### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. the commission should adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could remain to be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , the commission should be enabled to mandate the development of harmonised standards for the interoperability of data processing services. ### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. the commission should , as soon as possible , adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , the commission should be enabled to mandate the development of harmonised standards for the interoperability of data processing services.


### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. the commission should adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could remain to be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , the commission should be enabled to mandate the development of harmonised standards for the interoperability of data processing services. ### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. taking into account , where relevant , positions adopted by the european data innovation board , as referred to in article 30(f) of regulation… [dga] , the commission should be able to adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri could be part of the technical specifications for semantic interoperability. furthermore , taking into account , where relevant , positions adopted by the european data innovation board , as referred to in article 30(f) of regulation… [dga] , the commission should be enabled to mandate the development of harmonised standards for the interoperability of data processing services.


### (81) in order to ensure the efficient implementation of this regulation , member states should designate one or more competent authorities. if a member state designates more than one competent authority , it should also designate a coordinating competent authority. competent authorities should cooperate with each other. the authorities responsible for the supervision of compliance with data protection and competent authorities designated under sectoral legislation should have the responsibility for application of this regulation in their areas of competence. ### (81) in order to ensure the efficient implementation of this regulation , member states should designate a competent authority with sufficient resources. if a member state designates more than one competent authority , it should also designate a coordinating competent authority. competent authorities should cooperate with each other effectively and in a timely manner , in line with the principles of good administration and mutual assistance to ensure the effective implementation and enforcement of this regulation. the authorities responsible for the supervision of compliance with data protection and competent authorities designated under sectoral legislation should have the responsibility for application of this regulation in their areas of competence. competent authorities shall cooperate upon request of the authorities within the european data protection board and the european data innovation board.


### (82) in order to enforce their rights under this regulation , natural and legal persons should be entitled to seek redress for the infringements of their rights under this regulation by lodging complaints with competent authorities. those authorities should be obliged to cooperate to ensure the complaint is appropriately handled and resolved. in order to make use of the consumer protection cooperation network mechanism and to enable representative actions , this regulation amends the annexes to the regulation (eu) 2017/2394 of the european parliament and of the council68 and directive (eu) 2020/1828 of the european parliament and of the council69 . ### (82) in order to enforce their rights under this regulation , natural and legal persons should be entitled to seek redress for the infringements of this regulation by lodging complaints with competent authorities and before the courts. those authorities should be obliged to cooperate to ensure the complaint is appropriately handled and resolved quickly and efficiently.. in order to make use of the consumer protection cooperation network mechanism and to enable representative actions , this regulation amends the annexes to the regulation (eu) 2017/2394 of the european parliament and of the council68 and directive (eu) 2020/1828 of the european parliament and of the council69 . authorities competent to enforce this regulation shall cooperate with the consumer protection cooperation network in relation to consumer protection matters , but not on data processing matters. any referral to the consumer protection cooperation network should not result in a lack of efficient or swift enforcement of the data act.


### (82) in order to enforce their rights under this regulation , natural and legal persons should be entitled to seek redress for the infringements of their rights under this regulation by lodging complaints with competent authorities. those authorities should be obliged to cooperate to ensure the complaint is appropriately handled and resolved. in order to make use of the consumer protection cooperation network mechanism and to enable representative actions , this regulation amends the annexes to the regulation (eu) 2017/2394 of the european parliament and of the council68 and directive (eu) 2020/1828 of the european parliament and of the council69 . ### (82) in order to enforce their rights under this regulation , natural and legal persons should be entitled to seek redress for the infringements of their rights under this regulation by lodging complaints with competent authorities. those authorities should be obliged to cooperate to ensure the complaint is appropriately handled in a timely manner and resolved. in order to make use of the consumer protection cooperation network mechanism and to enable representative actions , this regulation amends the annexes to the regulation (eu) 2017/2394 of the european parliament and of the council68 and directive (eu) 2020/1828 of the european parliament and of the council69 .


### (83) member states competent authorities should ensure that infringements of the obligations laid down in this regulation are sanctioned by penalties. when doing so , they should take into account the nature , gravity , recurrence and duration of the infringement in view of the public interest at stake , the scope and kind of activities carried out , as well as the economic capacity of the infringer. they should take into account whether the infringer systematically or recurrently fails to comply with its obligations stemming from this regulation. in order to help enterprises to draft and negotiate contracts , the commission should develop and recommend non-mandatory model contractual terms for business-to-business data sharing contracts , where necessary taking into account the conditions in specific sectors and the existing practices with voluntary data sharing mechanisms. these model contractual terms should be primarily a practical tool to help in particular smaller enterprises to conclude a contract. when used widely and integrally , these model contractual terms should also have the beneficial effect of influencing the design of contracts about access to and use of data and therefore lead more broadly towards fairer contractual relations when accessing and sharing data. ### (83) member states competent authorities should ensure that infringements of the obligations laid down in this regulation are sanctioned by penalties. when doing so , they should take into account the nature , gravity , recurrence and duration of the infringement in view of the public interest at stake , the scope and kind of activities carried out , as well as the economic capacity of the infringer. they should take into account whether the infringer systematically or recurrently fails to comply with its obligations stemming from this regulation. in order to help enterprises to draft and negotiate contracts , the commission should develop and recommend non-mandatory model contractual terms for business-to-business data sharing contracts , where necessary taking into account the conditions in specific sectors and the existing practices with voluntary data sharing mechanisms. these model contractual terms should notably address the preservation of the confidentiality of trade secrets in the framework of this regulation. these model contractual terms should be primarily a practical tool to help in particular smaller enterprises to conclude a contract. when used widely and integrally , these model contractual terms should also have the beneficial effect of influencing the design of contracts about access to and use of data and therefore lead more broadly towards fairer contractual relations when accessing and sharing data. to that end , the adaptation of directive 93/13/eec on unfair terms in consumer contracts to the data economy should be particularly scrutinised.


### 1. this regulation lays down harmonised rules on making data generated by the use of a product or related service available to the user of that product or service , on the making data available by data holders to data recipients , and on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need , for the performance of a task carried out in the public interest: ### 1. this regulation lays down harmonised rules on making data lawfully obtained , collected , or generated by the use of a product or data lawfully obtained , collected , or generated during the provision of a related service to the user of that product , on providers of related services , on the making data available by data holders upon request by a user or data subject to data recipients , and on contractual terms between users and data holder , and users and data recipients.


### 1. this regulation lays down harmonised rules on making data generated by the use of a product or related service available to the user of that product or service , on the making data available by data holders to data recipients , and on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need , for the performance of a task carried out in the public interest: ### 1. this regulation lays down harmonised rules:


### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording; ### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording; content , or data obtained , generated or collected by the connected product or transmitted to it on behalf of others for the purpose of storage or processing , shall not be covered by this regulation.


### (3) ‘related service’ means a digital service , including software , which is incorporated in or inter-connected with a product in such a way that its absence would prevent the product from performing one of its functions; ### (3) ‘related service’ means a digital service , including software , which is necessary in order for the product to perform one or more of its functions and which involves communicating data from the product to the related service , and deriving or inferring data;


### (3) ‘related service’ means a digital service , including software , which is incorporated in or inter-connected with a product in such a way that its absence would prevent the product from performing one of its functions; ### (3) ‘related service’ means a digital service , including software , which is necessary in order for the connected product to perform one or more of its functions and which involves the transmission of data from the connected product to the provider of that service


### (4) ‘virtual assistants’ means software that can process demands , tasks or questions including based on audio , written input , gestures or motions , and based on those demands , tasks or questions provides access their own and third party services or control their own and third party devices; ### (4) ‘virtual assistants’ means software that can process demands , tasks or questions including based on audio , written input , gestures or motions , and based on those demands , tasks or questions provides access to related services or control products;


### (4) ‘virtual assistants’ means software that can process demands , tasks or questions including based on audio , written input , gestures or motions , and based on those demands , tasks or questions provides access their own and third party services or control their own and third party devices; ### (4) ‘virtual assistants’ means software , including when incorporated in a connected product , that can process demands , tasks or questions including based on audio , written input , gestures or motions , and based on those demands , tasks or questions provides access to services or control the functions of connected products;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives related services , and the data subject;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person , including a data subject , that owns a connected product or receives a related service , or to whom the owner of the connected product has transferred , on the basis of a rental or lease agreement , temporary rights to use the connected product or receive related services;


### maintaining functional equivalence of the service in the it-environment of the different provider or providers of data processing services covering the same service type , in accordance with article 26. ### maintaining functional equivalence of the service in the it-environment of the different provider or providers of data processing services covering the same service type.


### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services shall be clearly set out in a written contract. without prejudice to directive (eu) 2019/770 , that contract shall include at least the following: ### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services or to an on-premise system shall be clearly reflected in a written contract. without prejudice to directive (eu) 2019/770 , that contract shall include at least the following:


### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall: ### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 60 calendar days , during which the data processing service provider shall:


### 2. before concluding a contract for the purchase , rent or lease of a product or a related service , at least the following information shall be provided to the user , in a clear and comprehensible format: ### 2. before concluding a contract for the purchase of a connected product , the vendor shall provide , at least the following information to a prospective buyer in a clear and comprehensible format:


### the nature and volume of the data likely to be generated by the use of the product or related service; ### the nature , format , estimated volume , collection frequency , and in-device storage duration of data , which the connected product is capable of obtaining , collecting or otherwise generating;


### how the user may access those data; ### how the access and , where relevant , retrieve those data;


### whether the seller , renter or lessor is the data holder and , if not , the identity of the data holder , such as its trading name and the geographical address at which it is established; ### deleted


### the means of communication which enable the user to contact the data holder quickly and communicate with that data holder efficiently; ### deleted


### how the user may request that the data are shared with a third-party; ### deleted


### the user’s right to lodge a complaint alleging a violation of the provisions of this chapter with the competent authority referred to in article 31. ### deleted


### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , free of charge and , where applicable , continuously and in real-time. this shall be done on the basis of a simple request through electronic means where technically feasible. ### 1. where it cannot be directly accessed by the user from the product , the data holder shall make available to the user any data transmitted to them by the connected product , or generated during the provision of related services without undue delay , free of charge and , where applicable , continuously and in real-time , in a comprehensive , structured , commonly used and machine-readable format and including the relevant metadata. this shall be done on the basis of a simple request through electronic means.


### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , free of charge and , where applicable , continuously and in real-time. this shall be done on the basis of a simple request through electronic means where technically feasible. ### 1. where it cannot be directly accessed by the user from the product , data holders shall make available to the user any data transmitted to them by the connected product , or generated during the provision of related services without undue delay , free of charge and , where applicable , continuously and in real-time , in a comprehensive , structured , commonly used and machine-readable format and including the relevant metadata. this shall be done on the basis of a simple request through electronic means where technically feasible.


### 4. the user shall not use the data obtained pursuant to a request referred to in paragraph 1 to develop a product that competes with the product from which the data originate. ### deleted


### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time. ### 1. upon request by a user , or by a party acting on behalf of a user , data holders shall make available data transmitted to them from the connected product or generated during the provision of a related service to a data recipient , without undue delay , free of charge to the user , in an interoperable , structured , commonly used and machine-readable format and of the same quality as is available to the data holder and , where applicable , continuously and in real-time , including any technically essential metadata.


### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time. ### 1. upon request by a user , or by a party acting on behalf of a user , or , in the case of personal data , upon request of the data subject , data holders shall make available data transmitted to them from the connected product or generated during the provision of a related service to a data recipient , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time.


### solicit or commercially incentivise a user in any manner , including by providing monetary or any other compensation , to make data available to one of its services that the user has obtained pursuant to a request under article 4(1); ### solicit or commercially incentivise a user in any manner whatsoever , to make data available to one of its services that the user has obtained pursuant to a request under article 4(1);


### solicit or commercially incentivise a user in any manner , including by providing monetary or any other compensation , to make data available to one of its services that the user has obtained pursuant to a request under article 4(1); ### solicit user in any manner to make data available to one of its services that the user has obtained pursuant to a request under article 4(1);


### 4. the third party shall not deploy coercive means or abuse evident gaps in the technical infrastructure of the data holder designed to protect the data in order to obtain access to data. ### 4. the data recipient shall not deploy coercive means or abuse evident gaps in the technical infrastructure of a data holder designed to protect the data in order to obtain access to data.


### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose. ### 1. a data recipient shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose , unless agreed differently with the user.


### coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user; ### make the exercise of the rights or choices of users unduly difficult including by offering choices to the users in a non-neutral manner , or coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface or a part thereof , including its structure , design , function or manner of operation;


### make the data available it receives to another third party , in raw , aggregated or derived form , unless this is necessary to provide the service requested by the user; ### make the data available it receives to another third party , unless this is explicitly permitted by the user , or necessary to provide the service requested by the user;


### make the data available it receives to an undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper pursuant to article […] of [regulation on contestable and fair markets in the digital sector (digital markets act)]; ### deleted


### scope of business to consumer and business to business data sharing obligations ### scope of business to business data sharing obligations


### 1. the obligations of this chapter shall not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise. ### 1. the obligations of this chapter related to business to business data-sharing shall not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise.


### 1. the obligations of this chapter shall not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise. ### 1. the obligations of article 5(1) shall not apply to connected products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise and where a micro or small enterprise is not subcontracted to manufacture or design a product or provide a related service.


### 2. where this regulation refers to products or related services , such reference shall also be understood to include virtual assistants , insofar as they are used to access or control a product or related service. ### deleted


### 1. where a data holder is obliged to make data available to a data recipient under article 5 or under other union law or national legislation implementing union law , it shall do so under fair , reasonable and non-discriminatory terms and in a transparent manner in accordance with the provisions of this chapter and chapter iv. ### 1. where a data holder is obliged to make data available to a data recipient under article 5 or under other union law or national legislation implementing union law , it shall agree , where applicable , with a data recipient the modalities for making the data available and shall do so under fair , reasonable and non-discriminatory terms and in a transparent manner in accordance with the provisions of this chapter and chapter iv.


### 2. a data holder shall agree with a data recipient the terms for making the data available. a contractual term concerning the access to and use of the data or the liability and remedies for the breach or the termination of data related obligations shall not be binding if it fulfils the conditions of article 13 or if it excludes the application of , derogates from or varies the effect of the user’s rights under chapter ii. ### 2. any contractual term concerning the access to and use of the data or the liability and remedies for the breach or the termination of data related obligations shall not be binding if it fulfils the conditions of article 13 or if it excludes the application of , derogates from or varies the effect of the user of the connected product’s rights under chapter ii.


### 2. a data holder shall agree with a data recipient the terms for making the data available. a contractual term concerning the access to and use of the data or the liability and remedies for the breach or the termination of data related obligations shall not be binding if it fulfils the conditions of article 13 or if it excludes the application of , derogates from or varies the effect of the user’s rights under chapter ii. ### 2. any contractual agreement concerning the access to and use of the data or the liability and remedies for the breach or the termination of data related obligations shall not be binding if it fulfils the conditions of article 13 or if it excludes the application of , derogates from or varies the effect of the user’s rights under chapter ii.


### 3. a data holder shall not discriminate between comparable categories of data recipients , including partner enterprises or linked enterprises , as defined in article 3 of the annex to recommendation 2003/361/ec , of the data holder , when making data available. where a data recipient considers the conditions under which data has been made available to it to be discriminatory , it shall be for the data holder to demonstrate that there has been no discrimination. ### 3. a data holder shall not discriminate with respect to the modalities of data sharing between comparable categories of data recipients , including partner enterprises or linked enterprises , as defined in article 3 of the annex to recommendation 2003/361/ec , of the data holder , when making data available. where a data recipient considers the conditions under which data has been made available to it to be discriminatory , it shall be for the data holder to demonstrate that there has been no discrimination.


### 1. any compensation agreed between a data holder and a data recipient for making data available shall be reasonable. ### 1. any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly.


### 1. any compensation agreed between a data holder and a data recipient for making data available shall be reasonable. ### 1. any compensation agreed between a data holder and a data recipient for making data available shall not exceed the costs related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly.


### 2. where the data recipient is a micro , small or medium enterprise , as defined in article 2 of the annex to recommendation 2003/361/ec , any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly. ### deleted


### 4. the data holder shall provide the data recipient with information setting out the basis for the calculation of the compensation in sufficient detail so that the data recipient can verify that the requirements of paragraph 1 and , where applicable , paragraph 2 are met. ### 4. the data holder shall provide the data recipient with information setting out the basis for the calculation of the compensation in sufficient detail so that the data recipient can verify that the requirements of paragraph 1 are met.


### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9. ### 1. users , data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the fulfilment of the data holder’s obligation to make data available to the data recipient , upon the request of the user , the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9.


### 1. the data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to effectively provide data to third parties pursuant to article 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1). ### 1. the user or data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to effectively access and use data transmitted from the product or generated during the provision of related services , or provide such data to data recipients pursuant to article 5 or any right of a data recipient under union law or national legislation implementing union law as referred to in article 8(1).


### 2. a data recipient that has , for the purposes of obtaining data , provided inaccurate or false information to the data holder , deployed deceptive or coercive means or abused evident gaps in the technical infrastructure of the data holder designed to protect the data , has used the data made available for unauthorised purposes or has disclosed those data to another party without the data holder’s authorisation , shall without undue delay , unless the data holder or the user instruct otherwise: ### 2. a data recipient that has , for the purposes of obtaining data , provided inaccurate or false information to the data holder , deployed deceptive or coercive means or abused evident gaps in the technical infrastructure designed to protect the data , has used the data made available for unauthorised purposes or has disclosed those data to another party without the user’s authorisation , shall without undue delay , unless the data holder or the user instruct otherwise:


### unfair contractual terms unilaterally imposed on a micro , small or medium-sized enterprise ### unilaterally imposed unfair contractual terms


### 1. a contractual term , concerning the access to and use of data or the liability and remedies for the breach or the termination of data related obligations which has been unilaterally imposed by an enterprise on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec shall not be binding on the latter enterprise if it is unfair. ### 1. a contractual term , concerning the access to and use of data or the liability and remedies for the breach or the termination of data related obligations which has been unilaterally imposed by one actor onto another shall not be binding on the latter actor if it is unfair.


### (3) in sectors characterised by the presence of micro , small and medium-sized enterprises , there is often a lack of digital capacities and skills to collect , analyse and use data , and access is frequently restricted where one actor holds it in the system or due to a lack of interoperability between data , between data services or across borders. ### (3) in particular in sectors characterised by the presence of micro , small and medium-sized enterprises , there is often a lack of digital capacities and skills to collect , analyse and use data , and access is frequently restricted where one actor holds it in the system or due to a lack of interoperability between data , between data services or across borders.


### (6) data generation is the result of the actions of at least two actors , the designer or manufacturer of a product and the user of that product. it gives rise to questions of fairness in the digital economy , because the data recorded by such products or related services are an important input for aftermarket , ancillary and other services. in order to realise the important economic benefits of data as a non-rival good for the economy and society , a general approach to assigning access and usage rights on data is preferable to awarding exclusive rights of access and use. ### (6) data generation is a function of the design of a connected product , in particular the inclusion of sensors and processing software within the device , of the actions of the user and , depending on the operating modalities , of the provision of one or more related service. in addition , many connected products , for example in the civil infrastructure , energy generation or transport sectors are recording data about their environment or interaction with other elements of that infrastructure without any actions by the user or any third party. such data may often be non-personal in nature and valuable for the user or third parties , which can use it to improve their operations , the overall functioning of a network or system or by making it available to create new products or services. this gives rise to questions of fairness in the digital economy , because the data generated and transmitted by such products or related services are an important input for aftermarket , ancillary and other services. in order to realise the important economic benefits of data for the user , as well as for the economy and society , a general approach to assigning access and usage rights on data is preferable to awarding exclusive rights of access and use.


### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , which has purchased , rented or leased the product. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service. ### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , which has purchased , rented or leased the product. depending on the legal title under which he or she uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service. a product or service may have been purchased , rented or leased by a business , and provided or otherwise made available to one or more employees. where such provision of a product or service results in the data concerned to be personal data , such data are subject to applicable union law , in particular on the protection of personal data , of privacy , and the protection of employees.


### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , which has purchased , rented or leased the product. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service. ### (18) the user of a connected product should be understood as the legal or natural person , such as a business or consumer , which has acquired the connected product or receives related services , or to whom the owner of the connected product has transferred , on the basis of a rental or lease agreement , temporary rights to use the connected product or receive related services. such a user bears the risks and enjoys the benefits of using the connected product and should therefore be entitled to derive benefit from data transmitted by that connected product and generated by the provision of any related service.


### (30) the use of a product or related service may , in particular when the user is a natural person , generate data that relates to an identified or identifiable natural person (the data subject). processing of such data is subject to the rules established under regulation (eu) 2016/679 , including where personal and non-personal data in a data set are inextricably linked64 . the data subject may be the user or another natural person. personal data may only be requested by a controller or a data subject. a user who is the data subject is under certain circumstances entitled under regulation (eu) 2016/679 to access personal data concerning them , and such rights are unaffected by this regulation. under this regulation , the user who is a natural person is further entitled to access all data generated by the product , personal and non-personal. where the user is not the data subject but an enterprise , including a sole trader , and not in cases of shared household use of the product , the user will be a controller within the meaning of regulation (eu) 2016/679. accordingly , such a user as controller intending to request personal data generated by the use of a product or related service is required to have a legal basis for processing the data under article 6(1) of regulation (eu) 2016/679 , such as the consent of the data subject or legitimate interest. this user should ensure that the data subject is appropriately informed of the specified , explicit and legitimate purposes for processing those data , and how the data subject may effectively exercise their rights. where the data holder and the user are joint controllers within the meaning of article 26 of regulation (eu) 2016/679 , they are required to determine , in a transparent manner by means of an arrangement between them , their respective responsibilities for compliance with that regulation. it should be understood that such a user , once data has been made available , may in turn become a data holder , if they meet the criteria under this regulation and thus become subject to the obligations to make data available under this regulation. ### (30) the use of a product or related service may , in particular when the user is a natural person , generate data that relates to an identified or identifiable natural person (the data subject). processing of such data is subject to the rules established under regulation (eu) 2016/679 , including where personal and non-personal data in a data set are inextricably linked64 . such generation and further processing of personal data is only permitted to begin with where one of the legal grounds pursuant to articles 6(1) and 9 of that regulation is met. a user who is the data subject is under certain circumstances entitled under regulation (eu) 2016/679 to access personal data concerning them , and such rights are unaffected by this regulation. under this regulation , the user who is a natural person is further entitled to access all data generated by the product , personal and non-personal. accordingly , such a user intending to request personal data generated by the use of a product or related service is required to have a legal basis for processing the data under article 6(1) of regulation (eu) 2016/679 , such as the consent of the data subject , a contractual arrangement , or a legal obligation. the legitimate interest of such a user , or of the provider of a product or service , should not be considered a legal basis for generating , further processing , and accessing personal data. the data subject can expect products and services to not collect , obtain , or generate data about them without their consent or a freely entered contractual agreement. this user should ensure that the data subject is appropriately informed of the specified , explicit and legitimate purposes for processing those data , and how the data subject may effectively exercise their rights. where the data holder and the user are joint controllers within the meaning of article 26 of regulation (eu) 2016/679 , they are required to determine , in a transparent manner by means of an arrangement between them , their respective responsibilities for compliance with that regulation. it should be understood that such a user , once data has been made available , may in turn become a data holder , if they meet the criteria under this regulation and thus become subject to the obligations to make data available under this regulation. where the user is a union institution , agency or body , regulation (eu) 2018/1725 should apply unprejudiced.


### (30) the use of a product or related service may , in particular when the user is a natural person , generate data that relates to an identified or identifiable natural person (the data subject). processing of such data is subject to the rules established under regulation (eu) 2016/679 , including where personal and non-personal data in a data set are inextricably linked64 . the data subject may be the user or another natural person. personal data may only be requested by a controller or a data subject. a user who is the data subject is under certain circumstances entitled under regulation (eu) 2016/679 to access personal data concerning them , and such rights are unaffected by this regulation. under this regulation , the user who is a natural person is further entitled to access all data generated by the product , personal and non-personal. where the user is not the data subject but an enterprise , including a sole trader , and not in cases of shared household use of the product , the user will be a controller within the meaning of regulation (eu) 2016/679. accordingly , such a user as controller intending to request personal data generated by the use of a product or related service is required to have a legal basis for processing the data under article 6(1) of regulation (eu) 2016/679 , such as the consent of the data subject or legitimate interest. this user should ensure that the data subject is appropriately informed of the specified , explicit and legitimate purposes for processing those data , and how the data subject may effectively exercise their rights. where the data holder and the user are joint controllers within the meaning of article 26 of regulation (eu) 2016/679 , they are required to determine , in a transparent manner by means of an arrangement between them , their respective responsibilities for compliance with that regulation. it should be understood that such a user , once data has been made available , may in turn become a data holder , if they meet the criteria under this regulation and thus become subject to the obligations to make data available under this regulation. ### (30) the use of a product or related service may , in particular when the user is a natural person , generate data that relates to an identified or identifiable natural person (the data subject). processing of such data is subject to the rules established under regulation (eu) 2016/679 , including where personal and non-personal data in a data set are inextricably linked64 . the data subject may be the user or another natural person. personal data may only be requested by a controller or a data subject. a user who is the data subject is under certain circumstances entitled under regulation (eu) 2016/679 to access personal data concerning them , and such rights are unaffected by this regulation. under this regulation , the user who is a natural person is further entitled to access all data transmitted by the connected product or generated during the provision of related services , personal and non-personal. where the user is not the data subject but an enterprise , including a sole trader , and not in cases of shared household use of the product , the user will be a controller within the meaning of regulation (eu) 2016/679. accordingly , such a user as controller intending to request personal data generated by the use of a product or related service is required to have a legal basis for processing the data under article 6(1) of regulation (eu) 2016/679 , such as the consent of the data subject or legitimate interest. this user should ensure that the data subject is appropriately informed of the specified , explicit and legitimate purposes for processing those data , and how the data subject may effectively exercise their rights. where the data holder and the user are joint controllers within the meaning of article 26 of regulation (eu) 2016/679 , they are required to determine , in a transparent manner by means of an arrangement between them , their respective responsibilities for compliance with that regulation. it should be understood that such a user , once data has been made available , may in turn become a data holder , if they meet the criteria under this regulation and thus become subject to the obligations to make data available under this regulation.


### (32) access to any data stored in and accessed from terminal equipment is subject to directive 2002/58/ec and requires the consent of the subscriber or user within the meaning of that directive unless it is strictly necessary for the provision of an information society service explicitly requested by the user or subscriber (or for the sole purpose of the transmission of a communication). directive 2002/58/ec (‘eprivacy directive’) (and the proposed eprivacy regulation) protect the integrity of the user's terminal equipment as regards the use of processing and storage capabilities and the collection of information. internet of things equipment is considered terminal equipment if it is directly or indirectly connected to a public communications network. ### (32) access to any data stored in and accessed from terminal equipment is subject to directive 2002/58/ec and requires the consent of the subscriber or user within the meaning of that directive unless it is strictly necessary for the provision of an information society service explicitly requested by the user or subscriber (or for the sole purpose of the transmission of a communication). directive 2002/58/ec (‘eprivacy directive’) (and the proposed eprivacy regulation) protect the integrity of the user's terminal equipment as regards the use of processing and storage capabilities and the collection of information.


### (40) in order to ensure that the conditions for mandatory data access are fair for both parties , the general rules on data access rights should refer to the rule on avoiding unfair contract terms. ### deleted


### (46) it is not necessary to intervene in the case of data sharing between large companies , or when the data holder is a small or medium-sized enterprise and the data recipient is a large company. in such cases , the companies are considered capable of negotiating any compensation if it is reasonable , taking into account factors such as the volume , format , nature , or supply of and demand for the data as well as the costs for collecting and making the data available to the data recipient. ### deleted


### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need. ### deleted


### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need. ### (56) in situations of exceptional need , arising from an imminent public emergency or from a situation where the public sector body or union institution , agency or body is acting on the basis of eu , or member state law and has identified a specific data set , which is unavailable to it and which is demonstrably necessary to fulfil a specific task in the public interest that has been explicitly provided by law , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data , which an enterprise is currently collecting or has previously obtained , collected or otherwise generated and which it retains at the time of the request , to respond to the situation of exceptional need. research-performing organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need.


### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. ### deleted


### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. ### (58) where the exceptional need is not justified by the need to respond to a public emergency , the public sector body or the union institution , agency or body , acting on the basis of eu or member state law , should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law and the legal basis for requiring the access to that data. such exceptional need may include the timely compilation of official statistics when data is not otherwise available and necessary for the fulfilment of a specific task in the public interest. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. data holders should inform users of connected products if their data access and use rights are affected by the request by the public sector body or the union institution , agency or body.


### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institution , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured. ### deleted


### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institution , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured. ### (61) a proportionate , limited and predictable framework at union level should complement eu or member state law for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institutions , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institutions , agencies and bodies to data holders should be based on eu or member state law , specific , transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests including secondary requests for access to the data under the once-only principle , made by public sector bodies , and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured.


### (63) data holders should have the possibility to either ask for a modification of the request made by a public sector body or union institution , agency and body or its cancellation in a period of 5 or 15 working days depending on the nature of the exceptional need invoked in the request. in case of requests motivated by a public emergency , justified reason not to make the data available should exist if it can be shown that the request is similar or identical to a previously submitted request for the same purpose by another public sector body or by another union institution , agency or body. a data holder rejecting the request or seeking its modification should communicate the underlying justification for refusing the request to the public sector body or to the union institution , agency or body requesting the data. in case the sui generis database rights under directive 96/6/ec of the european parliament and of the council66 apply in relation to the requested datasets , data holders should exercise their rights in a way that does not prevent the public sector body and union institutions , agencies or bodies from obtaining the data , or from sharing it , in accordance with this regulation. ### deleted


### (63) data holders should have the possibility to either ask for a modification of the request made by a public sector body or union institution , agency and body or its cancellation in a period of 5 or 15 working days depending on the nature of the exceptional need invoked in the request. in case of requests motivated by a public emergency , justified reason not to make the data available should exist if it can be shown that the request is similar or identical to a previously submitted request for the same purpose by another public sector body or by another union institution , agency or body. a data holder rejecting the request or seeking its modification should communicate the underlying justification for refusing the request to the public sector body or to the union institution , agency or body requesting the data. in case the sui generis database rights under directive 96/6/ec of the european parliament and of the council66 apply in relation to the requested datasets , data holders should exercise their rights in a way that does not prevent the public sector body and union institutions , agencies or bodies from obtaining the data , or from sharing it , in accordance with this regulation. ### (63) data holders should have the possibility to either ask for a modification of the request made by a public sector body or union institution , agency and body or its cancellation in a period of 10 or 20 working days depending on the nature of the exceptional need invoked in the request. in case of requests motivated by a public emergency , justified reason not to make the data available should exist if it can be shown that the request is similar or identical to a previously submitted request for the same purpose by another public sector body or by another union institution , agency or body or if the data holder is not currently collecting or has not previously collected , obtained or otherwise generated the requested data and does not retain it at the time of the request. a data holder rejecting the request or seeking its modification should communicate the underlying justification for refusing the request to the public sector body or to the union institution , agency or body requesting the data. in case the sui generis database rights under directive 96/6/ec of the european parliament and of the council apply in relation to the requested datasets , data holders should exercise their rights in a way that does not prevent the public sector body and union institutions , agencies or bodies from obtaining the data , or from sharing it , in accordance with this regulation.


### (64) where it is strictly necessary to include personal data in the data made available to a public sector body or to a union institution , agency or body the applicable rules on personal data protection should be complied with and the making available of the data and their subsequent use should and be accompanied by safeguards for the rights and interests of individuals concerned by those data. the body requesting the data should demonstrate the strict necessity and the specific and limited purposes for processing. the data holder should take reasonable efforts to anonymise the data or , where such anonymisation proves impossible , the data holder should apply technological means such as pseudonymisation and aggregation , prior to making the data available. ### deleted


### (65) data made available to public sector bodies and to union institutions , agencies and bodies on the basis of exceptional need should only be used for the purpose for which they were requested , unless the data holder that made the data available has expressly agreed for the data to be used for other purposes. the data should be destroyed once it is no longer necessary for the purpose stated in the request , unless agreed otherwise , and the data holder should be informed thereof. ### deleted


### (65) data made available to public sector bodies and to union institutions , agencies and bodies on the basis of exceptional need should only be used for the purpose for which they were requested , unless the data holder that made the data available has expressly agreed for the data to be used for other purposes. the data should be destroyed once it is no longer necessary for the purpose stated in the request , unless agreed otherwise , and the data holder should be informed thereof. ### (65) data made available to public sector bodies and to union institutions , agencies and bodies on the basis of exceptional need should only be used for the purpose for which they were requested. the data should be destroyed once it is no longer necessary for the purpose stated in the request , unless agreed otherwise , and the data holder should be informed thereof. public sector bodies and to union institutions , agencies and bodies should ensure , including through the application of proportionate security measures , where applicable in accordance with union and national law , that any protected nature of data is preserved and unauthorised access is avoided.


### (67) when the safeguarding of a significant public good is at stake , such as is the case of responding to public emergencies , the public sector body or the union institution , agency or body should not be expected to compensate enterprises for the data obtained. public emergencies are rare events and not all such emergencies require the use of data held by enterprises. the business activities of the data holders are therefore not likely to be negatively affected as a consequence of the public sector bodies or union institutions , agencies or bodies having recourse to this regulation. however , as cases of an exceptional need other than responding to a public emergency might be more frequent , including cases of prevention of or recovery from a public emergency , data holders should in such cases be entitled to a reasonable compensation which should not exceed the technical and organisational costs incurred in complying with the request and the reasonable margin required for making the data available to the public sector body or to the union institution , agency or body. the compensation should not be understood as constituting payment for the data itself and as being compulsory. ### deleted


### (67) when the safeguarding of a significant public good is at stake , such as is the case of responding to public emergencies , the public sector body or the union institution , agency or body should not be expected to compensate enterprises for the data obtained. public emergencies are rare events and not all such emergencies require the use of data held by enterprises. the business activities of the data holders are therefore not likely to be negatively affected as a consequence of the public sector bodies or union institutions , agencies or bodies having recourse to this regulation. however , as cases of an exceptional need other than responding to a public emergency might be more frequent , including cases of prevention of or recovery from a public emergency , data holders should in such cases be entitled to a reasonable compensation which should not exceed the technical and organisational costs incurred in complying with the request and the reasonable margin required for making the data available to the public sector body or to the union institution , agency or body. the compensation should not be understood as constituting payment for the data itself and as being compulsory. ### (67) when the safeguarding of a significant public good is at stake , such as is the case of responding to public emergencies , the public sector body or the union institution , agency or body should not be expected to compensate enterprises for the data obtained as long as the request is limited in time and scope , proportionate to the state of the public emergency. public emergencies are rare events and not all such emergencies require the use of data held by enterprises. the business activities of the data holders are therefore not likely to be negatively affected as a consequence of the public sector bodies or union institutions , agencies or bodies having recourse to this regulation. however , as cases of an exceptional need other than responding to a public emergency might be more frequent , including cases of prevention of or recovery from a public emergency , data holders should in such cases be entitled to a reasonable compensation. this regulation should not affect existing eu or member state arrangements in which data is shared free of charge , or prevent public sector bodies , union institutions , agencies or bodies , and data holders from entering into voluntary data sharing agreements free of charge.


### (80) to promote the interoperability of smart contracts in data sharing applications , it is necessary to lay down essential requirements for smart contracts for professionals who create smart contracts for others or integrate such smart contracts in applications that support the implementation of agreements for sharing data. in order to facilitate the conformity of such smart contracts with those essential requirements , it is necessary to provide for a presumption of conformity for smart contracts that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. ### (80) to promote the interoperability of smart contracts in data sharing applications , it may be necessary to lay down essential requirements for smart contracts for professionals who create smart contracts for others or integrate such smart contracts in applications that support the implementation of agreements for sharing data. in order to facilitate the conformity of such smart contracts with those essential requirements , it may be necessary to provide for a presumption of conformity for smart contracts that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council.


### (85) in order to take account of technical aspects of data processing services , the power to adopt acts in accordance with article 290 tfeu should be delegated to the commission in respect of supplementing this regulation to introduce a monitoring mechanism on switching charges imposed by data processing service providers on the market , to further specify the essential requirements for operators of data spaces and data processing service providers on interoperability and to publish the reference of open interoperability specifications and european standards for the interoperability of data processing services. it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement on better law-making of 13 april 201670 . in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states’ experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts. ### (85) in order to take account of technical aspects of data processing services , the power to adopt acts in accordance with article 290 tfeu should be delegated to the commission in respect of supplementing this regulation to introduce a monitoring mechanism on switching charges imposed by data processing service providers on the market , to further specify the essential requirements for operators of data spaces and data processing service providers on interoperability and to publish the reference of open standards for the interoperability of data processing services. it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement on better law-making of 13 april 201670 . in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states’ experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts.


### manufacturers of products and suppliers of related services placed on the market in the union and the users of such products or services; ### manufacturers of products and providers of related services placed on the market in the union and the users , or in the case of personal data , identified or identifiable natural person the information generated by the use of such products or related services relates to;


### manufacturers of products and suppliers of related services placed on the market in the union and the users of such products or services; ### manufacturers and vendors of connected products , as well as providers of related services placed on the market in the union and the users of such connected products or related services;


### public sector bodies and union institutions , agencies or bodies that request data holders to make data available where there is an exceptional need to that data for the performance of a task carried out in the public interest and the data holders that provide those data in response to such request; ### deleted


### public sector bodies and union institutions , agencies or bodies that request data holders to make data available where there is an exceptional need to that data for the performance of a task carried out in the public interest and the data holders that provide those data in response to such request; ### public sector bodies and union institutions , agencies or bodies that request users or data holders to make data available where there is an exceptional need the performance of a task carried out in the public interest and the data holders that provide those data in response to such request;


### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. this regulation shall not affect the applicability of union law on the protection of personal data , in particular regulation (eu) 2016/679 and directive 2002/58/ec , including the powers and competences of supervisory authorities. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement the right of data portability under article 20 of regulation (eu) 2016/679. ### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. the obtaining , collection , or generation of personal data through the use of a product or related service requires a legal basis pursuant to data protection law. this regulation does not create a legal basis for the processing of personal data , nor does it affect any of the rights and obligations set out in regulations (eu) 2016/679 or (eu) 2018/1725 or directives 2002/58/ec or (eu) 2016/680. the legitimate interest , as laid down in article 6 paragraph 1 point f of regulation (eu) 2016/679 , of the manufacturer of a product or the provider of a related service shall not constitute a legal basis for this. this regulation is without prejudice to union law on the protection of personal data and privacy , in particular regulation (eu) 2016/679 , regulation (eu) 2018/1725 , directive 2002/58/ec , and directive (eu) 2016(680) , including the powers and competences of supervisory authorities. in the event of a conflict between this regulation and union law on the protection of personal data or privacy or national law adopted in accordance with such union law , the relevant union or national law on the protection of personal data or privacy shall prevail. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement and particularise the right of data portability under article 20 of regulation (eu) 2016/679 , and shall not adversely affect data protection rights of others. insofar the processing of personal data , that is made available to a data recipient pursuant to article 5 of this regulation , is restricted in article 6 of this regulation , these provisions shall take precedence over article 6 of regulation (eu) 2016/679.


### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. this regulation shall not affect the applicability of union law on the protection of personal data , in particular regulation (eu) 2016/679 and directive 2002/58/ec , including the powers and competences of supervisory authorities. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement the right of data portability under article 20 of regulation (eu) 2016/679. ### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. the obtaining , collection , or generation of personal data through the use of a product or related service requires a legal basis pursuant to data protection law. this regulation does not create a legal basis for the processing of personal data , nor does it affect any of the rights and obligations set out in regulations (eu) 2016/679 or (eu) 2018/1725 or directives 2002/58/ec or (eu) 2016/680. the legitimate interest , as laid down in article 6 paragraph 1 point f of regulation (eu) 2016/679 , of the manufacturer of a product or the provider of a related service shall not constitute a legal basis for this. this regulation is without prejudice to union law on the protection of personal data , in particular regulation (eu) 2016/679 and directive 2002/58/ec , including the powers and competences of supervisory authorities. in the event of a conflict between this regulation and union law on the protection of personal data or privacy or national law adopted in accordance with such union law , the relevant union or national law on the protection of personal data or privacy shall prevail. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement the right of data portability under article 20 of regulation (eu) 2016/679.


### 4. this regulation shall not affect union and national legal acts providing for the sharing , access and use of data for the purpose of the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , including regulation (eu) 2021/784 of the european parliament and of the council72 and the [e-evidence proposals [com(2018) 225 and 226] once adopted , and international cooperation in that area. this regulation shall not affect the collection , sharing , access to and use of data under directive (eu) 2015/849 of the european parliament and of the council on the prevention of the use of the financial system for the purposes of money laundering and terrorist financing and regulation (eu) 2015/847 of the european parliament and of the council on information accompanying the transfer of funds. this regulation shall not affect the competences of the member states regarding activities concerning public security , defence , national security , customs and tax administration and the health and safety of citizens in accordance with union law. ### 4. this regulation shall not affect union and national legal acts providing for the sharing , access and use of data for the purpose of the prevention , investigation , detection or prosecution of criminal or administrative offences or the execution of criminal or administrative penalties , including regulation (eu) 2021/784 of the european parliament and of the council72 and the [e-evidence proposals [com(2018) 225 and 226] once adopted , and international cooperation in that area. this regulation shall not affect the collection , sharing , access to and use of data under directive (eu) 2015/849 of the european parliament and of the council on the prevention of the use of the financial system for the purposes of money laundering and terrorist financing and regulation (eu) 2015/847 of the european parliament and of the council on information accompanying the transfer of funds. this regulation shall not affect the competences of the member states regarding activities concerning public security , defence , national security , customs and tax administration and shall be implemented with due consideration to public health , the fundamental rights and the safety of citizens in accordance with union law.


### 4. this regulation shall not affect union and national legal acts providing for the sharing , access and use of data for the purpose of the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , including regulation (eu) 2021/784 of the european parliament and of the council72 and the [e-evidence proposals [com(2018) 225 and 226] once adopted , and international cooperation in that area. this regulation shall not affect the collection , sharing , access to and use of data under directive (eu) 2015/849 of the european parliament and of the council on the prevention of the use of the financial system for the purposes of money laundering and terrorist financing and regulation (eu) 2015/847 of the european parliament and of the council on information accompanying the transfer of funds. this regulation shall not affect the competences of the member states regarding activities concerning public security , defence , national security , customs and tax administration and the health and safety of citizens in accordance with union law. ### 4. this regulation shall not affect union and national legal acts providing for the sharing , access and use of data for the purpose of the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , including regulation (eu) 2021/784 of the european parliament and of the council and the [e-evidence proposals [com(2018) 225 and 226] once adopted , competition law and antitrust investigations , and international cooperation in these areas. this regulation shall not affect the collection , sharing , access to and use of data under directive (eu) 2015/849 of the european parliament and of the council on the prevention of the use of the financial system for the purposes of money laundering and terrorist financing and regulation (eu) 2015/847 of the european parliament and of the council on information accompanying the transfer of funds. this regulation shall not affect the competences of the member states regarding activities concerning public security , defence , national security , customs and tax administration and the health and safety of citizens in accordance with union law.


### (2) ‘product’ means a tangible , movable item , including where incorporated in an immovable item , that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data via a publicly available electronic communications service and whose primary function is not the storing and processing of data; ### (2) ‘product’ means a tangible item , that , through its design and features , including sensors or in-device software , obtains , collects , or generates , data concerning its use or environment , and that is able to communicate data , and whose primary function is not the storing and processing of data , with the exception of products that are primarily designed to display or play content , or to record and transmit content , amongst others for the use by an online service should not be covered by this regulation;


### (2) ‘product’ means a tangible , movable item , including where incorporated in an immovable item , that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data via a publicly available electronic communications service and whose primary function is not the storing and processing of data; ### (2) ‘connected product’ means a tangible item that , through its technical design and features , including sensors and in-device software , obtains , collects or otherwise generates transmissible data concerning its use or environment , and that is able to communicate data and whose primary function is not the storing and processing of data on behalf of third parties;


### (6) ‘data holder’ means a legal or natural person who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data and through control of the technical design of the product and related services , the ability , to make available certain data; ### (6) ‘data holder’ means a legal or natural person , who offers a related service to the user , which involves access to data transmitted from a connected product or generated during the provision of a related service , and who has , in the case of non-personal data , the contractually agreed ability to use such data


### (7) ‘data recipient’ means a legal or natural person , acting for purposes which are related to that person’s trade , business , craft or profession , other than the user of a product or related service , to whom the data holder makes data available , including a third party following a request by the user to the data holder or in accordance with a legal obligation under union law or national legislation implementing union law; ### (7) ‘data recipient’ means a legal or natural person , including a data intermediation service , or data altruism organisation , as defined in regulation … [dga] to whom the user or , following a request of the user or a data holder makes available data transmitted by a connected product or generated during the provision of a related service;


### (10) ‘public emergency’ means an exceptional situation negatively affecting the population of the union , a member state or part of it , with a risk of serious and lasting repercussions on living conditions or economic stability , or the substantial degradation of economic assets in the union or the relevant member state(s); ### (10) ‘public emergency’ means an exceptional situation , such as public health emergencies , emergencies resulting from natural disasters , as well as human-induced major disasters , negatively affecting the population of the union , a member state or part of it , with a risk of serious and lasting repercussions on living conditions or economic stability , or the substantial degradation of economic assets in the union or the relevant member state(s) and which is determined and officially declared according to the respective procedures under union or national law;


### (12) ‘data processing service’ means a digital service other than an online content service as defined in article 2(5) of regulation (eu) 2017/1128 , provided to a customer , which enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources of a centralised , distributed or highly distributed nature; ### (12) ‘data processing service’ means a digital service other than an online content service as defined in article 2(5) of regulation (eu) 2017/1128 , provided to a customer , which enables on-demand administration and broad remote access to storage and computing resources , including related services , of a centralised , distributed or highly distributed nature;


### (16) ‘smart contract’ means a computer program stored in an electronic ledger system wherein the outcome of the execution of the program is recorded on the electronic ledger; ### deleted


### (17) ‘electronic ledger’ means an electronic ledger within the meaning of article 3 , point (53) , of regulation (eu) no 910/2014; ### deleted


### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user. ### 1. connected products shall be designed and manufactured in such a manner that transmissible data obtained , collected or otherwise generated by the connected product are , by default , easily , securely and , where technically feasible , directly accessible and retrievable to the user , in a structured , commonly used and machine-readable format , including the relevant metadata.


### whether the manufacturer supplying the product or the service provider providing the related service intends to use the data itself or allow a third party to use the data and , if so , the purposes for which those data will be used; ### deleted


### 3. trade secrets shall only be disclosed provided that all specific necessary measures are taken to preserve the confidentiality of trade secrets in particular with respect to third parties. the data holder and the user can agree measures to preserve the confidentiality of the shared data , in particular in relation to third parties. ### 3. when sharing data mentioned under point b of article 3(2a) , trade secrets shall only be disclosed provided that all specific necessary measures are taken to preserve the confidentiality of trade secrets in particular with respect to third parties. the data holder and the user can agree measures to preserve the confidentiality of the shared data , in particular in relation to third parties.


### 5. where the user is not a data subject , any personal data generated by the use of a product or related service shall only be made available by the data holder to the user where there is a valid legal basis under article 6(1) of regulation (eu) 2016/679 and , where relevant , the conditions of article 9 of regulation (eu) 2016/679 are fulfilled. ### 5. where the user is not a data subject , any personal data transmitted from a product or related service shall only be made available by a data holder to the user where there is a valid legal basis under article 6(1) of regulation (eu) 2016/679 and , where relevant , the conditions of article 9 of regulation (eu) 2016/679 are fulfilled.


### 2. any undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper , pursuant to article […] of [regulation xxx on contestable and fair markets in the digital sector (digital markets act)73 ] , shall not be an eligible third party under this article and therefore shall not: ### 2. any undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper , pursuant to article […] of [regulation xxx on contestable and fair markets in the digital sector (digital markets act)73 ] , shall not: