### (14) companies and data subjects should be able to trust that the re-use of certain categories of protected data , which are held by the public sector , will take place in a manner that respects their rights and interests. additional safeguards should thus be put in place for situations in which the re-use of such public sector data is taking place on the basis of a processing of the data outside the public sector. such an additional safeguard could be found in the requirement that public sector bodies should take fully into account the rights and interests of natural and legal persons (in particular the protection of personal data , commercially sensitive data and the protection of intellectual property rights) in case such data is transferred to third countries. ### (14) companies and data subjects should be able to trust that the re-use of certain categories of protected data , which are held by the public sector , will take place in a manner that respects their rights and interests. additional safeguards should thus be put in place for situations in which the re-use of such public sector data is taking place on the basis of a processing of the data outside the public sector. such an additional safeguard could be found in the requirement that public sector bodies should fully respect the rights and interests of natural and legal persons (in particular the protection of personal data , commercially sensitive data and the protection of intellectual property rights) in case such data is transferred to third countries.


### (15) furthermore , it is important to protect commercially sensitive data of non-personal nature , notably trade secrets , but also non-personal data representing content protected by intellectual property rights from unlawful access that may lead to ip theft or industrial espionage. in order to ensure the protection of fundamental rights or interests of data holders , non-personal data which is to be protected from unlawful or unauthorised access under union or national law , and which is held by public sector bodies , should be transferred only to third-countries where appropriate safeguards for the use of data are provided. such appropriate safeguards should be considered to exist when in that third-country there are equivalent measures in place which ensure that non-personal data benefits from a level of protection similar to that applicable by means of union or national law in particular as regards the protection of trade secrets and the protection of intellectual property rights. to that end , the commission may adopt implementing acts that declare that a third country provides a level of protection that is essentially equivalent to those provided by union or national law. the assessment of the level of protection afforded in such third-country should , in particular , take into consideration the relevant legislation , both general and sectoral , including concerning public security , defence , national security and criminal law concerning the access to and protection of non-personal data , any access by the public authorities of that third country to the data transferred , the existence and effective functioning of one or more independent supervisory authorities in the third country with responsibility for ensuring and enforcing compliance with the legal regime ensuring access to such data , or the third countries’ international commitments regarding the protection of data the third country concerned has entered into , or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems. the existence of effective legal remedies for data holders , public sector bodies or data sharing providers in the third country concerned is of particular importance in the context of the transfer of non-personal data to that third country. such safeguards should therefore include the availability of enforceable rights and of effective legal remedies. ### (15) furthermore , it is important to protect commercially sensitive data of non-personal nature , notably trade secrets , but also non-personal data representing content protected by intellectual property rights from unlawful access that may lead to ip theft or industrial espionage. in order to ensure the protection of fundamental rights or interests of data holders , non-personal data which is to be protected from unlawful or unauthorised access under union or national law , and which is held by public sector bodies , should be transferred only to third-countries where appropriate safeguards for the use of data are provided. such appropriate safeguards should be considered to exist when in that third-country there are equivalent measures in place which ensure that non-personal data benefits from a level of protection similar to that applicable by means of union or national law in particular as regards the protection of trade secrets and the protection of intellectual property rights. to that end , the commission may adopt implementing acts that declare that a third country provides a level of protection that is essentially equivalent to those provided by union or national law. the assessment of the level of protection afforded in such third-country should , in particular , take into consideration the relevant legislation , both general and sectoral , including concerning public security , defence , national security and criminal law concerning the access to and protection of non-personal data , any access by the public authorities of that third country to the data transferred , the existence and effective functioning of one or more independent supervisory authorities in the third country with responsibility for ensuring and enforcing compliance with the legal regime ensuring access to such data , or the third countries’ international commitments regarding the protection of data the third country concerned has entered into , or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems. the existence of effective legal remedies for data subjects and data holders , public sector bodies or data sharing providers in the third country concerned is of particular importance in the context of the transfer of non-personal data to that third country. such safeguards should therefore include the availability of enforceable rights and of effective legal remedies.


### (15) furthermore , it is important to protect commercially sensitive data of non-personal nature , notably trade secrets , but also non-personal data representing content protected by intellectual property rights from unlawful access that may lead to ip theft or industrial espionage. in order to ensure the protection of fundamental rights or interests of data holders , non-personal data which is to be protected from unlawful or unauthorised access under union or national law , and which is held by public sector bodies , should be transferred only to third-countries where appropriate safeguards for the use of data are provided. such appropriate safeguards should be considered to exist when in that third-country there are equivalent measures in place which ensure that non-personal data benefits from a level of protection similar to that applicable by means of union or national law in particular as regards the protection of trade secrets and the protection of intellectual property rights. to that end , the commission may adopt implementing acts that declare that a third country provides a level of protection that is essentially equivalent to those provided by union or national law. the assessment of the level of protection afforded in such third-country should , in particular , take into consideration the relevant legislation , both general and sectoral , including concerning public security , defence , national security and criminal law concerning the access to and protection of non-personal data , any access by the public authorities of that third country to the data transferred , the existence and effective functioning of one or more independent supervisory authorities in the third country with responsibility for ensuring and enforcing compliance with the legal regime ensuring access to such data , or the third countries’ international commitments regarding the protection of data the third country concerned has entered into , or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems. the existence of effective legal remedies for data holders , public sector bodies or data sharing providers in the third country concerned is of particular importance in the context of the transfer of non-personal data to that third country. such safeguards should therefore include the availability of enforceable rights and of effective legal remedies. ### (15) furthermore , it is important to protect data of non-personal nature , notably trade secrets , but also non-personal data representing content protected by intellectual property rights from unlawful access that may lead to ip theft or industrial espionage , while ensuring that unnecessary legal barriers pertaining to exclusive rights are removed in order to unlock the potential of the use of non-personal data. in order to ensure the protection of fundamental rights or interests of data subjects and data holders , non-personal data which is to be protected from unlawful or unauthorised access under union or national law , and which is held by public sector bodies , should be transferred only to third-countries where appropriate safeguards for the use of data are provided. such appropriate safeguards should be considered to exist when in that third-country there are equivalent measures in place which ensure that non-personal data benefits from a level of protection similar to that applicable by means of union or national law in particular as regards the protection of trade secrets and the protection of intellectual property rights. to that end , the commission may adopt implementing acts that declare that a third country provides a level of protection that is essentially equivalent to those provided by union or national law. the assessment of the level of protection afforded in such third-country should , in particular , take into consideration the relevant legislation , both general and sectoral , including concerning public security , defence , national security and criminal law concerning the access to and protection of non-personal data , any access by the public authorities of that third country to the data transferred , the existence and effective functioning of one or more independent supervisory authorities in the third country with responsibility for ensuring and enforcing compliance with the legal regime ensuring access to such data , or the third countries’ international commitments regarding the protection of data the third country concerned has entered into , or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems. the existence of effective legal remedies for data subjects and data holders , public sector bodies or data sharing providers in the third country concerned is of particular importance in the context of the transfer of non-personal data to that third country. such safeguards should therefore include the availability of enforceable rights and of effective legal remedies.


### (20) public sector bodies should be able to charge fees for the re-use of data but should also be able to decide to make the data available at lower or no cost , for example for certain categories of re-uses such as non-commercial re-use , or re-use by small and medium-sized enterprises , so as to incentivise such re-use in order to stimulate research and innovation and support companies that are an important source of innovation and typically find it more difficult to collect relevant data themselves , in line with state aid rules. such fees should be reasonable , transparent , published online and non-discriminatory. ### (20) public sector bodies should be able to charge cost-based fees for the re-use of data but should also be able to decide to make the data available at lower or no cost , for example for certain categories of re-uses such as non-commercial re-use , or re-use by small and medium-sized enterprises , so as to facilitate such re-use in order to stimulate research and innovation and support companies that are an important source of innovation and typically find it more difficult to collect relevant data themselves , in line with state aid rules. such fees should be reasonable , transparent , published online and non-discriminatory.


### (20) public sector bodies should be able to charge fees for the re-use of data but should also be able to decide to make the data available at lower or no cost , for example for certain categories of re-uses such as non-commercial re-use , or re-use by small and medium-sized enterprises , so as to incentivise such re-use in order to stimulate research and innovation and support companies that are an important source of innovation and typically find it more difficult to collect relevant data themselves , in line with state aid rules. such fees should be reasonable , transparent , published online and non-discriminatory. ### (20) public sector bodies should be able to charge fees for the re-use of data but should also be able to decide to allow re-use at lower or no cost , for example for certain categories of re-uses such as non-commercial re-use , re-use for scientific research purposes , or re-use by small and medium-sized enterprises , so as to incentivise such re-use in order to stimulate research and innovation and support companies that are an important source of innovation and typically find it more difficult to collect relevant data themselves , in line with state aid rules. such fees should be reasonable , transparent , published online and non-discriminatory.


### (21) in order to incentivise the re-use of these categories of data , member states should establish a single information point to act as the primary interface for re-users that seek to re-use such data held by the public sector bodies. it should have a cross-sector remit , and should complement , if necessary , arrangements at the sectoral level. in addition , member states should designate , establish or facilitate the establishment of competent bodies to support the activities of public sector bodies allowing re-use of certain categories of protected data. their tasks may include granting access to data , where mandated in sectoral union or member states legislation. those competent bodies should provide support to public sector bodies with state-of-the-art techniques , including secure data processing environments , which allow data analysis in a manner that preserves the privacy of the information. such support structure could support the data holders with management of the consent , including consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. data processing should be performed under the responsibility of the public sector body responsible for the register containing the data , who remains a data controller in the sense of regulation (eu) 2016/679 insofar as personal data are concerned. member states may have in place one or several competent bodies , which could act in different sectors. ### (21) in order to facilitate the re-use of these categories of data , member states should establish a single information point to act as the primary interface for re-users that seek to re-use such data held by the public sector bodies. it should have a cross-sector remit , and should complement , if necessary , arrangements at the sectoral level. in addition , member states should designate , establish or facilitate the establishment of competent bodies to support the activities of public sector bodies allowing re-use of certain categories of protected data. their tasks may include granting access to data , where mandated in sectoral union or member states legislation. those competent bodies should provide support to public sector bodies with state-of-the-art techniques , including secure data processing environments , which allow data analysis in a manner that preserves the privacy of the information. such support structure could support the data subjects and holders with management of the consent , including consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. the competent bodies should not have a supervisory function , which is reserved for supervisory authorities under regulation (eu)2016/679. without prejudice to the supervisory powers of data protection authorities , processing should be performed under the responsibility of the public sector body responsible for the register containing the data , who remains a data controller in the sense of regulation (eu) 2016/679 insofar as personal data are concerned. member states may have in place one or several competent bodies , which could act in different sectors.


### (21) in order to incentivise the re-use of these categories of data , member states should establish a single information point to act as the primary interface for re-users that seek to re-use such data held by the public sector bodies. it should have a cross-sector remit , and should complement , if necessary , arrangements at the sectoral level. in addition , member states should designate , establish or facilitate the establishment of competent bodies to support the activities of public sector bodies allowing re-use of certain categories of protected data. their tasks may include granting access to data , where mandated in sectoral union or member states legislation. those competent bodies should provide support to public sector bodies with state-of-the-art techniques , including secure data processing environments , which allow data analysis in a manner that preserves the privacy of the information. such support structure could support the data holders with management of the consent , including consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. data processing should be performed under the responsibility of the public sector body responsible for the register containing the data , who remains a data controller in the sense of regulation (eu) 2016/679 insofar as personal data are concerned. member states may have in place one or several competent bodies , which could act in different sectors. ### (21) in order to incentivise the re-use of these categories of data , member states should establish a single information point to act as the primary interface for re-users that seek to re-use such data held by the public sector bodies. it should have a cross-sector remit , and should complement , if necessary , arrangements at the sectoral level. in addition , member states should designate , establish or facilitate the establishment of competent bodies to support the activities of public sector bodies allowing re-use of certain categories of protected data. their tasks may include granting access to data , where mandated in sectoral union or member states legislation. those competent bodies should provide support to public sector bodies with state-of-the-art techniques , including secure data processing environments , which allow data analysis in a manner that preserves the privacy of the information. such support structure could support the data subjects and data holders with management of consents and permissions , including consent or permission to re-use for certain areas of scientific research when in keeping with recognised ethical standards for scientific research. the competent bodies should not have a supervisory function , which is reserved for supervisory authorities under regulation (eu) 2016/679. without prejudice to the supervisory powers of data protection authorities , data processing should be performed under the responsibility of the public sector body responsible for the register containing the data , who remains a data controller in the sense of regulation (eu) 2016/679 insofar as personal data are concerned. member states may have in place one or several competent bodies , which could act in different sectors.


### (22) providers of data sharing services (data intermediaries) are expected to play a key role in the data economy , as a tool to facilitate the aggregation and exchange of substantial amounts of relevant data. data intermediaries offering services that connect the different actors have the potential to contribute to the efficient pooling of data as well as to the facilitation of bilateral data sharing. specialised data intermediaries that are independent from both data holders and data users can have a facilitating role in the emergence of new data-driven ecosystems independent from any player with a significant degree of market power. this regulation should only cover providers of data sharing services that have as a main objective the establishment of a business , a legal and potentially also technical relation between data holders , including data subjects , on the one hand , and potential users on the other hand , and assist both parties in a transaction of data assets between the two. it should only cover services aiming at intermediating between an indefinite number of data holders and data users , excluding data sharing services that are meant to be used by a closed group of data holders and users. providers of cloud services should be excluded , as well as service providers that obtain data from data holders , aggregate , enrich or transform the data and licence the use of the resulting data to data users , without establishing a direct relationship between data holders and data users , for example advertisement or data brokers , data consultancies , providers of data products resulting from value added to the data by the service provider. at the same time , data sharing service providers should be allowed to make adaptations to the data exchanged , to the extent that this improves the usability of the data by the data user , where the data user desires this , such as to convert it into specific formats. in addition , services that focus on the intermediation of content , in particular on copyright-protected content , should not be covered by this regulation. data exchange platforms that are exclusively used by one data holder in order to enable the use of data they hold as well as platforms developed in the context of objects and devices connected to the internet-of-things that have as their main objective to ensure functionalities of the connected object or device and allow value added services , should not be covered by this regulation. ‘consolidated tape providers’ in the sense of article 4 (1) point 53 of directive 2014/65/eu of the european parliament and of the council42 as well as ‘account information service providers’ in the sense of article 4 point 19 of directive (eu) 2015/2366 of the european parliament and of the council43 should not be considered as data sharing service providers for the purposes of this regulation. entities which restrict their activities to facilitating use of data made available on the basis of data altruism and that operate on a not-for-profit basis should not be covered by chapter iii of this regulation , as this activity serves objectives of general interest by increasing the volume of data available for such purposes. ### (22) providers of data sharing services (data intermediaries) are expected to play a key role in the data economy , as a tool to facilitate the aggregation and exchange of substantial amounts of relevant data. data intermediaries offering services that connect the different actors have the potential to contribute to the efficient pooling of data as well as to the facilitation of bilateral data sharing. specialised data intermediaries that are independent from both data holders and data users can have a facilitating role in the emergence of new data-driven ecosystems independent from any player with a significant degree of market power. this regulation should only cover providers of data sharing services that have as a main objective the establishment of a business , a legal and potentially also technical relation between data holders , including data subjects , on the one hand , and potential users on the other hand , and assist both parties in a transaction of data assets between the two. it should only cover services aiming at intermediating between an indefinite number of data subjects and holders and data users , excluding data sharing services that are meant to be used by a closed group of data subjects and holders and users. providers of cloud services should be excluded , as well as service providers that obtain data from data subjects and data holders , aggregate , enrich or transform the data and licence the use of the resulting data to data users , without establishing a direct relationship between data subjects and holders and data users , for example advertisement or data brokers , data consultancies , providers of data products resulting from value added to the data by the service provider. at the same time , data sharing service providers should be allowed to make adaptations to the data exchanged , to the extent that this improves the usability of the data by the data user , where the data user desires this , such as to convert it into specific formats. in addition , services that focus on the intermediation of content , in particular on copyright-protected content , should not be covered by this regulation. data exchange platforms that are exclusively used by one data holder in order to enable the use of data they hold as well as platforms developed in the context of objects and devices connected to the internet-of-things that have as their main objective to ensure functionalities of the connected object or device and allow value added services , should not be covered by this regulation. ‘consolidated tape providers’ in the sense of article 4 (1) point 53 of directive 2014/65/eu of the european parliament and of the council42 as well as ‘account information service providers’ in the sense of article 4 point 19 of directive (eu) 2015/2366 of the european parliament and of the council43 should not be considered as data sharing service providers for the purposes of this regulation. entities which restrict their activities to facilitating use of data made available on the basis of data altruism and that operate on a not-for-profit basis should not be covered by chapter iii of this regulation , as this activity serves objectives of general interest by increasing the volume of data available for such purposes.


### (22) providers of data sharing services (data intermediaries) are expected to play a key role in the data economy , as a tool to facilitate the aggregation and exchange of substantial amounts of relevant data. data intermediaries offering services that connect the different actors have the potential to contribute to the efficient pooling of data as well as to the facilitation of bilateral data sharing. specialised data intermediaries that are independent from both data holders and data users can have a facilitating role in the emergence of new data-driven ecosystems independent from any player with a significant degree of market power. this regulation should only cover providers of data sharing services that have as a main objective the establishment of a business , a legal and potentially also technical relation between data holders , including data subjects , on the one hand , and potential users on the other hand , and assist both parties in a transaction of data assets between the two. it should only cover services aiming at intermediating between an indefinite number of data holders and data users , excluding data sharing services that are meant to be used by a closed group of data holders and users. providers of cloud services should be excluded , as well as service providers that obtain data from data holders , aggregate , enrich or transform the data and licence the use of the resulting data to data users , without establishing a direct relationship between data holders and data users , for example advertisement or data brokers , data consultancies , providers of data products resulting from value added to the data by the service provider. at the same time , data sharing service providers should be allowed to make adaptations to the data exchanged , to the extent that this improves the usability of the data by the data user , where the data user desires this , such as to convert it into specific formats. in addition , services that focus on the intermediation of content , in particular on copyright-protected content , should not be covered by this regulation. data exchange platforms that are exclusively used by one data holder in order to enable the use of data they hold as well as platforms developed in the context of objects and devices connected to the internet-of-things that have as their main objective to ensure functionalities of the connected object or device and allow value added services , should not be covered by this regulation. ‘consolidated tape providers’ in the sense of article 4 (1) point 53 of directive 2014/65/eu of the european parliament and of the council42 as well as ‘account information service providers’ in the sense of article 4 point 19 of directive (eu) 2015/2366 of the european parliament and of the council43 should not be considered as data sharing service providers for the purposes of this regulation. entities which restrict their activities to facilitating use of data made available on the basis of data altruism and that operate on a not-for-profit basis should not be covered by chapter iii of this regulation , as this activity serves objectives of general interest by increasing the volume of data available for such purposes. ### (22) providers of data sharing services (data intermediaries) are expected to play a key role in the data economy. they could become a tool to facilitate the aggregation and exchange of substantial amounts of relevant data. data intermediaries offering services that connect the different actors have the potential to contribute to the efficient pooling of data as well as to the facilitation of bilateral data sharing. specialised data intermediaries that are independent from both data subjects and data holders , and from data users , can have a facilitating role in the emergence of new data-driven ecosystems independent from any player with a significant degree of market power. this regulation should only cover providers of data sharing services that have as a main objective the establishment of a business , a legal and technical relation between data subjects and data holders , on the one hand , and potential users on the other hand , and assist both parties in a transaction of data assets between the two. it should only cover services aiming at intermediating between an undefined number of data subjects and data holders , on the one hand , and data users on the other hand , excluding data sharing services that are meant to be used by a closed group of data subjects and data holders , and users. providers of cloud services should be excluded , as well as service providers that obtain data from data subjects and data holders , aggregate , enrich or transform the data and licence the use of the resulting data to data users , without establishing a direct relationship between data subjects and data holders , on the one hand , and data users on the other hand , for example advertisement or data brokers , data consultancies , providers of data products resulting from value added to the data by the service provider. at the same time , data sharing service providers should be allowed to make adaptations to the data exchanged , to the extent that this improves the usability of the data by the data user , where the data user desires this , such as to convert it into specific formats. in addition , services that focus on the intermediation of content , in particular on copyright-protected content , should not be covered by this regulation. data exchange platforms that are exclusively used by one data holder in order to enable the use of data they hold as well as platforms developed in the context of objects and devices connected to the internet-of-things that have as their main objective to ensure functionalities of the connected object or device and allow value added services , should not be covered by this regulation. ‘consolidated tape providers’ in the sense of article 4 (1) point 53 of directive 2014/65/eu of the european parliament and of the council as well as ‘account information service providers’ in the sense of article 4 point 19 of directive (eu) 2015/2366 of the european parliament and of the council should not be considered as data sharing service providers for the purposes of this regulation. entities which restrict their activities to facilitating use of data made available on the basis of data altruism and that operate on a not-for-profit basis should not be covered by chapter iii of this regulation , as this activity serves objectives of general interest by increasing the volume of data available for such purposes.


### (25) in order to increase trust in such data sharing services , in particular related to the use of data and the compliance with the conditions imposed by data holders , it is necessary to create a union-level regulatory framework , which would set out highly harmonised requirements related to the trustworthy provision of such data sharing services. this will contribute to ensuring that data holders and data users have better control over the access to and use of their data , in accordance with union law. both in situations where data sharing occurs in a business-to-business context and where it occurs in a business-to-consumer context , data sharing providers should offer a novel , ‘european’ way of data governance , by providing a separation in the data economy between data provision , intermediation and use. providers of data sharing services may also make available specific technical infrastructure for the interconnection of data holders and data users. ### (25) in order to increase trust in such data sharing services , in particular related to the use of data and the compliance with the conditions imposed by data subjects and data holders , it is necessary to create a union-level regulatory framework , which would set out highly harmonised requirements related to the trustworthy , open and non-discriminatory provision of such data sharing services. this will contribute to ensuring that data subjects , data holders and data users have better control over the access to and use of their data , in accordance with union law. both in situations where data sharing occurs in a business-to-business context and where it occurs in a business-to-consumer context , data sharing providers should offer a novel , ‘european’ way of data governance , by providing a separation in the data economy between data provision , intermediation and use. providers of data sharing services may also make available specific technical infrastructure for the interconnection between data subjects and data holders and data users.


### (26) a key element to bring trust and more control for data holder and data users in data sharing services is the neutrality of data sharing service providers as regards the data exchanged between data holders and data users. it is therefore necessary that data sharing service providers act only as intermediaries in the transactions , and do not use the data exchanged for any other purpose. this will also require structural separation between the data sharing service and any other services provided , so as to avoid issues of conflict of interest. this means that the data sharing service should be provided through a legal entity that is separate from the other activities of that data sharing provider. data sharing providers that intermediate the exchange of data between individuals as data holders and legal persons should , in addition , bear fiduciary duty towards the individuals , to ensure that they act in the best interest of the data holders. ### (26) a key element to bring trust and more control for data holder and data users in data sharing services is the neutrality of data sharing service providers as regards the data exchanged between data subjects and data holders on the one hand and data users on the other. it is therefore necessary that data sharing service providers act only as intermediaries in the transactions , and do not use the data exchanged for any other purpose. this will also require structural separation between the data sharing service and any other services provided , so as to avoid issues of conflict of interest. this means that the data sharing service should be provided through a legal entity that is separate from the other activities of that data sharing provider. where an actor provides other data-related services , in addition to data sharing services , the pricing and terms of services for the data sharing service should not be influenced by whether and to what degree a data holder or data user uses other data-related services from the same actor. data sharing providers that intermediate the exchange of data between individuals as data subjects and legal persons as data users should , in addition , bear fiduciary duty towards the individuals , to ensure that they act in the best interest of the data subjects.


### (35) there is a strong potential in the use of data made available voluntarily by data subjects based on their consent or , where it concerns non-personal data , made available by legal persons , for purposes of general interest. such purposes would include healthcare , combating climate change , improving mobility , facilitating the establishment of official statistics or improving the provision of public services. support to scientific research , including for example technological development and demonstration , fundamental research , applied research and privately funded research , should be considered as well purposes of general interest. this regulation aims at contributing to the emergence of pools of data made available on the basis of data altruism that have a sufficient size in order to enable data analytics and machine learning , including across borders in the union. ### (35) there is a strong potential in the use of data made available voluntarily by data subjects based on their consent or , where it concerns non-personal data , made available by legal persons , for purposes of general interest. such purposes would include healthcare , combating climate change , improving mobility , facilitating the establishment of official statistics or improving the provision of public services. support to scientific research , including for example technological development and demonstration , fundamental research , applied research and privately funded research , may also be considered as well purposes of general interest. this regulation aims at contributing to the emergence of pools of data made available on the basis of data altruism that have a sufficient size in order to enable data analytics and machine learning , including across borders in the union.


### (35) there is a strong potential in the use of data made available voluntarily by data subjects based on their consent or , where it concerns non-personal data , made available by legal persons , for purposes of general interest. such purposes would include healthcare , combating climate change , improving mobility , facilitating the establishment of official statistics or improving the provision of public services. support to scientific research , including for example technological development and demonstration , fundamental research , applied research and privately funded research , should be considered as well purposes of general interest. this regulation aims at contributing to the emergence of pools of data made available on the basis of data altruism that have a sufficient size in order to enable data analytics and machine learning , including across borders in the union. ### (35) there is a strong potential in the use of data made available voluntarily by data subjects based on their consent or , where it concerns non-personal data , made available by legal persons , for purposes of public interest. such purposes would include healthcare , combating climate change , improving mobility , facilitating the establishment of official statistics or improving the provision of public services. support to scientific research , including for example technological development and demonstration , fundamental research , applied research and privately funded research , can also fulfil purposes of public interest. this regulation aims at contributing to the emergence of pools of data made available on the basis of data altruism that have a sufficient size in order to enable data analytics and machine learning , including across borders in the union.


### (36) legal entities that seek to support purposes of general interest by making available relevant data based on data altruism at scale and meet certain requirements , should be able to register as ‘data altruism organisations recognised in the union’. this could lead to the establishment of data repositories. as registration in a member state would be valid across the union , and this should facilitate cross-border data use within the union and the emergence of data pools covering several member states. data subjects in this respect would consent to specific purposes of data processing , but could also consent to data processing in certain areas of research or parts of research projects as it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. legal persons could give permission to the processing of their non-personal data for a range of purposes not defined at the moment of giving the permission. the voluntary compliance of such registered entities with a set of requirements should bring trust that the data made available on altruistic purposes is serving a general interest purpose. such trust should result in particular from a place of establishment within the union , as well as from the requirement that registered entities have a not-for-profit character , from transparency requirements and from specific safeguards in place to protect rights and interests of data subjects and companies. further safeguards should include making it possible to process relevant data within a secure processing environment operated by the registered entity , oversight mechanisms such as ethics councils or boards to ensure that the data controller maintains high standards of scientific ethics , effective technical means to withdraw or modify consent at any moment , based on the information obligations of data processors under regulation (eu) 2016/679 as well as means for data subjects to stay informed about the use of data they made available. ### (36) legal entities that seek to support purposes of general interest by making available relevant data based on data altruism at scale and meet certain requirements , should be able to register as ‘eu-registered data altruism organisation'. this could lead to the establishment of data repositories. as registration in a member state would be valid across the union , and this should facilitate cross-border data use within the union and the emergence of data pools covering several member states. data subjects in this respect would consent to specific purposes of data processing , but could also subsequently be asked for consent for data processing in certain areas of research or parts of research projects as it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. legal persons could give permission to the processing of their non-personal data for a range of purposes not defined at the moment of giving the permission. the voluntary compliance of such registered entities with a set of requirements should bring trust that the data made available on altruistic purposes is serving a general interest purpose. such trust should result in particular from a place of establishment within the union , as well as from the requirement that registered entities have a not-for-profit character , from transparency requirements and from specific safeguards in place to protect rights and interests of data subjects and companies. further safeguards should include making it possible to process relevant data within a secure processing environment operated by the registered entity , oversight mechanisms such as ethics councils or boards to ensure that the data controller maintains high standards of scientific ethics , effective technical means to withdraw or modify consent at any moment , based on the information obligations of data processors under regulation (eu) 2016/679 as well as means for data subjects to stay informed about the use of data they made available.


### (36) legal entities that seek to support purposes of general interest by making available relevant data based on data altruism at scale and meet certain requirements , should be able to register as ‘data altruism organisations recognised in the union’. this could lead to the establishment of data repositories. as registration in a member state would be valid across the union , and this should facilitate cross-border data use within the union and the emergence of data pools covering several member states. data subjects in this respect would consent to specific purposes of data processing , but could also consent to data processing in certain areas of research or parts of research projects as it is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. legal persons could give permission to the processing of their non-personal data for a range of purposes not defined at the moment of giving the permission. the voluntary compliance of such registered entities with a set of requirements should bring trust that the data made available on altruistic purposes is serving a general interest purpose. such trust should result in particular from a place of establishment within the union , as well as from the requirement that registered entities have a not-for-profit character , from transparency requirements and from specific safeguards in place to protect rights and interests of data subjects and companies. further safeguards should include making it possible to process relevant data within a secure processing environment operated by the registered entity , oversight mechanisms such as ethics councils or boards to ensure that the data controller maintains high standards of scientific ethics , effective technical means to withdraw or modify consent at any moment , based on the information obligations of data processors under regulation (eu) 2016/679 as well as means for data subjects to stay informed about the use of data they made available. ### (36) legal entities that seek to support purposes of public interest by making available relevant databased on data altruism at scale and meet certain requirements , should be able to apply for registration as ‘public interest data hub’. this could lead to the establishment of data repositories. as registration in a member state would be valid across the union , and this should facilitate cross-border data use within the union and the emergence of data pools covering several member states. legal persons could give permission to the processing of their non-personal data for a range of purposes not defined at the moment of giving the permission. the compliance of such registered entities with a set of requirements should bring trust that the data made available on altruistic purposes is serving a public interest purpose. such trust should result in particular from a place of establishment or a legal representative within the union , as well as from the requirement that registered entities have a not-for-profit character , from transparency requirements and from specific safeguards in place to protect rights and interests of data subjects and companies. the protection of the rights and interests of data subjects should notably include representative actions for the protection of the collective interests of consumers referred to as data subjects according to directive 2020/1828. further safeguards should include making it possible to process relevant data within a secure processing environment operated by the registered entity , oversight mechanisms such as ethics councils or boards to ensure that the data controller maintains high standards of scientific ethics , effective technical means to withdraw or modify consent at any moment , based on the information obligations of data processors under regulation (eu) 2016/679 as well as means for data subjects to stay informed about the use of data they made available.


### (37) this regulation is without prejudice to the establishment , organisation and functioning of entities that seek to engage in data altruism pursuant to national law. it builds on national law requirements to operate lawfully in a member state as a not-for-profit organisation. entities which meet the requirements in this regulation should be able to use the title of ‘data altruism organisations recognised in the union’. ### (37) this regulation is without prejudice to the establishment , organisation and functioning of entities that seek to engage in data altruism pursuant to national law. it builds on national law requirements to operate lawfully in a member state as a not-for-profit organisation. entities which meet the requirements in this regulation should be able to use the title of ‘eu-registered data altruism organisations'.


### (38) data altruism organisations recognised in the union should be able to collect relevant data directly from natural and legal persons or to process data collected by others. typically , data altruism would rely on consent of data subjects in the sense of article 6(1)(a) and 9(2)(a) and in compliance with requirements for lawful consent in accordance with article 7 of regulation (eu) 2016/679. in accordance with regulation (eu) 2016/679 , scientific research purposes can be supported by consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research or only to certain areas of research or parts of research projects. article 5(1)(b) of regulation (eu) 2016/679 specifies that further processing for scientific or historical research purposes or statistical purposes should , in accordance with article 89(1) of regulation (eu) 2016/679 , not be considered to be incompatible with the initial purposes. ### (38) eu-registered data altruism organisations should be able to collect relevant data directly from natural and legal persons or to process data collected by others. typically , data altruism would rely on consent of data subjects in the sense of article 6(1)(a) and 9(2)(a) and in compliance with requirements for lawful consent in accordance with article 7 of regulation (eu) 2016/679. in accordance with regulation (eu) 2016/679 , scientific research purposes can be supported by consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research or only to certain areas of research or parts of research projects. article 5(1)(b) of regulation (eu) 2016/679 specifies that further processing for scientific or historical research purposes or statistical purposes should , in accordance with article 89(1) of regulation (eu) 2016/679 , not be considered to be incompatible with the initial purposes.


### (38) data altruism organisations recognised in the union should be able to collect relevant data directly from natural and legal persons or to process data collected by others. typically , data altruism would rely on consent of data subjects in the sense of article 6(1)(a) and 9(2)(a) and in compliance with requirements for lawful consent in accordance with article 7 of regulation (eu) 2016/679. in accordance with regulation (eu) 2016/679 , scientific research purposes can be supported by consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research or only to certain areas of research or parts of research projects. article 5(1)(b) of regulation (eu) 2016/679 specifies that further processing for scientific or historical research purposes or statistical purposes should , in accordance with article 89(1) of regulation (eu) 2016/679 , not be considered to be incompatible with the initial purposes. ### (38) public interest data hubs should be able to collect relevant data directly from natural and legal persons or to process data collected by others. where they are data controllers or processors in the meaning of regulation (eu) 2016/679 they are bound by the rules of that regulation. typically , data altruism would rely on consent of data subjects in the sense of article 6(1)(a) and 9(2)(a) and in compliance with requirements for lawful consent in accordance with article 7 of regulation (eu)2016/679. in accordance with regulation (eu) 2016/679 , scientific research purposes can be supported by consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research or only to certain areas of research or parts of research projects. article5(1)(b) of regulation (eu) 2016/679 specifies that further processing for scientific or historical research purposes or statistical purposes should , in accordance with article 89(1) of regulation (eu) 2016/679 , not be considered to be incompatible with the initial purposes. for non-personal data , the usage limitations should be found in the permission given by the data holder.


### (40) in order to successfully implement the data governance framework , a european data innovation board should be established , in the form of an expert group. the board should consist of representatives of the member states , the commission and representatives of relevant data spaces and specific sectors (such as health , agriculture , transport and statistics). the european data protection board should be invited to appoint a representative to the european data innovation board. ### (40) in order to successfully implement the data governance framework , a european data innovation board should be established , in the form of an expert group. the board should consist of representatives of the member states , the commission and representatives of relevant data spaces and specific sectors (such as health , agriculture , transport and statistics) , standards-setting organisations , academia and civil society , as appropriate. the european data protection board should be invited to appoint a representative to the european data innovation board.


### (40) in order to successfully implement the data governance framework , a european data innovation board should be established , in the form of an expert group. the board should consist of representatives of the member states , the commission and representatives of relevant data spaces and specific sectors (such as health , agriculture , transport and statistics). the european data protection board should be invited to appoint a representative to the european data innovation board. ### (40) in order to successfully implement the data governance framework , a european data innovation board should be established , in the form of an expert group. the board should consist of representatives of the member states , the commission and representatives of relevant data spaces and specific sectors (such as health , agriculture , transport and statistics) , as well as representatives from civil society , academia , research and standard setting organisations , as relevant. the european data protection board should be invited to appoint a representative to the european data innovation board.


### (4) ‘metadata’ means data collected on any activity of a natural or legal person for the purposes of the provision of a data sharing service , including the date , time and geolocation data , duration of activity , connections to other natural or legal persons established by the person who uses the service; ### deleted


### (4) ‘metadata’ means data collected on any activity of a natural or legal person for the purposes of the provision of a data sharing service , including the date , time and geolocation data , duration of activity , connections to other natural or legal persons established by the person who uses the service; ### (4) 'metadata' means basic information about data , including the description of data and information about data properties , location , time , context or purpose of data collection;


### (7) ‘data sharing’ means the provision by a data holder of data to a data user for the purpose of joint or individual use of the shared data , based on voluntary agreements , directly or through an intermediary; ### (7) ‘data sharing’ means the provision by a data holder of data to a data user for the purpose of joint or individual use of the shared data , based on voluntary agreements , or the sharing of data by a data subject , based on their consent , directly or through an intermediary;


### (7) ‘data sharing’ means the provision by a data holder of data to a data user for the purpose of joint or individual use of the shared data , based on voluntary agreements , directly or through an intermediary; ### (7) ‘data sharing’ means the provision of data by a data holder to a data user for the purpose of joint or individual use of that data , based on voluntary agreements or union law , as well as the provision of data by a data subject to a data user based on consent , directly or through an intermediary;


### (7) ‘data sharing’ means the provision by a data holder of data to a data user for the purpose of joint or individual use of the shared data , based on voluntary agreements , directly or through an intermediary; ### (7) ‘data sharing service’ means a service , which intermediates between an indefinite number of potential data holders and potential data users by making available technical , legal , or other means to enable or facilitate the exchange , pooling or licensing of data between data holders and data users;


### (10) ‘data altruism’ means the consent by data subjects to process personal data pertaining to them , or permissions of other data holders to allow the use of their non-personal data without seeking a reward , for purposes of general interest , such as scientific research purposes or improving public services; ### (10) ‘data altruism’ means voluntary data sharing by data holders , or the consent to data processing by a data subject , without seeking or receiving a reward , for purposes of general interest , such as healthcare , combating climate change , improving mobility , facilitating the establishment of official statistics , improving public services , or scientific research purposes


### (10) ‘data altruism’ means the consent by data subjects to process personal data pertaining to them , or permissions of other data holders to allow the use of their non-personal data without seeking a reward , for purposes of general interest , such as scientific research purposes or improving public services; ### (10) ‘data altruism’ means voluntary data sharing by data holders , or the consent to data sharing by a data subject , without seeking or receiving a reward , for purposes of public interest , such as health care , combating climate change , improving mobility , facilitating the establishment of official statistics , improving public services , or scientific research purposes in the public interest;


### (14) ‘secure processing environment’ means the physical or virtual environment and organisational means to provide the opportunity to re-use data in a manner that allows for the operator of the secure processing environment to determine and supervise all data processing actions , including to display , storage , download , export of the data and calculation of derivative data through computational algorithms. ### (14) ‘secure processing environment’ means the physical or virtual environment and organisational means to provide the opportunity to re-use data in a manner that respects data subjects’ rights under regulation (eu) 2016/679 as well as commercial and statistical confidentiality , that ensures compliance with applicable legislation , or that allows for the operator of the secure processing environment to determine and supervise all data processing actions , including to display , storage , download , export of the data and calculation of derivative data through computational algorithms.


### (14) ‘secure processing environment’ means the physical or virtual environment and organisational means to provide the opportunity to re-use data in a manner that allows for the operator of the secure processing environment to determine and supervise all data processing actions , including to display , storage , download , export of the data and calculation of derivative data through computational algorithms. ### (14) ‘secure processing environment’ means the physical or virtual environment and organisational means to provide the opportunity to re-use data in a manner that preserves data subjects’ rights under regulation (eu) 2016/679 and commercial and statistical confidentiality , ensuring compliance with applicable legislation , or that allows the entity providing the secure processing environment to determine and supervise all data processing actions , including the display , storage , download , export of the data , and calculation of derivative data.


### (3) public sector bodies may impose an obligation to re-use only pre-processed data where such pre-processing aims to anonymize or pseudonymise personal data or delete commercially confidential information , including trade secrets. ### (3) where feasible and proportionate , public sector bodies shall impose an obligation to re-use only pre-processed data where such pre-processing serves to anonymise or pseudonymise personal data or delete commercially confidential information , including trade secrets.


### (3) public sector bodies may impose an obligation to re-use only pre-processed data where such pre-processing aims to anonymize or pseudonymise personal data or delete commercially confidential information , including trade secrets. ### (3) public sector bodies shall , in accordance with union law , impose conditions necessary to preserve protection on the grounds listed in article 3(1) to enable re-use. such conditions may consist of the following requirements for re-users:


### to access and re-use the data within a secure processing environment provided and controlled by the public sector ; ### to access and re-use the data remotely within a secure processing environment provided and controlled by the public sector; or


### (5) the public sector bodies shall impose conditions that preserve the integrity of the functioning of the technical systems of the secure processing environment used. the public sector body shall be able to verify any results of processing of data undertaken by the re-user and reserve the right to prohibit the use of results that contain information jeopardising the rights and interests of third parties. ### (5) in the case that re-use has been allowed according to paragraph 3 , points(a) and (b) , the public sector bodies shall impose conditions that preserve the integrity of the functioning of the technical systems of the secure processing environment used. the public sector body shall reserve the right to verify the process , the means , and any results of processing of data undertaken by the re-user to preserve the integrity of the protection of the data and reserve the right to prohibit the use of results that contain information jeopardising the rights and interests of third parties. the public sector body shall make use of such a secure processing environment provided the re-user has signed a confidentiality agreement that prohibits the disclosure of any information jeopardising the rights and interests of third parties that the re-user may have acquired despite the safeguards and conditions put in place pursuant to paragraph 3.


### (6) where the re-use of data cannot be granted in accordance with the obligations laid down in paragraphs 3 to 5 and there is no other legal basis for transmitting the data under regulation (eu) 2016/679 , the public sector body shall support re-users in seeking consent of the data subjects and/or permission from the legal entities whose rights and interests may be affected by such re-use , where it is feasible without disproportionate cost for the public sector. in that task they may be assisted by the competent bodies referred to in article 7 (1). ### (6) where the re-use of personal data cannot be granted in accordance with the obligations laid down in paragraphs 3 to 5 and there is no other legal basis for transmitting the data under regulation(eu) 2016/679 , the public sector body shall support entities requesting re-use in seeking valid consent of the data subjects , insofar as a legal basis exists for the public sector body to collect this consent , and/or in seeking permission from the data holders whose rights and interests may be affected by such re-use , where it is feasible without disproportionate cost for the public sector , and where there is no reason to believe that the combination of non-personal data sets would lead to the identification of data subjects. in that task they may be assisted by the competent bodies referred to in article 7 (1).


### (6) where the re-use of data cannot be granted in accordance with the obligations laid down in paragraphs 3 to 5 and there is no other legal basis for transmitting the data under regulation (eu) 2016/679 , the public sector body shall support re-users in seeking consent of the data subjects and/or permission from the legal entities whose rights and interests may be affected by such re-use , where it is feasible without disproportionate cost for the public sector. in that task they may be assisted by the competent bodies referred to in article 7 (1). ### (6) where the re-use of personal data cannot be granted in accordance with the obligations laid down in paragraphs 3 to 5 and there is no other legal basis for transmitting the data under regulation (eu) 2016/679 , the public sector body shall support entities requesting re-use in seeking valid consent of the data subjects , insofar as a legal basis exists for the public sector body to collect their consent , and/or permission from the data holders whose rights and interests may be affected by such re-use , where it is feasible without disproportionate cost for the public sector , and where there is no reason to believe that the combination of non-personal data sets would lead to the identification of data subjects. in that task they may be assisted by the competent bodies referred to in article 7 (1).


### (9) the commission may adopt implementing acts declaring that the legal , supervisory and enforcement arrangements of a third country: ### (9) the commission may adopt implementing acts declaring that the legal , supervisory and enforcement arrangements of a third country without prejudice to article 45 of regulation (eu) 2016/679:


### (11) where specific union acts adopted in accordance with a legislative procedure establish that certain non-personal data categories held by public sector bodies shall be deemed to be highly sensitive for the purposes of this article , the commission shall be empowered to adopt delegated acts in accordance with article 28 supplementing this regulation by laying down special conditions applicable for transfers to third-countries. the conditions for the transfer to third-countries shall be based on the nature of data categories identified in the union act and on the grounds for deeming them highly sensitive , non-discriminatory and limited to what is necessary to achieve the public policy objectives identified in the union law act , such as safety and public health , as well as risks of re-identification of anonymized data for data subjects , in accordance with the union’s international obligations. they may include terms applicable for the transfer or technical arrangements in this regard , limitations as regards the re-use of data in third-countries or categories of persons which are entitled to transfer such data to third countries or , in exceptional cases , restrictions as regards transfers to third-countries. ### (11) where specific union acts adopted in accordance with a legislative procedure establish that certain non-personal data categories held by public sector bodies shall be deemed to be highly sensitive for the purposes of this article and where their transfer to third countries may put at risk union policy objectives , such as safety and public health , or may lead to identification of data subjects in anonymised data , the commission shall be empowered to adopt delegated acts in accordance with article 28 supplementing this regulation by laying down special conditions applicable for transfers to third-countries. those conditions shall be based on the nature of data categories identified in the union act and on the grounds for deeming them highly sensitive , non-discriminatory and limited to what is necessary to achieve the public policy objectives identified in the union law act , such as safety and public health , as well as risks of identification of data subjects , in accordance with the union’s international obligations. the conditions may include terms applicable for the transfer or technical arrangements in this regard , limitations as regards the re-use of data in third-countries or categories of persons which are entitled to transfer such data to third countries or , in exceptional cases , restrictions as regards transfers to third-countries.


### (13) where the re-user intends to transfer non-personal data to a third country , the public sector body shall inform the data holder about the transfer of data to that third country. ### (13) where the re-user intends to transfer non-personal data to a third country , the public sector body shall inform the data holder about the transfer of data to that third country. data should be treated as personal if there is a foreseeable risk that the re-user may be re-identified.


### (13) where the re-user intends to transfer non-personal data to a third country , the public sector body shall inform the data holder about the transfer of data to that third country. ### (13) where the re-user intends to transfer non-personal data to a third country , the public sector body shall inform the data holder about the intention to transfer that data to that third country. where the data can be reasonably assumed to lead to the identification or identifiability of natural persons when combined with other datasets , the data shall be treated as personal data.


### (1) public sector bodies which allow re-use of the categories of data referred to in article 3 (1) may charge fees for allowing the re-use of such data. ### (1) public sector bodies which allow re-use of the categories of data referred to in article 3 (1) may charge cost-based fees for allowing the re-use of such data.


### (2) any fees shall be non-discriminatory , proportionate and objectively justified and shall not restrict competition. ### (2) any fees shall be non-discriminatory , proportionate and objectively justified and shall not restrict competition or inhibit use of data for the general interest.


### (2) any fees shall be non-discriminatory , proportionate and objectively justified and shall not restrict competition. ### (2) any fees pursuant to paragraph 1 shall be non-discriminatory , proportionate and objectively justified and shall not restrict competition , or inhibit the re-use of data for purposes in the public interest.


### (4) where they apply fees , public sector bodies shall take measures to incentivise the re-use of the categories of data referred to in article 3 (1) for non-commercial purposes and by small and medium-sized enterprises in line with state aid rules. ### (4) where they apply fees , public sector bodies shall take measures to facilitate the re-use of the categories of data referred to in article 3 (1) for non-commercial purposes and by small and medium-sized enterprises in line with state aid rules.


### (4) where they apply fees , public sector bodies shall take measures to incentivise the re-use of the categories of data referred to in article 3 (1) for non-commercial purposes and by small and medium-sized enterprises in line with state aid rules. ### (4) where they apply fees , public sector bodies shall take measures to incentivise the re-use of the categories of data referred to in article 3 (1) by non-profit organisations , and for non-commercial purposes such as scientific research , and by small and medium-sized enterprises in line with state aid rules. where possible , this should allow the re-use at lower or no cost.


### (5) fees shall be derived from the costs related to the processing of requests for re-use of the categories of data referred to in article 3 (1). the methodology for calculating fees shall be published in advance. ### (5) fees shall be derived from the costs related to the processing of requests for re-use of the categories of data referred to in article 3 (1). any fees shall be limited to covering the costs incurred , such as for the preparation of data to uphold protection on the grounds listed in article 3(1) , for maintaining the secure processing environment and further costs incurred by article 5(3) , and as incurred in relation to supporting re-users seeking consent and permission as provided in article5(6). the criteria and methodology for calculating fees shall be published in advance.


### (1) member states shall designate one or more competent bodies , which may be sectoral , to support the public sector bodies which grant access to the re-use of the categories of data referred to in article 3 (1) in the exercise of that task. ### (1) in order to carry out the tasks listed in this article , member states shall designate one or more competent bodies , which may be sectoral , to support the public sector bodies which grant access to the re-use of the categories of data referred to in article 3 (1) in the exercise of that task.


### (1) member states shall designate one or more competent bodies , which may be sectoral , to support the public sector bodies which grant access to the re-use of the categories of data referred to in article 3 (1) in the exercise of that task. ### (1) for the tasks mentioned in this article , member states shall designate one or more competent bodies , which may be sectoral , to support the public sector bodies which grant access to the re-use of the categories of data referred to in article 3 (1) in the exercise of that task.


### providing technical support by making available a secure processing environment for providing access for the re-use of data; ### providing technical support to ensure a secure processing environment for providing access for the re-use of data;


### assisting the public sector bodies , where relevant , in obtaining consent or permission by re-users for re-use for altruistic and other purposes in line with specific decisions of data holders , including on the jurisdiction or jurisdictions in which the data processing is intended to take place; ### assisting the public sector bodies to support re-users in obtaining consent for re-use of personal data , or permission from data holders in line with their specific decisions , including on the jurisdiction or jurisdictions in which the data processing is intended to take place;


### intermediation services between data holders which are legal persons and potential data users , including making available the technical or other means to enable such services; those services may include bilateral or multilateral exchanges of data or the creation of platforms or databases enabling the exchange or joint exploitation of data , as well as the establishment of a specific infrastructure for the interconnection of data holders and data users; ### intermediation services between data holders and potential data users of non-personal data , including making available the technical or other means to enable such services; those services may include bilateral or multilateral exchanges of non-personal data or the creation of platforms or databases enabling the exchange or joint exploitation of non-personal data , as well as the establishment of a specific infrastructure for the interconnection of data holders and data users;


### intermediation services between data subjects that seek to make their personal data available and potential data users , including making available the technical or other means to enable such services , in the exercise of the rights provided in regulation (eu) 2016/679; ### intermediation services between data subjects that seek to make their personal data available and potential data users , including making available the technical or other means to enable such services , in the exercise of the rights provided in regulation (eu) 2016/679. the data sharing services shall not themselves process the personal data , but shall only allow data subjects to give consent to specific data users to allow the processing of personal data pertaining to them for specific purposes;


### intermediation services between data subjects that seek to make their personal data available and potential data users , including making available the technical or other means to enable such services , in the exercise of the rights provided in regulation (eu) 2016/679; ### intermediation services between data subjects that seek to make their personal data available and potential data users , including making available the technical or other means to enable such services , and in particular enabling the exercise of the data subjects' rights provided in regulation (eu) 2016/679;


### intermediation services between data subjects that seek to make their personal data available and potential data users , including making available the technical or other means to enable such services , in the exercise of the rights provided in regulation (eu) 2016/679; ### intermediation services between data subjects that seek to make their personal data available and potential data users ,including making available the technical or other means to enable such services , and in particular enabling the exercise of the data subjects' rights provided in regulation (eu) 2016/679;


### services of data cooperatives , that is to say services supporting data subjects or one-person companies or micro , small and medium-sized enterprises , who are members of the cooperative or who confer the power to the cooperative to negotiate terms and conditions for data processing before they consent , in making informed choices before consenting to data processing , and allowing for mechanisms to exchange views on data processing purposes and conditions that would best represent the interests of data subjects or legal persons. ### data cooperatives , namely services that enable data subjects to exercise the rights provided for in regulation (eu) 2016/679 , such as by negotiating terms and conditions for data processing before they freely consent , by providing support to enable the making of informed choices before consenting to data processing , and by allowing for mechanisms to exchange views on data processing purposes and conditions that would best represent the interests of data subjects or legal persons , or which enable small and medium-sized enterprises , not-for-profit or academic institutions , to collectively negotiate terms for sharing non-personal data.


### services of data cooperatives , that is to say services supporting data subjects or one-person companies or micro , small and medium-sized enterprises , who are members of the cooperative or who confer the power to the cooperative to negotiate terms and conditions for data processing before they consent , in making informed choices before consenting to data processing , and allowing for mechanisms to exchange views on data processing purposes and conditions that would best represent the interests of data subjects or legal persons. ### activities of data cooperatives , that is to say organisations or services , which:


### (2) this chapter shall be without prejudice to the application of other union and national law to providers of data sharing services , including powers of supervisory authorities to ensure compliance with applicable law , in particular as regard the protection of personal data and competition law. ### (2) this regulation shall be without prejudice to the application of other union and national law to providers of data sharing services , including powers of supervisory authorities to ensure compliance with applicable law , in particular as regard the protection of personal data and competition law.


### (3) a provider of data sharing services that is not established in the union , but offers the services referred to in article 9 (1) within the union , shall appoint a legal representative in one of the member states in which those services are offered. the provider shall be deemed to be under the jurisdiction of the member state in which the legal representative is established. ### (3) a provider of data sharing services that is not established in the union , but offers the services referred to in article 9 (1) within the union , shall appoint a legal representative in one of the member states in which those services are offered. the provider shall be deemed to be under the jurisdiction of the member state in which the legal representative is established. the representative shall be mandated by the provider of data sharing services to be addressed in addition to or instead of it by , in particular , competent authorities and data subjects and data holders , on all issues related to the service , for the purposes of ensuring compliance with this regulation. the designation of a representative by the provider of data sharing services shall be without prejudice to legal actions which could be initiated against the provider of data sharing services themselves.


### (3) a provider of data sharing services that is not established in the union , but offers the services referred to in article 9 (1) within the union , shall appoint a legal representative in one of the member states in which those services are offered. the provider shall be deemed to be under the jurisdiction of the member state in which the legal representative is established. ### (3) a provider of data sharing services that is not established in the union , but offers the services referred to in article 9 (1) within the union , shall appoint a legal representative in one of the member states in which those services are offered. the provider shall be deemed to be under the jurisdiction of the member state in which the legal representative is established. the representative shall be mandated by the provider of data sharing services to be addressed in addition to or instead of it by , in particular , competent authorities and data subjects and data holders , on all issues related to the data sharing services , for the purposes of ensuring compliance with this regulation. the designation of a representative by providers of data sharing services shall be without prejudice to legal actions which could be initiated against providers of data sharing services themselves.


### a website where information on the provider and the activities can be found , where applicable; ### a public website where information on the provider and a full list of its activities can be found , where applicable;


### a website where information on the provider and the activities can be found , where applicable; ### a publicly accessible website where information on the provider and the activities can be found , including as a minimum the information referred to in this paragraph , points (a) ,(b) , (c) , (e) , (f) , and (fa);


### a description of the service the provider intends to provide; ### a description of the service the provider intends to provide and how the conditions set out in article 11 are fulfilled;


### the estimated date for starting the activity; ### the intended date for starting the activity , and , where applicable , the duration foreseen;


### (2) the metadata collected from the provision of the data sharing service may be used only for the development of that service; ### (2) the data generated by and collected from the provision of the data sharing service may be used only for the development of that service;


### (2) the metadata collected from the provision of the data sharing service may be used only for the development of that service; ### (2) the data collected with respect to any activity of a natural or legal person for the purposes of the provision of a data sharing service , including the date , time and geolocation data , duration of activity and connections to other natural or legal persons established by the person who uses the service may be used only for the development of that service;


### (3) the provider shall ensure that the procedure for access to its service is fair , transparent and non-discriminatory for both data holders and data users , including as regards prices; ### (3) the provider shall ensure that the procedure for access to its service is fair , transparent and non-discriminatory for data subjects , data holders and data users , including as regards prices;


### (3) the provider shall ensure that the procedure for access to its service is fair , transparent and non-discriminatory for both data holders and data users , including as regards prices; ### (3) the provider shall ensure that the procedure for access to its service is fair , transparent and non-discriminatory for both data subjects and data holders , as well as for data users , including as regards prices;


### (5) the provider shall have procedures in place to prevent fraudulent or abusive practices in relation to access to data from parties seeking access through their services; ### (5) the provider shall have procedures in place to detect , mitigate and prevent fraudulent or abusive practices in relation to access to data from parties seeking access through their services;


### (5) the provider shall have procedures in place to prevent fraudulent or abusive practices in relation to access to data from parties seeking access through their services; ### (5) the provider shall have procedures in place to prevent fraudulent or abusive practices in relation to parties seeking access through their services;


### (6) the provider shall ensure a reasonable continuity of provision of its services and , in the case of services which ensure storage of data , shall have sufficient guarantees in place that allow data holders and data users to obtain access to their data in case of insolvency; ### (6) the provider shall ensure a reasonable continuity of provision of its services and , in the case of services which ensure storage of data , shall have sufficient guarantees in place that allow data holders and data users to obtain access to and delete their data in case of insolvency;


### (6) the provider shall ensure a reasonable continuity of provision of its services and , in the case of services which ensure storage of data , shall have sufficient guarantees in place that allow data holders and data users to obtain access to their data in case of insolvency; ### (6) the provider shall ensure a reasonable continuity of provision of its services and , in the case of services which ensure storage of data , shall have sufficient guarantees in place that allow data holders and data users to obtain access to their data or , in the case of providing intermediation services between data subjects and data users , pursuant to article 9(1) , point b , that allow data subjects to exercise their rights in case of insolvency of the provider;


### (10) the provider offering services to data subjects shall act in the data subjects’ best interest when facilitating the exercise of their rights , in particular by advising data subjects on potential data uses and standard terms and conditions attached to such uses; ### (10) the provider offering services to data subjects shall act in the data subjects’ best interest when facilitating the exercise of their rights , in particular by advising data subjects on potential data uses and standard terms and conditions attached to such uses and how consent and permissions can be withdrawn;


### (3) the designated competent authorities , the data protection authorities , the national competition authorities , the authorities in charge of cybersecurity , and other relevant sectorial authorities shall exchange the information which is necessary for the exercise of their tasks in relation to data sharing providers. ### (3) the powers of the designated competent authorities are without prejudice to the powers of data protection authorities , national competition authorities , authorities in charge of cybersecurity , and other relevant sectorial authorities. those authorities shall exchange the information which is necessary for the exercise of their tasks in relation to data sharing providers. in particular , for any question requiring an assessment of compliance with regulation (eu)2016/679 , and before starting any data sharing service activities related to personal data , the competent authority shall first request an opinion or decision by the competent supervisory authority established pursuant to that regulation by which it shall be legally bound.


### (3) the designated competent authorities , the data protection authorities , the national competition authorities , the authorities in charge of cybersecurity , and other relevant sectorial authorities shall exchange the information which is necessary for the exercise of their tasks in relation to data sharing providers. ### (3) the powers of the designated competent authorities are without prejudice to the powers of the data protection authorities , the national competition authorities , the authorities in charge of cybersecurity , and other relevant sectorial authorities. those authorities shall exchange the information which is necessary for the exercise of their tasks in relation to data sharing providers. in particular , for any question requiring an assessment of compliance with regulation (eu) 2016/679 , and before starting any data sharing service activities related to personal data , the competent authority shall first request an opinion or decision by the competent supervisory authority established pursuant to that regulation which shall be legally binding for the competent authority.


### (1) each competent authority designated pursuant to article 20 shall keep a register of recognised data altruism organisations. ### (1) each competent authority designated pursuant to article 20 shall keep a public register of recognised data altruism organisations.


### (3) an entity registered in the register in accordance with article 16 may refer to itself as a ‘data altruism organisation recognised in the union’ in its written and spoken communication. ### (3) an entity registered in the register in accordance with article 16 may refer to itself as an ‘eu-registered data altruism organisation’ in its written and spoken communication.


### operate on a not-for-profit basis and be independent from any entity that operates on a for-profit basis; ### operate on a not-for-profit basis and be fully independent , both with regard to the organisation itself and with regard to its personnel , from any relevant entity that operates on a for-profit basis;


### operate on a not-for-profit basis and be independent from any entity that operates on a for-profit basis; ### operate on a not-for-profit basis and be independent , at least with regard to its organisation and personnel , from any entity that operates on a for-profit basis;


### perform the activities related to data altruism take place through a legally independent structure , separate from other activities it has undertaken. ### perform the activities related to data altruism through a legally independent structure , separate from other activities it has undertaken.


### the entity’s main sources of income; ### the entity’s sources of income and start-up capital;


### a website where information on the entity and the activities can be found; ### a website where information on the entity and the activities can be found including , as a minimum , the information referred to in points (a) , (b) , (d) , (e) , (g) and (h) of this paragraph;


### a website where information on the entity and the activities can be found; ### a publicly accessible website where information on the entity and the activities can be found , including as a minimum the information referred to in points (a) , (b) , (d) , (e) , (g) and (h) of this paragraph;


### the purposes of general interest it intends to promote when collecting data; ### the purposes of general interest it intends to promote;


### (1) any entity entered in the register of recognised data altruism organisations shall inform data holders: ### (1) prior to any data processing , the entity entered in the register of recognised data altruism organisations shall inform data subjects and holders:


### about the purposes of general interest for which it permits the processing of their data by a data user in an easy-to-understand manner; ### about the purposes of general interest for which the data subject provides consent and for which the organisation permits the processing of their data by a data user in an easy-to-understand manner;


### about any processing outside the union. ### about by whom and where any processing outside the union is envisaged.


### lose its right to refer to itself as a ‘data altruism organisation recognised in the union’ in any written and spoken communication; ### lose its right to refer to itself as an ‘eu-registered data altruism organisation’ in any written and spoken communication;


### european data altruism consent form ### european data altruism consent interface


### (1) in order to facilitate the collection of data based on data altruism , the commission may adopt implementing acts developing a european data altruism consent form. the form shall allow the collection of consent across member states in a uniform format. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 29 (2). ### (1) in order to facilitate the collection of data based on data altruism , the commission may adopt implementing acts developing a european data altruism consent interface. the interface shall allow the collection and revocation of free and informed consent across member states in a uniform format. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 29 (2).


### (2) the european data altruism consent form shall use a modular approach allowing customisation for specific sectors and for different purposes. ### (2) the european data altruism consent interface shall use a modular approach allowing customisation for specific sectors and for different purposes.


### (3) where personal data are provided , the european data altruism consent form shall ensure that data subjects are able to give consent to and withdraw consent from a specific data processing operation in compliance with the requirements of regulation (eu) 2016/679. ### (3) where personal data are provided , the european data altruism consent interface shall ensure that data subjects are able to give consent to and withdraw consent from a specific data processing operation in compliance with the requirements of regulation (eu) 2016/679. the interface shall provide up to date information concerning what types of data have been used , with what frequency and for what purposes by users of the data altruism organisation.


### (4) the form shall be available in a manner that can be printed on paper and read by humans as well as in an electronic , machine-readable form. ### (4) the interface shall include a consent form which shall be available in a manner that can be printed on paper and read by humans as well as in an electronic , machine-readable form.


### (2) stakeholders and relevant third parties may be invited to attend meetings of the board and to participate in its work. ### (2) stakeholders and relevant third parties , in particular , groups representing citizens' rights , may be invited to attend meetings of the board and to participate in its work.


### (28) this regulation should be without prejudice to the obligation of providers of data sharing services to comply with regulation (eu) 2016/679 and the responsibility of supervisory authorities to ensure compliance with that regulation. where the data sharing service providers are data controllers or processors in the sense of regulation (eu) 2016/679 they are bound by the rules of that regulation. this regulation should be also without prejudice to the application of competition law. ### (28) this regulation should be without prejudice to the obligation of providers of data sharing services to comply with regulation (eu) 2016/679 and the responsibility of supervisory authorities to ensure compliance with that regulation. when providers of data sharing services process personal data , this regulation should not affect the protection of personal data. where the data sharing service providers are data controllers or processors in the sense of regulation (eu) 2016/679 they are bound by the rules of that regulation. this regulation should be also without prejudice to the application of competition law.


### (5) ‘data holder’ means a legal person or data subject who , in accordance with applicable union or national law , has the right to grant access to or to share certain personal or non-personal data under its control; ### (5) ‘data holder’ means a natural or legal person that , in accordance with applicable union or national law , has the right to grant access to or to share certain non-personal data under its control;