### (29) specific provisions should be laid down on advertising of credit agreements or crowdfunding credit services and certain items of standard information to be provided to consumers in order to enable them , in particular , to compare different offers. such information should be given in a clear , concise and prominent way by means of a representative example. the standard information should be shown upfront and saliently , in a clear way and in an engaging format. it should be clearly legible and adapted to take into account the technical constraints of certain media such as mobile telephone screens. temporary promotional conditions , such as a teaser rate with lower interest rate for the initial months of the credit agreement or crowdfunding credit services , should be clearly identified as such. consumers should see all essential information at a glance , even when they watch it on the screen of a mobile telephone. the creditor and , where applicable , credit intermediary and provider of crowdfunding credit services’ telephone number and email address should also be communicated to the consumer to enable him or her to contact the creditor , the credit intermediary or provider of crowdfunding credit services quickly and efficiently. a ceiling should be provided where it is not possible to indicate the total amount of credit as the total sums made available , in particular where a credit agreement gives the consumer freedom of drawdown with a limitation with regard to the amount. the ceiling should indicate the upper limit of credit which can be made available to the consumer. in specific and justified cases , in order to improve consumer understanding of information disclosed in advertising of credit agreements or crowdfunding credit services where the medium used does not allow to visually display it , such as in radio advertising , the amount of information disclosed could be reduced. in addition , member states should remain free to regulate information requirements in their national law regarding advertising of credit agreements or crowdfunding credit services which does not contain information on the cost of the credit. ### (29) specific provisions should be laid down on advertising of credit agreements or crowdfunding credit services and certain items of standard information to be provided to consumers in order to enable them , in particular , to compare different offers. such information should be given in a clear , concise and prominent way by means of a representative example. the standard information should be shown upfront and saliently , in a clear way and in an engaging format. it should be clearly legible and adapted to take into account the technical constraints of certain media such as mobile telephone screens and/or digital channels. temporary promotional conditions , such as a teaser rate with lower interest rate for the initial months of the credit agreement or crowdfunding credit services , should be clearly identified as such. consumers should see essential information at a glance , with further information made available on the consumer by clicking or swiping even when they watch it on the screen of a mobile telephone the creditor and , where applicable , credit intermediary and provider of crowdfunding credit services’ telephone number and email address should also be communicated to the consumer to enable him or her to contact the creditor , the credit intermediary or provider of crowdfunding credit services quickly and efficiently. a ceiling should be provided where it is not possible to indicate the total amount of credit as the total sums made available , in particular where a credit agreement gives the consumer freedom of drawdown with a limitation with regard to the amount. the ceiling should indicate the upper limit of credit which can be made available to the consumer. in specific and justified cases , in order to improve consumer understanding of information disclosed in advertising of credit agreements or crowdfunding credit services where the medium used does not allow to visually display it , such as in radio advertising or digital channels , the amount of information disclosed could be reduced. general and generic information should be provided through an appropriate medium which may include digital channels such as the undertaking's websites , etc. in addition , member states should remain free to regulate information requirements in their national law regarding advertising of credit agreements or crowdfunding credit services which does not contain information on the cost of the credit.


### (29) specific provisions should be laid down on advertising of credit agreements or crowdfunding credit services and certain items of standard information to be provided to consumers in order to enable them , in particular , to compare different offers. such information should be given in a clear , concise and prominent way by means of a representative example. the standard information should be shown upfront and saliently , in a clear way and in an engaging format. it should be clearly legible and adapted to take into account the technical constraints of certain media such as mobile telephone screens. temporary promotional conditions , such as a teaser rate with lower interest rate for the initial months of the credit agreement or crowdfunding credit services , should be clearly identified as such. consumers should see all essential information at a glance , even when they watch it on the screen of a mobile telephone. the creditor and , where applicable , credit intermediary and provider of crowdfunding credit services’ telephone number and email address should also be communicated to the consumer to enable him or her to contact the creditor , the credit intermediary or provider of crowdfunding credit services quickly and efficiently. a ceiling should be provided where it is not possible to indicate the total amount of credit as the total sums made available , in particular where a credit agreement gives the consumer freedom of drawdown with a limitation with regard to the amount. the ceiling should indicate the upper limit of credit which can be made available to the consumer. in specific and justified cases , in order to improve consumer understanding of information disclosed in advertising of credit agreements or crowdfunding credit services where the medium used does not allow to visually display it , such as in radio advertising , the amount of information disclosed could be reduced. in addition , member states should remain free to regulate information requirements in their national law regarding advertising of credit agreements or crowdfunding credit services which does not contain information on the cost of the credit. ### (29) specific provisions should be laid down on advertising of credit agreements or crowdfunding credit services and certain items of standard information to be provided to consumers in order to enable them , in particular , to compare different offers. such information should be given in a clear , concise and prominent way by means of a representative example. the standard information should be shown in a clear way and in an engaging format. it should be clearly legible and adapted to take into account the technical constraints of certain media such as mobile telephone screens and/or digital channels. temporary promotional conditions , such as a teaser rate with lower interest rate for the initial months of the credit agreement or crowdfunding credit services , should be clearly identified as such. consumers should see all essential information at a glance , with further information made available on the consumer by clicking or swiping when they watch it on the screen of a mobile telephone. the creditor and , where applicable , credit intermediary and provider of crowdfunding credit services’ telephone number and email address should also be communicated to the consumer to enable him or her to contact the creditor , the credit intermediary or provider of crowdfunding credit services quickly and efficiently. a ceiling should be provided where it is not possible to indicate the total amount of credit as the total sums made available , in particular where a credit agreement gives the consumer freedom of drawdown with a limitation with regard to the amount. the ceiling should indicate the upper limit of credit which can be made available to the consumer. in specific and justified cases , in order to improve consumer understanding of information disclosed in advertising of credit agreements or crowdfunding credit services where the medium used does not allow to visually display it , such as in radio advertising or digital channels , the amount of information disclosed could be reduced. in addition , member states should remain free to regulate information requirements in their national law regarding advertising of credit agreements or crowdfunding credit services which does not contain information on the cost of the credit.


### the information obtained in accordance with this paragraph shall be appropriately verified , where necessary through reference to independently verifiable documentation. ### the information obtained in accordance with this paragraph shall be appropriately verified , where necessary through reference to independently verifiable documentation or by statistical methods with automated decision-making.


### member states shall also require that the creditor or the provider of crowdfunding credit services documents and maintains the information referred to in paragraph 2. ### deleted


### 4. member states shall ensure that the creditor or the provider of crowdfunding credit services only makes the credit available to the consumer where the result of the creditworthiness assessment indicates that the obligations resulting from the credit agreement or the agreement for the provision of crowdfunding credit services are likely to be met in the manner required under that agreement. ### 4. member states shall ensure that the creditor or the provider of crowdfunding credit services only makes the credit available to the consumer where the result of the creditworthiness assessment indicates that the obligations resulting from the credit agreement or the agreement for the provision of crowdfunding credit services are likely to be met in the manner required under that agreement. however , a positive creditworthiness assessment should not constitute an obligation for the creditor to provide credit.


### 6. where the creditworthiness assessment involves the use of profiling or other automated processing of personal data , member states shall ensure that the consumer has the right to: ### deleted


### the day on which the consumer receives the contractual terms and conditions and information in accordance with articles 20 and 21 , if that day is later than the date referred to in point (a) of this subparagraph. ### the day on which the consumer receives the information of the right of withdrawal in accordance with articles 20 and 21 , if that day is later than the date referred to in point (a) of this subparagraph.


### article 31 ### deleted


### 1. member states shall introduce caps on one or more of the following: ### 1. member states may introduce caps on one or more of the following:


### 1. member states shall require creditors to have adequate policies and procedures so that they make efforts to exercise , where appropriate , reasonable forbearance before enforcement proceedings are initiated. such forbearance measures shall take into account , among other elements , the consumer’s circumstances and may consist in , among other possibilities: ### 1. member states may require creditors to have adequate policies and procedures so that they make efforts to exercise , where appropriate , reasonable forbearance before enforcement proceedings are initiated. such forbearance measures shall take into account , among other elements , the consumer’s circumstances and may consist in , among other possibilities:


### directive 2008/48/ec shall also continue to apply to credit agreements existing on [op: please insert date - six months from the transposition deadline] until [their termination]. ### directive 2008/48/ec shall also continue to apply to credit agreements existing on [op: please insert date - 12 months from the transposition deadline] until [their termination].


### however , articles 23 and 24 , article 25(1) , second sentence , article 25(2) and articles 28 and 39 of this directive shall apply to all open-end credit agreements existing on [op: please insert date - six months from the transposition deadline]. ### however , articles 23 and 24 , article 25(1) , second sentence , article 25(2) and articles 28 and 39 of this directive shall apply to all open-end credit agreements existing on [op: please insert date - 12 months from the transposition deadline].


### standard european consumer credit overview ### deleted


### (14) the definitions contained in this directive determine the scope of harmonisation. the obligation on member states to implement this directive should therefore be limited to its scope as determined by those definitions. however , this directive should be without prejudice to the application by member states , in accordance with union law , of the provisions of this directive to areas not covered by its scope. a member state could thereby maintain or introduce national legislation corresponding to this directive or certain provisions of this directive on credit agreements outside its scope , for instance on credit agreements upon the conclusion of which the consumer is requested to deposit an item as security in the creditor's safe-keeping and where the liability of the consumer is strictly limited to that pledged item. furthermore , member states could also apply this directive to linked credit which does not fall within the definition of a linked credit agreement in this directive. thus , the provisions of this directive on linked credit agreements could be applied to credit agreements that serve only partially to finance a contract for the supply of goods or provision of a service. ### (14) the definitions contained in this directive determine the scope of harmonization and are without prejudice to national law in the situations indicated below. the obligation on member states to implement this directive should therefore be limited to its scope as determined by those definitions. however , this directive should be without prejudice to the application by member states , in accordance with union law , of the provisions of this directive to areas not covered by its scope. a member state could thereby maintain or introduce national legislation corresponding to this directive or certain provisions of this directive on credit agreements outside its scope , for instance on credit agreements upon the conclusion of which the consumer is requested to deposit an item as security in the creditor's safe-keeping and where the liability of the consumer is strictly limited to that pledged item. furthermore , member states could also apply this directive to linked credit which does not fall within the definition of a linked credit agreement in this directive. thus , the provisions of this directive on linked credit agreements could be applied to credit agreements that serve only partially to finance a contract for the supply of goods or provision of a service.


### (30) in order to be able to make their decisions in full knowledge of the facts , consumers should receive adequate information , for careful consideration at their own leisure and convenience , at least one day prior to the conclusion of the credit agreement or of the agreement for the provision of crowdfunding credit services , including information on the conditions and cost of the credit and on their obligations , as well as adequate explanations thereof. these rules should be without prejudice to council directive 93/13/eec29. ### (30) in order to be able to make their decisions in full knowledge of the facts , consumers should receive adequate information , for careful consideration at their own leisure and convenience , if possible at least one day prior to the conclusion of the credit agreement or of the agreement for the provision of crowdfunding credit services , including information on the conditions and cost of the credit and on their obligations , as well as adequate explanations thereof. these rules should be without prejudice to council directive 93/13/eec29.


### (47) the assessment of creditworthiness should be based on information on the financial and economic situation , including income and expenses , of the consumer. the european banking authority guidelines on loan origination and monitoring (eba/gl/2020/06) provide guidelines on what categories of data may be used for the processing of personal data for creditworthiness purposes , which include evidence of income or other sources of repayment , information on financial assets and liabilities , or information on other financial commitments. personal data , such as personal data found on social media platforms or health data , including cancer data , should not be used when conducting a creditworthiness assessment. consumers should provide information about their financial and economic situation in order to facilitate the creditworthiness assessment. in principle , credit should only made available to the consumer where the result of the creditworthiness assessment indicates that the obligations resulting from the credit agreement or the agreement for the provision of crowdfunding credit services are likely to be met in the manner required under that agreement. however , should such assessment be negative , the creditor or the provider of crowdfunding credit services can exceptionally make credit available in specific and justified circumstances such as when they have a long-standing relationship with the consumer , or in case of loans to fund exceptional healthcare expenses , students loans or loans for consumers with disabilities. in such case , when deciding on whether or not to make the credit available to the consumer , the creditor or the provider of crowdfunding credit services should take into account the amount and the purpose of the credit , and the likelihood that the obligations resulting from the agreement will be met. ### (47) the assessment of creditworthiness should be based on information on the financial and economic situation , including income and expenses , of the consumer. the european banking authority guidelines on loan origination and monitoring (eba/gl/2020/06) provide guidelines on what categories of data may be used for the processing of personal data for creditworthiness purposes , which include evidence of income or other sources of repayment , information on financial assets and liabilities , or information on other financial commitments. personal data , such as personal data found on social media platforms or health data , including cancer data , should not be used when conducting a creditworthiness assessment. consumers should provide information about their financial and economic situation in order to facilitate the creditworthiness assessment. in principle , credit should only made available to the consumer where the result of the creditworthiness assessment indicates that the obligations resulting from the credit agreement or the agreement for the provision of crowdfunding credit services are likely to be met in the manner required under that agreement. however , should such assessment be negative , the creditor or the provider of crowdfunding credit services can exceptionally make credit available in specific and justified circumstances such as when they have a long-standing relationship with the consumer , or in case of loans to fund exceptional healthcare expenses , students loans or loans for consumers with disabilities. in such case , when deciding on whether or not to make the credit available to the consumer , the creditor or the provider of crowdfunding credit services should take into account the amount and the purpose of the credit , and the likelihood that the obligations resulting from the agreement will be met. however , a positive creditworthiness assessment should not constitute an obligation for the creditor to provide credit.


### credit agreements involving a total amount of credit of more than eur 100 000; ### credit agreements involving a total amount of less than eur 250 or more than eur 100 000;


### 3. notwithstanding paragraph 2 , point (c) , this directive applies to unsecured credit agreements involving a total amount of credit of more than eur 100 000 , where the purpose of those credit agreements is the renovation of a residential immovable property. ### 3. notwithstanding paragraph 2 , point (c) , this directive applies to unsecured credit agreements involving a total amount of credit of more than eur 100 000 , where the purpose of those credit agreements is the renovation of a residential immovable property , provided they do not fall under the scope of different national legislation.


### without prejudice to directive 2005/29/ec , member states shall require that any advertising and marketing communications concerning credit agreements or crowdfunding credit services are fair , clear and not misleading. wording in such advertising and marketing communications that may create false expectations for a consumer regarding the availability or the cost of a credit shall be prohibited. ### without prejudice to directive 2005/29/ec , member states shall require that advertising and marketing communications concerning credit agreements or crowdfunding credit services covered by this legislation are fair , clear and not misleading. wording in such advertising and marketing communications that may create false expectations for a consumer regarding the availability or the cost of a credit shall be prohibited.


### 1. member states shall ensure that clear and comprehensible general information about credit agreements or crowdfunding credit services is made available to consumers by creditors or , where applicable , by credit intermediaries or providers of crowdfunding credit services , at all times on paper or on another durable medium. ### 1. member states shall ensure that clear and comprehensible general information about credit agreements or crowdfunding credit services is made available to consumers by creditors or , where applicable , by credit intermediaries or providers of crowdfunding credit services , at all times in electronic form or on request by the customer on paper or on another durable medium.


### 1. member states shall require that the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services provide the consumer with the pre-contractual information needed to compare different offers in order to take an informed decision on whether to conclude a credit agreement or crowdfunding credit services on the basis of the credit terms and conditions offered by the creditor or by the provider of crowdfunding credit services and , where applicable , the preferences expressed and information supplied by the consumer. such pre-contractual information shall be provided to the consumer at least one day before he or she is bound by any credit agreement or offer , or by any agreement or offer for the provision of crowdfunding credit services. ### 1. member states shall require that the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services provide the consumer with the pre-contractual information needed to compare different offers in order to take an informed decision on whether to conclude a credit agreement or crowdfunding credit services on the basis of the credit terms and conditions offered by the creditor or by the provider of crowdfunding credit services and , where applicable , the preferences expressed and information supplied by the consumer. such pre-contractual information shall be provided to the consumer in due time before he or she is bound by any credit agreement or offer , or by any agreement or offer for the provision of crowdfunding credit services.


### the right of early repayment , and , where applicable , information concerning the creditor's right to compensation and the way in which that compensation will be determined; ### the right of early repayment , and , where applicable , information concerning the creditor's right to compensation and the way in which that compensation will be determined in accordance with article 29;


### 4. at the same time as the standard european consumer credit information form is provided to the consumer , the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services , shall provide the consumer with the standard european consumer credit overview form set out in annex ii , containing the following pre-contractual information: ### deleted


### 4. at the same time as the standard european consumer credit information form is provided to the consumer , the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services , shall provide the consumer with the standard european consumer credit overview form set out in annex ii , containing the following pre-contractual information: ### 4. at the same time as the standard european consumer credit information form is provided to the consumer , the creditor and , where applicable , the credit intermediary or the provider of crowdfunding credit services , may provide the consumer with the standard european consumer credit overview form set out in annex ii , containing the following pre-contractual information:


### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services. ### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprise. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services.


### (5) this regulation ensures that users of a product or related service in the union can access , in a timely manner , the data generated by the use of that product or related service and that those users can use the data , including by sharing them with third parties of their choice. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by products or related services. ### (5) this regulation ensures that users of a connected product or related service in the union can access , in a timely manner , the data generated by the use of that connected product or related service and that those users can use the data , including by sharing them with third parties of their choice , either directly or through data intermediation services. it imposes the obligation on the data holder to make data available to users and third parties nominated by the users in certain circumstances. it also ensures that data holders make data available to data recipients in the union under fair , reasonable and non-discriminatory terms and in a transparent manner. private law rules are key in the overall framework of data sharing. therefore , this regulation adapts rules of contract law and prevents the exploitation of contractual imbalances that hinder fair data access and use for micro , small or medium-sized enterprises within the meaning of recommendation 2003/361/ec. this regulation also ensures that data holders make available to public sector bodies of the member states and to union institutions , agencies or bodies , where there is an exceptional need , the data that are necessary for the performance of tasks carried out in the public interest. in addition , this regulation seeks to facilitate switching between data processing services and to enhance the interoperability of data and data sharing mechanisms and services in the union. this regulation should not be interpreted as recognising or creating any legal basis for the data holder to hold , have access to or process data , or as conferring any new right on the data holder to use data generated by the use of a connected product or related service. instead , it takes as its starting point the control that the data holder effectively enjoys , de facto or de jure , over data generated by connected products or related services.


### (14) physical products that obtain , generate or collect , by means of their components , data concerning their performance , use or environment and that are able to communicate that data via a publicly available electronic communications service (often referred to as the internet of things) should be covered by this regulation. electronic communications services include land-based telephone networks , television cable networks , satellite-based networks and near-field communication networks. such products may include vehicles , home equipment and consumer goods , medical and health devices or agricultural and industrial machinery. the data represent the digitalisation of user actions and events and should accordingly be accessible to the user , while information derived or inferred from this data , where lawfully held , should not be considered within scope of this regulation. such data are potentially valuable to the user and support innovation and the development of digital and other services protecting the environment , health and the circular economy , in particular though facilitating the maintenance and repair of the products in question. ### (14) physical products that obtain , generate or collect , by means of their components , data concerning their performance , use or environment and that are able to communicate that data via a publicly available electronic communications service (often referred to as the internet of things) should be covered by this regulation. electronic communications services include land-based telephone networks , television cable networks , satellite-based networks and near-field communication networks. such products may include vehicles , home equipment and consumer goods , medical and health devices or agricultural and industrial machinery. the data represent the digitalisation of user actions and events and should accordingly be accessible to the user , while information derived or inferred from this data , where lawfully held , should not be considered within scope of this regulation. such data are potentially valuable to the user and support innovation and the development of digital and other services protecting the environment , health and the circular economy , in particular though facilitating the maintenance and repair of the products in question. product-design data , that relate exclusively to the inner functioning and design of a product and do not present a significant interest to the user , for example data generated or collected as a by product of the interaction between components of sub-components of a system , should be excluded from the scope of this regulation , provided the product manufacturer can show sharing such data brings no significant benefits to the user in reasonably foreseeable use cases such as the maintenance and repair of the product.


### (14) physical products that obtain , generate or collect , by means of their components , data concerning their performance , use or environment and that are able to communicate that data via a publicly available electronic communications service (often referred to as the internet of things) should be covered by this regulation. electronic communications services include land-based telephone networks , television cable networks , satellite-based networks and near-field communication networks. such products may include vehicles , home equipment and consumer goods , medical and health devices or agricultural and industrial machinery. the data represent the digitalisation of user actions and events and should accordingly be accessible to the user , while information derived or inferred from this data , where lawfully held , should not be considered within scope of this regulation. such data are potentially valuable to the user and support innovation and the development of digital and other services protecting the environment , health and the circular economy , in particular though facilitating the maintenance and repair of the products in question. ### (14) physical products that obtain , generate or collect , by means of their components , including sensors , or embedded operating systems , data concerning their performance , use or environment and that are able to communicate that data via an available electronic communications service (often referred to as the internet of things) should be covered by this regulation. electronic communications services include land-based telephone networks , television cable networks , satellite-based networks and near-field communication networks. such products may include vehicles , home equipment and consumer goods , medical and health devices or agricultural and industrial machinery.


### (14) physical products that obtain , generate or collect , by means of their components , data concerning their performance , use or environment and that are able to communicate that data via a publicly available electronic communications service (often referred to as the internet of things) should be covered by this regulation. electronic communications services include land-based telephone networks , television cable networks , satellite-based networks and near-field communication networks. such products may include vehicles , home equipment and consumer goods , medical and health devices or agricultural and industrial machinery. the data represent the digitalisation of user actions and events and should accordingly be accessible to the user , while information derived or inferred from this data , where lawfully held , should not be considered within scope of this regulation. such data are potentially valuable to the user and support innovation and the development of digital and other services protecting the environment , health and the circular economy , in particular though facilitating the maintenance and repair of the products in question. ### (14) physical products that obtain , generate or collect , by means of their components , data concerning their performance , use or environment and that are able to communicate that data via a publicly available electronic communications service (often referred to as the internet of things) should be covered by this regulation. electronic communications services include land-based telephone networks , television cable networks , satellite-based networks and near-field communication networks. such products may include vehicles , home equipment and consumer goods , medical and health devices or agricultural and industrial machinery. the data represent the digitalisation of user actions and events and should accordingly be accessible to the user , while information derived or inferred from this data , where lawfully held , should not be considered within scope of this regulation. such data are potentially valuable to the user and support innovation and the development of digital and other services protecting the environment , health and the circular economy , in particular though facilitating the maintenance and repair of the products in question. information derived or inferred from this data , where lawfully held , should not be considered within the scope of this regulation. products design-related data , meaning data related to the internal functioning and design of the product can expose eu companies' core know-how and therefore the eu strategic , technological and competitiveness interests. such data should therefore be excluded from the scope of the regulation.


### (15) in contrast , certain products that are primarily designed to display or play content , or to record and transmit content , amongst others for the use by an online service should not be covered by this regulation. such products include , for example , personal computers , servers , tablets and smart phones , cameras , webcams , sound recording systems and text scanners. they require human input to produce various forms of content , such as text documents , sound files , video files , games , digital maps. ### (15) in contrast , certain products are primarily designed to display or play content , or to record and transmit content , amongst others for the use by an online service and are often covered by intellectual property rights and electronic communications services legislation. such products include , for example , personal computers , servers tablets and smart phones , smart televisions , cameras , webcams , sound recording systems and text scanners. they require human input to produce various forms of content , such as text documents , sound files , video files , games , digital maps. all these connected products have also a strong element of collection of data on how the products operate , such as proximity sensors , accelerometer or gyroscope , the collection of these data being of potential value in improving the performance of the connected products or related services. these non-personal data referring to the functionality of connected products should be included in the scope of this regulation and should exclude all content data regulated by union and national law and data concerning intellectual property and electronic communications services.


### (17) data generated by the use of a product or related service include data recorded intentionally by the user. such data include also data generated as a by-product of the user’s action , such as diagnostics data , and without any action by the user , such as when the product is in ‘standby mode’ , and data recorded during periods when the product is switched off. such data should include data in the form and format in which they are generated by the product , but not pertain to data resulting from any software process that calculates derivative data from such data as such software process may be subject to intellectual property rights. ### (17) data generated by the use of a product or related service include data recorded intentionally by the user. such data include also data generated as a by-product of the user’s action , such as diagnostics data , and without any action by the user , such as when the product is in ‘standby mode’ , and data recorded during periods when the product is switched off. such data should include data in the form and format in which they are generated by the product , but not pertain to data resulting from any software process that calculates derivative data from such data as such software process may be subject to intellectual property rights. product design data , that relate exclusively to the inner functioning and design of a product ,should be excluded from the scope of this regulation insofar as such data brings no significant benefits to the user in reasonably foreseeable uses cases.


### (17) data generated by the use of a product or related service include data recorded intentionally by the user. such data include also data generated as a by-product of the user’s action , such as diagnostics data , and without any action by the user , such as when the product is in ‘standby mode’ , and data recorded during periods when the product is switched off. such data should include data in the form and format in which they are generated by the product , but not pertain to data resulting from any software process that calculates derivative data from such data as such software process may be subject to intellectual property rights. ### deleted


### (17) data generated by the use of a product or related service include data recorded intentionally by the user. such data include also data generated as a by-product of the user’s action , such as diagnostics data , and without any action by the user , such as when the product is in ‘standby mode’ , and data recorded during periods when the product is switched off. such data should include data in the form and format in which they are generated by the product , but not pertain to data resulting from any software process that calculates derivative data from such data as such software process may be subject to intellectual property rights. ### (17) data generated by the use of a product or related service include data recorded intentionally by the user. such data include also data generated as a by-product of the user’s action , such as diagnostics data , and without any action by the user , such as when the product is in ‘standby mode’ , and data recorded during periods when the product is switched off. such data should include data in the form and format in which they are generated by the product , but not pertain to data resulting from any software process that calculates derivative data from such data as such software process may be subject to intellectual property rights. functional system data , meaning data related to the internal functioning of the product , in particular regarding interfaces between components , do not present any interest for users but can expose eu companies' know-how and and therefore the eu strategic , technological and competitiveness interests. such data should therefore be excluded from the scope of this regulation.


### (20) in case several persons or entities own a product or are party to a lease or rent agreement and benefit from access to a related service , reasonable efforts should be made in the design of the product or related service or the relevant interface so that all persons can have access to data they generate. users of products that generate data typically require a user account to be set up. this allows for identification of the user by the manufacturer as well as a means to communicate to exercise and process data access requests. manufacturers or designers of a product that is typically used by several persons should put in place the necessary mechanism that allow separate user accounts for individual persons , where relevant , or the possibility for several persons to use the same user account. access should be granted to the user upon simple request mechanisms granting automatic execution , not requiring examination or clearance by the manufacturer or data holder. this means that data should only be made available when the user actually wants this. where automated execution of the data access request is not possible , for instance , via a user account or accompanying mobile application provided with the product or service , the manufacturer should inform the user how the data may be accessed. ### (20) in cases of co-ownership of the connected product and related services provided , where several persons or entities own a product or are party to a lease or rent agreement , the design of the connected product or related service or the relevant interface shall enable all persons to have access to data they generate. users of products that generate data typically require a user account to be set up. this allows for identification of the user by the manufacturer or related service provider as well as a means to communicate to exercise and process data access requests. for identification and authentication purposes , manufacturers and providers of related services should enable users to use european digital identity wallets , issued pursuant to regulation (eu) xxx/xxxx establishing a framework for a european digital identity. manufacturers or designers of a product that is typically used by several persons should put in place the necessary mechanism that allow separate user accounts for individual persons , where relevant , or the possibility for several persons to use the same user account. access should be granted to the user upon simple request mechanisms granting automatic execution , not requiring examination or clearance by the manufacturer or data holder. this means that data should only be made available when the user actually wants this. where automated execution of the data access request is not possible , for instance , via a user account or accompanying mobile application provided with the product or service , the manufacturer should inform the user how the data may be accessed. user accounts should enable users to revoke consent for processing and data sharing , as well as request deletion of the data generated through the use of the connected product , particularly in cases when the users of the product intend to transfer the ownership of the product to another party.


### (21) products may be designed to make certain data directly available from an on-device data storage or from a remote server to which the data are communicated. access to the on-device data storage may be enabled via cable-based or wireless local area networks connected to a publicly available electronic communications service or a mobile network. the server may be the manufacturer’s own local server capacity or that of a third party or a cloud service provider who functions as data holder. they may be designed to permit the user or a third party to process the data on the product or on a computing instance of the manufacturer. ### (21) products may be designed to make certain data directly available from an on-device data storage or from a remote server to which the data are communicated. access to the on-device data storage may be enabled via cable-based or wireless local area networks connected to a publicly available electronic communications service or a mobile network. the server may be the manufacturer’s own local server capacity or that of a third party or a cloud service provider who functions as data holder. data processors as defined in regulation (eu) 2016/679 are by default not considered to act as data holders , unless specifically tasked by the data controller. they may be designed to permit the user or a third party to process the data on the product or on a computing instance of the manufacturer.


### (21) products may be designed to make certain data directly available from an on-device data storage or from a remote server to which the data are communicated. access to the on-device data storage may be enabled via cable-based or wireless local area networks connected to a publicly available electronic communications service or a mobile network. the server may be the manufacturer’s own local server capacity or that of a third party or a cloud service provider who functions as data holder. they may be designed to permit the user or a third party to process the data on the product or on a computing instance of the manufacturer. ### (21) connected products may be designed to make certain data directly available from an on-device data storage or from a remote server to which the data are communicated. access to the on-device data storage may be enabled via cable-based or wireless local area networks connected or a mobile network. the server may be the manufacturer’s own local server capacity or that of a third party or a cloud service provider who functions as data holder. connected products may be designed to permit the user or a third party to process the data on the product or on a computing instance of the manufacturer as well as enable the user to retrieve the data.


### (22) virtual assistants play an increasing role in digitising consumer environments and serve as an easy-to-use interface to play content , obtain information , or activate physical objects connected to the internet of things. virtual assistants can act as a single gateway in , for example , a smart home environment and record significant amounts of relevant data on how users interact with products connected to the internet of things , including those manufactured by other parties and can replace the use of manufacturer-provided interfaces such as touchscreens or smart phone apps. the user may wish to make available such data with third party manufacturers and enable novel smart home services. such virtual assistants should be covered by the data access right provided for in this regulation also regarding data recorded before the virtual assistant’s activation by the wake word and data generated when a user interacts with a product via a virtual assistant provided by an entity other than the manufacturer of the product. however , only the data stemming from the interaction between the user and product through the virtual assistant falls within the scope of this regulation. data produced by the virtual assistant unrelated to the use of a product is not the object of this regulation. ### (22) virtual assistants play an increasing role in digitising consumer environments and serve as an easy-to-use interface to play content , obtain information , or activate physical objects connected to the internet. virtual assistants can act as a single gateway in , for example , a smart home environment and record significant amounts of relevant data on how users interact with products connected to the internet , including those manufactured by other parties and can replace the use of manufacturer-provided interfaces such as touchscreens or smart phone apps. the user may wish to make available such data with third party manufacturers and enable novel smart home services. such virtual assistants should be covered by the data access right provided for in this regulation also regarding data recorded before the virtual assistant’s activation by the wake word and data generated when a user interacts with a product via a virtual assistant provided by an entity other than the manufacturer of the product. however , only the data stemming from the interaction between the user and product through the virtual assistant falls within the scope of this regulation. data produced by the virtual assistant unrelated to the use of a product is not the object of this regulation.


### (23) before concluding a contract for the purchase , rent , or lease of a product or the provision of a related service , clear and sufficient information should be provided to the user on how the data generated may be accessed. this obligation provides transparency over the data generated and enhances the easy access for the user. this obligation to provide information does not affect the obligation for the controller to provide information to the data subject pursuant to article 12 , 13 and 14 of regulation 2016/679. ### (23) before concluding a contract for the purchase , rent , or lease of a product or the provision of a related service , the data holder shall provide to the user clear and sufficient information that would enable the user to effectively exercise its rights upon the data they generate through the use of connected products and related services. the data holder shall develop mechanisms to keep the user up to date when the information changes during the lifetime of the connected product or when the purpose for which the data will be used changes from the originally specified purpose. this obligation provides transparency over the data generated and enhances the easy and secure access for the user , as well as the right to retrieve , process and further harness the value of non-personal data. this obligation to provide information does not affect the obligation for the controller to provide information to the data subject pursuant to article 12 , 13 and 14 of regulation (eu) 2016/679.


### (24) this regulation imposes the obligation on data holders to make data available in certain circumstances. insofar as personal data are processed , the data holder should be a controller under regulation (eu) 2016/679. where users are data subjects , data holders should be obliged to provide them access to their data and to make the data available to third parties of the user’s choice in accordance with this regulation. however , this regulation does not create a legal basis under regulation (eu) 2016/679 for the data holder to provide access to personal data or make it available to a third party when requested by a user that is not a data subject and should not be understood as conferring any new right on the data holder to use data generated by the use of a product or related service. this applies in particular where the manufacturer is the data holder. in that case , the basis for the manufacturer to use non-personal data should be a contractual agreement between the manufacturer and the user. this agreement may be part of the sale , rent or lease agreement relating to the product. any contractual term in the agreement stipulating that the data holder may use the data generated by the user of a product or related service should be transparent to the user , including as regards the purpose for which the data holder intends to use the data. this regulation should not prevent contractual conditions , whose effect is to exclude or limit the use of the data , or certain categories thereof , by the data holder. this regulation should also not prevent sector-specific regulatory requirements under union law , or national law compatible with union law , which would exclude or limit the use of certain such data by the data holder on well-defined public policy grounds. ### (24) this regulation imposes the obligation on data holders to make data available in certain circumstances. insofar as personal data are processed , the data holder should be a controller under regulation (eu) 2016/679. where users are data subjects , data holders should be obliged to provide them access to their data and to make the data available to third parties of the user’s choice in accordance with this regulation. however , this regulation does not create a legal basis under regulation (eu) 2016/679 for the data holder to provide access to personal data or make it available to a third party when requested by s user that is not a data subject and should not be understood as conferring any new right on the data holder to use data generated by the use of a connected product or related service. when the manufacturer is also the party providing related services and qualifies as a data holder , the basis for the manufacturer to use non-personal data should be a contractual agreement between the manufacturer and the user. in such cases , the contract for purchase and provision of related services can be merged. any contractual term in the agreement stipulating that the data holder may use the data generated by the user of a connected product or related service should be transparent to the user , including as regards the purpose for which the data holder intends to use the data. this regulation should not prevent contractual conditions , whose effect is to exclude or limit the use of the data , or certain categories thereof , by the data holder. where a data holder intends to share data with third parties for the fulfilment of the contractual obligations , it should inform the user of the nature and volume of the shared data and , where relevant , contractually bind the third party not to use the data for any other purposes. this regulation should also not prevent sector-specific regulatory requirements under union law , or national law compatible with union law , which would exclude or limit the use of certain such data by the data holder on well-defined public policy grounds.


### (26) in contracts between a data holder and a consumer as a user of a product or related service generating data , directive 93/13/eec applies to the terms of the contract to ensure that a consumer is not subject to unfair contractual terms. for unfair contractual terms unilaterally imposed on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec63 , this regulation provides that such unfair terms should not be binding on that enterprise. ### (26) in contracts between a data holder and a consumer as a user of a product or related service generating data , directive 93/13/eec applies to the terms of the contract to ensure that a consumer is not subject to unfair contractual terms. for unfair contractual terms unilaterally imposed on a micro , small or medium-sized enterprise , this regulation provides that such unfair terms should not be binding on that enterprise.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) when the user has requested the data holder to make data available to third parties for the user's commercial purposes , the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in connected products with functionalities based on the use of data from sensors built into that connected product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also foster the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of connected product from which the data are obtained , for instance , by the use of data to develop a competing connected product.


### (35) the third party should also refrain from using the data to profile individuals unless these processing activities are strictly necessary to provide the service requested by the user. the requirement to delete data when no longer required for the purpose agreed with the user complements the right to erasure of the data subject pursuant to article 17 of regulation 2016/679. where the third party is a provider of a data intermediation service within the meaning of [data governance act] , the safeguards for the data subject provided for by that regulation apply. the third party may use the data to develop a new and innovative product or related service but not to develop a competing product. ### (35) data holders and data recipients should also refrain from using the data to profile individuals unless these processing activities are strictly necessary to provide the service requested by the user. the requirement to delete data when no longer required for the purpose agreed with the user complements the right to erasure of the data subject pursuant to article 17 of regulation 2016/679. where the third party is a provider of a data intermediation service within the meaning of [data governance act] , the safeguards for the data subject provided for by that regulation apply. the data recipient may use the data to develop a new and innovative connected product or related service but not to develop a competing product.


### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means. ### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the[regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679.consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right without additional safeguards. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot solicitor commercially incentivise a user or data holder in any manner , including by providing monetary or any other compensation , to make data available to one of its services.an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. this does not prevent third parties from using data processing services offered by a designated gatekeeper and does not prevent these companies from obtaining data through other lawful means.


### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy through the accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the [regulation on contestable and fair markets in the digital sector (digital markets act)] aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the [regulation on contestable and fair markets in the digital sector (digital markets act)] , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion of designated gatekeepers from the scope of the access right under this regulation does not prevent these companies from obtaining data through other lawful means. ### (36) start-ups , small and medium-sized enterprises and companies from traditional sectors with less-developed digital capabilities struggle to obtain access to relevant data. this regulation aims to facilitate access to data for these entities , while ensuring that the corresponding obligations are scoped as proportionately as possible to avoid overreach. at the same time , a small number of very large companies have emerged with considerable economic power in the digital economy by either manufacturing of connected products and provision of related services in certain sectors or accumulation and aggregation of vast volumes of data and the technological infrastructure for monetising them. these companies include undertakings which hold a dominant position in certain sectors in manufacturing connected devices and providing related services and undertakings that provide core platform services controlling whole platform ecosystems in the digital economy and whom existing or new market operators are unable to challenge or contest. the regulation (eu) 2022/1925 aims to redress these inefficiencies and imbalances by allowing the commission to designate a provider as a “gatekeeper” , and imposes a number of obligations on such designated gatekeepers , including a prohibition to combine certain data without consent , and an obligation to ensure effective rights to data portability under article 20 of regulation (eu) 2016/679. consistent with the regulation (eu) 2022/1925 , and given the unrivalled ability of these companies to acquire data , it would not be necessary to achieve the objective of this regulation , and would thus be disproportionate in relation to data holders made subject to such obligations , to include such gatekeeper undertakings as beneficiaries of the data access right. this means that an undertaking providing core platform services that has been designated as a gatekeeper cannot request or be granted access to users’ data generated by the use of a product or related service or by a virtual assistant based on the provisions of chapter ii of this regulation. an undertaking providing core platform services designated as a gatekeeper pursuant to digital markets act should be understood to include all legal entities of a group of companies where one legal entity provides a core platform service. furthermore , third parties to whom data are made available at the request of the user may not make the data available to a designated gatekeeper. for instance , the third party may not sub-contract the service provision to a gatekeeper. however , this does not prevent third parties from using data processing services offered by a designated gatekeeper. this exclusion from the scope of the access right under this regulation of undertakings manufacturing connected products or providing related services , which have been determined to have a dominant position on the market pursuant national or union competition law and any designated gatekeepers does not prevent these companies from obtaining data through other lawful means.


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### (37) given the current state of technology it is overly burdensome for data holders that are micro and small enterprises to fulfill the obligations to make data available to data recipients. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a connected product or provide a related service. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation.


### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available. ### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available. the commission should develop guidance detailing what qualifies as a reasonable compensation in the data economy.


### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. ### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. in the case of major cybersecurity incidents , this should not result in the duplication of requirements for firms such as those under regulation xxxx/xxxx on digital operational resilience for the financial sector and the directive xxxx/xxxx on measures for a high common level of cybersecurity across the union , repealing directive (eu) 2016/1148.


### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. ### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency should be determined and declared according to the respective procedures in the member states or of relevant international organisations. in cases of major cybersecurity incidents , this regulation should be complementary but not create a duplication of requirements deriving from directive (eu) xxxx/xxxx on measures for a high common level of cybersecurity across the union [nis2] and regulation (eu) xxx/xxxx on digital operational resilience for financial entities [dora].


### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to , prevent or recover from public emergencies or to maintain the capacity to fulfil specific tasks explicitly provided by law. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65 should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested. ### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to , prevent or recover from public emergencies. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65 should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested only with the prior explicit consent of the data holder.


### (69) the ability for customers of data processing services , including cloud and edge services , to switch from one data processing service to another , while maintaining a minimum functionality of service , is a key condition for a more competitive market with lower entry barriers for new service providers. ### (69) the ability for customers of data processing services , including cloud and edge services , to switch from one cloud service provider to another , while maintaining a minimum functionality of service , is a key condition for a more competitive market with lower entry barriers for new service providers. facilitating a multi-cloud approach for customers of cloud services also contributes to increase their digital operational resilience , as recognised for financial service institutions in the digital operational resilience act (dora).


### (71) data processing services should cover services that allow on-demand and broad remote access to a scalable and elastic pool of shareable and distributed computing resources. those computing resources include resources such as networks , servers or other virtual or physical infrastructure , operating systems , software , including software development tools , storage , applications and services. the capability of the customer of the data processing service to unilaterally self-provision computing capabilities , such as server time or network storage , without any human interaction by the service provider could be described as on-demand administration. the term ‘broad remote access’ is used to describe that the computing capabilities are provided over the network and accessed through mechanisms promoting the use of heterogeneous thin or thick client platforms (from web browsers to mobile devices and workstations). the term ‘scalable’ refers to computing resources that are flexibly allocated by the data processing service provider , irrespective of the geographical location of the resources , in order to handle fluctuations in demand. the term ‘elastic pool’ is used to describe those computing resources that are provisioned and released according to demand in order to rapidly increase or decrease resources available depending on workload. the term ‘shareable’ is used to describe those computing resources that are provided to multiple users who share a common access to the service , but where the processing is carried out separately for each user , although the service is provided from the same electronic equipment. the term ‘distributed’ is used to describe those computing resources that are located on different networked computers or devices and which communicate and coordinate among themselves by message passing. the term ‘highly distributed’ is used to describe data processing services that involve data processing closer to where data are being generated or collected , for instance in a connected data processing device. edge computing , which is a form of such highly distributed data processing , is expected to generate new business models and cloud service delivery models , which should be open and interoperable from the outset. ### (71) cloud computing services should cover services that allow on-demand and broad remote access to a scalable and elastic pool of shareable and distributed computing resources. those computing resources include resources such as networks , servers or other virtual or physical infrastructure , operating systems , software , including software development tools , storage , applications and services. the deployment models of cloud computing should include private , community , public and hybrid cloud. the aforementioned service and deployment models have the same meaning as the terms of service and deployment models defined under iso/iec 17788:2014 standard. the capability of the customer of the data processing service to unilaterally self-provision computing capabilities , such as server time or network storage , without any human interaction by the provider of cloud computing services could be described as on-demand administration. the term ‘broad remote access’ is used to describe that the computing capabilities are provided over the network and accessed through mechanisms promoting the use of heterogeneous thin or thick client platforms (from web browsers to mobile devices and workstations). the term ‘scalable’ refers to computing resources that are flexibly allocated by the provider of cloud computing services , irrespective of the geographical location of the resources , in order to handle fluctuations in demand. the term ‘elastic pool’ is used to describe those computing resources that are provisioned and released according to demand in order to rapidly increase or decrease resources available depending on workload. the term ‘shareable’ is used to describe those computing resources that are provided to multiple users who share a common access to the service , but where the processing is carried out separately for each user , although the service is provided from the same electronic equipment. the term ‘distributed’ is used to describe those computing resources that are located on different networked computers or devices and which communicate and coordinate among themselves by message passing. the term ‘highly distributed’ is used to describe data processing services that involve data processing closer to where data are being generated or collected , for instance in a connected data processing device. edge computing , which is a form of such highly distributed data processing , is expected to generate new business models and cloud service delivery models , which should be open and interoperable from the outset.


### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment while benefitting from functional equivalence. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. functional equivalence means the maintenance of a minimum level of functionality of a service after switching , and should be deemed technically feasible whenever both the originating and the destination data processing services cover (in part or in whole) the same service type. meta-data , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching. ### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment while benefitting from functional equivalence. it should be noted that the data processing services in scope are those where data processing , as defined under the regulation , forms part of the core-business of a provider. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. switching is an operation consisting in three main successive steps: i) data extraction , i.e downloading data from a originating provider’s ecosystem; ii) transformation , when the data is structured in a way that matches the schema of the target location iii) load of the data in a new destination location. obstacles of different natures may occur during the different steps of the switching process. cloud service providers and clients have different levels of responsibilities , depending on the steps of the process referred to. obstacles to switching are of different nature , depending on the step of the switching process it is referred to. functional equivalence means a definition as agreed upon by a customer and provider of data processing services , or the maintenance of a minimum level of pre-defined functionality during the switching process , to such an extent that the service will deliver comparable minimum level functionality , such as the same output at the same performance and with the same level of security , operational resilience and quality of service as agreed at the time of termination of the contract , where both the original and destination service providers independently offer the same core functionality; services can only be expected to facilitate functional equivalence for the functionalities that both the originating and destination service offer. the regulation does not instance an obligation of facilitating functional equivalence for data processing services of the paas and/or saas delivery model. meta-data , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching. data processing services are used across sectors and vary in complexity and service type; this is an important consideration with regards to the porting process and the timeframes.


### (74) data processing service providers should be required to offer all assistance and support that is required to make the switching process successful and effective without requiring those data processing service providers to develop new categories of services within or on the basis of the it-infrastructure of different data processing service providers to guarantee functional equivalence in an environment other than their own systems. nevertheless , service providers are required to offer all assistance and support that is required to make the switching process effective. existing rights relating to the termination of contracts , including those introduced by regulation (eu) 2016/679 and directive (eu) 2019/770 of the european parliament and of the council67 should not be affected. ### (74) providers of cloud computing services should be required to remove all relevant obstacles , offer all assistance and support that is required to make the switching process successful , safe and effective and in line with the industry best practices , without requiring those cloud computing providers to develop new categories of services within or on the basis of the it-infrastructure of different data processing service providers to guarantee functional equivalence in an environment other than their own systems. nevertheless , service providers are required to offer all assistance and support that is required to make the switching process effective. providers of cloud computing services should support development of customer’s exit strategy relevant to the contracted services , including through providing information such as procedures for initiating switching from the cloud computing service , the machine-readable data formats that user’s data can be exported to , the tools , including at least one open standard data portability interface , foreseen to export data , information on known technical restrictions and limitations that could impact switching process , estimated time necessary to complete the switching process and additional services offered to facilitate the switching process , including the ability of the customer to test its switching process. existing rights relating to the termination of contracts , including those introduced by regulation (eu) 2016/679 and directive (eu) 2019/770 of the european parliament and of the council67 should not be affected. any mandatory period under this regulation shall not affect the compliance with goals under sectoral legislation.