### (24) this regulation imposes the obligation on data holders to make data available in certain circumstances. insofar as personal data are processed , the data holder should be a controller under regulation (eu) 2016/679. where users are data subjects , data holders should be obliged to provide them access to their data and to make the data available to third parties of the user’s choice in accordance with this regulation. however , this regulation does not create a legal basis under regulation (eu) 2016/679 for the data holder to provide access to personal data or make it available to a third party when requested by a user that is not a data subject and should not be understood as conferring any new right on the data holder to use data generated by the use of a product or related service. this applies in particular where the manufacturer is the data holder. in that case , the basis for the manufacturer to use non-personal data should be a contractual agreement between the manufacturer and the user. this agreement may be part of the sale , rent or lease agreement relating to the product. any contractual term in the agreement stipulating that the data holder may use the data generated by the user of a product or related service should be transparent to the user , including as regards the purpose for which the data holder intends to use the data. this regulation should not prevent contractual conditions , whose effect is to exclude or limit the use of the data , or certain categories thereof , by the data holder. this regulation should also not prevent sector-specific regulatory requirements under union law , or national law compatible with union law , which would exclude or limit the use of certain such data by the data holder on well-defined public policy grounds. ### (24) this regulation imposes the obligation on data holders to make data available in certain circumstances. insofar as personal data are processed , the data holder should be a controller under regulation (eu) 2016/679. where users are data subjects , data holders should be obliged to provide them access to their data and to make the data available to third parties of the user’s choice in accordance with this regulation. however , this regulation does not create a legal basis under regulation (eu) 2016/679 for the data holder to provide access to personal data or make it available to a third party when requested by a user that is not a data subject and should not be understood as conferring any new right on the data holder to use data generated by the use of a product or related service. this applies in particular where the manufacturer is the data holder. the performance of a contract can only be a legal ground for processing of personal data if the data subject is a party or if steps are being taken at the request of the data subject prior to entering into a contract. the necessity requirement for processing personal data for the performance of a contract pursuant to article 6(1)(b) of regulation (eu) 2016/679 cannot be fulfilled by merely providing for processing in a contractual clause. assessing what is objectively necessary must be fact-based , and this legal ground shall be allowed only in situations where it is not possible to perform service or provide product which the data subject has actively requested or signed up for without processing of specific data. personal data necessary for the controller’s wider business mode but not necessary for the individual services requested by the data subject , do not fulfil this requirement. in that case , the basis for the manufacturer to use non-personal data should be a contractual agreement between the manufacturer and the user. this agreement may be part of the sale , rent or lease agreement relating to the product. any contractual term in the agreement stipulating that the data holder may use the data generated by the user of a product or related service should be transparent to the user , including as regards the purpose for which the data holder intends to use the data. this regulation should not prevent contractual conditions , whose effect is to exclude or limit the use of the data , or certain categories thereof , by the data holder. this regulation should also not prevent sector-specific regulatory requirements under union law , or national law compatible with union law , which would exclude or limit the use of certain such data by the data holder on well-defined public policy grounds.


### (24) this regulation imposes the obligation on data holders to make data available in certain circumstances. insofar as personal data are processed , the data holder should be a controller under regulation (eu) 2016/679. where users are data subjects , data holders should be obliged to provide them access to their data and to make the data available to third parties of the user’s choice in accordance with this regulation. however , this regulation does not create a legal basis under regulation (eu) 2016/679 for the data holder to provide access to personal data or make it available to a third party when requested by a user that is not a data subject and should not be understood as conferring any new right on the data holder to use data generated by the use of a product or related service. this applies in particular where the manufacturer is the data holder. in that case , the basis for the manufacturer to use non-personal data should be a contractual agreement between the manufacturer and the user. this agreement may be part of the sale , rent or lease agreement relating to the product. any contractual term in the agreement stipulating that the data holder may use the data generated by the user of a product or related service should be transparent to the user , including as regards the purpose for which the data holder intends to use the data. this regulation should not prevent contractual conditions , whose effect is to exclude or limit the use of the data , or certain categories thereof , by the data holder. this regulation should also not prevent sector-specific regulatory requirements under union law , or national law compatible with union law , which would exclude or limit the use of certain such data by the data holder on well-defined public policy grounds. ### (24) this regulation imposes the obligation on data holders to make data available in certain circumstances. insofar as personal data are processed , the data holder should be a controller under regulation (eu) 2016/679. where users are data subjects , data holders should be obliged to provide them access to their data and to make the data available to third parties of the user’s choice in accordance with this regulation. however , this regulation does not create a legal basis under regulation (eu) 2016/679 for the data holder to provide access to personal data or make it available to a third party when requested by a user that is not a data subject and should not be understood as conferring any new right on the data holder to use data generated by the use of a product or related service. this applies in particular where the manufacturer is the data holder. in that case , the basis for the manufacturer to use non-personal data should be a contractual agreement between the manufacturer and the user. this agreement may be part of the sale , rent or lease agreement relating to the product. any contractual term in the agreement stipulating that the data holder may use the data generated by the user of a product or related service should be fair and transparent to the user , including as regards the purpose for which the data holder intends to use the data. this regulation should not prevent contractual conditions , whose effect is to exclude or limit the use of the data , or certain categories thereof , by the data holder. this regulation should also not prevent sector-specific regulatory requirements under union law , or national law compatible with union law , which would exclude or limit the use of certain such data by the data holder on well-defined public policy grounds.


### (25) in sectors characterised by the concentration of a small number of manufacturers supplying end users , there are only limited options available to users with regard to sharing data with those manufacturers. in such circumstances , contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers , making it difficult for users to obtain value from the data generated by the equipment they purchase or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation may be brought forward to address sector-specific needs and objectives. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , preferably with granular permission options (such as “allow once” or “allow while using this app or service”) , including the option to withdraw permission. ### (25) in sectors characterised by the concentration of a small number of manufacturers supplying end users , there are only limited options available to users with regard to sharing data with those manufacturers. in such circumstances , contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers or other data holders , making it difficult for users to obtain value from the data generated by the equipment they purchase , rent or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation may be brought forward to address sector-specific needs and objectives. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , with granular permission options (such as “allow once” or “allow while using this app or service”) , including the prominent option to withdraw permission.


### (25) in sectors characterised by the concentration of a small number of manufacturers supplying end users , there are only limited options available to users with regard to sharing data with those manufacturers. in such circumstances , contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers , making it difficult for users to obtain value from the data generated by the equipment they purchase or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation may be brought forward to address sector-specific needs and objectives. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , preferably with granular permission options (such as “allow once” or “allow while using this app or service”) , including the option to withdraw permission. ### (25) in sectors characterised by the concentration of a small number of manufacturers supplying end users , there are only limited options available to users with regard to sharing data with those manufacturers. in such circumstances , contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers , making it difficult for users to obtain value from the data generated by the equipment they purchase or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation may be brought forward to address sector-specific needs and objectives and develop new applications and services. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , preferably with granular permission options (such as “allow once” or “allow while using this app or service”) , including the option to withdraw permission.


### (25) in sectors characterised by the concentration of a small number of manufacturers supplying end users , there are only limited options available to users with regard to sharing data with those manufacturers. in such circumstances , contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers , making it difficult for users to obtain value from the data generated by the equipment they purchase or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation may be brought forward to address sector-specific needs and objectives. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , preferably with granular permission options (such as “allow once” or “allow while using this app or service”) , including the option to withdraw permission. ### (25) contractual agreements may be insufficient to achieve the objective of user empowerment. the data tends to remain under the control of the manufacturers or other data holders , making it difficult for users to obtain value from the data generated by the equipment they purchase or lease. consequently , there is limited potential for innovative smaller businesses to offer data-based solutions in a competitive manner and for a diverse data economy in europe. this regulation should therefore build on recent developments in specific sectors , such as the code of conduct on agricultural data sharing by contractual agreement. sectoral legislation may be brought forward to address sector-specific needs and objectives. furthermore , the data holder should not use any data generated by the use of the product or related service in order to derive insights about the economic situation of the user or its assets or production methods or the use in any other way that could undermine the commercial position of the user on the markets it is active on. this would , for instance , involve using knowledge about the overall performance of a business or a farm in contractual negotiations with the user on potential acquisition of the user’s products or agricultural produce to the user’s detriment , or for instance , using such information to feed in larger databases on certain markets in the aggregate ( ,e.g. databases on crop yields for the upcoming harvesting season) as such use could affect the user negatively in an indirect manner. the user should be given the necessary technical interface to manage permissions , preferably with granular permission options (such as “allow once” or “allow while using this app or service”) , including the option to withdraw permission.


### (26) in contracts between a data holder and a consumer as a user of a product or related service generating data , directive 93/13/eec applies to the terms of the contract to ensure that a consumer is not subject to unfair contractual terms. for unfair contractual terms unilaterally imposed on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec63 , this regulation provides that such unfair terms should not be binding on that enterprise. ### (26) in contracts between a data holder and a consumer as a user of a product or related service generating data , eu consumer law applies , directive 2005/29/ec , which applies against unfair commercial practices , and directive 93/13/eec which applies to the terms of the contract to ensure that a consumer is not subject to unfair contractual terms. for unfair contractual terms unilaterally imposed on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec63 , this regulation provides that such unfair terms should not be binding on that enterprise.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services tailored to the development of society and user needs , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the request should also be valid regardless of whether the request is put forward by the user or an authorised third party acting on users behalf , such as authorised data intermediation service in the meaning of the regulation (eu) 2022/868. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product.


### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product. ### (28) the user should be free to use the data for any lawful purpose. this includes providing the data the user has received exercising the right under this regulation to a third party offering an aftermarket service that may be in competition with a service provided by the data holder , or to instruct the data holder to do so. the data holder should ensure that the data made available to the third party is as accurate , complete , reliable , relevant and up-to-date as the data the data holder itself may be able or entitled to access from the use of the product or related service. any trade secrets or intellectual property rights should be respected in handling the data. it is important to preserve the confidentiality of trade secrets through contractual instruments , such as non-disclosure agreements , as well as the incentives to invest in products with functionalities based on the use of data from sensors built into that product. the aim of this regulation should accordingly be understood as to foster the development of new , innovative products or related services , stimulate innovation on aftermarkets , but also stimulate the development of entirely novel services making use of the data , including based on data from a variety of products or related services. at the same time , it aims to avoid undermining the investment incentives for the type of product from which the data are obtained , for instance , by the use of data to develop a competing product.


### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , for any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party. ### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , which cannot exceed any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party.


### (31) data generated by the use of a product or related service should only be made available to a third party at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , for any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party. ### (31) data generated by the use of a product or related service should only be made available to a third party such as authorised data intermediation service in the meaning of the regulation (eu) 2022/868 at the request of the user. this regulation accordingly complements the right provided under article 20 of regulation (eu) 2016/679. that article provides for a right of data subjects to receive personal data concerning them in a structured , commonly used and machine-readable format , and to port those data to other controllers , where those data are processed on the basis of article 6(1) , point (a) , or article 9(2) , point (a) , or of a contract pursuant to article 6(1) , point (b). data subjects also have the right to have the personal data transmitted directly from one controller to another , but only where technically feasible. article 20 specifies that it pertains to data provided by the data subject but does not specify whether this necessitates active behaviour on the side of the data subject or whether it also applies to situations where a product or related service by its design observes the behaviour of a data subject or other information in relation to a data subject in a passive manner. the right under this regulation complements the right to receive and port personal data under article 20 of regulation (eu) 2016/679 in several ways. it grants users the right to access and make available to a third party to any data generated by the use of a product or related service , irrespective of its nature as personal data , of the distinction between actively provided or passively observed data , and irrespective of the legal basis of processing. unlike the technical obligations provided for in article 20 of regulation (eu) 2016/679 , this regulation mandates and ensures the technical feasibility of third party access for all types of data coming within its scope , whether personal or non-personal. this regulation also allows direct data sharing from users to third parties. this regulation precludes the data holder or the third party from directly or indirectly charging consumers or data subjects a fee , compensation or costs for sharing data or for accessing it. this regulation does not directly or indirectly incentivise the commercialisation or trade of personal data it also allows the data holder to set reasonable compensation to be met by third parties , but not by the user , for any cost incurred in providing direct access to the data generated by the user’s product. if a data holder and third party are unable to agree terms for such direct access , the data subject should be in no way prevented from exercising the rights contained in regulation (eu) 2016/679 , including the right to data portability , by seeking remedies in accordance with that regulation. it is to be understood in this context that , in accordance with regulation (eu) 2016/679 , a contractual agreement does not allow for the processing of special categories of personal data by the data holder or the third party.


### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon request of the user should only process the data for the purposes agreed with the user and share it with another third party only if this is necessary to provide the service requested by the user. ### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon request of the user should only process the data for the purposes agreed with the user and share it with another third party only if , as clearly unequivocally informed to the user in timely manner , this is necessary to provide the service requested by the user.


### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon request of the user should only process the data for the purposes agreed with the user and share it with another third party only if this is necessary to provide the service requested by the user. ### (33) in order to prevent the exploitation of users , third parties to whom data has been made available upon request of the user should only process the data for the purposes agreed with the user and share it with another third party only if this is necessary to provide the service requested by the user , subject to the protection of that data .


### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the third party should not coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user. in this context , third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. common and legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec. ### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. data holder or the third party should not make the exercise of the rights or choices of users unduly difficult including by offering choices to users in a non-neutral manner , or coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or free choices of the user , including by means of a digital interface or a part thereof , including its structure , design , function or manner of operation. in this context , the data holders and third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and free choice. common and legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. data holders and third parties should comply with their obligations under relevant union law , including the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec.


### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the third party should not coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user. in this context , third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. common and legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec. ### (34) in line with the data minimisation principle , the third party should only access additional information that is necessary for the provision of the service requested by the user. having received access to data , the third party should process it exclusively for the purposes agreed with the user , without interference from the data holder. it should be as easy for the user to refuse or discontinue access by the third party to the data as it is for the user to authorise access. the data holder or the third party should not make the exercise of rights or choices of users unduly difficult , including by offering choices to users in a non-neutral manner , or coerce , deceive or manipulate the user in any way , or subvert or impair the autonomy , decision-making or free choices of the user , including by means of a digital interface or a part thereof , including its structure , design , function or manner of operation. in this context , data holders and third parties should not rely on so-called dark patterns in designing their digital interfaces. dark patterns are design techniques that push or deceive consumers into decisions that have negative consequences for them. these manipulative techniques can be used to persuade users , particularly vulnerable consumers , to engage in unwanted behaviours , and to deceive users by nudging them into decisions on data disclosure transactions or to unreasonably bias the decision-making of the users of the service , in a way that subverts and impairs their autonomy , decision-making and choice. legitimate commercial practices that are in compliance with union law should not in themselves be regarded as constituting dark patterns. third parties should comply with their obligations under relevant union law , in particular the requirements set out in directive 2005/29/ec , directive 2011/83/eu , directive 2000/31/ec and directive 98/6/ec.


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### deleted


### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. ### (37) given the current state of technology , it is overly burdensome to impose further design obligations in relation to products manufactured or designed and related services provided by micro and small enterprises. that is not the case , however , where a micro or small enterprise is sub-contracted to manufacture or design a product. in such situations , the enterprise , which has sub-contracted to the micro or small enterprise , is able to compensate the sub-contractor appropriately. a micro or small enterprise may nevertheless be subject to the requirements laid down by this regulation as data holder , where it is not the manufacturer of the product or a provider of related services. digital training and ad hoc programmes to support micro and small enterprises should be provided by member states.


### (41) in order to compensate for the lack of information on the conditions of different contracts , which makes it difficult for the data recipient to assess if the terms for making the data available are non-discriminatory , it should be on the data holder to demonstrate that a contractual term is not discriminatory. it is not unlawful discrimination , where a data holder uses different contractual terms for making data available or different compensation , if those differences are justified by objective reasons. these obligations are without prejudice to regulation (eu) 2016/679. ### (41) in order to compensate for the lack of information on the conditions of different contracts , which makes it difficult for the data recipient to assess if the terms for making the data available are non-discriminatory , it should be on the data holder to demonstrate that a contractual term is not discriminatory. it is not unlawful discrimination , where a data holder uses different contractual terms for making data available , if those differences are justified by objective reasons. these obligations are without prejudice to regulation (eu) 2016/679.


### (41) in order to compensate for the lack of information on the conditions of different contracts , which makes it difficult for the data recipient to assess if the terms for making the data available are non-discriminatory , it should be on the data holder to demonstrate that a contractual term is not discriminatory. it is not unlawful discrimination , where a data holder uses different contractual terms for making data available or different compensation , if those differences are justified by objective reasons. these obligations are without prejudice to regulation (eu) 2016/679. ### (41) in order to compensate for the lack of information on the conditions of different contracts , which makes it difficult for the data recipient to assess if the terms for making the data available are non-discriminatory , it should be on the data holder to demonstrate that a contractual term is not discriminatory. it is not unlawful discrimination , where a data holder uses different contractual terms for making data available , if those differences are justified by objective reasons. these obligations are without prejudice to regulation (eu) 2016/679


### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available. ### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient , in business-to-business relations. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available.


### (42) in order to incentivise the continued investment in generating valuable data , including investments in relevant technical tools , this regulation contains the principle that the data holder may request reasonable compensation when legally obliged to make data available to the data recipient. these provisions should not be understood as paying for the data itself , but in the case of micro , small or medium-sized enterprises , for the costs incurred and investment required for making the data available. ### (42) this regulation precludes the data holder or the third party from directly or indirectly charging users a fee , or any compensation of costs for sharing or accessing data.


### (43) in justified cases , including the need to safeguard consumer participation and competition or to promote innovation in certain markets , union law or national legislation implementing union law may impose regulated compensation for making available specific data types. ### (43) in duly justified cases , including the need to safeguard consumer participation and competition or to promote innovation in certain markets , union law or national legislation implementing union law may impose regulated compensation for making available specific data types.


### (44) to protect micro , small or medium-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models , the compensation for making data available to be paid by them should not exceed the direct cost of making the data available and be non-discriminatory. ### (44) to protect micro , small or medium-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models , the compensation for making data available to be paid by them should not exceed the direct cost of making the data available and be non-discriminatory. a possible means of supporting these businesses in such situations would be to offer affordable subscriptions.


### (44) to protect micro , small or medium-sized enterprises from excessive economic burdens which would make it commercially too difficult for them to develop and run innovative business models , the compensation for making data available to be paid by them should not exceed the direct cost of making the data available and be non-discriminatory. ### (44) to avoid directly or indirectly incentivising the commercialisation or trade of personal data , the compensation for making data available should not exceed the direct cost of making the data available and be non-discriminatory.


### (47) transparency is an important principle to ensure that the compensation requested by the data holder is reasonable , or , in case the data recipient is a micro , small or medium-sized enterprise , that the compensation does not exceed the costs directly related to making the data available to the data recipient and is attributable to the individual request. in order to put the data recipient in the position to assess and verify that the compensation complies with the requirements under this regulation , the data holder should provide to the data recipient the information for the calculation of the compensation with a sufficient degree of detail. ### (47) in order to put the data recipient in the position to assess and verify that the compensation complies with the requirements under this regulation , the data holder should provide to the data recipient the information for the calculation of the compensation with a sufficient degree of detail.


### (48) ensuring access to alternative ways of resolving domestic and cross-border disputes that arise in connection with making data available should benefit data holders and data recipients and therefore strengthen trust in data sharing. in cases where parties cannot agree on fair , reasonable and non-discriminatory terms of making data available , dispute settlement bodies should offer a simple , fast and low-cost solution to the parties. ### (48) ensuring access to alternative ways of resolving domestic and cross-border disputes that arise in connection with making data available should benefit data holders and data recipients and therefore strengthen trust in data sharing. in cases where parties cannot agree on fair , reasonable and non-discriminatory terms of making data available , dispute settlement bodies should offer a simple , fast and low-cost solution to the parties. this process cannot undermine the exercise of the rights of users and in case users are affected by a dispute between data holders and data recipients or third parties , users should be effectively and swiftly compensated.


### (48) ensuring access to alternative ways of resolving domestic and cross-border disputes that arise in connection with making data available should benefit data holders and data recipients and therefore strengthen trust in data sharing. in cases where parties cannot agree on fair , reasonable and non-discriminatory terms of making data available , dispute settlement bodies should offer a simple , fast and low-cost solution to the parties. ### (48) ensuring access to alternative ways of resolving domestic and cross-border disputes that arise in connection with making data available should benefit data holders and data recipients and therefore strengthen trust in data sharing. in cases where parties cannot agree on fair , reasonable and non-discriminatory terms of making data available , dispute settlement bodies should offer a simple , fast and low-cost solution to the parties within a reasonable period.


### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed on micro , small and medium-sized enterprises. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the micro , small or medium-sized enterprise cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the micro , small or medium-sized enterprise or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed. ### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed on micro , small and medium-sized enterprises. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the micro , small or medium-sized enterprise cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the micro , small or medium-sized enterprise or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed. all contractual agreements shall be in line with fair , reasonable and non-discriminatory (frand) principles


### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed on micro , small and medium-sized enterprises. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the micro , small or medium-sized enterprise cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the micro , small or medium-sized enterprise or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed. ### (52) rules on contractual terms should take into account the principle of contractual freedom as an essential concept in business-to-business relationships. therefore , not all contractual terms should be subject to an unfairness test , but only to those terms that are unilaterally imposed on micro , small and medium-sized enterprises. this concerns ‘take-it-or-leave-it’ situations where one party supplies a certain contractual term and the micro , small or medium-sized enterprise cannot influence the content of that term despite an attempt to negotiate it. a contractual term that is simply provided by one party and accepted by the micro , small or medium-sized enterprise or a term that is negotiated and subsequently agreed in an amended way between contracting parties should not be considered as unilaterally imposed. all contractual agreements shall be in line with fair , reasonable and non-discriminatory (frand) principles.


### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. ### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold , especially if such an emergency also has cross-border implications. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request and for a fixed period , so as to identify the best solutions to resolve the emergency in question. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations.


### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency is determined according to the respective procedures in the member states or of relevant international organisations. ### (57) in case of public emergencies , such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters including those aggravated by climate change , as well as human-induced major disasters , such as major cybersecurity incidents , the public interest resulting from the use of the data will outweigh the interests of the data holders to dispose freely of the data they hold. in such a case , data holders should be placed under an obligation to make the data available to public sector bodies or to union institutions , agencies or bodies upon their request. the existence of a public emergency should be determined according to the respective procedures in the member states or of relevant international organisations.


### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to , prevent or recover from public emergencies or to maintain the capacity to fulfil specific tasks explicitly provided by law. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested. ### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge and information to respond to , prevent or recover from public emergencies or to maintain the capacity to fulfil specific tasks explicitly provided by law. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65 should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested , subject to adequate protection of that data.


### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to , prevent or recover from public emergencies or to maintain the capacity to fulfil specific tasks explicitly provided by law. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65 should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested. ### (62) the objective of the obligation to provide the data is to ensure that public sector bodies and union institutions , agencies or bodies have the necessary knowledge to respond to , prevent or recover from public emergencies. the data obtained by those entities may be commercially sensitive. therefore , directive (eu) 2019/1024 of the european parliament and of the council65 should not apply to data made available under this regulation and should not be considered as open data available for reuse by third parties. this however should not affect the applicability of directive (eu) 2019/1024 to the reuse of official statistics for the production of which data obtained pursuant to this regulation was used , provided the reuse does not include the underlying data. in addition , it should not affect the possibility of sharing the data for conducting research or for the compilation of official statistics , provided the conditions laid down in this regulation are met. public sector bodies should also be allowed to exchange data obtained pursuant to this regulation with other public sector bodies to address the exceptional needs for which the data has been requested.


### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment while benefitting from functional equivalence. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. functional equivalence means the maintenance of a minimum level of functionality of a service after switching , and should be deemed technically feasible whenever both the originating and the destination data processing services cover (in part or in whole) the same service type. meta-data , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching. ### (72) this regulation aims to facilitate switching between data processing services , which encompasses all conditions and actions that are necessary for a customer to terminate a contractual agreement of a data processing service , to conclude one or multiple new contracts with different providers of data processing services , to port all its digital assets , including data , to the concerned other providers and to continue to use them in the new environment while benefitting from functional equivalence. digital assets refer to elements in digital format for which the customer has the right of use , including data , applications , virtual machines and other manifestations of virtualisation technologies , such as containers. functional equivalence means the maintenance of a minimum level of functionality of a service after switching , and should be deemed technically feasible whenever both the originating and the destination data processing services cover (in part or in whole) the same service type. services can only be expected to facilitate functional equivalence for the functionalities that both the originating and destination services offer. this regulation doesn't instate an obligation of facilitating functional equivalence for data processing services of the paas and/or saas service delivery model. meta-data , generated by the customer’s use of a service , should also be portable pursuant to this regulation’s provisions on switching.


### (74) data processing service providers should be required to offer all assistance and support that is required to make the switching process successful and effective without requiring those data processing service providers to develop new categories of services within or on the basis of the it-infrastructure of different data processing service providers to guarantee functional equivalence in an environment other than their own systems. nevertheless , service providers are required to offer all assistance and support that is required to make the switching process effective. existing rights relating to the termination of contracts , including those introduced by regulation (eu) 2016/679 and directive (eu) 2019/770 of the european parliament and of the council67should not be affected. ### (74) data processing service providers should be required to offer all assistance and support that is required to make the switching process successful and effective without requiring those data processing service providers to develop new categories of services within or on the basis of the it-infrastructure of different data processing service providers to guarantee functional equivalence in an environment other than their own systems. nevertheless , service providers are required to offer all assistance and support that is required to make the switching process effective at no extra cost to the recipient. existing rights relating to the termination of contracts , including those introduced by regulation (eu) 2016/679 and directive (eu) 2019/770 of the european parliament and of the council67 should not be affected.


### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. the commission should adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could remain to be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , the commission should be enabled to mandate the development of harmonised standards for the interoperability of data processing services. ### (79) standardisation and semantic interoperability should play a key role to provide technical solutions to ensure interoperability. in order to facilitate the conformity with the requirements for interoperability , it is necessary to provide for a presumption of conformity for interoperability solutions that meet harmonised standards or parts thereof in accordance with regulation (eu) no 1025/2012 of the european parliament and of the council. these standards should be developed in open , technology neutral and inclusive way line with chapter ii of the regulation (eu) no 1025/2012. the commission should adopt common specifications in areas where no harmonised standards exist or where they are insufficient in order to further enhance interoperability for the common european data spaces , application programming interfaces , cloud switching as well as smart contracts. additionally , common specifications in the different sectors could remain to be adopted , in accordance with union or national sectoral law , based on the specific needs of those sectors. reusable data structures and models (in form of core vocabularies) , ontologies , metadata application profile , reference data in the form of core vocabulary , taxonomies , code lists , authority tables , thesauri should also be part of the technical specifications for semantic interoperability. furthermore , the commission should be enabled to mandate the development of harmonised standards for the interoperability of data processing services in consultation with the european data innovation board as outlined in the article 30 of the regulation (eu) no 2022/868.


### (81) in order to ensure the efficient implementation of this regulation , member states should designate one or more competent authorities. if a member state designates more than one competent authority , it should also designate a coordinating competent authority. competent authorities should cooperate with each other. the authorities responsible for the supervision of compliance with data protection and competent authorities designated under sectoral legislation should have the responsibility for application of this regulation in their areas of competence. ### (81) in order to ensure the efficient implementation of this regulation , member states should designate one competent authority. competent authorities should cooperate with each other. the authorities responsible for the supervision of compliance with data protection and competent authorities designated under sectoral legislation should have the responsibility for application of this regulation in their areas of competence.


### (82) in order to enforce their rights under this regulation , natural and legal persons should be entitled to seek redress for the infringements of their rights under this regulation by lodging complaints with competent authorities. those authorities should be obliged to cooperate to ensure the complaint is appropriately handled and resolved. in order to make use of the consumer protection cooperation network mechanism and to enable representative actions , this regulation amends the annexes to the regulation (eu) 2017/2394 of the european parliament and of the council68 and directive (eu) 2020/1828 of the european parliament and of the council69 . ### (82) in order to enforce their rights under this regulation , natural and legal persons should be entitled to seek redress for the infringements of their rights under this regulation by lodging complaints with competent authorities. those authorities should be obliged to cooperate to ensure the complaint is appropriately handled and resolved swiftly. in order to make use of the consumer protection cooperation network mechanism and to enable representative actions , this regulation amends the annexes to the regulation (eu) 2017/2394 of the european parliament and of the council68 and directive (eu) 2020/1828 of the european parliament and of the council69 .


### (82) in order to enforce their rights under this regulation , natural and legal persons should be entitled to seek redress for the infringements of their rights under this regulation by lodging complaints with competent authorities. those authorities should be obliged to cooperate to ensure the complaint is appropriately handled and resolved. in order to make use of the consumer protection cooperation network mechanism and to enable representative actions , this regulation amends the annexes to the regulation (eu) 2017/2394 of the european parliament and of the council68 and directive (eu) 2020/1828 of the european parliament and of the council69 . ### (82) in order to enforce their rights under this regulation , natural and legal persons should be entitled to seek redress for the infringements of their rights under this regulation by lodging complaints with competent authorities and before courts. those authorities should be obliged to cooperate to ensure the complaint is appropriately handled and resolved swiftly and effectively. in order to make use of the consumer protection cooperation network mechanism and to enable representative actions , this regulation amends the annexes to the regulation (eu) 2017/2394 of the european parliament and of the council68 and directive (eu) 2020/1828 of the european parliament and of the council69 .


### 1. this regulation lays down harmonised rules on making data generated by the use of a product or related service available to the user of that product or service , on the making data available by data holders to data recipients , and on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need , for the performance of a task carried out in the public interest: ### 1. this regulation lays down harmonised rules on making data generated by the use of a product or related service available to the user of that product or service , on the making data available by data holders to data recipients , and on the making data available by data holders to public sector bodies or union institutions , agencies or bodies , where there is an exceptional need , due to a public emergency:


### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording; ### (1) ‘data’ means any digital representation of acts , facts or information and any compilation of such acts , facts or information , including in the form of sound , visual or audio-visual recording communicated by a product or related service via a publicly available electronic communication service. this includes data that represent the digitalisation of user actions and events such as data generated by the use of a product or related service or recorded intentionally by the user.


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services , or related services , or the data subject


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a related service , and the data subject;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person that owns , rents or leases or a consumer that uses a product or receives a related service;


### (5) ‘user’ means a natural or legal person that owns , rents or leases a product or receives a services; ### (5) ‘user’ means a natural or legal person , including a data subject , that owns , rents or leases a product or receives a related service;


### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 30 calendar days , during which the data processing service provider shall: ### clauses allowing the customer , upon request , to switch to a data processing service offered by another provider of data processing service or to port all data , applications and digital assets generated directly or indirectly by the customer to an on-premise system , in particular the establishment of a mandatory maximum transition period of 60 calendar days , during which the data processing service provider shall:


### (1) assist and , where technically feasible , complete the switching process; ### (1) assist and , where technically feasible , complete the switching process , including reasonably assisting a third-party entity managing the switching process on behalf of the customer;


### (2) ensure full continuity in the provision of the respective functions or services. ### (2) ensure full continuity or sufficient continuity in compliance with the contractual arrangements related to continuity in the provision of the respective functions or services.


### an exhaustive specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service; ### an exhaustive specification of all data and application categories exportable during the switching process , including , where technically feasible , at minimum;


### an exhaustive specification of all data and application categories exportable during the switching process , including , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service; ### an exhaustive specification of all data and application categories exportable during the switching process , including , where technically feasible , at minimum , all data imported by the customer at the inception of the service agreement and all data and metadata created by the customer and by the use of the service during the period the service was provided , including , but not limited to , configuration parameters , security settings , access rights and access logs to the service;


### a minimum period for data retrieval of at least 30 calendar days , starting after the termination of the transition period that was agreed between the customer and the service provider , in accordance with paragraph 1 , point (a) and paragraph 2. ### a minimum period for data retrieval of at least 60 calendar days , starting after the termination of the transition period that was agreed between the customer and the service provider , in accordance with paragraph 1 , point (a) and paragraph 2.


### 2. before concluding a contract for the purchase , rent or lease of a product or a related service , at least the following information shall be provided to the user , in a clear and comprehensible format: ### 2. before concluding a contract for the purchase , rent or lease of a product or a related service , consumers should be presented with granular , meaningful consent options for data processing , within the meaning of article4 (11) of regulation (eu) 2016/679 , differentiating between data that is essential for the functioning of the product and a related and other types of data. in addition , at least the following information shall be provided to the user , in a timely , prominent and comprehensible and easily accessible format:


### 2. before concluding a contract for the purchase , rent or lease of a product or a related service , at least the following information shall be provided to the user , in a clear and comprehensible format: ### 2. before concluding a contract for the purchase , rent or lease of a product or a related service , users should be presented with granular , meaningful consent options for data processing , within the meaning of article 4(11) of regulation (eu) 2016/679 , differentiating between data that is essential for the functioning of the product and a related service and other types of data. in addition , at least the following information shall be provided to the user , in a timely and prominent manner , in an easily accessible , clear and comprehensible format:


### how the user may access those data; ### how the user may access those data and a copy of those data , free of charge;


### how the user may access those data; ### how the user may access and request a copy of those data;


### how the user may access those data; ### how the user may access those data delivered in a usable format and in a simple , clear and free manner for the user ; ;


### whether the seller , renter or lessor is the data holder and , if not , the identity of the data holder , such as its trading name and the geographical address at which it is established; ### whether the seller , renter or lessor is the data holder and , if not , the identity of the data holder , such as its trading name , contact details and the geographical address at which it is established;


### the means of communication which enable the user to contact the data holder quickly and communicate with that data holder efficiently; ### the means of communication which enable the user to contact the data holder quickly and communicate with that data holder efficiently in a durable method;


### how the user may request that the data are shared with a third-party; ### how the user may request that the data are shared with a third-party , free of charge;


### how the user may request that the data are shared with a third-party; ### how the user may request that the data are shared with a third-party , the period during which the third party has access to this data and the necessary safeguards after the data access has ended;


### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , free of charge and , where applicable , continuously and in real-time. this shall be done on the basis of a simple request through electronic means where technically feasible. ### 1. where data cannot be directly accessed by the user from the product or related service , the data holder shall make available to the user the data generated by the use of a product or related service , that are accessible to the data holder , as well as the relevant metadata , without undue delay , free of charge , easily , securely , in a structured , commonly used and machine-readable format , and , where applicable , continuously and in real-time. this shall be done on the basis of a simple request through electronic means where technically feasible. the manufacturer , where technically supported , shall provide on-device access in a non-discriminatory manner. where on-device and off-device access are available , the user or third party shall choose their preferred method.


### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , free of charge and , where applicable , continuously and in real-time. this shall be done on the basis of a simple request through electronic means where technically feasible. ### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , free of charge and , where applicable , continuously and in real-time in a structured , commonly used and machine-readable format. this shall be done on the basis of a simple request through electronic means where technically feasible.


### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by its use of a product or related service without undue delay , free of charge and , where applicable , continuously and in real-time. this shall be done on the basis of a simple request through electronic means where technically feasible. ### 1. where data cannot be directly accessed by the user from the product , the data holder shall make available to the user the data generated by the use of a product or related service without undue delay easily , in a structured , commonly used and machine-readable format , free of charge and , where applicable , continuously and in real-time accompanied with relevant metadata. data shall be provided in the form in which they have been generated by the product including data generated by the use of a product , with only the minimal adaptations necessary to make them useable by a third party , including related metadata and support tools necessary to interpret and use the data in order to achieve the intended purpose- this shall be done on the basis of a simple request through electronic means where this shall be done on the basis of a simple request through electronic means where technically feasible.


### 4. the user shall not use the data obtained pursuant to a request referred to in paragraph 1 to develop a product that competes with the product from which the data originate. ### 4. the user shall not use the data obtained pursuant to a request referred to in paragraph 1 to develop a product that competes with the product or related service from which the data originate.


### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time. ### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service that are accessible to the data holder , as well as the relevant metadata , to a third party , without undue delay , free of charge to the user , in an interoperable , structured , commonly used and machine-readable format , of the same quality as is available to the data holder and , where applicable , continuously and in real-time and done on the basis of secure access mechanisms. such data shall be digitally processable and interpretable and shall at least provide basic context , metadata and time stamp.


### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time. ### 1. upon explicit request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time and only for the purposes of:


### 1. upon request by a user , or by a party acting on behalf of a user , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , free of charge to the user , of the same quality as is available to the data holder and , where applicable , continuously and in real-time. ### 1. upon request by a user by a party acting on behalf of a user such as authorised data intermediation service in the meaning of the regulation (eu) 2022/868 , the data holder shall make available the data generated by the use of a product or related service to a third party , without undue delay , of the same quality as is available to the data holder , free of charge to the user via a well-formed application programming interface and , where applicable , continuously and in real-time.


### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose. ### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes , mentioned in paragraph 2a and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall immediately delete the data when they are no longer necessary for the agreed purpose.