### (76) open interoperability specifications and standards developed in accordance with paragraph 3 and 4 of annex ii of regulation (eu) 1025/2021 in the field of interoperability and portability enable a seamless multi-vendor cloud environment , which is a key requirement for open innovation in the european data economy. as market-driven processes have not demonstrated the capacity to establish technical specifications or standards that facilitate effective cloud interoperability at the paas (platform-as-a-service) and saas (software-as-a-service) levels , the commission should be able , on the basis of this regulation and in accordance with regulation (eu) no 1025/2012 , to request european standardisation bodies to develop such standards , particularly for service types where such standards do not yet exist. in addition to this , the commission will encourage parties in the market to develop relevant open interoperability specifications. the commission , by way of delegated acts , can mandate the use of european standards for interoperability or open interoperability specifications for specific service types through a reference in a central union standards repository for the interoperability of data processing services. european standards and open interoperability specifications will only be referenced if in compliance with the criteria specified in this regulation , which have the same meaning as the requirements in paragraphs 3 and 4 of annex ii of regulation (eu) no 1025/2021 and the interoperability facets defined under the iso/iec 19941:2017. ### (76) open interoperability specifications and standards developed in accordance with paragraph 3 and 4 of annex ii of regulation (eu) 1025/2021 in the field of interoperability and portability enable a seamless multi-vendor cloud environment , which is a key requirement for open innovation in the european data economy. as market-driven processes have not demonstrated the capacity to establish technical specifications or standards that facilitate effective cloud computing service interoperability at the paas (platform-as-a-service) and saas (software-as-a-service) levels , the commission should be able , on the basis of this regulation and in accordance with regulation (eu) no 1025/2012 , to request european standardisation bodies to develop such standards , for equivalent services where such standards do not yet exist. in addition to this , the commission will encourage parties in the market to develop relevant open interoperability specifications. following consultation with stakeholders and taking into account relevant international and european standards and self-regulating initiatives , the commission , by way of delegated acts , can mandate the use of european standards for interoperability or open interoperability specifications for specific equivalent services through a reference in a central union standards repository for the interoperability of cloud computing services. european standards and open interoperability specifications will only be referenced if in compliance with the criteria specified in this regulation , which have the same meaning as the requirements in paragraphs 3 and 4 of annex ii of regulation (eu) no 1025/2021 and the interoperability facets defined under the iso/iec 19941:2017.


### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. the commission should adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could remain to be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , the commission should be enabled to mandate the development of harmonised standards for the interoperability of data processing services. ### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. the commission should adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could remain to be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , following consultation with stakeholders and taking into account relevant international and european standards and self-regulating initiatives the commission should be enabled to mandate the development of harmonised standards for the interoperability of cloud computing services.


### 1. this regulation lays down harmonised rules on making data generated by the use of a product or related service available to the user of that product or service , on the making data available by data holders to data recipients , and on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need , for the performance of a task carried out in the public interest: ### 1. this regulation lays down harmonised rules on making data generated by the use of a connected product or related service available to the user of that connected product or related service , on the making data available by a user to a data recipient or by the data holders to data recipients , and on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need:


### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording; ### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording , however only raw 'data' that has not undergone any processing beyond mere collection or is generated as a by-product of the user's actions , including diagnostics and other technical data;


### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording; ### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording , that is generated by the use of a connected product and can be transmitted via electronic communications services.


### (3) ‘related service’ means a digital service , including software , which is incorporated in or inter-connected with a product in such a way that its absence would prevent the product from performing one of its functions; ### (3) ‘related service’ means a digital service , including software , but excluding electronic communication services (ecs) ,which is at the time of the purchase , rental or leasing agreement , inter-connected with a product in such a way that its absence would prevent the product from performing one of its core functions;


### (3) ‘related service’ means a digital service , including software , which is incorporated in or inter-connected with a product in such a way that its absence would prevent the product from performing one of its functions; ### (3) ‘related service’ means a digital service , including software , but excluding electronic communications services , which is inter-connected with a product in such a way that its absence would prevent the product from performing one or more of its functions;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a service , and the data subject;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person that owns a product and receives a related service from a data holder or a lawful user to whom the owner of the connected product has transferred , pursuant to a rental or lease agreement , the right to use the connected product or receive related services from a data holder;


### 2. paragraph 1 shall only apply to obstacles that are related to the services , contractual agreements or commercial practices provided by the original provider. ### deleted


### 2. paragraph 1 shall only apply to obstacles that are related to the services , contractual agreements or commercial practices provided by the original provider. ### 2. paragraph 1 shall only apply to obstacles that are related to the services , contractual agreements or commercial practices provided by the provider of source cloud computing services.


### 2. paragraph 1 shall only apply to obstacles that are related to the services , contractual agreements or commercial practices provided by the original provider. ### 2. paragraph 1 shall only apply to obstacles that are related to the services , contractual agreements , pre-commercial or commercial practices provided by the original provider


### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services shall be clearly set out in a written contract. without prejudice to directive (eu) 2019/770 , that contract shall include at least the following: ### 1. the rights of the customer and the obligations of the provider of a cloud computing service in relation to switching between providers of such services shall be clearly set out in a written contract. without prejudice to directive (eu) 2019/770 , the provider of cloud computing services shall ensure that contractual agreement shall include at least the following:


### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services shall be clearly set out in a written contract. without prejudice to directive (eu) 2019/770 , that contract shall include at least the following: ### 1. the rights of the customer and the obligations of the provider of a data processing service in relation to switching between providers of such services shall be clearly set out in a written contract. without prejudice to directive (eu) 2019/770 , that contract shall be clear and transparent to the customer and shall include at least the following:


### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall: ### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , to be initiated after the maximum notice period referred to in article 23 , during which the data processing service provider shall:


### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall: ### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 60 calendar days , during which the data processing service provider shall:


### (1) assist and , where technically feasible , complete the switching process; ### (1) assist through and facilitate the switching process;


### (2) ensure full continuity in the provision of the respective functions or services. ### (2) act with due care to maintain business continuity and security of the service and , taking into account the advancement in the switching process , ensure , to the greatest extent possible , continuity in the provision of the relevant functions or services within the provider of source cloud computing services’ infrastructure capacity and according to the contractual obligations.


### an exhaustive specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service; ### an exhaustive specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata related to the customer's services and created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service; being understood that cloud service providers shall not be required to disclose trade secrets or other proprietary information.


### a minimum period for data retrieval of at least 30 calendar days , starting after the termination of the transition period that was agreed between the customer and the service provider , in accordance with paragraph 1 , point (a) and paragraph 2. ### a minimum period for data retrieval of at least 30 calendar days , starting after the termination of the transition period that was agreed between the customer and the provider of cloud computing services , in accordance with paragraph 1 , point (a) and paragraph 2.


### a minimum period for data retrieval of at least 30 calendar days , starting after the termination of the transition period that was agreed between the customer and the service provider , in accordance with paragraph 1 , point (a) and paragraph 2. ### a minimum period for data retrieval of at least 60 calendar days , starting after the termination of the transition period that was agreed between the customer and the service provider , in accordance with paragraph 1 , point (a) and paragraph 2.


### 2. before concluding a contract for the purchase , rent or lease of a product or a related service , at least the following information shall be provided to the user , in a clear and comprehensible format: ### 2. before concluding a contract for the provision of a related service , at least the following information shall be provided to the user , in a simple manner , clear and comprehensible format:


### the nature and volume of the data likely to be generated by the use of the product or related service; ### the nature and type of the data likely to be generated by the use of the product or related service;


### the nature and volume of the data likely to be generated by the use of the product or related service; ### the nature , format , frequency and estimated volume of the data to be generated by the use of the connected product and related service;


### how the user may access those data; ### how the user may access , retrieve , and request the deletion of those data;


### how the user may access those data; ### how the user may access , retrieve and request de erasure of those data;


### whether the seller , renter or lessor is the data holder and , if not , the identity of the data holder , such as its trading name and the geographical address at which it is established; ### whether the provider of the related service is the only data holder and , if not , the identity of the other data holders , such as its trading name , the geographical address at which it is established and where applicable the legal entity identifier;


### how the user may request that the data are shared with a third-party; ### how the user may request that the data are shared with a third-party and withdraw the consent for data sharing;


### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , free of charge and , where applicable , continuously and in real-time. this shall be done on the basis of a simple request through electronic means where technically feasible. ### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , free of charge , easily , securely , in as structured , commonly used and machine-readable format and , where applicable , continuously and in real-time. this shall be done on the basis of a simple request through electronic means where technically feasible.


### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , free of charge and , where applicable , continuously and in real-time. this shall be done on the basis of a simple request through electronic means where technically feasible. ### 1. where data cannot be directly accessed by the user from the product the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , in a structured , commonly used and machine-readable format , free of charge and , where technically feasible , continuously and in real-time.


### 4. the user shall not use the data obtained pursuant to a request referred to in paragraph 1 to develop a product that competes with the product from which the data originate. ### 4. the user shall not use the data obtained pursuant to a request referred to in paragraph 1 to develop a product or a related service that competes with the product or the related service from which the data originate.


### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time. ### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a connected product or related service to a third party , in accordance with articles 8 and 9 , provided that the third party and its ultimate parent have their registered seat in the european union , without undue delay , free of charge to the user , of the same quality as is available to the data holder easily , securely , in a structured , commonly used and machine readable format and , where technically feasible , continuously and in real-time.


### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time. ### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a connected product or related service to a third party , in accordance with articles 8 and 9 , without undue delay , free of charge to the user , of the same quality as is available to the data holder easily , securely , in a structured , commonly used and machine-readable format and , where technically feasible , continuously and in real-time.


### 2. any undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper , pursuant to article […] of [regulation xxx on contestable and fair markets in the digital sector (digital markets act)73 ] , shall not be an eligible third party under this article and therefore shall not: ### deleted


### solicit or commercially incentivise a user in any manner , including by providing monetary or any other compensation , to make data available to one of its services that the user has obtained pursuant to a request under article 4(1); ### solicit or commercially incentivise a user or a data recipient in any manner , including by providing monetary or any other compensation , to make data available to one of its services that the user has obtained pursuant to a request under article 4(1) or that the data recipient has obtained pursuant to this article;


### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose. ### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and where all conditions and rules provided by data protection legislation are complied with , notably where there is a valid legal basis under article 6 and where relevant , the conditions of article 9 of the gdpr and article 5(3) of eprivacy directive are fulfilled and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose.


### coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user; ### coerce , deceive or manipulate the user or data subject in any way , by subverting or impairing the autonomy , decision-making or choices of the user or data subject , including by means of a digital interface with the user or data subject;


### make the data available it receives to another third party , in raw , aggregated or derived form , unless this is necessary to provide the service requested by the user; ### make the data available it receives to another third party , in raw , aggregated or derived form , unless


### make the data available it receives to an undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper pursuant to article […] of [regulation on contestable and fair markets in the digital sector (digital markets act)]; ### deleted


### make the data available it receives to an undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper pursuant to article […] of [regulation on contestable and fair markets in the digital sector (digital markets act)]; ### make the data available it receives to an undertaking manufacturing connected products or providing related services which has been determined to have a dominant position on the market pursuant to national or union competition law and to an undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper pursuant to article […] of [regulation on contestable and fair markets in the digital sector (digital markets act)];


### 1. the obligations of this chapter shall not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise. ### 1. the obligations pursuant to articles 4 , 5 , and 6 of this chapter shall not apply to data generated by the use of connected products and related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise.


### 2. where this regulation refers to products or related services , such reference shall also be understood to include virtual assistants , insofar as they are used to access or control a product or related service. ### 2. where this regulation refers to related services , such reference shall also be understood to include virtual assistants , insofar as they are used to access or control a connected product.


### 3. a data holder shall not discriminate between comparable categories of data recipients , including partner enterprises or linked enterprises , as defined in article 3 of the annex to recommendation 2003/361/ec , of the data holder , when making data available. where a data recipient considers the conditions under which data has been made available to it to be discriminatory , it shall be for the data holder to demonstrate that there has been no discrimination. ### 3. a data holder shall not discriminate between comparable categories of data recipients , including partner enterprises or linked enterprises , as defined in article 3 of the annex to recommendation 2003/361/ec , of the data holder , when making data available. where a data recipient has a reasonable doubt that the conditions under which data has been made available to it to be discriminatory , it shall be for the data holder and the data recipient to demonstrate whether there has been discrimination.


### 3. a data holder shall not discriminate between comparable categories of data recipients , including partner enterprises or linked enterprises , as defined in article 3 of the annex to recommendation 2003/361/ec , of the data holder , when making data available. where a data recipient considers the conditions under which data has been made available to it to be discriminatory , it shall be for the data holder to demonstrate that there has been no discrimination. ### 3. a data holder shall not discriminate between comparable categories of data recipients , including partner enterprises or linked enterprises , as defined in article 3 of the annex to recommendation 2003/361/ec , of the data holder , when making data available. where a data recipient considers the conditions under which data has been made available to it to be discriminatory , it shall be for the data holder to demonstrate that there has been no discrimination. these obligations are without prejudice to regulation (eu) 2016/679.


### 1. any compensation agreed between a data holder and a data recipient for making data available shall be reasonable. ### 1. any compensation agreed between a data holder and a data recipient for the costs incurred and investment required for making non-personal data available shall be reasonable.


### 2. where the data recipient is a micro , small or medium enterprise , as defined in article 2 of the annex to recommendation 2003/361/ec , any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly. ### 2. where the data recipient is a micro , small or medium enterprise , as defined in article 2 of the annex to recommendation 2003/361/ec , any compensation agreed shall not exceed the costs directly related to making the non-personal data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly.


### 2. where the data recipient is a micro , small or medium enterprise , as defined in article 2 of the annex to recommendation 2003/361/ec , any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly. ### 2. where the data recipient is a micro , small or medium enterprise , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro , small or medium enterprise , any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly.


### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9. ### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9. this is without prejudice to the data subject’s rights and controllers’ processor obligations , including the data subject's right to seek redress before a supervisory authority , established under regulation (eu) 2016/679.


### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9. ### 1. users , data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9.


### 1. the data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to effectively provide data to third parties pursuant to article 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1). ### 1. the data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to discriminate between data recipients or to hinder the user’s right to access data , retrieve the data or effectively provide data to third parties pursuant to article 4 and 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1).


### 2. a data recipient that has , for the purposes of obtaining data , provided inaccurate or false information to the data holder , deployed deceptive or coercive means or abused evident gaps in the technical infrastructure of the data holder designed to protect the data , has used the data made available for unauthorised purposes or has disclosed those data to another party without the data holder’s authorisation , shall without undue delay , unless the data holder or the user instruct otherwise: ### 2. a data recipient that has , for the purposes of obtaining data , provided inaccurate or false information to the data holder , deployed deceptive or coercive means or abused evident gaps in the technical infrastructure of the data holder designed to protect the data , has used the data made available for unauthorised purposes or has disclosed those data to another party without the data holder’s authorisation or in the case of personal data , an appropriate legal basis under regulation (eu) 2016/679 , shall without undue delay , unless the data holder or the user instruct otherwise:


### 2. a data recipient that has , for the purposes of obtaining data , provided inaccurate or false information to the data holder , deployed deceptive or coercive means or abused evident gaps in the technical infrastructure of the data holder designed to protect the data , has used the data made available for unauthorised purposes or has disclosed those data to another party without the data holder’s authorisation , shall without undue delay , unless the data holder or the user instruct otherwise: ### 2. a data recipient that has , for the purposes of obtaining non-personal data , provided inaccurate or false information to the data holder , deployed deceptive or coercive means or abused gaps in the technical infrastructure of the data holder designed to protect the data , has used the data made available for unauthorised purposes or has disclosed those data to another party without the data holder’s authorisation , shall without undue delay , unless the data holder or the user instruct otherwise:


### 2. any contractual term in a data sharing agreement which , to the detriment of one party , or , where applicable , to the detriment of the user , excludes the application of this chapter , derogates from it , or varies its effect , shall not be binding on that party. ### 2. any contractual term in a data sharing agreement which , to the detriment of one party , or , where applicable , to the detriment of the user , excludes the application of this chapter , derogates from it , or varies its effect , shall not be binding on that party. any contractual term in a data sharing agreement between data holders and data recipients which , to the detriment of the data subjects , undermines the application of their rights to privacy and data protection , derogates from it , or varies its effect , shall not be binding on that party.


### (6) data generation is the result of the actions of at least two actors , the designer or manufacturer of a product and the user of that product. it gives rise to questions of fairness in the digital economy , because the data recorded by such products or related services are an important input for aftermarket , ancillary and other services. in order to realise the important economic benefits of data as a non-rival good for the economy and society , a general approach to assigning access and usage rights on data is preferable to awarding exclusive rights of access and use. ### (6) data generation is the result of the actions of at least two actors , the designer or manufacturer of a product , and where different from the manufacturer the provider of related services for the connected product and the user of that connected product. it gives rise to questions of fairness in the digital economy , because the data recorded by such connected products or related services are an important input for aftermarket , ancillary and other services. in order to realise the important economic benefits of data as a non-rival good for the economy and society , a general approach to assigning access and usage rights on data is preferable to awarding exclusive rights of access and use.


### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , which has purchased , rented or leased the product. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service. ### (18) the user of a connected product should be understood as the legal or natural person , such as a business , consumer which has purchased the product , or to whom the owner of the connected product has transferred , on the basis of a rental or lease agreement , temporary rights to use the connected product or receive related services. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy the access to the data it generates. the user should therefore have an active role in the data economy and be entitled to derive benefit from non-personal data generated by the use of that connected product and any related service.


### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need. ### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need.


### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. ### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. at the same time , the public sector body or the union institution , agency or body should demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation.


### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. ### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. however , when a public emergency is caused by and could reasonably be addressed by policy decisions of the requesting public sector body , then the request should not be deemed an exceptional need.


### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. ### (58) an exceptional need would arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that it has exhausted all other alternative means for obtaining the data requested and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation.


### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institution , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured. ### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public-sector bodies and to union institution , agencies or bodies to ensure legal certainty , to minimise the administrative burden placed on businesses and to avoid misuse of data. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent , limited in time , and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the request should also respect the legitimate interests of the businesses to whom the request is made. in order to ensure a higher degree of coordination and avoid additional burden on private companies , member states should designate one competent authority to act as a single point of contact between public entities requesting access to data and private entities providing access to these data. the competent authority should receive the requests from the public sector bodies or union institutions , agencies or bodies , analyse whether the requests comply with the requirements set by this regulation and further direct them to the data holders for execution. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the competent authority and online public availability of all requests justified by a public emergency should be ensured.


### (63) data holders should have the possibility to either ask for a modification of the request made by a public sector body or union institution , agency and body or its cancellation in a period of 5 or 15 working days depending on the nature of the exceptional need invoked in the request. in case of requests motivated by a public emergency , justified reason not to make the data available should exist if it can be shown that the request is similar or identical to a previously submitted request for the same purpose by another public sector body or by another union institution , agency or body. a data holder rejecting the request or seeking its modification should communicate the underlying justification for refusing the request to the public sector body or to the union institution , agency or body requesting the data. in case the sui generis database rights under directive 96/6/ec of the european parliament and of the council66 apply in relation to the requested datasets , data holders should exercise their rights in a way that does not prevent the public sector body and union institutions , agencies or bodies from obtaining the data , or from sharing it , in accordance with this regulation. ### (63) data holders should have the possibility to either ask for a modification of the request made by a public sector body or union institution , agency and body or its cancellation without undue delay , but no longer than 5 working days. in case of requests motivated by a public emergency , justified reason not to make the data available should exist if it can be shown that the data is unavailable , the request does not meet the criteria laid down in chapter v of this regulation or the request is similar or identical to a previously submitted request for the same purpose by another public sector body or by another union institution , agency or body and the data holder has not been notified regarding the destruction of such data. a data holder rejecting the request or seeking its modification should communicate the underlying justification for refusing the request to the competent authority. in case the sui generis database rights under directive 96/6/ec of the european parliament and of the council66 apply in relation to the requested datasets , data holders should exercise their rights in a way that does not prevent the public sector body and union institutions , agencies or bodies from obtaining the data , or from sharing it , in accordance with this regulation.


### (64) where it is strictly necessary to include personal data in the data made available to a public sector body or to a union institution , agency or body the applicable rules on personal data protection should be complied with and the making available of the data and their subsequent use should and be accompanied by safeguards for the rights and interests of individuals concerned by those data. the body requesting the data should demonstrate the strict necessity and the specific and limited purposes for processing. the data holder should take reasonable efforts to anonymise the data or , where such anonymisation proves impossible , the data holder should apply technological means such as pseudonymisation and aggregation , prior to making the data available. ### (64) where it is strictly necessary to include personal data in the data made available to a public sector body or to a union institution , agency or body the applicable rules on personal data protection should be complied with and the making available of the data and their subsequent use should and be accompanied by safeguards for the rights and interests of individuals concerned by those data. the body requesting the data should demonstrate the strict necessity and the specific and limited purposes for processing. prior to making the data available , the data holder should apply all necessary means to anonymise the data or , where such anonymisation proves impossible , the data holder should apply technological means such as pseudonymisation and aggregation.


### (65) data made available to public sector bodies and to union institutions , agencies and bodies on the basis of exceptional need should only be used for the purpose for which they were requested , unless the data holder that made the data available has expressly agreed for the data to be used for other purposes. the data should be destroyed once it is no longer necessary for the purpose stated in the request , unless agreed otherwise , and the data holder should be informed thereof. ### (65) data made available to public sector bodies and to union institutions , agencies and bodies on the basis of exceptional need should only be used for the purpose for which they were requested , unless the data holder that made the data available has explicitly agreed for the data to be used for other purposes. the public sector bodies and union institutions , agencies and bodies should take all necessary legal , technical and organisational measures to ensure the integrity and security of the data and should destroy the data once it is no longer necessary for the purpose stated in the request , unless agreed otherwise , and the data holder should be informed thereof.


### (67) when the safeguarding of a significant public good is at stake , such as is the case of responding to public emergencies , the public sector body or the union institution , agency or body should not be expected to compensate enterprises for the data obtained. public emergencies are rare events and not all such emergencies require the use of data held by enterprises. the business activities of the data holders are therefore not likely to be negatively affected as a consequence of the public sector bodies or union institutions , agencies or bodies having recourse to this regulation. however , as cases of an exceptional need other than responding to a public emergency might be more frequent , including cases of prevention of or recovery from a public emergency , data holders should in such cases be entitled to a reasonable compensation which should not exceed the technical and organisational costs incurred in complying with the request and the reasonable margin required for making the data available to the public sector body or to the union institution , agency or body. the compensation should not be understood as constituting payment for the data itself and as being compulsory. ### (67) when the safeguarding of a significant public interest is at stake , such as is the case of responding to public emergencies , the public sector body or the union institution , agency or body should not be expected to compensate enterprises for the data obtained. public emergencies are rare , temporary events and not all such emergencies require the use of data held by enterprises. the business activities of the data holders are therefore not likely to be negatively affected as a consequence of the public sector bodies or union institutions , agencies or bodies having recourse to this regulation. however , as cases of an exceptional need other than responding to a public emergency might be more frequent , including cases of prevention of or recovery from a public emergency , data holders should in such cases be entitled to a reasonable compensation which should not exceed the technical and organisational costs incurred in complying with the request and the reasonable margin required for making the data available to the public sector body or to the union institution , agency or body. the compensation should not be understood as constituting payment for the data itself and as being compulsory.


### manufacturers of products and suppliers of related services placed on the market in the union and the users of such products or services; ### manufacturers of connected products and providers of related services placed on the market in the union , irrespective of their place of establishment;


### public sector bodies and union institutions , agencies or bodies that request data holders to make data available where there is an exceptional need to that data for the performance of a task carried out in the public interest and the data holders that provide those data in response to such request; ### public sector bodies and union institutions , agencies or bodies that request data holders to make data available where there is an exceptional need to that data for the response to or recovery from a public emergency and the data holders that provide those data in response to such request;


### public sector bodies and union institutions , agencies or bodies that request data holders to make data available where there is an exceptional need to that data for the performance of a task carried out in the public interest and the data holders that provide those data in response to such request; ### public sector bodies and union institutions , agencies or bodies that request data holders to make data available where there is an exceptional need to that data for the prevention , response or recovery from a public emergency and the data holders that provide those data in response to such request;


### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. this regulation shall not affect the applicability of union law on the protection of personal data , in particular regulation (eu) 2016/679 and directive 2002/58/ec , including the powers and competences of supervisory authorities. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement the right of data portability under article 20 of regulation (eu) 2016/679. ### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to any personal data processed in connection with the rights and obligations laid down in this regulation. this regulation is without prejudice to union law on the protection of personal data or privacy , in particular regulation (eu) 2016/679 , regulation (eu) 2018/1725 and directive 2002/58/ec , including the powers and competences of supervisory authorities. in the event of a conflict between this regulation and union law on the protection of personal data or privacy or national law adopted in accordance with such union law , the relevant union or national law on the protection of personal data or privacy shall prevail. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement the right of data portability under article 20 of regulation (eu) 2016/679. this regulation does not create a legal basis for the processing of personal data , nor does it affect any of the rights and obligations set out in regulations (eu) 2016/679 or (eu) 2018/1725 or directives 2002/58/ec or (eu) 2016/680.


### 4. this regulation shall not affect union and national legal acts providing for the sharing , access and use of data for the purpose of the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , including regulation (eu) 2021/784 of the european parliament and of the council72 and the [e-evidence proposals [com(2018) 225 and 226] once adopted , and international cooperation in that area. this regulation shall not affect the collection , sharing , access to and use of data under directive (eu) 2015/849 of the european parliament and of the council on the prevention of the use of the financial system for the purposes of money laundering and terrorist financing and regulation (eu) 2015/847 of the european parliament and of the council on information accompanying the transfer of funds. this regulation shall not affect the competences of the member states regarding activities concerning public security , defence , national security , customs and tax administration and the health and safety of citizens in accordance with union law. ### 4. this regulation shall not affect union and national legal acts providing for the sharing , access and use of data for the purpose of the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , including regulation (eu) 2021/784 of the european parliament and of the council72 and the [e-evidence proposals [com(2018) 225 and 226] once adopted , and international cooperation in that area. this regulation shall not affect the collection , sharing , access to and use of data under directive (eu) 2015/849 of the european parliament and of the council on the prevention of the use of the financial system for the purposes of money laundering and terrorist financing and regulation (eu) 2015/847 of the european parliament and of the council on information accompanying the transfer of funds. this regulation shall not affect the competences of the member states regarding activities concerning public security , defence , national security , customs and tax administration and the health and safety of citizens in accordance with union law. this regulation shall not affect data collected or generated by defence activities , products , or services or by products or services deployed and used for defence purposes , and it shall not affect product design data , insofar as the product manufacturer has demonstrated that such data is of no significant interest to the user.


### 4. this regulation shall not affect union and national legal acts providing for the sharing , access and use of data for the purpose of the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , including regulation (eu) 2021/784 of the european parliament and of the council72 and the [e-evidence proposals [com(2018) 225 and 226] once adopted , and international cooperation in that area. this regulation shall not affect the collection , sharing , access to and use of data under directive (eu) 2015/849 of the european parliament and of the council on the prevention of the use of the financial system for the purposes of money laundering and terrorist financing and regulation (eu) 2015/847 of the european parliament and of the council on information accompanying the transfer of funds. this regulation shall not affect the competences of the member states regarding activities concerning public security , defence , national security , customs and tax administration and the health and safety of citizens in accordance with union law. ### 4. this regulation shall not apply to , nor pre-empt , voluntary arrangements for the exchange of non-personal data between private and public entities. it shall not affect union and national legal acts providing for the sharing , access and use of data for the purpose of the prevention , investigation , detection or prosecution of criminal offences or the execution of criminal penalties , including regulation (eu) 2021/784 of the european parliament and of the council72 and the [e-evidence proposals [com(2018) 225 and 226] once adopted , and international cooperation in that area. this regulation shall not affect the collection , sharing , access to and use of data under directive (eu) 2015/849 of the european parliament and of the council on the prevention of the use of the financial system for the purposes of money laundering and terrorist financing and regulation (eu) 2015/847 of the european parliament and of the council on information accompanying the transfer of funds. this regulation shall not affect the competences of the member states regarding activities concerning public security , defence , national security , customs and tax administration and the health and safety of citizens in accordance with union law. this regulation shall not apply to the data generated by connected products and related services provided for public security , defence and national security.


### (2) ‘product’ means a tangible , movable item , including where incorporated in an immovable item , that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data via a publicly available electronic communications service and whose primary function is not the storing and processing of data; ### (2) ‘product’ means a tangible , movable item , including where incorporated in an immovable item , that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data via a publicly available electronic communications service and whose primary function is not the storing and processing of data , with the exception of personal computers , servers , tablets and smart phones , cameras , webcams , sound recording systems and text scanners;


### (2) ‘product’ means a tangible , movable item , including where incorporated in an immovable item , that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data via a publicly available electronic communications service and whose primary function is not the storing and processing of data; ### (2) ‘product’ means a tangible item that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data directly or indirectly via a publicly available electronic communications service and whose primary function is not the storing and processing of data , nor is it primarily designed to display or play content , or to record and transmit content;


### (2) ‘product’ means a tangible , movable item , including where incorporated in an immovable item , that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data via a publicly available electronic communications service and whose primary function is not the storing and processing of data; ### (2) ‘connected product’ means a tangible item , that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data via an electronic communications service and whose primary function is not the storing and processing of data;


### (6) ‘data holder’ means a legal or natural person who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data and through control of the technical design of the product and related services , the ability , to make available certain data; ### (6) ‘data holder’ means a legal or natural person , other than the user , who has the right in accordance with this regulation , applicable union law or national legislation implementing union law , to make available non-personal data generated by the use of a connected product or a related service and who has the control over these data;


### (7) ‘data recipient’ means a legal or natural person , acting for purposes which are related to that person’s trade , business , craft or profession , other than the user of a product or related service , to whom the data holder makes data available , including a third party following a request by the user to the data holder or in accordance with a legal obligation under union law or national legislation implementing union law; ### (7) ‘data recipient’ means a legal or natural person , acting for purposes which are related to that person’s trade , business , craft or profession , other than the user of a connected product or related service , to whom the user makes the data available either directly , or through data intermediation services , or the data holder , including a third party following a request by the user to the data holder or in accordance with a legal obligation under union law or national legislation implementing union law;


### (9) ‘public sector body’ means national , regional or local authorities of the member states and bodies governed by public law of the member states , or associations formed by one or more such authorities or one or more such bodies; ### (9) ‘public sector body’ means national , regional or local authorities of the member states;


### (10) ‘public emergency’ means an exceptional situation negatively affecting the population of the union , a member state or part of it , with a risk of serious and lasting repercussions on living conditions or economic stability , or the substantial degradation of economic assets in the union or the relevant member state(s); ### (10) ‘public emergency’ means an exceptional situation such as public health emergencies , emergencies resulting from natural disasters , as well as human-induced major disasters , such as major cybersecurity incidents , negatively affecting the population of the union , a member state or part of it , with a risk of serious and lasting repercussions on living conditions or economic stability , or the substantial degradation of economic assets in the union or the relevant member state(s) and which is determined according to the respective procedures under union or national law;


### (10) ‘public emergency’ means an exceptional situation negatively affecting the population of the union , a member state or part of it , with a risk of serious and lasting repercussions on living conditions or economic stability , or the substantial degradation of economic assets in the union or the relevant member state(s); ### (10) ‘public emergency’ means a legally declared state of emergency by the union or a member state for an exceptional and immediate situation caused by natural or man-made disasters , adversely affecting the population of the union , a member state or part of it , with a risk of significant and lasting repercussions on the health , safety or economic stability of citizen , or the substantial degradation of economic assets in the union or the relevant member state(s);


### (14) ‘functional equivalence’ means the maintenance of a minimum level of functionality in the environment of a new data processing service after the switching process , to such an extent that , in response to an input action by the user on core elements of the service , the destination service will deliver the same output at the same performance and with the same level of security , operational resilience and quality of service as the originating service at the time of termination of the contract; ### (14) ‘functional equivalence’ means the maintenance of a minimum level of functionality in the environment of a new data processing service after the switching process , to such an extent that , in response to an input action by the user on core elements of the service , the destination service will deliver the same output at the same performance and with the same level of security , operational resilience and quality of service as the originating service at the time of termination of the contract , , insofar as the originating and the destination data processing services cover (in part or in whole) the same service type;


### (17) ‘electronic ledger’ means an electronic ledger within the meaning of article 3 , point (53) , of regulation (eu) no 910/2014; ### (17) ‘electronic ledger’ means an electronic ledger within the meaning of article 3 , point (53) , of regulation (eu) xxx/xxxx [establishing a european digital identity framework];


### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user. ### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user. data subjects shall be offered the possibility to use the products covered by this regulation anonymously.


### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user. ### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely , safely , and , where relevant and appropriate , directly accessible to the user , in a structured , commonly used and machine-readable format.


### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user. ### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use that the data holder can readily obtain from the product on to an existing interface , or data that are collected or aimed to be collected by the data holder , are by default , easily , securely and , where relevant and appropriate , directly accessible to the user in a structured , commonly used and machine-readable format along with the relevant metadata , on a free of charge basis and retrievable by the user. where technically feasible , the user should be able to access and retrieve such data directly from the device , without recourse to related services.


### whether the manufacturer supplying the product or the service provider providing the related service intends to use the data itself or allow a third party to use the data and , if so , the purposes for which those data will be used; ### whether the service provider providing the related service intends to use the data itself or allow a third party to use the data and , if so , the purposes for which those data will be used;


### 3. trade secrets shall only be disclosed provided that all specific necessary measures are taken to preserve the confidentiality of trade secrets in particular with respect to third parties. the data holder and the user can agree measures to preserve the confidentiality of the shared data , in particular in relation to third parties. ### 3. the data holder can take all necessary measures , in advance to preserve the confidentiality of its trade secrets , insofar this is not hampering the rights of the users or third parties to access data. the data holder and the user can agree on measures to preserve the confidentiality of the shared data , in particular in relation to third parties.


### 5. where the user is not a data subject , any personal data generated by the use of a product or related service shall only be made available by the data holder to the user where there is a valid legal basis under article 6(1) of regulation (eu) 2016/679 and , where relevant , the conditions of article 9 of regulation (eu) 2016/679 are fulfilled. ### 5. where the user is not a data subject , any personal data generated by the use of a product or related service shall only be made available by the data holder to the user where there is a valid legal basis under article 6 of regulation (eu) 2016/679 and , where relevant , the conditions of article 9 of regulation (eu) 2016/679 and article 5(3) of directive 2002/58/ec are fulfilled.


### 2. any undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper , pursuant to article […] of [regulation xxx on contestable and fair markets in the digital sector (digital markets act)73 ] , shall not be an eligible third party under this article and therefore shall not: ### 2. any undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper , pursuant to article […] of [regulation xxx on contestable and fair markets in the digital sector (digital markets act)73 ] , shall not :


### 2. any undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper , pursuant to article […] of [regulation xxx on contestable and fair markets in the digital sector (digital markets act)73 ] , shall not be an eligible third party under this article and therefore shall not: ### 2. any undertaking manufacturing connected products or providing related services which has been determined to have a dominant position on the market pursuant to national or union competition law and any undertaking providing core platform services for which one or more of such services have been designated as a gatekeeper , pursuant to article […] of [regulation xxx on contestable and fair markets in the digital sector (digital markets act)73 ] , shall not be an eligible third party under this article and therefore shall not:


### receive data from a user that the user has obtained pursuant to a request under article 4(1). ### deleted


### 3. the user or third party shall not be required to provide any information beyond what is necessary to verify the quality as user or as third party pursuant to paragraph 1. the data holder shall not keep any information on the third party’s access to the data requested beyond what is necessary for the sound execution of the third party’s access request and for the security and the maintenance of the data infrastructure. ### 3. the user or third party shall not be required to provide any information beyond what is strictly necessary to verify the quality as user or as third party pursuant to paragraph 1. the data holder shall not keep any information on the third party’s access to the data requested beyond what is necessary for the sound execution of the third party’s access request and for the security and the maintenance of the data infrastructure. where identification is not legally required , users should be able to use products anonymously.


### 5. the data holder shall not use any non-personal data generated by the use of the product or related service to derive insights about the economic situation , assets and production methods of or use by the third party that could undermine the commercial position of the third party on the markets in which the third party is active , unless the third party has consented to such use and has the technical possibility to withdraw that consent at any time. ### 5. the data holder shall not use any data generated by the use of the product or related service to derive insights about the economic situation , assets and production methods of or use by the third party that could undermine the commercial position of the third party on the markets in which the third party is active , unless the third party has consented to such use and has the technical possibility to withdraw that consent at any time.


### 6. where the user is not a data subject , any personal data generated by the use of a product or related service shall only be made available where there is a valid legal basis under article 6(1) of regulation (eu) 2016/679 and where relevant , the conditions of article 9 of regulation (eu) 2016/679 are fulfilled. ### 6. where the user is not a data subject , any personal data generated by the use of a product or related service shall only be made available by the data holder to the third party where there is a valid legal basis under article 6(1) of regulation (eu) 2016/679 and where relevant , the conditions of article 9 of regulation (eu) 2016/679 and article 5(3) of directive 2002/58/ec are fulfilled.


### 9. the right referred to in paragraph 1 shall not adversely affect data protection rights of others. ### 9. the right referred to in paragraph 1 shall not adversely affect data subject rights of others pursuant to applicable data protection legislation.


### use the data it receives for the profiling of natural persons within the meaning of article 4(4) of regulation (eu) 2016/679 , unless it is necessary to provide the service requested by the user; ### use the data it receives for the profiling of natural persons within the meaning of article 4(4) of regulation (eu) 2016/679;


### use the data it receives for the profiling of natural persons within the meaning of article 4(4) of regulation (eu) 2016/679 , unless it is necessary to provide the service requested by the user; ### use the data it receives for the profiling of natural persons within the meaning of article 4(4) of regulation (eu) 2016/679 beyond the provisions of that regulation;


### use the data it receives for the profiling of natural persons within the meaning of article 4(4) of regulation (eu) 2016/679 , unless it is necessary to provide the service requested by the user; ### use the data it receives for purposes of direct marketing or advertising , credit scoring , including for the profiling of natural persons within the meaning of article 4(4) of regulation (eu) 2016/679 , unless it is necessary to provide the service requested by the user , and with the user’s explicit consent;


### use the data it receives to develop a product that competes with the product from which the accessed data originate or share the data with another third party for that purpose; ### use the data it receives to develop a product or related service that competes with the product or the related service from which the accessed data originate or share the data with another third party for that purpose;


### destroy the data made available by the data holder and any copies thereof; ### destroy the data made available by the data holder and any copies thereof , without prejudice to to the data subject’s right to restriction of processing under article 18 of regulation (eu) 2016/679;


### article 14 ### deleted


### article 15 ### deleted


### an exceptional need to use data within the meaning of this chapter shall be deemed to exist in any of the following circumstances: ### an exceptional need to use data within the meaning of this chapter shall be deemed to exist where all of the following conditions are met:


### an exceptional need to use data within the meaning of this chapter shall be deemed to exist in any of the following circumstances: ### an exceptional need to use data within the meaning of this chapter shall be limited in time and scope and deemed to exist only in the following circumstances:


### where the data requested is necessary to respond to a public emergency; ### the data requested is strictly necessary to respond to a public emergency;


### where the data requested is necessary to respond to a public emergency; ### where the data requested is strictly necessary to respond to a public emergency;


### where the data request is limited in time and scope and necessary to prevent a public emergency or to assist the recovery from a public emergency; ### or to assist the recovery from a public emergency and is limited in time and scope;


### where the data request is limited in time and scope and necessary to prevent a public emergency or to assist the recovery from a public emergency; ### where the data request is strictly necessary to prevent a public emergency or to assist the recovery from a public emergency; and only if all of the following conditions are fulfilled:


### where the lack of available data prevents the public sector body or union institution , agency or body from fulfilling a specific task in the public interest that has been explicitly provided by law; and ### deleted


### where the lack of available data prevents the public sector body or union institution , agency or body from fulfilling a specific task in the public interest that has been explicitly provided by law; and ### the lack of available data prevents the public sector body or union institution , agency or body from responding to the public emergency or from assisting the recovery from a public emergency;


### (1) the public sector body or union institution , agency or body has been unable to obtain such data by alternative means , including by purchasing the data on the market at market rates or by relying on existing obligations to make data available , and the adoption of new legislative measures cannot ensure the timely availability of the data; or ### (1) the public sector body or union institution , agency or body has been unable to obtain such data by alternative means , including by purchasing the data on the market at market rates or by relying on existing obligations to make data available.


### (2) obtaining the data in line with the procedure laid down in this chapter would substantively reduce the administrative burden for data holders or other enterprises. ### deleted


### article 16 ### deleted


### article 17 ### deleted


### explain the purpose of the request , the intended use of the data requested , and the duration of that use; ### explain the purpose of the request , the intended use of the data requested , the duration of that use , and which third parties the data may be disclosed to;


### specify the deadline by which the data are to be made available or within which the data holder may request the public sector body , union institution , agency or body to modify or withdraw the request. ### specify a reasonable deadline by which the data are to be made available;


### paragraph 3 does not preclude a public sector body or a union institution , agency or body to exchange data obtained pursuant to this chapter with another public sector body , union institution , agency or body , in view of completing the tasks in article 15 or to make the data available to a third party in cases where it has outsourced , by means of a publicly available agreement , technical inspections or other functions to this third party. the obligations on public sector bodies , union institutions , agencies or bodies pursuant to article 19 apply. ### paragraph 3 does not preclude a public sector body or a union institution , agency or body to exchange data obtained pursuant to this chapter with another public sector body , union institution , agency or body , in view of completing the tasks in article 15 or to make the data available to a third party in cases where it has outsourced , by means of a publicly available agreement , technical inspections or other functions to this third party. the obligations on public sector bodies , union institutions , agencies or bodies pursuant to article 19 also apply to such third parties.


### paragraph 3 does not preclude a public sector body or a union institution , agency or body to exchange data obtained pursuant to this chapter with another public sector body , union institution , agency or body , in view of completing the tasks in article 15 or to make the data available to a third party in cases where it has outsourced , by means of a publicly available agreement , technical inspections or other functions to this third party. the obligations on public sector bodies , union institutions , agencies or bodies pursuant to article 19 apply. ### a public sector body or a union institution , agency or body shall not be able to exchange data obtained pursuant to this chapter with another public sector body , union institution , agency or body from the union , in view of completing the tasks in article 15 or to make the data available to a third party in cases where it has outsourced , by means of a publicly available agreement , technical inspections or other functions to this third party , unless the public sector bodies , union institutions , agencies or bodies or third parties have been included in the request in accordance with paragraph 1(cb). where the public sector body or a union institution , agency or body intends to transmit or make data available under this paragraph to a third party that was not included in the request , prior consent of the data holder shall be requested. the receiving public sector bodies , union institutions , agencies or bodies and third parties shall fulfill the obligations laid down in article 19.


### article 18 ### deleted


### 2. without prejudice to specific needs regarding the availability of data defined in sectoral legislation , the data holder may decline or seek the modification of the request within 5 working days following the receipt of a request for the data necessary to respond to a public emergency and within 15 working days in other cases of exceptional need , on either of the following grounds: ### 2. without prejudice to specific needs regarding the availability of data defined in sectoral legislation , the data holder may decline or seek the modification of the request , without undue delay , but no longer than 5 working days following the receipt of a request for the data necessary to respond to a public emergency , on either of the following grounds:


### 5. where compliance with the request to make data available to a public sector body or a union institution , agency or body requires the disclosure of personal data , the data holder shall take reasonable efforts to pseudonymise the data , insofar as the request can be fulfilled with pseudonymised data. ### 5. where compliance with the request to make data available to a public sector body or a union institution , agency or body requires the disclosure of personal data , the applicable rules on personal data protection shall be fully complied with. the data holder shall take reasonable efforts to pseudonymise the personal data made available , insofar as the request can be fulfilled with pseudonymised data.


### 5. where compliance with the request to make data available to a public sector body or a union institution , agency or body requires the disclosure of personal data , the data holder shall take reasonable efforts to pseudonymise the data , insofar as the request can be fulfilled with pseudonymised data. ### 5. where compliance with the request to make data available to a public sector body or a union institution , agency or body requires the disclosure of personal data , the data holder shall take all necessary measures to irreversibly anonymise the data.


### article 19 ### deleted


### implement , insofar as the processing of personal data is necessary , technical and organisational measures that safeguard the rights and freedoms of data subjects; ### implement , insofar as the processing of personal data is necessary , technical , cybersecurity , and organisational measures that safeguard the rights and freedoms of data subjects;


### destroy the data as soon as they are no longer necessary for the stated purpose and inform the data holder that the data have been destroyed. ### destroy , without undue delay , the data that are no longer necessary for the stated purpose;


### 2. disclosure of trade secrets or alleged trade secrets to a public sector body or to a union institution , agency or body shall only be required to the extent that it is strictly necessary to achieve the purpose of the request. in such a case , the public sector body or the union institution , agency or body shall take appropriate measures to preserve the confidentiality of those trade secrets. ### 2. disclosure of trade secrets or alleged trade secrets to a public sector body or to a union institution , agency or body shall only be required to the extent that it is strictly necessary to achieve the purpose of the request. in such a case , the public sector body or the union institution , agency or body shall take appropriate technical , cybersecurity , and organizational measures to preserve the confidentiality of those trade secrets and to ensure the security of the data and the prevention of its unauthorised disclosure.


### 2. disclosure of trade secrets or alleged trade secrets to a public sector body or to a union institution , agency or body shall only be required to the extent that it is strictly necessary to achieve the purpose of the request. in such a case , the public sector body or the union institution , agency or body shall take appropriate measures to preserve the confidentiality of those trade secrets. ### 2. disclosure of trade secrets or alleged trade secrets to a public sector body or to a union institution , agency or body shall only be required to the extent that it is strictly necessary to achieve the purpose of the request. in such a case , the public sector body or the union institution , agency or body shall take the legal , technical and organisational measures needed to preserve the confidentiality of those trade secrets.


### article 20 ### deleted


### 1. data made available to respond to a public emergency pursuant to article 15 , point (a) , shall be provided free of charge. ### 1. data made available to respond to a public emergency pursuant to article 15 , shall be provided free of charge.


### 2. where the data holder claims compensation for making data available in compliance with a request made pursuant to article 15 , points (b) or (c) , such compensation shall not exceed the technical and organisational costs incurred to comply with the request including , where necessary , the costs of anonymisation and of technical adaptation , plus a reasonable margin. upon request of the public sector body or the union institution , agency or body requesting the data , the data holder shall provide information on the basis for the calculation of the costs and the reasonable margin. ### 2. where the data holder claims compensation for making data available in compliance with a request made pursuant to article 15 , such compensation shall not exceed the technical and organisational costs incurred to comply with the request including , where necessary , the costs of anonymisation and of technical adaptation , plus a reasonable margin. upon request of the public sector body or the union institution , agency or body requesting the data , the data holder shall provide information on the basis for the calculation of the costs and the reasonable margin.


### 2. where the data holder claims compensation for making data available in compliance with a request made pursuant to article 15 , points (b) or (c) , such compensation shall not exceed the technical and organisational costs incurred to comply with the request including , where necessary , the costs of anonymisation and of technical adaptation , plus a reasonable margin. upon request of the public sector body or the union institution , agency or body requesting the data , the data holder shall provide information on the basis for the calculation of the costs and the reasonable margin. ### 2. the data holder shall be entitled to reasonable compensation for making data available in compliance with a request made pursuant to article 15 , point (b). such compensation shall not exceed the technical and organisational costs incurred to comply with the request including , where necessary , the costs of anonymisation and of technical adaptation , plus a fair and reasonable margin. upon request of the public sector body or the union institution , agency or body requesting the data , the data holder shall provide information on the basis for the calculation of the costs and the reasonable margin.


### article 21 ### deleted


### 1. a public sector body or a union institution , agency or body shall be entitled to share data received under this chapter with individuals or organisations in view of carrying out scientific research or analytics compatible with the purpose for which the data was requested , or to national statistical institutes and eurostat for the compilation of official statistics. ### 1. a public sector body or a union institution , agency or body shall be entitled to share data received under this chapter with individuals or organisations or national statistical institutes and eurostat in view of carrying out scientific research or analytics for the purpose for which the data was requested.


### 4. where a public sector body or a union institution , agency or body transmits or makes data available under paragraph 1 , it shall notify the data holder from whom the data was received. ### 4. where a public sector body or a union institution , agency or body transmits or makes data available under paragraph 1 , it shall notify the data holder from whom the data was received , providing all necessary information regarding the identity of the data recipient and the activities to be carried out by the data recipient , and shall ensure all organizational ,technical , and cybersecurity measures to preserve the integrity of the data and to prevent its unauthorised disclosure.