protected from unlawful or unauthorised access under union or national law , and which is held by public sector bodies , should be transferred only to third-countries where appropriate safeguards for the use of data are provided. such appropriate safeguards should be considered to exist when in that third-country there are equivalent measures in place which ensure that non-personal data benefits from a level of protection similar to that applicable by means of union or national law in particular as regards the protection of trade secrets and the protection of intellectual property rights. to that end , the commission may adopt implementing acts that declare that a third country provides a level of protection that is essentially equivalent to those provided by union or national law. the assessment of the level of protection afforded in such third-country should , in particular , take into consideration the relevant legislation , both general and sectoral , including concerning public security , defence , national security and criminal law concerning the access to and protection of non-personal data , any access by the public authorities of that third country to the data transferred , the existence and effective functioning of one or more independent supervisory authorities in the third country with responsibility for ensuring and enforcing compliance with the legal regime ensuring access to such data , or the third countries’ international commitments regarding the protection of data the third country concerned has entered into , or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems. the existence of effective legal remedies for data holders , public sector bodies or data sharing providers in the third country concerned is of particular importance in the context of the transfer of non-personal data to that third country. such safeguards should therefore include the availability of enforceable rights and of effective legal remedies. ### (15) furthermore , in order to preserve fair competition and an open market economy it is important to protect commercially sensitive data of non-personal nature , notably trade secrets , but also non-personal data representing content protected by intellectual property rights from unlawful access that may lead to ip theft or industrial espionage. in order to ensure the protection of fundamental rights or interests of data holders , non-personal data which is to be protected from unlawful or unauthorised access under union or national law , and which is held by public sector bodies , should be transferred only to third-countries where appropriate safeguards for the use of data are provided. such appropriate safeguards should be considered to exist when in those third-countries there are equivalent measures in place which ensure that non-personal data benefits from a level of protection similar to that applicable by means of union or national law in particular as regards the protection of trade secrets and the protection of intellectual property rights. to that end , the power to adopt acts in accordance with article 290 tfeu should be delegated to the commission to draw up and subsequently update a list identifying the third-countries that provide a level of protection that is essentially equivalent to those provided by union or national law. the assessment of the level of protection afforded in such third-countries should , in particular , take into consideration the relevant legislation , both general and sectoral , including concerning public security , defence , national security and criminal law concerning the access to and protection of non-personal data , any access by the public authorities of that third country to the data transferred , the existence and effective functioning of one or more independent supervisory authorities in the third country with responsibility for ensuring and enforcing compliance with the legal regime ensuring access to such data , or the third countries’ international commitments regarding the protection of data the third country concerned has entered into , or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems. the existence of effective legal remedies for data holders , public sector bodies or providers of data intermediation services in the third country concerned is of particular importance in the context of the transfer of non-personal data to that third country. such safeguards should therefore include the availability of enforceable rights and of effective legal remedies. moreover , should there be any worrying cases concerning the re-use of non-personal date in third countries , the commission should take these into account when adopting delegated acts.


### (17) some third countries adopt laws , regulations and other legal acts which aim at directly transferring or providing access to non-personal data in the union under the control of natural and legal persons under the jurisdiction of the member states. judgments of courts or tribunals or decisions of administrative authorities in third countries requiring such transfer or access to non-personal data should be enforceable when based on an international agreement , such as a mutual legal assistance treaty , in force between the requesting third country and the union or a member state. in some cases , situations may arise where the obligation to transfer or provide access to non-personal data arising from a third country law conflicts with a competing obligation to protect such data under union or national law , in particular as regards the protection of commercially sensitive data and the protection of intellectual property rights , and including its contractual undertakings regarding confidentiality in accordance with such law. in the absence of international agreements regulating such matters , transfer or access should only be allowed under certain conditions , in particular that the third-country system requires the reasons and proportionality of the decision to be set out , that the court order or the decision is specific in character , and the reasoned objection of the addressee is subject to a review by a competent court in the third country , which is empowered to take duly into account the relevant legal interests of the provider of such data. ### (17) some third countries adopt laws , regulations and other legal acts which aim at directly transferring or providing access to non-personal data in the union under the control of natural and legal persons under the jurisdiction of the member states. the public sector bodies , natural and legal entities , data intermediation service providers and data altruism organisations which have granted or have been granted the right to share or re-use data , should ensure that whenever entering contractual relations with third-parties , non-personal data held in the union can only be accessed by or transferred to third countries if union data protection law , security rules and consumer protection law or the data protection law , security rules and consumer protection law of the relevant member state are respected. they should also comply with , whenever possible , the highest level of technical standards , codes of conduct and certifications at union level. judgments of courts or tribunals or decisions of administrative authorities in third countries requiring such transfer or access to non-personal data should be enforceable when based on an international agreement , such as a mutual legal assistance treaty , in force between the requesting third country and the union or a member state. in some cases , situations may arise where the obligation to transfer or provide access to non-personal data arising from a third country law conflicts with a competing obligation to protect such data under union or national law , in particular as regards the protection of commercially sensitive data and the protection of intellectual property rights , and including its contractual undertakings regarding confidentiality in accordance with such law. in the absence of international agreements regulating such matters , transfer or access should only be allowed under certain conditions , in particular that the third-country system requires the reasons and proportionality of the decision to be set out , that the court order or the decision is specific in character , and the reasoned objection of the addressee is subject to a review by a competent court in the third country , which is empowered to take duly into account the relevant legal interests of the provider of such data.


### (19) in order to build trust in re-use mechanisms , it may be necessary to attach stricter conditions for certain types of non-personal data that have been identified as highly sensitive , as regards the transfer to third countries , if such transfer could jeopardise public policy objectives , in line with international commitments. for example , in the health domain , certain datasets held by actors in the public health system , such as public hospitals , could be identified as highly sensitive health data. in order to ensure harmonised practices across the union , such types of highly sensitive non-personal public data should be defined by union law , for example in the context of the european health data space or other sectoral legislation. the conditions attached to the transfer of such data to third countries should be laid down in delegated acts. conditions should be proportionate , non-discriminatory and necessary to protect legitimate public policy objectives identified , such as the protection of public health , public order , safety , the environment , public morals , consumer protection , privacy and personal data protection. the conditions should correspond to the risks identified in relation to the sensitivity of such data , including in terms of the risk of the re-identification of individuals. these conditions could include terms applicable for the transfer or technical arrangements , such as the requirement of using a secure processing environment , limitations as regards the re-use of data in third-countries or categories of persons which are entitled to transfer such data to third countries or who can access the data in the third country. in exceptional cases they could also include restrictions on transfer of the data to third countries to protect the public interest. ### (19) in order to build trust in re-use mechanisms , it may be necessary to attach stricter conditions for certain types of non-personal data that have been identified as highly sensitive , as regards the transfer to third countries , if such transfer could jeopardise public policy objectives , in line with international commitments. for example , in the health domain , certain datasets held by actors in the public health system , such as public hospitals , could be identified as highly sensitive health data. in order to ensure harmonised practices across the union , such types of highly sensitive non-personal public data should be defined by union law , for example in the context of the european health data space or other sectoral legislation. other sectors in which similar developments could be fostered through european data spaces are industry , agriculture , finance , mobility , environment and energy , public administration , professional skills. the conditions attached to the transfer of such data to third countries should be laid down in delegated acts. conditions should be proportionate , non-discriminatory and necessary to protect legitimate public policy objectives identified , such as the protection of public health , public order , safety , the environment , public morals , consumer protection , privacy and personal data protection. the conditions should correspond to the risks identified in relation to the sensitivity of such data , including in terms of the risk of the re-identification of individuals. these conditions could include terms applicable for the transfer or technical arrangements , such as the requirement of using a secure processing environment , limitations as regards the re-use of data in third-countries or categories of persons which are entitled to transfer such data to third countries or who can access the data in the third country. in exceptional cases they could also include restrictions on transfer of the data to third countries to protect the public interest.


### (21) in order to incentivise the re-use of these categories of data , member states should establish a single information point to act as the primary interface for re-users that seek to re-use such data held by the public sector bodies. it should have a cross-sector remit , and should complement , if necessary , arrangements at the sectoral level. in addition , member states should designate , establish or facilitate the establishment of competent bodies to support the activities of public sector bodies allowing re-use of certain categories of protected data. their tasks may include granting access to data , where mandated in sectoral union or member states legislation. those competent bodies should provide support to public sector bodies with state-of-the-art techniques , including secure data processing environments , which allow data analysis in a manner that preserves the privacy of the information. such support structure could support the data holders with management of the consent , including consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. data processing should be performed under the responsibility of the public sector body responsible for the register containing the data , who remains a data controller in the sense of regulation (eu) 2016/679 insofar as personal data are concerned. member states may have in place one or several competent bodies , which could act in different sectors. ### (21) in order to incentivise the re-use of these categories of data , member states should establish a single information point to act as the primary interface for re-users that seek to re-use such data held by the public sector bodies. it should have a cross-sector remit , and should complement , if necessary , arrangements at the sectoral level. in addition , member states should designate , establish or facilitate the establishment of competent bodies to support the activities of public sector bodies allowing re-use of certain categories of protected data. their tasks may include granting access to data , where mandated in sectoral union or member states legislation. those competent bodies should provide support to public sector bodies with state-of-the-art techniques , including secure data processing environments , which allow data analysis in a manner that preserves the privacy of the information. such support structure could support the data holders with management of the consent , including consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. data processing should be performed under the responsibility of the public sector body responsible for the register containing the data , who remains a data controller in the sense of regulation (eu) 2016/679 insofar as personal data are concerned. member states may have in place one or several competent bodies , which could act in different sectors while fully respecting the powers of supervisory authorities under regulation (eu) 2016/679.


### (21) in order to incentivise the re-use of these categories of data , member states should establish a single information point to act as the primary interface for re-users that seek to re-use such data held by the public sector bodies. it should have a cross-sector remit , and should complement , if necessary , arrangements at the sectoral level. in addition , member states should designate , establish or facilitate the establishment of competent bodies to support the activities of public sector bodies allowing re-use of certain categories of protected data. their tasks may include granting access to data , where mandated in sectoral union or member states legislation. those competent bodies should provide support to public sector bodies with state-of-the-art techniques , including secure data processing environments , which allow data analysis in a manner that preserves the privacy of the information. such support structure could support the data holders with management of the consent , including consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. data processing should be performed under the responsibility of the public sector body responsible for the register containing the data , who remains a data controller in the sense of regulation (eu) 2016/679 insofar as personal data are concerned. member states may have in place one or several competent bodies , which could act in different sectors. ### (21) in order to incentivise the re-use of these categories of data , member states should establish a single information point to act as the primary interface for re-users that seek to re-use such data held by the public sector bodies. it should have a cross-sector remit , and should complement , if necessary , arrangements at the sectoral level. in addition , member states should designate , establish or facilitate the establishment of competent bodies to support the activities of public sector bodies allowing re-use of certain categories of protected data. their tasks may include granting access to data , where mandated in sectoral union or member states legislation , and developing a harmonised approach and processes for public sector bodies to make data available. those competent bodies should provide support to public sector bodies with state-of-the-art techniques , including secure data processing environments , which allow data analysis in a manner that preserves the privacy of the information. such support structure could support the data holders with management of the consent , including consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. data processing should be performed under the responsibility of the public sector body responsible for the register containing the data , who remains a data controller in the sense of regulation (eu) 2016/679 insofar as personal data are concerned. member states may have in place one or several competent bodies , which could act in different sectors.


### (22) providers of data sharing services (data intermediaries) are expected to play a key role in the data economy , as a tool to facilitate the aggregation and exchange of substantial amounts of relevant data. data intermediaries offering services that connect the different actors have the potential to contribute to the efficient pooling of data as well as to the facilitation of bilateral data sharing. specialised data intermediaries that are independent from both data holders and data users can have a facilitating role in the emergence of new data-driven ecosystems independent from any player with a significant degree of market power. this regulation should only cover providers of data sharing services that have as a main objective the establishment of a business , a legal and potentially also technical relation between data holders , including data subjects , on the one hand , and potential users on the other hand , and assist both parties in a transaction of data assets between the two. it should only cover services aiming at intermediating between an indefinite number of data holders and data users , excluding data sharing services that are meant to be used by a closed group of data holders and users. providers of cloud services should be excluded , as well as service providers that obtain data from data holders , aggregate , enrich or transform the data and licence the use of the resulting data to data users , without establishing a direct relationship between data holders and data users , for example advertisement or data brokers , data consultancies , providers of data products resulting from value added to the data by the service provider. at the same time , data sharing service providers should be allowed to make adaptations to the data exchanged , to the extent that this improves the usability of the data by the data user , where the data user desires this , such as to convert it into specific formats. in addition , services that focus on the intermediation of content , in particular on copyright-protected content , should not be covered by this regulation. data exchange platforms that are exclusively used by one data holder in order to enable the use of data they hold as well as platforms developed in the context of objects and devices connected to the internet-of-things that have as their main objective to ensure functionalities of the connected object or device and allow value added services , should not be covered by this regulation. ‘consolidated tape providers’ in the sense of article 4 (1) point 53 of directive 2014/65/eu of the european parliament and of the council42 as well as ‘account information service providers’ in the sense of article 4 point 19 of directive (eu) 2015/2366 of the european parliament and of the council43 should not be considered as data sharing service providers for the purposes of this regulation. entities which restrict their activities to facilitating use of data made available on the basis of data altruism and that operate on a not-for-profit basis should not be covered by chapter iii of this regulation , as this activity serves objectives of general interest by increasing the volume of data available for such purposes. ### (22) providers of data intermediation services (data intermediaries) are expected to play a key role in the data economy , as a tool to facilitate the aggregation and exchange of substantial amounts of relevant data. data intermediaries offering services that connect the different actors have the potential to contribute to the efficient pooling of data as well as to the facilitation of bilateral data sharing. specialised data intermediaries that are independent from both data holders and data users can have a facilitating role in the emergence of new data-driven ecosystems independent from any player with a significant degree of market power. this regulation should only cover providers of data intermediation services that have as a main objective the establishment of a business , a legal and potentially also technical relation between data holders , including data subjects , on the one hand , and potential users on the other hand , and assist both parties in a transaction of data assets between the two. it should only cover services aiming at intermediating between an indefinite number of data holders and data users , excluding data sharing services that are meant to be used by a closed group of data holders and users. providers of cloud services should be excluded , as well as service providers that obtain data from data holders , aggregate , enrich or transform the data and licence the use of the resulting data to data users , without establishing a direct relationship between data holders and data users , for example advertisement or data brokers , data consultancies , providers of data products resulting from value added to the data by the service provider. at the same time , providers of data intermediation services should be allowed to make adaptations to the data exchanged , in order to improve the usability of the data by the data user , where the data user desires this , or improve interoperability such as to convert it into specific formats. in addition , services that focus on the intermediation of content , in particular on copyright-protected content , should not be covered by this regulation. data exchange platforms that are exclusively used by one data holder in order to enable the use of data they hold as well as platforms developed in the context of objects and devices connected to the internet-of-things that have as their main objective to ensure functionalities of the connected object or device and allow value added services , should not be covered by this regulation. ‘consolidated tape providers’ in the sense of article 4 (1) point 53 of directive 2014/65/eu of the european parliament and of the council42 as well as ‘account information service providers’ in the sense of article 4 point 19 of directive (eu) 2015/2366 of the european parliament and of the council43 should not be considered as providers of data intermediation services for the purposes of this regulation. entities which restrict their activities to facilitating use of data made available on the basis of data altruism and that operate on a not-for-profit basis should not be covered by chapter iii of this regulation , as this activity serves objectives of general interest by increasing the volume of data available for such purposes.


### (23) a specific category of data intermediaries includes providers of data sharing services that offer their services to data subjects in the sense of regulation (eu) 2016/679. such providers focus exclusively on personal data and seek to enhance individual agency and the individuals’ control over the data pertaining to them. they would assist individuals in exercising their rights under regulation (eu) 2016/679 , in particular managing their consent to data processing , the right of access to their own data , the right to the rectification of inaccurate personal data , the right of erasure or right ‘to be forgotten’ , the right to restrict processing and the data portability right , which allows data subjects to move their personal data from one controller to the other. in this context , it is important that their business model ensures that there are no misaligned incentives that encourage individuals to make more data available for processing than what is in the individuals’ own interest. this could include advising individuals on uses of their data they could allow and making due diligence checks on data users before allowing them to contact data subjects , in order to avoid fraudulent practices. in certain situations , it could be desirable to collate actual data within a personal data storage space , or ‘personal data space’ so that processing can happen within that space without personal data being transmitted to third parties in order to maximise the protection of personal data and privacy. ### (23) a specific category of data intermediaries includes providers of data sharing services that offer their services to data subjects in the sense of regulation (eu) 2016/679. such providers seek to enhance individual agency and the individuals’ control over the data relating to them. they would assist individuals in exercising their rights under regulation (eu) 2016/679 , in particular managing their consent to data processing , the right of access to their own data , the right to the rectification of inaccurate personal data , the right of erasure or right ‘to be forgotten’ , the right to restrict processing and the data portability right , which allows data subjects to move their personal data from one controller to the other. in this context , it is important that their business model ensures that there are no misaligned incentives that encourage individuals to make more data available for processing than what is in the individuals’ own interest. this could include advising individuals on uses of their data they could allow and making due diligence checks on data users before allowing them to contact data subjects , in order to avoid fraudulent practices. in certain situations , it could be desirable to collate actual data within a personal data storage space , or ‘personal data space’ so that processing can happen within that space without personal data being transmitted to third parties in order to maximise the protection of personal data and privacy.


### (25) in order to increase trust in such data sharing services , in particular related to the use of data and the compliance with the conditions imposed by data holders , it is necessary to create a union-level regulatory framework , which would set out highly harmonised requirements related to the trustworthy provision of such data sharing services. this will contribute to ensuring that data holders and data users have better control over the access to and use of their data , in accordance with union law. both in situations where data sharing occurs in a business-to-business context and where it occurs in a business-to-consumer context , data sharing providers should offer a novel , ‘european’ way of data governance , by providing a separation in the data economy between data provision , intermediation and use. providers of data sharing services may also make available specific technical infrastructure for the interconnection of data holders and data users. ### (25) in order to increase trust in such data intermediation services , in particular related to the use of data and the compliance with the conditions imposed by data holders , it is necessary to create a union-level regulatory framework , which would set out highly harmonised requirements related to the trustworthy provision of such data intermediation services. this will contribute to ensuring that data holders and data users have better control over the access to and use of their data , in accordance with union law. additionally , in order to foster trust , the commission should encourage and facilitate the development of self-regulatory codes of conduct at union level , involving relevant stakeholders. both in situations where data sharing occurs in a business-to-business context and where it occurs in a business-to-consumer context , data intermediation providers should offer a novel , ‘european’ way of data governance , by providing a separation in the data economy between data provision , intermediation and use. providers of data intermediation services may also make available specific technical infrastructure for the interconnection of data holders and data users. in that regard , it is important to shape that infrastructure in such a way that smes and start-ups as well as civil society actors encounter no technical or other barriers to their participation in the data economy.


### (26) a key element to bring trust and more control for data holder and data users in data sharing services is the neutrality of data sharing service providers as regards the data exchanged between data holders and data users. it is therefore necessary that data sharing service providers act only as intermediaries in the transactions , and do not use the data exchanged for any other purpose. this will also require structural separation between the data sharing service and any other services provided , so as to avoid issues of conflict of interest. this means that the data sharing service should be provided through a legal entity that is separate from the other activities of that data sharing provider. data sharing providers that intermediate the exchange of data between individuals as data holders and legal persons should , in addition , bear fiduciary duty towards the individuals , to ensure that they act in the best interest of the data holders. ### (26) a key element to bring trust and more control for data holder and data users in data intermediation services is the neutrality of providers of data intermediation services as regards the data exchanged between data holders and data users. it is therefore necessary that providers of data intermediation services act only as intermediaries in the transactions , and do not use the data exchanged for any other purpose. this will also require structural separation between the data intermediation service and any other services provided , so as to avoid issues of conflict of interest. this means that the data intermediation service should be provided through a legal entity that is separate from the other activities of that provider of data intermediation services. providers of data intermediation services should , however , be able to offer data holders and data users tools for the purpose of facilitating the exchange of data , for example tools for the analysis , conversion , aggregation , curation , anonymisation or pseudonymisation of data. providers of data intermediation services that intermediate the exchange of data between individuals as data holders and legal persons should , in addition , bear fiduciary duty towards the individuals , to ensure that they act in the best interest of the data holders.


### (33) the competent authorities designated to monitor compliance of data sharing services with the requirements in this regulation should be chosen on the basis of their capacity and expertise regarding horizontal or sectoral data sharing , and they should be independent as well as transparent and impartial in the exercise of their tasks. member states should notify the commission of the identity of the designated competent authorities. ### (33) the competent authorities designated to monitor compliance of data intermediation services with the requirements in this regulation should be chosen on the basis of their capacity and expertise regarding horizontal or sectoral data sharing , and they should be independent as well as transparent and impartial in the exercise of their tasks. member states should notify the commission of the identity of the designated competent authorities.


### (36) legal entities that seek to support purposes of general interest by making available relevant data based on data altruism at scale and meet certain requirements , should be able to register as ‘data altruism organisations recognised in the union’. this could lead to the establishment of data repositories. as registration in a member state would be valid across the union , and this should facilitate cross-border data use within the union and the emergence of data pools covering several member states. data subjects in this respect would consent to specific purposes of data processing , but could also consent to data processing in certain areas of research or parts of research projects as it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. legal persons could give permission to the processing of their non-personal data for a range of purposes not defined at the moment of giving the permission. the voluntary compliance of such registered entities with a set of requirements should bring trust that the data made available on altruistic purposes is serving a general interest purpose. such trust should result in particular from a place of establishment within the union , as well as from the requirement that registered entities have a not-for-profit character , from transparency requirements and from specific safeguards in place to protect rights and interests of data subjects and companies. further safeguards should include making it possible to process relevant data within a secure processing environment operated by the registered entity , oversight mechanisms such as ethics councils or boards to ensure that the data controller maintains high standards of scientific ethics , effective technical means to withdraw or modify consent at any moment , based on the information obligations of data processors under regulation (eu) 2016/679 as well as means for data subjects to stay informed about the use of data they made available. ### (36) legal entities that seek to support purposes of general interest by making available relevant data based on data altruism at scale and meet certain requirements , should be able to register as ‘data altruism organisations recognised in the union’. this could lead to the establishment of data repositories. as registration in a member state would be valid across the union , and this should facilitate cross-border data use within the union and the emergence of data pools covering several member states. data subjects in this respect would consent to specific purposes of data processing , but could also consent to data processing in certain areas of research or parts of research projects as it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. legal persons could give permission to the processing of their non-personal data for a range of purposes not defined at the moment of giving the permission. the voluntary compliance of such registered entities with a set of requirements should bring trust that the data made available on altruistic purposes is serving a general interest purpose. such trust should result in particular from a place of establishment within the union , as well as from the requirement that registered entities have a not-for-profit character , from transparency requirements and from specific safeguards in place to protect rights and interests of data subjects and companies. further safeguards should include making it possible to process relevant data within a secure processing environment operated by the registered entity , oversight mechanisms such as ethics councils or boards to ensure that the data controller maintains high standards of scientific ethics , effective technical means to withdraw or modify consent at any moment , based on the information obligations of data processors under regulation (eu) 2016/679 as well as means for data subjects to stay informed about the use of data they made available. registration as a recognised data altruism organisation should be a precondition for exercising data altruism activities. additionally , the commission should encourage and facilitate the development of self-regulatory codes of conduct at union level , involving relevant stakeholders.


### (36) legal entities that seek to support purposes of general interest by making available relevant data based on data altruism at scale and meet certain requirements , should be able to register as ‘data altruism organisations recognised in the union’. this could lead to the establishment of data repositories. as registration in a member state would be valid across the union , and this should facilitate cross-border data use within the union and the emergence of data pools covering several member states. data subjects in this respect would consent to specific purposes of data processing , but could also consent to data processing in certain areas of research or parts of research projects as it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. legal persons could give permission to the processing of their non-personal data for a range of purposes not defined at the moment of giving the permission. the voluntary compliance of such registered entities with a set of requirements should bring trust that the data made available on altruistic purposes is serving a general interest purpose. such trust should result in particular from a place of establishment within the union , as well as from the requirement that registered entities have a not-for-profit character , from transparency requirements and from specific safeguards in place to protect rights and interests of data subjects and companies. further safeguards should include making it possible to process relevant data within a secure processing environment operated by the registered entity , oversight mechanisms such as ethics councils or boards to ensure that the data controller maintains high standards of scientific ethics , effective technical means to withdraw or modify consent at any moment , based on the information obligations of data processors under regulation (eu) 2016/679 as well as means for data subjects to stay informed about the use of data they made available. ### (36) legal entities that seek to support purposes of general interest by making available relevant data based on data altruism at scale and meet certain requirements , should be able to register as ‘data altruism organisations recognised in the union’. this could lead to the establishment of data repositories. as registration in a member state would be valid across the union , and this should facilitate cross-border data use within the union and the emergence of data pools covering several member states. data subjects in this respect would consent to specific purposes of data processing , but could also consent to data processing in certain areas of research or parts of research projects as it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. legal persons could give permission to the processing of their non-personal data for a range of purposes not defined at the moment of giving the permission. the voluntary compliance of such registered entities with a set of requirements should bring trust that the data made available on altruistic purposes is serving a general interest purpose. such trust should result in particular from a place of establishment within the union , as well as from the requirement that registered entities have a not-for-profit character , from transparency requirements and from specific safeguards in place to protect rights and interests of data subjects and companies. further safeguards should include making it possible to process relevant data within a secure processing environment operated by the registered entity , oversight mechanisms such as ethics councils or boards to ensure that the data controller maintains high standards of scientific ethics , effective technical means to withdraw or modify consent at any moment , based on the information obligations of data processors under regulation (eu) 2016/679 as well as means for data subjects to stay informed about the use of data they made available. additionally , in order to foster trust , the commission should encourage and facilitate the development of self-regulatory codes of conduct at union level , involving relevant stakeholders.


### (39) to bring additional legal certainty to granting and withdrawing of consent , in particular in the context of scientific research and statistical use of data made available on an altruistic basis , a european data altruism consent form should be developed and used in the context of altruistic data sharing. such a form should contribute to additional transparency for data subjects that their data will be accessed and used in accordance with their consent and also in full compliance with the data protection rules. it could also be used to streamline data altruism performed by companies and provide a mechanism allowing such companies to withdraw their permission to use the data. in order to take into account the specificities of individual sectors , including from a data protection perspective , there should be a possibility for sectoral adjustments of the european data altruism consent form. ### (39) to promote trust and bring additional legal certainty and user-friendliness to granting and withdrawing of consent , in particular in the context of scientific research and statistical use of data made available on an altruistic basis , a european data altruism consent form should be developed and used in the context of altruistic data sharing. such a form should contribute to additional transparency for data subjects that their data will be accessed and used in accordance with their consent and also in full compliance with the data protection rules. it could also be used to streamline data altruism performed by companies and provide a mechanism allowing such companies to withdraw their permission to use the data. in order to take into account the specificities of individual sectors , including from a data protection perspective , there should be a possibility for sectoral adjustments of the european data altruism consent form.