### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , for any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party. ### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. this regulation also allows direct data sharing from users to third parties. this regulation precludes the data holder or the third party from directly or indirectly charging consumers or data subjects a fee , compensation or costs for sharing data or for accessing it. this regulation does not directly or indirectly incentivise the commercialisation or trade of personal data. in any case , the consumer and data subject should be in no way prevented from exercising the rights contained in this regulation or regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with both regulations. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party.


### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , for any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party. ### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. this regulation also allows direct data sharing from users to third parties. this regulation precludes the data holder or the third party from directly or indirectly charging consumers or data subjects a fee , compensation or costs for sharing data or for accessing it. this regulation does not directly or indirectly incentivise the commercialisation or trade of personal data. it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , for any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in this regulation or regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with both regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party.


### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon request of the user should only process the data for the purposes agreed with the user and share it with another third party only if this is necessary to provide the service requested by the user. ### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon request of the user should only process the data for the purposes explicitly requested by the user and share it with another third party only if this is necessary to provide the service requested by the user.


### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the third party should not coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user. in this context , third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. common and legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec. ### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the data holder or the third party should not make the exercise of the right or choices of users unduly difficult including by offering choices to users in a non-neutral manner , or coerce , deceive or manipulate the user in any way or subvert or impair the autonomy , decision-making or free choices of the user , including by means of a digital interface or a part thereof , including its structure , design , function or manner of operation. in this context , data holders and third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and free choice. legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. data holders and third parties should comply with their obligations under relevant union law , including the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec.


### (35) the third party should also refrain from using the data to profile individuals unless these processing activities are strictly necessary to provide the service requested by the user. the requirement to delete data when no longer required for the purpose agreed with the user complements the right to erasure of the data subject pursuant to article 17 of regulation 2016/679. where the third party is a provider of a data intermediation service within the meaning of [data governance act] , the safeguards for the data subject provided for by that regulation apply. the third party may use the data to develop a new and innovative product or related service but not to develop a competing product. ### (35) the third party should also refrain from using the data to profile individuals the requirement to delete data when no longer required for the purpose agreed with the user complements the right to erasure of the data subject pursuant to article 17 of regulation 2016/679. where the third party is a provider of a data intermediation service within the meaning of [data governance act] , the safeguards for the data subject provided for by that regulation apply.


### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means. ### (36) micro and small enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means.


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### deleted


### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available. ### (42) this regulation precludes the data holder or the third party from directly or indirectly charging consumers or data subjects a fee , compensation or costs for sharing data or for accessing it.


### (43) in justified cases , including the need to safeguard consumer participation and competition or to promote innovation in certain markets , union law or national legislation implementing union law may impose regulated compensation for making available specific data types. ### (43) this regulation does not directly or indirectly incentivise the commercialisation or trade of personal data.


### (44) to protect micro , small or medium-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models , the compensation for making data available to be paid by them should not exceed the direct cost of making the data available and be non-discriminatory. ### (44) to protect micro or small-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models , the compensation for making data available to be paid by them should not exceed the direct cost of making the data available and be non-discriminatory.


### (47) transparency is an important principle to ensure that the compensation requested by the data holder is reasonable , or , in case the data recipient is a micro , small or medium-sized enterprise , that the compensation does not exceed the costs directly related to making the data available to the data recipient and is attributable to the individual request. in order to put the data recipient in the position to assess and verify that the compensation complies with the requirements under this regulation , the data holder should provide to the data recipient the information for the calculation of the compensation with a sufficient degree of detail. ### (47) transparency is an important principle to ensure that the compensation requested by the data holder is reasonable , or , in case the data recipient is a micro or small-sized enterprise , that the compensation does not exceed the costs directly related to making the data available to the data recipient and is attributable to the individual request. in order to put the data recipient in the position to assess and verify that the compensation complies with the requirements under this regulation , the data holder should provide to the data recipient the information for the calculation of the compensation with a sufficient degree of detail.


### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on micro , small or medium-sized enterprises when they have been unilaterally imposed on them. ### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on consumers , micro or small-sized enterprises when they have been unilaterally imposed on them.


### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on micro , small or medium-sized enterprises when they have been unilaterally imposed on them. ### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm users and micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on micro , small or medium-sized enterprises when they have been unilaterally imposed on them.


### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. ### deleted


### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to , prevent or recover from public emergencies or to maintain the capacity to fulfil specific tasks explicitly provided by law. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65 should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested. ### deleted


### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. the commission should adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could remain to be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , the commission should be enabled to mandate the development of harmonised standards for the interoperability of data processing services. ### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability within the common european data spaces. this regulation lays down certain essential requirements for interoperability. data holders , and other operators within the data spaces facilitating or engaging in data sharing within the common european data spaces , should comply with these requirements. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. the commission should adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could remain to be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , the commission in consultation with the european data innovation board should be enabled to mandate the development of harmonised standards for the interoperability of data processing services.


### (81) in order to ensure the efficient implementation of this regulation , member states should designate one or more competent authorities. if a member state designates more than one competent authority , it should also designate a coordinating competent authority. competent authorities should cooperate with each other. the authorities responsible for the supervision of compliance with data protection and competent authorities designated under sectoral legislation should have the responsibility for application of this regulation in their areas of competence. ### (81) in order to ensure the efficient implementation of this regulation , member states should designate one or more competent authorities. if a member state designates more than one competent authority , it should also designate a coordinating competent authority. competent authorities should cooperate with each other effectively and in a timely manner , in line with the principles of good administration and mutual assistance to ensure the effective implementation and enforcement of this regulation. . the authorities responsible for the supervision of compliance with data protection and competent authorities designated under sectoral legislation should have the responsibility for application of this regulation in their areas of competence.


### (81) in order to ensure the efficient implementation of this regulation , member states should designate one or more competent authorities. if a member state designates more than one competent authority , it should also designate a coordinating competent authority. competent authorities should cooperate with each other. the authorities responsible for the supervision of compliance with data protection and competent authorities designated under sectoral legislation should have the responsibility for application of this regulation in their areas of competence. ### (81) in order to ensure the efficient implementation of this regulation , member states should designate one or more competent authorities with sufficient resources. if a member state designates more than one competent authority , it should also designate a coordinating competent authority. competent authorities should cooperate with each other effectively and in a timely manner , in line with the principles of good administration and mutual assistance to ensure the effective implementation and enforcement of this regulation. the authorities responsible for the supervision of compliance with data protection and competent authorities designated under sectoral legislation should have the responsibility for application of this regulation in their areas of competence. competent authorities shall cooperate upon request of the authorities within the european data protection board and the european data innovation board.


### (82) in order to enforce their rights under this regulation , natural and legal persons should be entitled to seek redress for the infringements of their rights under this regulation by lodging complaints with competent authorities. those authorities should be obliged to cooperate to ensure the complaint is appropriately handled and resolved. in order to make use of the consumer protection cooperation network mechanism and to enable representative actions , this regulation amends the annexes to the regulation (eu) 2017/2394 of the european parliament and of the council68 and directive (eu) 2020/1828 of the european parliament and of the council69 . ### (82) in order to enforce their rights under this regulation , natural and legal persons should be entitled to seek redress for the infringements of their rights under this regulation by lodging complaints with competent authorities. those authorities should be obliged to cooperate to ensure the complaint is appropriately handled and resolved. in order to make use of the consumer protection cooperation network mechanism and to enable representative actions , this regulation amends the annexes to the regulation (eu) 2017/2394 of the european parliament and of the council68 and directive (eu) 2020/1828 of the european parliament and of the council69 . authorities competent to enforce this regulation shall cooperate with the consumer protection cooperation network in relation to consumer protection matters , but not on data processing matters. any referral to the consumer protection cooperation network should not result in a lack of efficient or swift enforcement of the data act.


### (83) member states competent authorities should ensure that infringements of the obligations laid down in this regulation are sanctioned by penalties. when doing so , they should take into account the nature , gravity , recurrence and duration of the infringement in view of the public interest at stake , the scope and kind of activities carried out , as well as the economic capacity of the infringer. they should take into account whether the infringer systematically or recurrently fails to comply with its obligations stemming from this regulation. in order to help enterprises to draft and negotiate contracts , the commission should develop and recommend non-mandatory model contractual terms for business-to-business data sharing contracts , where necessary taking into account the conditions in specific sectors and the existing practices with voluntary data sharing mechanisms. these model contractual terms should be primarily a practical tool to help in particular smaller enterprises to conclude a contract. when used widely and integrally , these model contractual terms should also have the beneficial effect of influencing the design of contracts about access to and use of data and therefore lead more broadly towards fairer contractual relations when accessing and sharing data. ### (83) member states competent authorities should ensure that infringements of the obligations laid down in this regulation are sanctioned dissuasive and effective penalties , including imposing a temporary or definitive limitation including a ban on processing. when doing so , they should take into account the nature , gravity , recurrence and duration of the infringement in view of the public interest at stake , the scope and kind of activities carried out , as well as the economic capacity of the infringer. they should take into account whether the infringer systematically or recurrently fails to comply with its obligations stemming from this regulation. those penalties must also allow for the deprivation of the profits obtained through infringements of this regulation. in order to help enterprises to draft and negotiate contracts , the commission should develop and recommend non-mandatory model contractual terms for business-to-business data sharing contracts , where necessary taking into account the conditions in specific sectors and the existing practices with voluntary data sharing mechanisms. these model contractual terms should be primarily a practical tool to help in particular smaller enterprises to conclude a contract. when used widely and integrally , these model contractual terms should also have the beneficial effect of influencing the design of contracts about access to and use of data and therefore lead more broadly towards fairer contractual relations when accessing and sharing data.


### (83) member states competent authorities should ensure that infringements of the obligations laid down in this regulation are sanctioned by penalties. when doing so , they should take into account the nature , gravity , recurrence and duration of the infringement in view of the public interest at stake , the scope and kind of activities carried out , as well as the economic capacity of the infringer. they should take into account whether the infringer systematically or recurrently fails to comply with its obligations stemming from this regulation. in order to help enterprises to draft and negotiate contracts , the commission should develop and recommend non-mandatory model contractual terms for business-to-business data sharing contracts , where necessary taking into account the conditions in specific sectors and the existing practices with voluntary data sharing mechanisms. these model contractual terms should be primarily a practical tool to help in particular smaller enterprises to conclude a contract. when used widely and integrally , these model contractual terms should also have the beneficial effect of influencing the design of contracts about access to and use of data and therefore lead more broadly towards fairer contractual relations when accessing and sharing data. ### (83) member states competent authorities should ensure that infringements of the obligations laid down in this regulation are sanctioned by penalties. when doing so , they should take into account the nature , gravity , recurrence and duration of the infringement in view of the public interest at stake , the scope and kind of activities carried out , as well as the economic capacity of the infringer. they should take into account whether the infringer systematically or recurrently fails to comply with its obligations stemming from this regulation. in order to help enterprises to draft and negotiate contracts , the commission should develop and recommend non-mandatory model contractual terms for business-to-business data sharing contracts , where necessary taking into account the conditions in specific sectors and the existing practices with voluntary data sharing mechanisms. these model contractual terms should be primarily a practical tool to help in particular smaller enterprises to conclude a contract. when used widely and integrally , these model contractual terms should also have the beneficial effect of influencing the design of contracts about access to and use of data and therefore lead more broadly towards fairer contractual relations when accessing and sharing data. insofar as these model contractual terms concern the processing of personal data , the commission should adopt those terms in the form of a delegated act , in consultation with the edpb.


### 1. this regulation lays down harmonised rules on making data generated by the use of a product or related service available to the user of that product or service , on the making data available by data holders to data recipients , and on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need , for the performance of a task carried out in the public interest: ### 1. this regulation lays down harmonised rules on making data lawfully obtained , collected , or generated by the use of a product or data lawfully obtained , collected , or generated during the provision of a related service to the user of that product , on providers of related services , on the making data available by data holders upon request by a user or data subject to data recipients , and on contractual terms between users and data holder , and users and data recipients.


### 1. this regulation lays down harmonised rules on making data generated by the use of a product or related service available to the user of that product or service , on the making data available by data holders to data recipients , and on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need , for the performance of a task carried out in the public interest: ### 1. this regulation lays down harmonised rules on making data lawfully obtained , collected , or generated by the use of a product or data lawfully obtained , collected , or generated during the provision of a related service available to the data subjects and users of that product or service , on the making data available by data holders upon request by a user or data subject to data recipients , on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need , for the performance of a task carried out in the public interest and contractual terms between users and data holder , and users and data recipients:


### for the purposes of this regulation , the following definitions apply: ### without prejudice to paragraph 1 , the following definitions apply:


### for the purposes of this regulation , the following definitions apply: ### 1. for the purposes of this regulation , the definitions of regulation (eu) 2016/679 apply.


### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording; ### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording that may not be considered personal data within the meaning of article 4 (1) regulation (eu) 2016/679; as well as personal data within the meaning of article 4 (1) regulation (eu) 2016/679;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person that owns , rents , leases a product or receives a services , and the data subject as referred to in article 4(1) of regulation (eu)2016/679;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person that owns , rents , leases a product , receives a services or a consumer or data subject that uses a product or receives a service;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives related services , and , where the product or related service involves the processing of personal data , the data subject


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) 'user' means a natural or legal person that owns , rents or leases a product or receives a services and the person referred to in article 4(1) of regulation (eu) 2016/679;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person , including a data subject or public sector bodies , that owns , rents or leases a product or receives a related service;


### 2. before concluding a contract for the purchase , rent or lease of a product or a related service , at least the following information shall be provided to the user , in a clear and comprehensible format: ### 2. before concluding a contract for the purchase , rent or lease of a product or a related service , consumers should be presented with granular , meaningful consent options for data processing , within the meaning of article 4(11) of regulation (eu)2016/679 , differentiating between data that is essential for the functioning of the product and a related service and other types of data. in addition , at least the following information shall be provided to the user , in a timely and prominent manner , in an easily accessible , clear and comprehensible format:


### 2. before concluding a contract for the purchase , rent or lease of a product or a related service , at least the following information shall be provided to the user , in a clear and comprehensible format: ### 2. before concluding a contract for the purchase , rent or lease of a product or a related service , users should be presented with granular , meaningful consent options for data processing , within the meaning of article 4(11) of regulation (eu) 2016/679 , differentiating between data that is essential for the functioning of the product and a related service and other types of data. in addition , the data holder shall at least provide the following information to the user , in a timely and prominent manner , and in an easily accessible , clear and comprehensible format:


### the nature and volume of the data likely to be generated by the use of the product or related service; ### the nature , the format and the estimated volume of the data likely to be generated by the use of the product or related service;


### how the user may access those data; ### how the user may access and request a copy of those data free of charge;


### how the user may access those data; ### how the user may access and request a copy of those data;


### whether the seller , renter or lessor is the data holder and , if not , the identity of the data holder , such as its trading name and the geographical address at which it is established; ### whether the seller , renter or lessor is the data holder and , if not , the identity of the data holder , such as its trading name , contact details and the geographical address at which it is established;


### how the user may request that the data are shared with a third-party; ### how the user may request that the data are shared with a third-party free of charge;


### the user’s right to lodge a complaint alleging a violation of the provisions of this chapter with the competent authority referred to in article 31. ### the user’s right to lodge a complaint alleging a violation of the provisions of this chapter with the competent authority referred to in article 31 , including a list of competent authorities per member state.


### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , free of charge and , where applicable , continuously and in real-time. this shall be done on the basis of a simple request through electronic means where technically feasible. ### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service swiftly , without undue delay and in any case within a day , free of charge , easily , securely , in a structured , commonly used and machine-readable format , including access to derived or inferred data , and including the relevant metadata and , where applicable , of the same quality as is available to the data holder , continuously and in real-time. this shall be done on the basis of a simple request through electronic means. where this is not technically feasible , the data holder shall provide a functionally equivalent alternative.


### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time. ### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , in an interoperable , structured , commonly used and machine-readable format , of the same quality as is available to the data holder and , where applicable , continuously and in real-time.


### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time. ### 1. upon explicit request by a user or a data subject , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user or the data subject , of the same quality as is available to the data holder , easily , securely , in an interoperable , structured , commonly used and machine-readable format , and , where applicable , continuously and in real-time.


### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose. ### 1. a third party shall process the data made available to it pursuant to article 5 only for the specific purposes mentioned in paragraph 2a and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the explicitly requested purpose in line with paragraph 2a of this article.


### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose. ### 1. a third party shall process personal data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and where all conditions and rules provided by data protection legislation are complied with , notably where there is a valid legal basis under points (a) or (b) of article 6(1) of regulation (eu) 2016/679 , and where relevant , the conditions of article 9 of regulation (eu) 2016/679 and article 5(3) of directive 2002/58/ec are fulfilled and subject to the rights of the data subject insofar as personal data are concerned. the third party shall delete the data when they are no longer necessary for the agreed purpose.


### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose. ### 1. a third party shall process the data made available to it pursuant to article 5 only for the specific purposes mentioned in paragraph 3 and under the conditions agreed with the user , and where all conditions and rules provided by data protection legislation are complied with , notably where there is a valid legal basis under points (a) or (b) of article 6(1) of regulation (eu) 2016/679 , and where relevant , the conditions of article 9 of regulation (eu) 2016/679 and article 5(3) of directive 2002/58/ec are fulfilled and subject to the rights of the data subject insofar as personal data are concerned , and shall immediately delete the data when they are no longer necessary for the explicitly requested purpose in line with paragraph 3 of this article.


### coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user; ### make the exercise of the rights or choices of users unduly difficult including by offering choices to the users in a non-neutral manner , or coerce , deceive or manipulate the user in any way , or subvert or impair the autonomy , decision-making or choices of the user , including by means of a digital interface or a part thereof , including its structure , design , function or manner of operation;


### coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user; ### make the exercise of the rights or choices of users unduly difficult including by offering choices to the users in a non-neutral manner , or coerce , deceive or manipulate in any way the user or the data subject where the user is not a data subject , or subvert or impair the autonomy , decision-making or free choices of the user or the data subject , including by means of a digital interface or a part thereof , including its structure , design , function or manner of operation;


### make the data available it receives to another third party , in raw , aggregated or derived form , unless this is necessary to provide the service requested by the user; ### make the data available it receives to another third party , in raw , aggregated or derived form , unless this is necessary to provide the service requested by the user , , and the user has explicitly been made aware of this in a clear , easily accessible and prominent way and , in the case of personal data , the rights and obligations of regulation(eu) 2016/679 are respected;


### make the data available it receives to another third party , in raw , aggregated or derived form , unless this is necessary to provide the service requested by the user; ### make the data available it receives to another third party , in raw , aggregated or derived form , unless this is necessary to provide the service requested by the user , and the user has explicitly been made aware of this in a clear , easily accessible and prominent way and , in the case of personal data , the rights and obligations of regulation (eu) 2016/679 are respected;


### 1. the obligations of this chapter shall not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise. ### deleted


### 1. any compensation agreed between a data holder and a data recipient for making data available shall be reasonable. ### 1. this regulation precludes the data holder or the third party from directly or indirectly charging consumers or data subjects a fee , compensation or costs for sharing data or for accessing it. third parties are precluded from charging any potential cost of accessing the data to the user.


### 1. any compensation agreed between a data holder and a data recipient for making data available shall be reasonable. ### 1. any compensation agreed between a data holder and a data recipient for making data available in business-to-business relations shall be fair and reasonable and shall not disproportionally exceed the costs directly related to making the data available..


### 2. where the data recipient is a micro , small or medium enterprise , as defined in article 2 of the annex to recommendation 2003/361/ec , any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly. ### 2. where the data recipient is a micro or small enterprise , as defined in article 2 of the annex to recommendation 2003/361/ec , any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly.


### 4. the data holder shall provide the data recipient with information setting out the basis for the calculation of the compensation in sufficient detail so that the data recipient can verify that the requirements of paragraph 1 and , where applicable , paragraph 2 are met. ### 4. the data holder shall provide the data recipient with information setting out the basis for the calculation of the compensation in sufficient detail so that the data recipient can verify that the requirements of paragraph 2 are met.


### 1. the data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to effectively provide data to third parties pursuant to article 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1). ### 1. the data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to access data , obtain a copy or effectively provide data to third parties pursuant to article 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1).


### 2. a data recipient that has , for the purposes of obtaining data , provided inaccurate or false information to the data holder , deployed deceptive or coercive means or abused evident gaps in the technical infrastructure of the data holder designed to protect the data , has used the data made available for unauthorised purposes or has disclosed those data to another party without the data holder’s authorisation , shall without undue delay , unless the data holder or the user instruct otherwise: ### 2. a data recipient that has , for the purposes of obtaining data , provided inaccurate or false information to the data holder , deployed deceptive or coercive means or abused evident gaps in the technical infrastructure of the data holder designed to protect legally-protected trade secrets , has used the data made available for unauthorised purposes or has disclosed those data to another party without the user's consent , shall without undue delay , unless the data holder or the user instruct otherwise:


### it would be disproportionate in light of the interests of the data holder. ### it would be disproportionate in light of the interests of the user.


### (3) in sectors characterised by the presence of micro , small and medium-sized enterprises , there is often a lack of digital capacities and skills to collect , analyse and use data , and access is frequently restricted where one actor holds it in the system or due to a lack of interoperability between data , between data services or across borders. ### (3) in sectors characterised by the presence of micro and small enterprises , there is often a lack of digital capacities and skills to collect , analyse and use data.


### (6) data generation is the result of the actions of at least two actors , the designer or manufacturer of a product and the user of that product. it gives rise to questions of fairness in the digital economy , because the data recorded by such products or related services are an important input for aftermarket , ancillary and other services. in order to realise the important economic benefits of data as a non-rival good for the economy and society , a general approach to assigning access and usage rights on data is preferable to awarding exclusive rights of access and use. ### (6) data generation is the result of the actions of at least two actors , the designer or manufacturer of a product and the user of that product. it gives rise to questions of the protection of privacy and fairness in the digital economy , because the data recorded by such products or related services are an important input for aftermarket , ancillary and other services.


### (10) this regulation is without prejudice to union legal acts providing for the sharing of , the access to and the use of data for the purpose of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , or for customs and taxation purposes , irrespective of the legal basis under the treaty on the functioning of the european union on which basis they were adopted. such acts include regulation (eu) 2021/784 of the european parliament and of the council of 29 april 2021 on addressing the dissemination of terrorist content online , the [e-evidence proposals [com(2018) 225 and 226] once adopted] , the [proposal for] a regulation of the european parliament and of the council on a single market for digital services (digital services act) and amending directive 2000/31/ec , as well as international cooperation in this context in particular on the basis of the council of europe 2001 convention on cybercrime (“budapest convention”). this regulation is without prejudice to the competences of the member states regarding activities concerning public security , defence and national security in accordance with union law , and activities from customs on risk management and in general , verification of compliance with the customs code by economic operators. ### (10) this regulation is without prejudice to union legal acts providing for the sharing of , the access to and the use of data for the purpose of prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , or for customs and taxation purposes , irrespective of the legal basis under the treaty on the functioning of the european union on which basis they were adopted. such acts include regulation (eu) 2021/784 of the european parliament and of the council of 29 april 2021 on addressing the dissemination of terrorist content online , , the [proposal for] a regulation of the european parliament and of the council on a single market for digital services (digital services act) and amending directive 2000/31/ec , as well as international cooperation in this context in particular on the basis of the council of europe 2001 convention on cybercrime (“budapest convention”). this regulation is without prejudice to the competences of the member states regarding activities concerning public security , defence and national security , in so far as these activities fall outside the scope of union law.


### (13) this regulation is without prejudice to the competences of the member states regarding activities concerning public security , defence and national security in accordance with union law , and activities from customs on risk management and in general , verification of compliance with the customs code by economic operators. ### (13) this regulation is without prejudice to the competences of the member states regarding activities concerning public security , defence and national security in so far as these activities fall outside the scope of union.


### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , which has purchased , rented or leased the product. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service. ### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , which has purchased , rented or leased the product. depending on the legal title under which he or she uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service. a product or service may have been purchased , rented or leased by a business , and provided or otherwise made available to one or more employees. where such provision of a product or service results in the data concerned to be personal data , such data are subject to applicable union law , in particular on the protection of personal data , of privacy , and the protection of employees.


### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , which has purchased , rented or leased the product. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service. ### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , as well as a public sector body which has purchased , rented or leased the product or receives a related service , or a natural person that uses a product or receives a related service , without necessarily having subscribed to this service. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service. in the context of multiple users , each user may contribute in a different manner to the data generation and can have an interest in several forms of use.


### (30) the use of a product or related service may , in particular when the user is a natural person , generate data that relates to an identified or identifiable natural person (the data subject). processing of such data is subject to the rules established under regulation (eu) 2016/679 , including where personal and non-personal data in a data set are inextricably linked64 . the data subject may be the user or another natural person. personal data may only be requested by a controller or a data subject. a user who is the data subject is under certain circumstances entitled under regulation (eu) 2016/679 to access personal data concerning them , and such rights are unaffected by this regulation. under this regulation , the user who is a natural person is further entitled to access all data generated by the product , personal and non-personal. where the user is not the data subject but an enterprise , including a sole trader , and not in cases of shared household use of the product , the user will be a controller within the meaning of regulation (eu) 2016/679. accordingly , such a user as controller intending to request personal data generated by the use of a product or related service is required to have a legal basis for processing the data under article 6(1) of regulation (eu) 2016/679 , such as the consent of the data subject or legitimate interest. this user should ensure that the data subject is appropriately informed of the specified , explicit and legitimate purposes for processing those data , and how the data subject may effectively exercise their rights. where the data holder and the user are joint controllers within the meaning of article 26 of regulation (eu) 2016/679 , they are required to determine , in a transparent manner by means of an arrangement between them , their respective responsibilities for compliance with that regulation. it should be understood that such a user , once data has been made available , may in turn become a data holder , if they meet the criteria under this regulation and thus become subject to the obligations to make data available under this regulation. ### (30) the use of a product or related service may , in particular when the user is a natural person , generate data that relates to an identified or identifiable natural person (the data subject). processing of such data is subject to the rules established under regulation (eu) 2016/679 , including where personal and non-personal data in a data set are inextricably linked64 . the data subject may be the user or another natural person. personal data may only be requested by a controller or a data subject. a user who is the data subject is under certain circumstances entitled under regulation (eu) 2016/679 to access personal data concerning them , and such rights are unaffected by this regulation. under this regulation , the user who is a natural person is further entitled to access all data generated by the product , personal and non-personal. where the user is not the data subject but an enterprise , including a sole trader , and not in cases of shared household use of the product , the user will be a controller within the meaning of regulation (eu) 2016/679. accordingly , such a user as controller intending to request personal data generated by the use of a product or related service is required to have a legal basis for processing the data under article 6(1) of regulation (eu) 2016/679 , such as the consent of the data subject or legitimate interest. this user should ensure that the data subject is appropriately informed of the specified , explicit and legitimate purposes for processing those data , and how the data subject may effectively exercise their rights. where the data holder and the user are joint controllers within the meaning of article 26 of regulation (eu) 2016/679 , they are required to determine , in a transparent manner by means of an arrangement between them , their respective responsibilities for compliance with that regulation. it should be understood that such a user , once data has been made available , may in turn become a data holder , if they meet the criteria under this regulation and thus become subject to the obligations to make data available under this regulation.where the user is a union institution , agency or body , regulation (eu) 2018/1725 should apply.


### (32) access to any data stored in and accessed from terminal equipment is subject to directive 2002/58/ec and requires the consent of the subscriber or user within the meaning of that directive unless it is strictly necessary for the provision of an information society service explicitly requested by the user or subscriber (or for the sole purpose of the transmission of a communication). directive 2002/58/ec (‘eprivacy directive’) (and the proposed eprivacy regulation) protect the integrity of the user's terminal equipment as regards the use of processing and storage capabilities and the collection of information. internet of things equipment is considered terminal equipment if it is directly or indirectly connected to a public communications network. ### (32) access to any data stored in and accessed from terminal equipment is subject to directive 2002/58/ec and requires the consent of the subscriber or user within the meaning of that directive unless it is strictly necessary for the provision of an information society service explicitly requested by the user or subscriber (or for the sole purpose of the transmission of a communication). directive 2002/58/ec (‘eprivacy directive’) protect the integrity of the user's terminal equipment as regards the use of processing and storage capabilities and the collection of information. internet of things equipment is considered terminal equipment if it is directly or indirectly connected to a public communications network.


### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need. ### deleted


### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need. ### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law.


### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need. ### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies in the performance of their statutory duties in the public interest to use data held by an enterprise as a data holder to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. the principles of purpose limitation , and transparency , accountability and non-discrimination , as well as other principles of data protection law should also apply to business-to-government data sharing. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need.


### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. ### deleted


### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. ### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the legitimate general interest that has been explicitly provided in law. such specific task should aim at addressing a key challenge in order to improve the efficient provision of public services and policy making , in particular on healthcare , climate change , mobility , official statistics , as well as scientific research. it covers inter alia affordable housing , local transport or city planning (including sustainable tourism development) , improving infrastructural services (such as energy , waste and water management) , or producing reliable and up to date statistics. those requirements on behalf of general interest are in line with the data governance acta and should be in line with the principles of purpose limitation , and transparency , time limitation , accountability and non-discrimination , as well as other principles of data protection law. such exceptional need to share data with public entities may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation.


### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institution , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured. ### deleted


### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institution , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured. ### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institution , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the principle of purpose limitation and other principles of data protection law should also apply to situations where the public sector body or eu institution , agency or body shares the data received under this chapter with third parties to whom they have outsourced any function. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured.


### (63) data holders should have the possibility to either ask for a modification of the request made by a public sector body or union institution , agency and body or its cancellation in a period of 5 or 15 working days depending on the nature of the exceptional need invoked in the request. in case of requests motivated by a public emergency , justified reason not to make the data available should exist if it can be shown that the request is similar or identical to a previously submitted request for the same purpose by another public sector body or by another union institution , agency or body. a data holder rejecting the request or seeking its modification should communicate the underlying justification for refusing the request to the public sector body or to the union institution , agency or body requesting the data. in case the sui generis database rights under directive 96/6/ec of the european parliament and of the council66 apply in relation to the requested datasets , data holders should exercise their rights in a way that does not prevent the public sector body and union institutions , agencies or bodies from obtaining the data , or from sharing it , in accordance with this regulation. ### deleted


### (64) where it is strictly necessary to include personal data in the data made available to a public sector body or to a union institution , agency or body the applicable rules on personal data protection should be complied with and the making available of the data and their subsequent use should and be accompanied by safeguards for the rights and interests of individuals concerned by those data. the body requesting the data should demonstrate the strict necessity and the specific and limited purposes for processing. the data holder should take reasonable efforts to anonymise the data or , where such anonymisation proves impossible , the data holder should apply technological means such as pseudonymisation and aggregation , prior to making the data available. ### deleted


### (65) data made available to public sector bodies and to union institutions , agencies and bodies on the basis of exceptional need should only be used for the purpose for which they were requested , unless the data holder that made the data available has expressly agreed for the data to be used for other purposes. the data should be destroyed once it is no longer necessary for the purpose stated in the request , unless agreed otherwise , and the data holder should be informed thereof. ### deleted


### (67) when the safeguarding of a significant public good is at stake , such as is the case of responding to public emergencies , the public sector body or the union institution , agency or body should not be expected to compensate enterprises for the data obtained. public emergencies are rare events and not all such emergencies require the use of data held by enterprises. the business activities of the data holders are therefore not likely to be negatively affected as a consequence of the public sector bodies or union institutions , agencies or bodies having recourse to this regulation. however , as cases of an exceptional need other than responding to a public emergency might be more frequent , including cases of prevention of or recovery from a public emergency , data holders should in such cases be entitled to a reasonable compensation which should not exceed the technical and organisational costs incurred in complying with the request and the reasonable margin required for making the data available to the public sector body or to the union institution , agency or body. the compensation should not be understood as constituting payment for the data itself and as being compulsory. ### deleted


### (80) to promote the interoperability of smart contracts in data sharing applications , it is necessary to lay down essential requirements for smart contracts for professionals who create smart contracts for others or integrate such smart contracts in applications that support the implementation of agreements for sharing data. in order to facilitate the conformity of such smart contracts with those essential requirements , it is necessary to provide for a presumption of conformity for smart contracts that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. ### (80) it is necessary to lay down essential requirements for smart contracts for professionals who create smart contracts for others or integrate such smart contracts in applications that support the implementation of agreements for sharing data. in order to facilitate the conformity of such smart contracts with those essential requirements , it is necessary to provide for a presumption of conformity for smart contracts that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council.


### manufacturers of products and suppliers of related services placed on the market in the union and the users of such products or services; ### manufacturers of products and providers of related services placed on the market in the union and the users or in the case of personal data , the data subject , with regard to the the information generated by the use of such products or related services relates to;


### manufacturers of products and suppliers of related services placed on the market in the union and the users of such products or services; ### manufacturers of products and suppliers of related services placed on the market in the union , irrespective of their place of establishment , and the use of such products or related services in the union;


### public sector bodies and union institutions , agencies or bodies that request data holders to make data available where there is an exceptional need to that data for the performance of a task carried out in the public interest and the data holders that provide those data in response to such request; ### deleted


### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. this regulation shall not affect the applicability of union law on the protection of personal data , in particular regulation (eu) 2016/679 and directive 2002/58/ec , including the powers and competences of supervisory authorities. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement the right of data portability under article 20 of regulation (eu) 2016/679. ### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. the obtaining , collection , or generation of personal data through the use of a product or related service requires a legal basis pursuant to data protection law. this regulation does not create a legal basis for the processing of personal data , nor does it affect any of the rights and obligations set out in regulations (eu) 2016/679 or (eu) 2018/1725 or directives 2002/58/ec or (eu) 2016/680. the legitimate interest , as laid down in article 6 paragraph 1 point f of regulation (eu) 2016/679 , of the manufacturer of a product or the provider of a related service shall not constitute a legal basis for this. this regulation is without prejudice to union law on the protection of personal data and privacy , in particular regulation (eu) 2016/679 , regulation (eu) 2018/1725 , directive 2002/58/ec , and directive (eu) 2016(680) , including the powers and competences of supervisory authorities. in the event of a conflict between this regulation and union law on the protection of personal data or privacy or national law adopted in accordance with such union law , the relevant union or national law on the protection of personal data or privacy shall prevail. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement and particularise the right of data portability under article 20 of regulation (eu) 2016/679 , and shall not adversely affect data protection rights of others. insofar as the processing of personal data , which is made available to a data recipient pursuant to article 5 of this regulation , is restricted in accordance with article 6 of this regulation , the provisions contained in here shall take precedence over article 6 of regulation (eu) 2016/679.