### (24) this regulation imposes the obligation on data holders to make data available in certain circumstances. insofar as personal data are processed , the data holder should be a controller under regulation (eu) 2016/679. where users are data subjects , data holders should be obliged to provide them access to their data and to make the data available to third parties of the user’s choice in accordance with this regulation. however , this regulation does not create a legal basis under regulation (eu) 2016/679 for the data holder to provide access to personal data or make it available to a third party when requested by a user that is not a data subject and should not be understood as conferring any new right on the data holder to use data generated by the use of a product or related service. this applies in particular where the manufacturer is the data holder. in that case , the basis for the manufacturer to use non-personal data should be a contractual agreement between the manufacturer and the user. this agreement may be part of the sale , rent or lease agreement relating to the product. any contractual term in the agreement stipulating that the data holder may use the data generated by the user of a product or related service should be transparent to the user , including as regards the purpose for which the data holder intends to use the data. this regulation should not prevent contractual conditions , whose effect is to exclude or limit the use of the data , or certain categories thereof , by the data holder. this regulation should also not prevent sector-specific regulatory requirements under union law , or national law compatible with union law , which would exclude or limit the use of certain such data by the data holder on well-defined public policy grounds. ### (24) this regulation imposes the obligation on data holders to make data available in certain circumstances. insofar as personal data are processed , data holders should be controllers under regulation (eu) 2016/679. where users are data subjects , data holders should be obliged to provide them access to their data and to make the data available to third parties of the data subject’s choice in accordance with this regulation. however , this regulation does not create a legal basis under regulation (eu) 2016/679 for data holders to provide access to personal data or make it available to a third party when requested by a user that is not a data subject and should not be understood as conferring any new right on data holders to use data transmitted to it from the connected generated by the use of a product or generated during the provision of a related service. instead , the basis for a data holder to use non-personal data transmitted to it should be a contractual agreement between the data holder , in its role as a provider of related services , and the user. where the manufacturer or vendor of the connected product is also a provider of related services , this agreement may combined with the sale agreement relating to the connected product. any agreement between the user and a data holder shall clearly and comprehensively address the nature and access modalities of data transmitted from the connected product to the data holder or generated during the provision of the related services , as well as the duration of the agreement and modalities to terminate the agreement prematurely. where a data holder intends to share data with third parties for the fulfilment of its contractual obligations , it shall inform the user of the nature and volume of the shared data and , where relevant , contractually bind the third party not to use the data for any other purpose. this regulation should not prevent contractual conditions , whose effect is to exclude or limit the use of the data , or certain categories thereof , by a data holder. this regulation should also not prevent sector-specific regulatory requirements under union law , or national law compatible with union law , which would exclude or limit the use of certain such data by a data holder on well-defined public policy grounds.


### (25) in sectors characterised by the concentration of a small number of manufacturers supplying end users , there are only limited options available to users with regard to sharing data with those manufacturers. in such circumstances , contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers , making it difficult for users to obtain value from the data generated by the equipment they purchase or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation may be brought forward to address sector-specific needs and objectives. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , preferably with granular permission options (such as “allow once” or “allow while using this app or service”) , including the option to withdraw permission. ### (25) contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers or other data holders , making it difficult for users to obtain value from the data generated by the equipment they purchase , rent , use or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation may be brought forward to address sector-specific needs and objectives. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , with granular permission options , including prominent options to withdraw permission.


### (25) in sectors characterised by the concentration of a small number of manufacturers supplying end users , there are only limited options available to users with regard to sharing data with those manufacturers. in such circumstances , contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers , making it difficult for users to obtain value from the data generated by the equipment they purchase or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation may be brought forward to address sector-specific needs and objectives. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , preferably with granular permission options (such as “allow once” or “allow while using this app or service”) , including the option to withdraw permission. ### (25) in sectors characterised by the concentration of a small number of manufacturers or providers of related services available to users , the ability of users to bargain for access to data transferred by the connected product or generated during the provision of related services is limited due to the bargaining power of the manufacturer or provider of related service. in such circumstances , contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers or providers of related services , making it difficult for users to obtain value from the data generated by the equipment they own. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. furthermore , data holders should not use any data transmitted to them from the connected product or generated during the provision of related services in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this could , for instance , involve using knowledge about the overall performance of a business in contractual negotiations with the user on potential acquisition of the user’s products to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , with granular permission options , where possible (such as “allow once” or “allow while using this app or service”) , including the option to withdraw permission.


### (26) in contracts between a data holder and a consumer as a user of a product or related service generating data , directive 93/13/eec applies to the terms of the contract to ensure that a consumer is not subject to unfair contractual terms. for unfair contractual terms unilaterally imposed on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec63 , this regulation provides that such unfair terms should not be binding on that enterprise. ### (26) in contracts between a data holder and a consumer as a user of a product or related service generating data , eu consumer law applies , including directive 2005/29/ec , which applies against unfair commercial practices , as does directive 93/13/eec which applies to the terms of the contract to ensure that a consumer is not subject to unfair contractual terms.. for unfair contractual terms unilaterally imposed on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec63 , this regulation provides that such unfair terms should not be binding on that enterprise.


### (26) in contracts between a data holder and a consumer as a user of a product or related service generating data , directive 93/13/eec applies to the terms of the contract to ensure that a consumer is not subject to unfair contractual terms. for unfair contractual terms unilaterally imposed on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec63 , this regulation provides that such unfair terms should not be binding on that enterprise. ### (26) in contracts between a data holder and a consumer as a user of a connected product or related service generating data , directive 93/13/eec applies to the terms of the contract to ensure that a consumer is not subject to unfair contractual terms. for unfair contractual terms unilaterally imposed on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec63 , this regulation provides that such unfair terms should not be binding on that enterprise.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. in order to comply with the user’s request , the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant , up-to-date and accessible as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. however , data holders should not undermine the right of the users to request access and use of data in accordance with this regulation on the basis of certain data that the data holder could still consider to be trade secrets or confidential business information. this bearing in mind that the disclosure of trade secrets within the meaning of directive (eu) 2016/943 serves the interest of innovation and of competition , notably in allowing reverse engineering of a lawfully acquired product , which should be considered as a lawful means of acquiring information. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a data recipient offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the data recipient is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the connected product or the provision of related functional services. the user should also be able to make available data transmitted from the connected product or generated during the provision of related services to data users through the use of data intermediation services , data altruism organisations or arm's length transactions , which may or may not involve remuneration or other economic arrangements. data intermediation services , as defined in the [dga] can fulfil a variety of purposes in the facilitating of data sharing , including acting as an agent to connect users , data recipients and third parties seeking to access data or act as a data recipient in the form of a data market or exchange. intellectual property rights should be respected when handling the data. the aim of this regulation should accordingly be understood as fostering the development of new , innovative connected products or related services , stimulating innovation on aftermarkets , but also as enabling the development of liquid and efficient markets on which non-personal data can be exchanged , for entirely novel purposes unrelated to the originating connected product or related service.


### (29) a third party to whom data is made available may be an enterprise , a research organisation or a not-for-profit organisation. in making the data available to the third party , the data holder should not abuse its position to seek a competitive advantage in markets where the data holder and third party may be in direct competition. the data holder should not therefore use any data generated by the use of the product or related service in order to derive insights about the economic situation of the third party or its assets or production methods or the use in any other way that could undermine the commercial position of the third party on the markets it is active on. ### (29) a third party to whom data is made available may be an individual , an enterprise , a research organisation or a not-for-profit organisation. in making the data available to the third party , the data holder should not abuse its position to seek a competitive advantage in markets where the data holder and third party may be in direct competition. the data holder should not therefore use any data generated by the use of the product or related service in order to derive insights about the economic situation of the third party or its assets or production methods or the use in any other way that could undermine the commercial position of the third party on the markets it is active on.


### (29) a third party to whom data is made available may be an enterprise , a research organisation or a not-for-profit organisation. in making the data available to the third party , the data holder should not abuse its position to seek a competitive advantage in markets where the data holder and third party may be in direct competition. the data holder should not therefore use any data generated by the use of the product or related service in order to derive insights about the economic situation of the third party or its assets or production methods or the use in any other way that could undermine the commercial position of the third party on the markets it is active on. ### (29) a data recipient to whom data is made available may be an natural or legal person , enterprise , research organisation , a not-for-profit organisation or an intermediary , including data intermediation services or data altruism organisations as defined in regulation [xx…dga]. in making the data available to a data recipient , a data holder should not abuse its position to seek a competitive advantage in markets where the data holder and data recipient may be in direct competition. data holders should not therefore use any data transmitted by the connected product or related service in order to derive insights about the economic situation of the data recipient or its assets or production methods or the use in any other way that could undermine the commercial position of the data recipient on the markets it is active on. upon the agreement of the user , data recipients should be able to transfer the data access rights granted by the user to third parties , including in exchange for compensation. data holders shall make available data to this third party on the same terms as to the initial data recipient.


### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , for any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party. ### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. this regulation also allows direct data sharing from users to third parties. this regulation precludes the data holder or the third party from directly or indirectly charging consumers or data subjects a fee , compensation or costs for sharing data or for accessing it. this regulation does not directly or indirectly incentivise the commercialisation or trade of personal data. the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party.


### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , for any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party. ### (31) data transmitted by a connected product or generated during the provision of related services should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a data recipient to any data transmitted by a connected product or generated during the provision of a related service , irrespective of its nature as personal data , of the distinction between actively provided , extrapolated or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. it also allows data holders to set compensation to be met by data recipients , but not by the user , not exceeding the any cost incurred in providing direct access to the data generated by the user’s connected product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party.


### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon request of the user should only process the data for the purposes agreed with the user and share it with another third party only if this is necessary to provide the service requested by the user. ### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon explicit request of the user should only process the data for the specific purposes explicitly requested by the user and share it with another third party only if this is strictly necessary to provide the service requested by the user.


### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon request of the user should only process the data for the purposes agreed with the user and share it with another third party only if this is necessary to provide the service requested by the user. ### (33) as far is personal data is concerned , in order to prevent the exploitation of users of connected products who are natural persons , data recipients to whom data has been made available upon request of the user should only process the data for the purposes agreed with the user and share it with another third party only if this is necessary to provide the service requested by the user , or explicitly agreed with the user.


### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the third party should not coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user. in this context , third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. common and legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec. ### (34) in line with the data minimisation principle , the data owner should only grant , and third parties should only access , information that is strictly necessary for the provision of the specific service explicitly requested by the user. having received access to data , the third party should process it exclusively for the specific purposes explicitly requested by the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the data holder or the third party should make the exercise of the rights or choices of users unduly difficult including by offering choices to users in a non-neutral manner , or coerce , deceive or manipulate the user in any way , or subvert or impair the autonomy , decision-making or choices of the user , including by means of a digital interface or a part thereof , including its structure , design , function or manner of operation. in this context , data holders or third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. data holders and third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec.


### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the third party should not coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user. in this context , third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. common and legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec. ### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the third party should not coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user. in this context , third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec.


### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the third party should not coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user. in this context , third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. common and legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec. ### (34) as far as personal data is concerned , in line with the data minimisation principle , the data recipient should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the data recipient should process it only in accordance with for the purposes agreed with the user , without interference from a data holder. it should be as easy for the user to refuse or discontinue access by the data recipient to the data as it is for the user to authorise access. the data recipient should not coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision making or choices of the user of the connected product , including by means of a digital interface. in this context , data recipient should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that they would not otherwise have taken. these manipulative techniques can be used to persuade users of connected products and related services , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive them by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision making of user in a way that subverts and impairs their autonomy , decision-making and choice. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec.


### (35) the third party should also refrain from using the data to profile individuals unless these processing activities are strictly necessary to provide the service requested by the user. the requirement to delete data when no longer required for the purpose agreed with the user complements the right to erasure of the data subject pursuant to article 17 of regulation 2016/679. where the third party is a provider of a data intermediation service within the meaning of [data governance act] , the safeguards for the data subject provided for by that regulation apply. the third party may use the data to develop a new and innovative product or related service but not to develop a competing product. ### (35) the third party should also refrain from using the data to profile individuals unless these processing activities are strictly necessary to provide the specific service explicitly requested by the user. the requirement to delete data when no longer required for the purpose agreed with the user complements the right to erasure of the data subject pursuant to article 17 of regulation 2016/679. where the third party is a provider of a data intermediation service within the meaning of [data governance act] , the safeguards for the data subject provided for by that regulation apply. the third party may use the data to develop a new and innovative product or related service but not to develop a competing product.


### (35) the third party should also refrain from using the data to profile individuals unless these processing activities are strictly necessary to provide the service requested by the user. the requirement to delete data when no longer required for the purpose agreed with the user complements the right to erasure of the data subject pursuant to article 17 of regulation 2016/679. where the third party is a provider of a data intermediation service within the meaning of [data governance act] , the safeguards for the data subject provided for by that regulation apply. the third party may use the data to develop a new and innovative product or related service but not to develop a competing product. ### (35) data holders and data recipients should also refrain from using the data to profile individuals unless these processing activities are strictly necessary for the functioning of the service requested by the user. the requirement to delete personal data when no longer required for the purpose agreed with the user of the connected product complements the right to erasure of the data subject pursuant to article 17 of regulation 2016/679. where the data recipient a provider of a data intermediation service within the meaning of [data governance act] , the safeguards for the data subject provided for by that regulation apply.


### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means. ### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. as a result , the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would therefore be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means.


### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means. ### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast amounts of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , a specific regime should apply to sharing data with these companies. this means that an undertaking providing core platform services that has been designated as a gatekeeper should not solicit , coerce or manipulate users into sharing data with them , and in particular , should use its customer access , bargaining power and information across multiple products or service markets. it should therefore not make the commercial terms , including pricing , of any products or services offered to the user conditional or otherwise commercially dependent upon whether , or to which degree , the user agrees to make available data , transmitted from the connected object or generated during the provision of related services , to the undertaking providing platform services or any of its affiliates. as an example , it should not offer the user a reduction in price or additional services in one digital service , in return for the user making available data in context of the same , or another service. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper.


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### (37) it is overly burdensome for micro and small enterprises to follow the obligations for data holders with respect to making available data to data recipients. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a connected product or provide a related service. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the other requirements laid down by this regulation.


### (41) in order to compensate for the lack of information on the conditions of different contracts , which makes it difficult for the data recipient to assess if the terms for making the data available are non-discriminatory , it should be on the data holder to demonstrate that a contractual term is not discriminatory. it is not unlawful discrimination , where a data holder uses different contractual terms for making data available or different compensation , if those differences are justified by objective reasons. these obligations are without prejudice to regulation (eu) 2016/679. ### (41) in order to compensate for the lack of information on the conditions of different contracts , which makes it difficult for the data recipient to assess if the terms for making the data available are non-discriminatory , it should be the responsibility of data holders to demonstrate that , where a data holder uses different contractual terms for making data available or provides different compensation , a contractual term is not discriminatory. these obligations are without prejudice to regulation (eu) 2016/679.


### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available. ### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request strictly cost-based compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available.


### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available. ### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request compensation in line with the costs incurred when legally obliged to make data available to a data recipient. these provisions should not be understood as paying for the data itself , but for the costs incurred and investment required for making the data available.


### (44) to protect micro , small or medium-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models , the compensation for making data available to be paid by them should not exceed the direct cost of making the data available and be non-discriminatory. ### deleted


### (47) transparency is an important principle to ensure that the compensation requested by the data holder is reasonable , or , in case the data recipient is a micro , small or medium-sized enterprise , that the compensation does not exceed the costs directly related to making the data available to the data recipient and is attributable to the individual request. in order to put the data recipient in the position to assess and verify that the compensation complies with the requirements under this regulation , the data holder should provide to the data recipient the information for the calculation of the compensation with a sufficient degree of detail. ### (47) transparency is an important principle to ensure that the compensation requested by a data holder does not exceed the costs directly related to making the data available to a data recipient and is attributable to the individual request. in order to put the data recipient in the position to assess and verify that the compensation complies with the requirements under this regulation , the data holder should provide to the data recipient the information for the calculation of the compensation with a sufficient degree of detail.


### (48) ensuring access to alternative ways of resolving domestic and cross-border disputes that arise in connection with making data available should benefit data holders and data recipients and therefore strengthen trust in data sharing. in cases where parties cannot agree on fair , reasonable and non-discriminatory terms of making data available , dispute settlement bodies should offer a simple , fast and low-cost solution to the parties. ### (48) ensuring access to alternative ways of resolving domestic and cross-border disputes that arise in connection with making data available should benefit data holders and data recipients and therefore strengthen trust in data sharing. in cases where parties cannot agree on fair , reasonable and non-discriminatory terms of making data available , dispute settlement bodies should offer a simple , fast and low-cost solution to the parties. the availability of a dispute body should not , however , prevent a data recipient to seek legal action to enforce a provider of related functional service’s obligation to make data available to the data recipient at the user of the connected product’s request.


### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on micro , small or medium-sized enterprises when they have been unilaterally imposed on them. ### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm users and micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on consumers or micro , small or medium-sized enterprises when they have been unilaterally imposed on them.


### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding on micro , small or medium-sized enterprises when they have been unilaterally imposed on them. ### (51) where one party is in a stronger bargaining position , there is a risk that that party could leverage such position to the detriment of the other contracting party when negotiating access to data and make access to data commercially less viable and sometimes economically prohibitive. such contractual imbalances particularly harm micro , small and medium-sized enterprises without a meaningful ability to negotiate the conditions for access to data , who may have no other choice than to accept ‘take-it-or-leave-it’ contractual terms. therefore , unfair contract terms regulating the access to and use of data or the liability and remedies for the breach or the termination of data related obligations should not be binding when they have been unilaterally imposed on them.


### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed on micro , small and medium-sized enterprises. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the micro , small or medium-sized enterprise cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the micro , small or medium-sized enterprise or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed. ### (52) rules on contractual terms between enterprises should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed on micro , small and medium-sized enterprises. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the micro , small or medium-sized enterprise cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the micro , small or medium-sized enterprise or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed.


### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed on micro , small and medium-sized enterprises. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the micro , small or medium-sized enterprise cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the micro , small or medium-sized enterprise or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed. ### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. however in some ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the other party cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the other party or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed.


### (53) furthermore , the rules on unfair contractual terms should only apply to those elements of a contract that are related to making data available , that is contractual terms concerning the access to and use of data as well as liability or remedies for breach and termination of data related obligations. other parts of the same contract , unrelated to making data available , should not be subject to the unfairness test laid down in this regulation. ### (53) furthermore , the rules on unfair contractual terms between enterprises should only apply to those elements of a contract that are related to making data available , that is contractual terms concerning the access to and use of data as well as liability or remedies for breach and termination of data related obligations. other parts of the same contract , unrelated to making data available , should not be subject to the unfairness test laid down in this regulation.


### (53) furthermore , the rules on unfair contractual terms should only apply to those elements of a contract that are related to making data available , that is contractual terms concerning the access to and use of data as well as liability or remedies for breach and termination of data related obligations. other parts of the same contract , unrelated to making data available , should not be subject to the unfairness test laid down in this regulation. ### (53) furthermore , the rules on unfair contractual terms should only apply to those elements of a contract that are related to making data available or supressing data access , that is contractual terms concerning the access to and use of data as well as liability or remedies for breach and termination of data related obligations. other parts of the same contract , unrelated to making data available or supressing data access , should not be subject to the unfairness test laid down in this regulation.


### (54) criteria to identify unfair contractual terms should be applied only to excessive contractual terms , where a stronger bargaining position is abused. the vast majority of contractual terms that are commercially more favourable to one party than to the other , including those that are normal in business-to-business contracts , are a normal expression of the principle of contractual freedom and shall continue to apply. ### (54) criteria to identify unfair contractual terms between enterprises should be applied only to excessive contractual terms , where a stronger bargaining position is abused. the vast majority of contractual terms that are commercially more favourable to one party than to the other , including those that are normal in business-to-business contracts , are a normal expression of the principle of contractual freedom and shall continue to apply.


### (55) if a contractual term is not included in the list of terms that are always considered unfair or that are presumed to be unfair , the general unfairness provision applies. in this regard , the terms listed as unfair terms should serve as a yardstick to interpret the general unfairness provision. finally , model contractual terms for business-to-business data sharing contracts to be developed and recommended by the commission may also be helpful to commercial parties when negotiating contracts. ### (55) if a contractual term is not included in the list of terms that are always considered unfair or that are presumed to be unfair between enterprises , the general unfairness provision applies. in this regard , the terms listed as unfair terms should serve as a yardstick to interpret the general unfairness provision. finally , model contractual terms for business-to-business data sharing contracts to be developed and recommended by the commission may also be helpful to commercial parties when negotiating contracts.


### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. ### deleted


### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. ### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data may outweigh the interests of the data holders to dispose freely of some specific data they hold. in such a case , and subject to conditions and other safeguards set out in this regulation or other eu or member state regulation , data holders may be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations.


### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to , prevent or recover from public emergencies or to maintain the capacity to fulfil specific tasks explicitly provided by law. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65 should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested. ### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to , prevent or recover from public emergencies or to maintain the capacity to fulfil specific tasks explicitly provided by law. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65 should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested , as long as all bodies respect the same rules and restrictions as the original requester of the data. businesses , and affected third parties , shall have the right to raise objections to planned data access on the grounds of data protection , protected applicable union legislation , security or trade secrets protected under directive 2016/943.


### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to , prevent or recover from public emergencies or to maintain the capacity to fulfil specific tasks explicitly provided by law. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65 should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested. ### deleted


### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to , prevent or recover from public emergencies or to maintain the capacity to fulfil specific tasks explicitly provided by law. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65 should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested. ### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to public emergencies or to maintain the capacity to fulfil specific tasks in the public interest explicitly provided by law. the data obtained by those entities may be commercially sensitive. therefore , regulation [dga] , as well as directive (eu) 2019/1024 of the european parliament and of the council should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for the compilation of official statistics , provided the conditions laid down in this regulation are met. where permitted by eu or member state law , public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested , as long as the data holder is informed in a timely manner and all bodies respect the same rules on transparency as the original requester of the data.


### (69) the ability for customers of data processing services , including cloud and edge services , to switch from one data processing service to another , while maintaining a minimum functionality of service , is a key condition for a more competitive market with lower entry barriers for new service providers. ### (69) the ability for customers of data processing services , including cloud and edge services , to switch from one data processing service to another without cost or disruption , while maintaining a minimum functionality of service , is a key condition for a more competitive market with lower entry barriers for new service providers.


### (70) regulation (eu) 2018/1807 of the european parliament and of the council encourages service providers to effectively develop and implement self-regulatory codes of conduct covering best practices for , inter alia , facilitating the switching of data processing service providers and the porting of data. given the limited efficacy of the self-regulatory frameworks developed in response , and the general unavailability of open standards and interfaces , it is necessary to adopt a set of minimum regulatory obligations on providers of data processing services to eliminate contractual , economic and technical barriers to effective switching between data processing services. ### (70) regulation (eu) 2018/1807 of the european parliament and of the council encourages service providers to effectively develop and implement self-regulatory codes of conduct covering best practices for , inter alia , facilitating the switching of data processing service providers and the porting of data. given the complete failure of the self-regulatory frameworks developed in response , and the general unavailability of open standards and interfaces , it is necessary to adopt a set of minimum regulatory obligations on providers of data processing services to eliminate all contractual , economic and technical barriers to effective switching between data processing services.


### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment while benefitting from functional equivalence. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. functional equivalence means the maintenance of a minimum level of functionality of a service after switching , and should be deemed technically feasible whenever both the originating and the destination data processing services cover (in part or in whole) the same service type. meta-data , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching. ### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment while benefitting from functional equivalence. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. functional equivalence means the maintenance of a minimum level of functionality of a service after switching , and should be deemed technically feasible whenever both the originating and the destination data processing services cover (in part or in whole) functionally the same service type. meta-data , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching.


### (74) data processing service providers should be required to offer all assistance and support that is required to make the switching process successful and effective without requiring those data processing service providers to develop new categories of services within or on the basis of the it-infrastructure of different data processing service providers to guarantee functional equivalence in an environment other than their own systems. nevertheless , service providers are required to offer all assistance and support that is required to make the switching process effective. existing rights relating to the termination of contracts , including those introduced by regulation (eu) 2016/679 and directive (eu) 2019/770 of the european parliament and of the council67 should not be affected. ### (74) both the source and destination data processing service providers should be required to offer all assistance and support that is required to make the switching process successful and effective without requiring those data processing service providers to develop new categories of services within or on the basis of the it-infrastructure of different data processing service providers to guarantee functional equivalence in an environment other than their own systems. nevertheless , service providers are required to offer all assistance and support that is required to make the switching process effective. existing rights relating to the termination of contracts , including those introduced by regulation (eu) 2016/679 and directive (eu) 2019/770 of the european parliament and of the council67 should not be affected.


### (76) open interoperability specifications and standards developed in accordance with paragraph 3 and 4 of annex ii of regulation (eu) 1025/2021 in the field of interoperability and portability enable a seamless multi-vendor cloud environment , which is a key requirement for open innovation in the european data economy. as market-driven processes have not demonstrated the capacity to establish technical specifications or standards that facilitate effective cloud interoperability at the paas (platform-as-a-service) and saas (software-as-a-service) levels , the commission should be able , on the basis of this regulation and in accordance with regulation (eu) no 1025/2012 , to request european standardisation bodies to develop such standards , particularly for service types where such standards do not yet exist. in addition to this , the commission will encourage parties in the market to develop relevant open interoperability specifications. the commission , by way of delegated acts , can mandate the use of european standards for interoperability or open interoperability specifications for specific service types through a reference in a central union standards repository for the interoperability of data processing services. european standards and open interoperability specifications will only be referenced if in compliance with the criteria specified in this regulation , which have the same meaning as the requirements in paragraphs 3 and 4 of annex ii of regulation (eu) no 1025/2021 and the interoperability facets defined under the iso/iec 19941:2017. ### (76) open interoperability specifications and standards developed in accordance with paragraph 3 and 4 of annex ii of regulation (eu) 1025/2021 in the field of interoperability and portability enable a seamless multi-vendor cloud environment , which is a key requirement for open innovation in the european data economy. as market-driven processes have not demonstrated the capacity to establish technical specifications or standards that facilitate effective cloud interoperability at the paas (platform-as-a-service) and saas (software-as-a-service) levels , the commission should be able , on the basis of this regulation and in accordance with regulation (eu) no 1025/2012 , to request european standardisation bodies to develop such standards where possible , particularly for service types where such standards do not yet exist. in addition to this , the commission will encourage parties in the market to develop relevant open interoperability specifications. the commission , by way of delegated acts , can mandate the use of european standards for interoperability or open interoperability specifications where possible through a reference in a central union standards repository for the interoperability of data processing services. european standards and open interoperability specifications will only be referenced if in compliance with the criteria specified in this regulation , which have the same meaning as the requirements in paragraphs 3 and 4 of annex ii of regulation (eu) no 1025/2021 and the interoperability facets defined under the iso/iec 19941:2017.


### (76) open interoperability specifications and standards developed in accordance with paragraph 3 and 4 of annex ii of regulation (eu) 1025/2021 in the field of interoperability and portability enable a seamless multi-vendor cloud environment , which is a key requirement for open innovation in the european data economy. as market-driven processes have not demonstrated the capacity to establish technical specifications or standards that facilitate effective cloud interoperability at the paas (platform-as-a-service) and saas (software-as-a-service) levels , the commission should be able , on the basis of this regulation and in accordance with regulation (eu) no 1025/2012 , to request european standardisation bodies to develop such standards , particularly for service types where such standards do not yet exist. in addition to this , the commission will encourage parties in the market to develop relevant open interoperability specifications. the commission , by way of delegated acts , can mandate the use of european standards for interoperability or open interoperability specifications for specific service types through a reference in a central union standards repository for the interoperability of data processing services. european standards and open interoperability specifications will only be referenced if in compliance with the criteria specified in this regulation , which have the same meaning as the requirements in paragraphs 3 and 4 of annex ii of regulation (eu) no 1025/2021 and the interoperability facets defined under the iso/iec 19941:2017. ### (76) open standards developed in accordance with paragraph 3 and 4 of annex ii of regulation (eu) 1025/201221 in the field of interoperability and portability enable a seamless multi-vendor cloud environment , which is a key requirement for open innovation in the european data economy. where market-driven processes do not successfully establish technical specifications or standards that facilitate effective cloud interoperability at the paas (platform-as-a-service) and saas (software-as-a-service) levels , the commission should be able , on the basis of this regulation and in accordance with regulation (eu) no 1025/2012 , to request european standardisation bodies to develop such standards , particularly for service types where such standards do not yet exist. the commission should be empowered to adopt delegated acts , in accordance with article 38 , to publish the reference of open standards for the interoperability of data processing services in central union standards repository for the interoperability of data processing services , where these satisfy the criteria specified in this regulation , notably to be developed on the basis of open decision-making accessible to all interested parties in the market , or markets affected by those technical specifications.