### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose. ### 1. a third party shall process personal data made available to it pursuant to article 5 only for the specific purposes mentioned in article 5 , paragraph 1 and under the conditions agreed with the user , and where all conditions and rules provided by data protection legislation are complied with , notably where there is a valid legal basis under article 6 of regulation (eu) 2016/679 and where relevant , the conditions of article 9 of regulation (eu) 2016/679 and article 5(3) of directive 2002/58/ec are fulfilled and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the explicitly requested purpose in line with paragraph 1 of article 5.


### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose. ### 1. a third party shall process the data made available to it pursuant to article 5 only for the purposes and under the conditions agreed with the user , including the period of access , and subject to the rights of the data subject insofar as personal data are concerned , and shall delete the data when they are no longer necessary for the agreed purpose.


### coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user; ### make the exercise of the rights or choices of users unduly difficult including by offering choices to the users in a non-neutral manner , or coerce , deceive or manipulate the user in any way , or subvert or impair the autonomy , decision-making or choices of the user , including by means of a digital interface with the user or a part thereof , including its structure , design , function or manner of operation;


### coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user; ### make the exercise of the rights or choices of users unduly difficult including by offering choices to the users in a non-neutral manner , or coerce , deceive or manipulate the user in any way , or subvert or impair the autonomy , decision-making or choices of the user , including by means of a digital interface or a part thereof , including its structure , design , function or manner of operation;


### coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user; ### make the exercise of the rights or choices of users unduly difficult including by offering choices to the end-users in a non-neutral manner , or coerce , deceive or manipulate the user in any way , by subverting or impairing the autonomy , decision-making or choices of the user , including by means of a digital interface with the user or a part thereof , including its structure , design , function or manner of operation;


### make the data available it receives to another third party , in raw , aggregated or derived form , unless this is necessary to provide the service requested by the user; ### make the data it receives available to another third party , in raw , aggregated or derived form , unless this is necessary to provide the service requested by the user and after the user has explicitly been made aware of this in a clear , easily accessible and prominent way;


### make the data available it receives to another third party , in raw , aggregated or derived form , unless this is necessary to provide the service requested by the user; ### make the data available it receives to another third party , in raw , aggregated or derived form , unless this is necessary to provide the service requested by the user , and the user has explicitly been made aware of this in a clear , easily accessible and prominent way and , in the case of personal data , the rights and obligations of regulation (eu) 2016/679 are respected;


### 1. the obligations of this chapter shall not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise. ### deleted


### 1. the obligations of this chapter shall not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise. ### 1. the obligations of this chapter related to business to business data sharing shall not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise.


### 1. the obligations of this chapter shall not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise. ### 1. the obligations of this chapter related to business-to-business data sharing shall not apply to data generated by the use of products manufactured or related services provided by enterprises that qualify as micro or small enterprises , as defined in article 2 of the annex to recommendation 2003/361/ec , provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro or small enterprise.


### 3. a data holder shall not discriminate between comparable categories of data recipients , including partner enterprises or linked enterprises , as defined in article 3 of the annex to recommendation 2003/361/ec , of the data holder , when making data available. where a data recipient considers the conditions under which data has been made available to it to be discriminatory , it shall be for the data holder to demonstrate that there has been no discrimination. ### 3. a data holder shall not discriminate between comparable categories of data recipients , that are comparable in terms of activity , size , type of business relationship , including partner enterprises or linked enterprises , as defined in article 3 of the annex to recommendation 2003/361/ec , of the data holder , when making data available. where a data recipient considers the conditions under which data has been made available to it to be discriminatory , it shall be for the data holder to demonstrate that there has been no discrimination.


### 1. any compensation agreed between a data holder and a data recipient for making data available shall be reasonable. ### 1. any compensation agreed between a data holder and a data recipient for making data available in business-to-business relations shall be reasonable. this regulation precludes the data holder or the third party from directly or indirectly charging consumers or data subjects a fee , compensation or costs for sharing data or for accessing it.


### 1. any compensation agreed between a data holder and a data recipient for making data available shall be reasonable. ### 1. any compensation agreed between a data holder and a data recipient for making data available shall be reasonable and shall not exceed the costs directly related to making the data available. the data holder or the third party may not directly or indirectly charge users a fee or any compensation of costs for sharing or accessing data.


### 1. any compensation agreed between a data holder and a data recipient for making data available shall be reasonable. ### 1. any compensation agreed between a data holder and a data recipient for making data available shall be reasonable and shall not exceed the costs directly related to making the data available.


### 2. where the data recipient is a micro , small or medium enterprise , as defined in article 2 of the annex to recommendation 2003/361/ec , any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly. ### 2. any reasonable compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly. these costs include the costs necessary for data reproduction , dissemination via electronic means and storage , but not of data collection or production.


### 2. where the data recipient is a micro , small or medium enterprise , as defined in article 2 of the annex to recommendation 2003/361/ec , any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly. ### deleted


### 2. where the data recipient is a micro , small or medium enterprise , as defined in article 2 of the annex to recommendation 2003/361/ec , any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly. ### 2. any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. article 8(3) shall apply accordingly.


### 4. the data holder shall provide the data recipient with information setting out the basis for the calculation of the compensation in sufficient detail so that the data recipient can verify that the requirements of paragraph 1 and , where applicable , paragraph 2 are met. ### 4. the data holder shall provide the data recipient with information setting out the basis for the calculation of the compensation in sufficient detail so that the data recipient can verify that the requirements of paragraph 1 are met.


### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9. ### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 , 9 and 13.


### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9. ### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9. this is without prejudice to the data subjects’ rights to seek redress before a supervisory authority , and to the controller’s data protection obligations.


### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9. ### 1. data holders and data recipients shall have access to cross-border and other dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9.


### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9. ### 1. data holders and data recipients shall have access to dispute settlement bodies , certified in accordance with paragraph 2 of this article , to settle disputes in relation to the determination of fair , reasonable and non-discriminatory terms for and the transparent manner of making data available in accordance with articles 8 and 9 and 13.


### 1. the data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to effectively provide data to third parties pursuant to article 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1). ### 1. the data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to effectively obtain a copy or provide data to third parties pursuant to article 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1).


### 1. the data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to effectively provide data to third parties pursuant to article 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1). ### 1. the data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to access data , obtain a copy or effectively provide data to third parties pursuant to article 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1). where personal data is concerned , these technical measures shall be consistent with the obligation of the data controller to implement appropriate technical and organisational measures so as to ensure a level of security appropriate to the risk of the personal data processing pursuant to data protection legislation.


### 1. the data holder may apply appropriate technical protection measures , including smart contracts , to prevent unauthorised access to the data and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to effectively provide data to third parties pursuant to article 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1). ### 1. the data holder shall apply appropriate technical and organisational protection measures , including smart contracts and encryption , to prevent unauthorised access to the data , including metadata , and to ensure compliance with articles 5 , 6 , 9 and 10 , as well as with the agreed contractual terms for making data available. such technical protection measures shall not be used as a means to hinder the user’s right to effectively provide data to third parties pursuant to article 5 or any right of a third party under union law or national legislation implementing union law as referred to in article 8(1).


### 2. a data recipient that has , for the purposes of obtaining data , provided inaccurate or false information to the data holder , deployed deceptive or coercive means or abused evident gaps in the technical infrastructure of the data holder designed to protect the data , has used the data made available for unauthorised purposes or has disclosed those data to another party without the data holder’s authorisation , shall without undue delay , unless the data holder or the user instruct otherwise: ### 2. a data recipient that has , for the purposes of obtaining data , provided inaccurate or false information to the data holder , deployed deceptive or coercive means or abused evident gaps in the technical infrastructure of the data holder designed to protect the data , has used the data made available for unauthorised purposes or has disclosed those data to another party without the data holder’s authorisation or in the case of personal data , an appropriate legal basis , shall without undue delay , unless the data holder or the user instruct otherwise:


### 1. a contractual term , concerning the access to and use of data or the liability and remedies for the breach or the termination of data related obligations which has been unilaterally imposed by an enterprise on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec shall not be binding on the latter enterprise if it is unfair. ### 1. a contractual term , concerning the access to and use of data or the liability and remedies for the breach or the termination of data related obligations which has been unilaterally imposed by an enterprise on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec provided those enterprises do not have partner enterprises or linked enterprises as defined in article 3 of the annex to recommendation 2003/361/ec which do not qualify as a micro , small or medium enterprise;


### 1. a contractual term , concerning the access to and use of data or the liability and remedies for the breach or the termination of data related obligations which has been unilaterally imposed by an enterprise on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec shall not be binding on the latter enterprise if it is unfair. ### 1. a contractual term , concerning the access to and use of data or the liability and remedies for the breach or the termination of data related obligations which has been unilaterally imposed by an enterprise on a micro , small or medium-sized enterprise as defined in article 2 of the annex to recommendation 2003/361/ec or which has been unilaterally imposed by an enterprise which is the sole source of crucial data they hold in some ecosystem shall not be binding on the recipient enterprise if it is unfair.


### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , which has purchased , rented or leased the product. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service. ### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , which has purchased , rented or leased the product. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service , subject to protection of that data.


### (18) the user of a product should be understood as the legal or natural person , such as a business or consumer , which has purchased , rented or leased the product. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service. ### (18) the user of a product should be understood as the legal or natural person , such as a business , consumer or public sector body , which has purchased , rented or leased the product. depending on the legal title under which he uses it , such a user bears the risks and enjoys the benefits of using the connected product and should enjoy also the access to the data it generates. the user should therefore be entitled to derive benefit from data generated by that product and any related service.


### (30) the use of a product or related service may , in particular when the user is a natural person , generate data that relates to an identified or identifiable natural person (the data subject). processing of such data is subject to the rules established under regulation (eu) 2016/679 , including where personal and non-personal data in a data set are inextricably linked64 . the data subject may be the user or another natural person. personal data may only be requested by a controller or a data subject. a user who is the data subject is under certain circumstances entitled under regulation (eu) 2016/679 to access personal data concerning them , and such rights are unaffected by this regulation. under this regulation , the user who is a natural person is further entitled to access all data generated by the product , personal and non-personal. where the user is not the data subject but an enterprise , including a sole trader , and not in cases of shared household use of the product , the user will be a controller within the meaning of regulation (eu) 2016/679. accordingly , such a user as controller intending to request personal data generated by the use of a product or related service is required to have a legal basis for processing the data under article 6(1) of regulation (eu) 2016/679 , such as the consent of the data subject or legitimate interest. this user should ensure that the data subject is appropriately informed of the specified , explicit and legitimate purposes for processing those data , and how the data subject may effectively exercise their rights. where the data holder and the user are joint controllers within the meaning of article 26 of regulation (eu) 2016/679 , they are required to determine , in a transparent manner by means of an arrangement between them , their respective responsibilities for compliance with that regulation. it should be understood that such a user , once data has been made available , may in turn become a data holder , if they meet the criteria under this regulation and thus become subject to the obligations to make data available under this regulation. ### (30) the use of a product or related service may , in particular when the user is a natural person , generate data that relates to an identified or identifiable natural person (the data subject). processing of such data is subject to the rules established under regulation (eu) 2016/679 , including where personal and non-personal data in a data set are inextricably linked64 . the data subject may be the user or another natural person. personal data may only be requested by a controller or a data subject. a user who is the data subject is under certain circumstances entitled under regulation (eu) 2016/679 to access personal data concerning them , and such rights are unaffected by this regulation. under this regulation , the user who is a natural person is further entitled to access all data generated by the product , personal and non-personal. where the user is not the data subject but an enterprise , including a sole trader , and not in cases of shared household use of the product , the user will be a controller within the meaning of regulation (eu) 2016/679. accordingly , such a user as controller intending to request personal data generated by the use of a product or related service is required to have a legal basis for processing the data under article 6(1) of regulation (eu) 2016/679 , such as the consent of the data subject or legitimate interest. this user should ensure that the data subject is appropriately informed of the specified , explicit and legitimate purposes for processing those data , and how the data subject may effectively exercise their rights. where the data holder and the user are joint controllers within the meaning of article 26 of regulation (eu) 2016/679 , they are required to determine , in a transparent manner by means of an arrangement between them , their respective responsibilities for compliance with that regulation. it should be understood that such a user , once data has been made available , may in turn become a data holder , if they meet the criteria under this regulation and thus become subject to the obligations to make data available under this regulation. where the user is a union institution , agency or body , regulation(eu) 2018/1725 should apply unprejudiced.


### (40) in order to ensure that the conditions for mandatory data access are fair for both parties , the general rules on data access rights should refer to the rule on avoiding unfair contract terms. ### (40) in order to ensure that the conditions for mandatory data access are fair for both parties , the general rules on data access rights should refer to the rule on avoiding unfair contract terms , so as to avoid possible prejudice to one party in favour of the other.


### (46) it is not necessary to intervene in the case of data sharing between large companies , or when the data holder is a small or medium-sized enterprise and the data recipient is a large company. in such cases , the companies are considered capable of negotiating any compensation if it is reasonable , taking into account factors such as the volume , format , nature , or supply of and demand for the data as well as the costs for collecting and making the data available to the data recipient. ### deleted


### (49) to avoid that two or more dispute settlement bodies are seized for the same dispute , particularly in a cross-border setting , a dispute settlement body should be able to reject a request to resolve a dispute that has already been brought before another dispute settlement body or before a court or a tribunal of a member state. ### (49) to avoid that two or more dispute settlement bodies are seized for the same dispute , particularly in a cross-border setting , and prevent excessively lengthy proceedings , a dispute settlement body should be able to reject a request to resolve a dispute that has already been brought before another dispute settlement body or before a court or a tribunal of a member state.


### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need. ### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law.


### (56) in situations of exceptional need , it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies or in other exceptional cases. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need. ### (56) public sector bodies are faced with several interrelated challenges spanning from pandemics and climate change to urban planning and mobility. privately held data has a high potential to help solving these problems in the public interest. by informing decision making , providing for new scientific insights and resolving policy issues , private held data enablse more targeted interventions and improvement of public service delivery , bringing about significant savings for the public budget. this is why situations it may be necessary for public sector bodies or union institutions , agencies or bodies to use data held by an enterprise to respond to public emergencies such as public health or climate emergencies , in other exceptional cases such as purposes of legitimate public interest explicitly provided by under union or national law. research-performing organisations and research-funding organisations could also be organised as public sector bodies or bodies governed by public law. to limit the burden on businesses , micro and small enterprises should be exempted from the obligation to provide public sector bodies and union institutions , agencies or bodies data in situations of exceptional need.


### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. ### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question.


### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. ### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested for a specified period prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation.


### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling a specific task in the public interest that has been explicitly provided in law. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. ### (58) an exceptional need may also arise when a public sector body can demonstrate that the data are necessary either to prevent a public emergency , or to assist recovery from a public emergency , in circumstances that are reasonably proximate to the public emergency in question. where the exceptional need is not justified by the need to respond to , prevent or assist recovery from a public emergency , the public sector body or the union institution , agency or body should demonstrate that the lack of timely access to and the use of the data requested prevents it from effectively fulfilling or exercising a task in the legitimate public interest as provided for in national law. the tasks , aimed at improving the efficient provision of public services and evidence-based public policymaking as well as gaining enforcement of existing laws or regulations , can include but should not be limited to , improving traffic and mobility , environmental sustainability , affordable housing , city planning as well as facilitating the development , production and dissemination of official statistics. such exceptional need may also occur in other situations , for example in relation to the timely compilation of official statistics when data is not otherwise available or when the burden on statistical respondents will be considerably reduced. at the same time , the public sector body or the union institution , agency or body should , outside the case of responding to , preventing or assisting recovery from a public emergency , demonstrate that no alternative means for obtaining the data requested exists and that the data cannot be obtained in a timely manner through the laying down of the necessary data provision obligations in new legislation. this covers situations where the existence of a reporting obligation fort the provision of the data in scope of the request exists but is in itself insufficient to guarantee the availability of data of the necessary quality , granularity , and timeliness or where the said obligation is otherwise not fit for the specific use purpose sought.


### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institution , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured. ### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institution , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured.


### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institution , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured. ### (61) a proportionate , limited and predictable framework at union level is necessary for the making available of data by data holders , in cases of exceptional needs , to public sector bodies and to union institution , agencies or bodies both to ensure legal certainty and to minimise the administrative burdens placed on businesses. to this end , data requests by public sector bodies and by union institution , agencies and bodies to data holders should be transparent and proportionate in terms of their scope of content and their granularity. the purpose of the request and the intended use of the data requested for a clearly specified period should be specific and clearly explained , while allowing appropriate flexibility for the requesting entity to perform its tasks in the public interest. the request should also respect the legitimate interests of the businesses to whom the request is made. the burden on data holders should be minimised by obliging requesting entities to respect the once-only principle , which prevents the same data from being requested more than once by more than one public sector body or union institution , agency or body where those data are needed to respond to a public emergency. to ensure transparency , data requests made by public sector bodies and by union institutions , agencies or bodies should be made public without undue delay by the entity requesting the data and online public availability of all requests justified by a public emergency should be ensured.


### (63) data holders should have the possibility to either ask for a modification of the request made by a public sector body or union institution , agency and body or its cancellation in a period of 5 or 15 working days depending on the nature of the exceptional need invoked in the request. in case of requests motivated by a public emergency , justified reason not to make the data available should exist if it can be shown that the request is similar or identical to a previously submitted request for the same purpose by another public sector body or by another union institution , agency or body. a data holder rejecting the request or seeking its modification should communicate the underlying justification for refusing the request to the public sector body or to the union institution , agency or body requesting the data. in case the sui generis database rights under directive 96/6/ec of the european parliament and of the council66 apply in relation to the requested datasets , data holders should exercise their rights in a way that does not prevent the public sector body and union institutions , agencies or bodies from obtaining the data , or from sharing it , in accordance with this regulation. ### (63) data holders should have the possibility to either ask for a modification of the request made by a public sector body or union institution , agency and body or its cancellation in a period of 5 or 15 working days depending on the nature of the exceptional need invoked in the request. a justified reason not to make the data available should exist if it can be shown that the request is similar or identical to a previously submitted request for the same purpose by another public sector body or by another union institution , agency or body. a data holder rejecting the request or seeking its modification should communicate the underlying justification for refusing the request to the public sector body or to the union institution , agency or body requesting the data. in case the sui generis database rights under directive 96/6/ec of the european parliament and of the council66 apply in relation to the requested datasets , data holders should exercise their rights in a way that does not prevent the public sector body and union institutions , agencies or bodies from obtaining the data , or from sharing it , in accordance with this regulation.


### (67) when the safeguarding of a significant public good is at stake , such as is the case of responding to public emergencies , the public sector body or the union institution , agency or body should not be expected to compensate enterprises for the data obtained. public emergencies are rare events and not all such emergencies require the use of data held by enterprises. the business activities of the data holders are therefore not likely to be negatively affected as a consequence of the public sector bodies or union institutions , agencies or bodies having recourse to this regulation. however , as cases of an exceptional need other than responding to a public emergency might be more frequent , including cases of prevention of or recovery from a public emergency , data holders should in such cases be entitled to a reasonable compensation which should not exceed the technical and organisational costs incurred in complying with the request and the reasonable margin required for making the data available to the public sector body or to the union institution , agency or body. the compensation should not be understood as constituting payment for the data itself and as being compulsory. ### (67) when the safeguarding of a significant public good is at stake , such as is the case of responding to public emergencies , the public sector body or the union institution , agency or body should not be expected to compensate enterprises for the data obtained. public emergencies are rare events and not all such emergencies require the use of data held by enterprises. the business activities of the data holders are therefore not likely to be negatively affected as a consequence of the public sector bodies or union institutions , agencies or bodies having recourse to this regulation.


### (85) in order to take account of technical aspects of data processing services , the power to adopt acts in accordance with article 290 tfeu should be delegated to the commission in respect of supplementing this regulation to introduce a monitoring mechanism on switching charges imposed by data processing service providers on the market , to further specify the essential requirements for operators of data spaces and data processing service providers on interoperability and to publish the reference of open interoperability specifications and european standards for the interoperability of data processing services. it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement on better law-making of 13 april 201670. in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states’ experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts. ### (85) in order to take account of the rapid development of new technologies in this area and the technical aspects of data processing services , the power to adopt acts in accordance with article 290 tfeu should be delegated to the commission in respect of supplementing this regulation to introduce a monitoring mechanism on switching charges imposed by data processing service providers on the market , to further specify the essential requirements for operators of data spaces and data processing service providers on interoperability and to publish the reference of open interoperability specifications and european standards for the interoperability of data processing services. it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level , and that those consultations be conducted in accordance with the principles laid down in the interinstitutional agreement of 13 april 2016 on better law-making70. in particular , to ensure equal participation in the preparation of delegated acts , the european parliament and the council receive all documents at the same time as member states’ experts , and their experts systematically have access to meetings of commission expert groups dealing with the preparation of delegated acts.


### (86) in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission in respect of supplementing this regulation to adopt common specifications to ensure the interoperability of common european data spaces and data sharing , the switching between data processing services , the interoperability of smart contracts as well as for technical means , such as application programming interfaces , for enabling transmission of data between parties including continuous or real-time and for core vocabularies of semantic interoperability , and to adopt common specifications for smart contracts. those powers should be exercised in accordance with regulation (eu) no 182/2011 of the european parliament and of the council71. ### (86) in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission in respect of supplementing this regulation to adopt common specifications to ensure the periodic updating and interoperability of common european data spaces and data sharing , the switching between data processing services , the interoperability of smart contracts as well as for technical means , such as application programming interfaces , for enabling transmission of data between parties including continuous or real-time and for core vocabularies of semantic interoperability , and to adopt common specifications for smart contracts. those powers should be exercised in accordance with regulation (eu) no 182/2011 of the european parliament and of the council71 .


### manufacturers of products and suppliers of related services placed on the market in the union and the users of such products or services; ### manufacturers of products and suppliers of related services placed on the market in the union and the union based users of such products or services;


### public sector bodies and union institutions , agencies or bodies that request data holders to make data available where there is an exceptional need to that data for the performance of a task carried out in the public interest and the data holders that provide those data in response to such request; ### public sector bodies and union institutions , agencies or bodies that request data holders to make data available where there is an exceptional need to that data due to a public emergency explicitly provided by law , and the data holders that provide those data in response to such request;


### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. this regulation shall not affect the applicability of union law on the protection of personal data , in particular regulation (eu) 2016/679 and directive 2002/58/ec , including the powers and competences of supervisory authorities. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement the right of data portability under article 20 of regulation (eu) 2016/679. ### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. this regulation shall not affect the applicability of union law on the protection of personal data , in particular regulation (eu) 2016/679 , regulation (eu) 2018/1725 and directive 2002/58/ec , including the powers and competences of supervisory authorities. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement the right of data portability under article 20 of regulation (eu) 2016/679. in the event of a conflict between this regulation and union law on the protection of personal data or national law adopted in accordance with such union law , the relevant union or national law on the protection of personal data shall prevail. however , insofar as the processing of personal data made available to a data recipient pursuant to article 5 of this regulation is restricted in line with article 6 of this regulation , these provisions should be understood as taking precedence over article 6 of regulation (eu) 2016/679. this regulation does not create a legal basis for the processing of personal data and no provision of this regulation should be applied or interpreted in such a way as to diminish or limit the right to the protection of personal data or the right to privacy and confidentiality of communications.


### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. this regulation shall not affect the applicability of union law on the protection of personal data , in particular regulation (eu) 2016/679 and directive 2002/58/ec , including the powers and competences of supervisory authorities. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement the right of data portability under article 20 of regulation (eu) 2016/679. ### 3. union law on the protection of personal data , privacy and confidentiality of communications and integrity of terminal equipment shall apply to personal data processed in connection with the rights and obligations laid down in this regulation. this regulation shall not affect the applicability of union law on the protection of personal data , in particular regulation (eu) 2016/679 and directive 2002/58/ec , including the powers and competences of supervisory authorities. insofar as the rights laid down in chapter ii of this regulation are concerned , and where users are the data subjects of personal data subject to the rights and obligations under that chapter , the provisions of this regulation shall complement the right of data portability under article 20 of regulation (eu) 2016/679. in the event of a conflict between this regulation and union law on the protection of personal data or national law adopted in accordance with such union law , the relevant union or national law on the protection of personal data shall prevail. however , insofar as the processing of personal data made available to a data recipient pursuant to article 5 of the data act is restricted in line with articles 3 to 6 , these provisions should be understood as taking precedence over article 6 of regulation (eu) 2016/679. this regulation does not create a legal basis for the processing of personal data and no provision of this regulation should be applied or interpreted in such a way as to diminish or limit the right to the protection of personal data or the right to privacy and confidentiality of communications.


### (2) ‘product’ means a tangible , movable item , including where incorporated in an immovable item , that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data via a publicly available electronic communications service and whose primary function is not the storing and processing of data; ### (2) ‘product’ means a tangible item that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data and whose primary function is not the storing and processing of data nor is it primarily designed to display or play content , or to record and transmit content;


### (2) ‘product’ means a tangible , movable item , including where incorporated in an immovable item , that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data via a publicly available electronic communications service and whose primary function is not the storing and processing of data; ### (2) ‘product’ means a item , that obtains , generates or collects , data concerning its use or environment , and that is able to communicate data via an electronic communications service and whose primary function is not the storing , processing or transmission of data nor is it primarily designed to display or play content , or to record and transmit content;


### (6) ‘data holder’ means a legal or natural person who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data and through control of the technical design of the product and related services , the ability , to make available certain data; ### (6) ‘data holder’ means a legal or natural person who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data and through control of the technical design of the product and related services , the ability , to make available certain data; when in possession of personal data , only a controller as defined by article 4.7 of regulation (eu) 2016/679 can be a ‘data holder’


### (7) ‘data recipient’ means a legal or natural person , acting for purposes which are related to that person’s trade , business , craft or profession , other than the user of a product or related service , to whom the data holder makes data available , including a third party following a request by the user to the data holder or in accordance with a legal obligation under union law or national legislation implementing union law; ### (7) ‘data recipient’ means a legal or natural person , acting for purposes which are related to that person’s trade , business , craft or profession , other than the user of a product or related service , to whom the data holder makes data available , including a third party following an explicit request by the user to the data holder or in accordance with a legal obligation under union law or national legislation implementing union law , and including a third party to whom the data is directly made available by the user;


### (9) ‘public sector body’ means national , regional or local authorities of the member states and bodies governed by public law of the member states , or associations formed by one or more such authorities or one or more such bodies; ### (9) ‘public sector body’ means national , regional or local authorities of the member states and bodies governed by public law of the member states , or associations formed by one or more such authorities or one or more such bodies who have the ability to securely and reliably process the data requested from data holders;


### (10) ‘public emergency’ means an exceptional situation negatively affecting the population of the union , a member state or part of it , with a risk of serious and lasting repercussions on living conditions or economic stability , or the substantial degradation of economic assets in the union or the relevant member state(s); ### (10) ‘public emergency’ means an exceptional situation such as public health emergencies , major natural disasters , including those aggravated by climate change and environmental degradation , and major man-made disasters , such as major cybersecurity incidents , negatively affecting the population of the union , a member state or part of it , with a risk of serious and lasting repercussions on living conditions or economic stability , or the substantial degradation of economic assets in the union or the relevant member state(s) and it is determined according to the respective procedures under union or national law;


### (10) ‘public emergency’ means an exceptional situation negatively affecting the population of the union , a member state or part of it , with a risk of serious and lasting repercussions on living conditions or economic stability , or the substantial degradation of economic assets in the union or the relevant member state(s); ### (10) ‘public emergency’ means an exceptional situation such as public health emergencies , emergencies resulting from environmental degradation and major natural disasters , including those exacerbated by climate change , and major man-made disasters , such as major cybersecurity incidents , negativelyaffecting the population of the union , a member state or part of it , with a risk of serious and lasting repercussions on living conditions or economic and financial stability , or the substantial degradation of economic assets in the union or the relevant member state(s) and which is determined according to the respective procedures under union or national law.


### (16) ‘smart contract’ means a computer program stored in an electronic ledger system wherein the outcome of the execution of the program is recorded on the electronic ledger; ### deleted


### (17) ‘electronic ledger’ means an electronic ledger within the meaning of article 3 , point (53) , of regulation (eu) no 910/2014; ### deleted


### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user. ### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user in a structured , commonly used and machine-readable format , free of charge. products shall be designed and manufactured , and related services shall be provided , in such a manner that data subjects , irrespective of their legal title over the product , are offered the possibility to use the products covered by this regulation anonymously or in the least privacy-intrusive way possible , such as by anonymising the data. where users can reasonably expect it due to the nature of the product , products shall be designed and manufactured , and related services shall be provided , in such a manner that a basic set of functionalities is maintained when the product or related service is used offline.


### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user. ### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use that are accessible to the data holder are free of charge and , are , by default , easily , securely and , where relevant and appropriate , directly accessible to the use in a structured , commonly used and machine-readable format. data shall be provided in the form in which they have been generated by the product , with only the minimal adaptations necessary to make them useable by a third party , including related metadata necessary to interpret and use the data.


### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user. ### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , free of charge , safely , easily , securely and , where relevant and appropriate , directly accessible to the user in a structured , commonly used and machine readable format. this shall be done without endangering their functionality and in accordance with data security requirements as laydown by regulation 2016/679.


### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user. ### 1. products shall be designed and manufactured , and related services shall be provided , in such a manner that data generated by their use are , by default , easily , securely and , where relevant and appropriate , directly accessible to the user. this should be done without endangering their functionality nor going against data security requirements from regulation 2016/679 , product regulations or technical standardisation


### whether the manufacturer supplying the product or the service provider providing the related service intends to use the data itself or allow a third party to use the data and , if so , the purposes for which those data will be used; ### whether the manufacturer supplying the product or the service provider providing the related service intends to use the data itself or allow a third party to use the data and , if so , the purposes for which those data will be used and the period for which they can be accessed;


### whether the manufacturer supplying the product or the service provider providing the related service intends to use the data itself or allow a third party to use the data and , if so , the purposes for which those data will be used; ### whether the manufacturer supplying the product or the service provider providing the related service intends to use the data itself or allow a third party to use the data and , if so , the identity of the third party and the purposes for which those data will be used;


### 3. trade secrets shall only be disclosed provided that all specific necessary measures are taken to preserve the confidentiality of trade secrets in particular with respect to third parties. the data holder and the user can agree measures to preserve the confidentiality of the shared data , in particular in relation to third parties. ### 3. trade secrets shall only be disclosed provided that all specific necessary measures are taken to preserve the confidentiality of trade secrets in particular with respect to third parties. the data holder and the user can agree measures to preserve the confidentiality of the shared data , in particular in relation to third parties. such measures shall be utilized in a limited manner and only when theshared data includes trade secrets as defined by the eu or national law. the data holder shall prove the existence of trade secrets when it invokes measures to preserve the confidentiality of the shared data.


### 3. trade secrets shall only be disclosed provided that all specific necessary measures are taken to preserve the confidentiality of trade secrets in particular with respect to third parties. the data holder and the user can agree measures to preserve the confidentiality of the shared data , in particular in relation to third parties. ### 3. data constitutive of trade secrets and data subject to intellectual property rights shall only be disclosed upon agreement of the trade secret holder or ipr holder. the trade secret holder , the data holder and the user can agree measures to preserve the confidentiality of the shared data , in particular in relation to third parties. the trade secret holder or ipr holder shall identify the data which are protected.


### 3. trade secrets shall only be disclosed provided that all specific necessary measures are taken to preserve the confidentiality of trade secrets in particular with respect to third parties. the data holder and the user can agree measures to preserve the confidentiality of the shared data , in particular in relation to third parties. ### 3. trade secrets shall only be disclosed upon agreement of both parties provided that all specific necessary measures are taken to preserve the confidentiality of trade secrets in particular with respect to third parties. the data holder and the user can agree measures to preserve the confidentiality of the shared data , in particular in relation to third parties.


### 3. trade secrets shall only be disclosed provided that all specific necessary measures are taken to preserve the confidentiality of trade secrets in particular with respect to third parties. the data holder and the user can agree measures to preserve the confidentiality of the shared data , in particular in relation to third parties. ### 3. trade secrets shall only be disclosed provided that all specific necessary measures are taken to preserve the confidentiality of trade secrets in particular with respect to third parties. the data holder and the user can agree , by way of contractual means , on measures to preserve the confidentiality of the shared data , in particular in relation to third parties.


### 5. where the user is not a data subject , any personal data generated by the use of a product or related service shall only be made available by the data holder to the user where there is a valid legal basis under article 6(1) of regulation (eu) 2016/679 and , where relevant , the conditions of article 9 of regulation (eu) 2016/679 are fulfilled. ### 5. where the user is not a data subject , any personal data generated by the use of a product or related service shall only be made available by the data holder to the user where all conditions and rules provided by data protection legislation are complied with , notably where there is a valid legal basis under article 6 of regulation (eu) 2016/679 and , where relevant , the conditions of article 9 of regulation (eu) 2016/679 679 and article 5(3) of directive 2002/58/ec are fulfilled.


### 3. the user or third party shall not be required to provide any information beyond what is necessary to verify the quality as user or as third party pursuant to paragraph 1. the data holder shall not keep any information on the third party’s access to the data requested beyond what is necessary for the sound execution of the third party’s access request and for the security and the maintenance of the data infrastructure. ### 3. the user or third party shall not be required to provide any information beyond what is necessary to verify the quality as user or as third party pursuant to paragraph 1. the data holder shall not keep any information on the third party’s access to the data requested beyond the period for which it has been granted and beyond what is necessary for the sound execution of the third party’s access request and for the security and the maintenance of the data infrastructure.


### 3. the user or third party shall not be required to provide any information beyond what is necessary to verify the quality as user or as third party pursuant to paragraph 1. the data holder shall not keep any information on the third party’s access to the data requested beyond what is necessary for the sound execution of the third party’s access request and for the security and the maintenance of the data infrastructure. ### 3. the user or third party shall not be required to provide any information beyond what is strictly necessary to verify the quality as user or as third party pursuant to paragraph 1. the data holder shall not keep any information on the third party’s access to the data requested beyond what is necessary for the sound execution of the third party’s access request and for the security and the maintenance of the data infrastructure.


### 5. the data holder shall not use any non-personal data generated by the use of the product or related service to derive insights about the economic situation , assets and production methods of or use by the third party that could undermine the commercial position of the third party on the markets in which the third party is active , unless the third party has consented to such use and has the technical possibility to withdraw that consent at any time. ### 5. the data holder shall not use any non-personal data generated by the use of the product or related service to derive insights about the economic situation , assets and production methods of or use by the third party that could undermine the commercial position of the third party on the markets in which the third party is active , unless the third party has consented to such use and has the technical possibility to withdraw that consent at any time. the data holder shall not use any data generated by the use of the product or related service to monitor the interactions between users and third parties except for objectively justified security considerations


### 6. where the user is not a data subject , any personal data generated by the use of a product or related service shall only be made available where there is a valid legal basis under article 6(1) of regulation (eu) 2016/679 and where relevant , the conditions of article 9 of regulation (eu) 2016/679 are fulfilled. ### 6. where the user is not a data subject , any personal data generated by the use of a product or related service shall only be made available by the data holder to the third party where all conditions and rules provided by data protection legislation are complied with , notably where there is a valid legal basis under article 6(1) of regulation (eu) 2016/679 and where relevant , the conditions of article 9 of regulation (eu) 2016/679 and article 5(3) of directive2002/58/ec are fulfilled.


### use the data it receives for the profiling of natural persons within the meaning of article 4(4) of regulation (eu) 2016/679 , unless it is necessary to provide the service requested by the user; ### use the data it receives for the profiling of natural persons within the meaning of article 4(4) of regulation (eu) 2016/679 , unless it is strictly necessary to provide the specific service explicitly requested by the user;


### use the data it receives for the profiling of natural persons within the meaning of article 4(4) of regulation (eu) 2016/679 , unless it is necessary to provide the service requested by the user; ### use the data it receives for the profiling of natural persons within the meaning of article 4(4) of regulation (eu) 2016/679 , unless it is strictly necessary to provide the service requested by the user;


### 4. a data holder shall not make data available to a data recipient on an exclusive basis unless requested by the user under chapter ii. ### 4. a data holder shall not make data available to a data recipient on an exclusive basis unless explicitly requested by the user under chapter ii.


### destroy the data made available by the data holder and any copies thereof; ### destroy the data made available by the data holder and any copies thereof after expiry of the period for which access has been granted;


### 3. paragraph 2 , point (b) , shall not apply in either of the following cases: ### 3. paragraph 2 , point (b) , shall not apply in either of the following cases where non-personal data are concerned:


### 1. upon request , a data holder shall make data available to a public sector body or to a union institution , agency or body demonstrating an exceptional need to use the data requested. ### 1. upon request , a data holder shall make data , including relevant metadata , available to a public sector body or to a union institution , agency or body demonstrating an exceptional need or a legitimate public interest to use the data requested.


### 1. upon request , a data holder shall make data available to a public sector body or to a union institution , agency or body demonstrating an exceptional need to use the data requested. ### 1. upon request , a data holder shall make data , including metadata , available to a public sector body or to a union institution , agency or body demonstrating an exceptional need to use the data requested.


### 2. this chapter shall not apply to small and micro enterprises as defined in article 2 of the annex to recommendation 2003/361/ec. ### deleted


### an exceptional need to use data within the meaning of this chapter shall be deemed to exist in any of the following circumstances: ### an exceptional need to use data within the meaning of this chapter shall be deemed to exist in the following circumstances:


### where the data requested is necessary to respond to a public emergency; ### where the data requested is limited in time and scope and necessary to respond to a public emergency or to help prevent a public emergency or to assist the recovery from a public emergency;


### where the data requested is necessary to respond to a public emergency; ### where the data requested is necessary to prevent or respond to or recover from a public emergency;


### where the data request is limited in time and scope and necessary to prevent a public emergency or to assist the recovery from a public emergency; ### deleted


### where the lack of available data prevents the public sector body or union institution , agency or body from fulfilling a specific task in the public interest that has been explicitly provided by law; and ### deleted


### where the lack of available data prevents the public sector body or union institution , agency or body from fulfilling a specific task in the public interest that has been explicitly provided by law; and ### where the lack of available data prevents the public sector body or union institution , agency or body from fulfilling or exercising tasks in the public interest that have been explicitly provided by law; and


### (1) the public sector body or union institution , agency or body has been unable to obtain such data by alternative means , including by purchasing the data on the market at market rates or by relying on existing obligations to make data available , and the adoption of new legislative measures cannot ensure the timely availability of the data; or ### (1) the public sector body or union institution , agency or body has been unable to obtain such data by alternative means , including by purchasing the data on the market on reasonable prices or by relying on existing obligations to make data available , and the adoption of new legislative measures cannot ensure the timely availability of the data; or


### 1. this chapter shall not affect obligations laid down in union or national law for the purposes of reporting , complying with information requests or demonstrating or verifying compliance with legal obligations. ### 1. this chapter shall not affect obligations laid down in union or national law for the purposes of reporting , complying with information requests or demonstrating or verifying compliance with legal obligations , including in relation to official statistics.


### specify what data are required; ### specify what data are required and the period of access thereto;


### explain the purpose of the request , the intended use of the data requested , and the duration of that use; ### explain the purpose of the request , the intended use of the data requested , and the duration of that use as well as the procedure to be followed after expiry of the access period;


### explain the purpose of the request , the intended use of the data requested , and the duration of that use; ### explain the purpose of the request , the choice of data providers , the intended use of the data requested , and the duration of that use;


### concern , insofar as possible , non-personal data; ### in case of requests made pursuant to article 15 , point (a) , concern , insofar as possible , non-personal data;


### paragraph 3 does not preclude a public sector body or a union institution , agency or body to exchange data obtained pursuant to this chapter with another public sector body , union institution , agency or body , in view of completing the tasks in article 15 or to make the data available to a third party in cases where it has outsourced , by means of a publicly available agreement , technical inspections or other functions to this third party. the obligations on public sector bodies , union institutions , agencies or bodies pursuant to article 19 apply. ### paragraph 3 does not preclude a public sector body or a union institution , agency or body to exchange data obtained pursuant to this chapter with another public sector body , union institution , agency or body , in view of completing the tasks in article 15 or to make the data available to a third party in cases where it has outsourced , by means of a publicly available agreement , technical inspections or other functions to this third party. the obligations on public sector bodies , union institutions , agencies or bodies pursuant to article 19 apply. the third party shall not use the data it receives to develop a product or a service that competes with the product or service from which the accessed data originate , or share the data with another third party.


### 1. a data holder receiving a request for access to data under this chapter shall make the data available to the requesting public sector body or a union institution , agency or body without undue delay. ### 1. a data holder receiving a request for access to data under this chapter shall make the data available to the requesting public sector body or a union institution , agency or body without undue delay during the agreed period of access.


### 1. a data holder receiving a request for access to data under this chapter shall make the data available to the requesting public sector body or a union institution , agency or body without undue delay. ### 1. a data holder receiving a request for access to data under this chapter shall make the data available to the requesting public sector body or a union institution , agency or body without undue delay , taking into account provision of time and necessary technical , organisational and legal measures.


### 5. where compliance with the request to make data available to a public sector body or a union institution , agency or body requires the disclosure of personal data , the data holder shall take reasonable efforts to pseudonymise the data , insofar as the request can be fulfilled with pseudonymised data. ### 5. where compliance with the request to make data available to a public sector body or a union institution , agency or body requires the disclosure of personal data , the data holder shall pseudonymise the data , insofar as the request can be fulfilled with pseudonymised data.


### 5. where compliance with the request to make data available to a public sector body or a union institution , agency or body requires the disclosure of personal data , the data holder shall take reasonable efforts to pseudonymise the data , insofar as the request can be fulfilled with pseudonymised data. ### 5. where compliance with the request to make data available to a public sector body or a union institution , agency or body requires the disclosure of personal data , the data holder shall take reasonable efforts to anonymise or pseudonymise the data , insofar as the request can be fulfilled with pseudonymised data.


### not use the data in a manner incompatible with the purpose for which they were requested; ### not use the data in a manner incompatible with the purpose for which they were requested and beyond the agreed period of access;


### 2. disclosure of trade secrets or alleged trade secrets to a public sector body or to a union institution , agency or body shall only be required to the extent that it is strictly necessary to achieve the purpose of the request. in such a case , the public sector body or the union institution , agency or body shall take appropriate measures to preserve the confidentiality of those trade secrets. ### 2. disclosure of trade secrets , alleged trade secrets or business sensitive internal information to a public sector body or to a union institution , agency or body shall only be required to the extent that it is strictly necessary to achieve the purpose of the request. in such a case , the public sector body or the union institution , agency or body shall take appropriate measures to preserve the confidentiality of those trade secrets.


### 2. where the data holder claims compensation for making data available in compliance with a request made pursuant to article 15 , points (b) or (c) , such compensation shall not exceed the technical and organisational costs incurred to comply with the request including , where necessary , the costs of anonymisation and of technical adaptation , plus a reasonable margin. upon request of the public sector body or the union institution , agency or body requesting the data , the data holder shall provide information on the basis for the calculation of the costs and the reasonable margin. ### deleted


### 2. where the data holder claims compensation for making data available in compliance with a request made pursuant to article 15 , points (b) or (c) , such compensation shall not exceed the technical and organisational costs incurred to comply with the request including , where necessary , the costs of anonymisation and of technical adaptation , plus a reasonable margin. upon request of the public sector body or the union institution , agency or body requesting the data , the data holder shall provide information on the basis for the calculation of the costs and the reasonable margin. ### 2. where the data holder claims compensation for making data available in compliance with a request made pursuant to article 15 , point (b) such compensation shall cover the technical and organisational costs incurred to comply with the request including , where necessary , the costs of anonymisation and of technical adaptation. upon request of the public sector body or the union institution , agency or body requesting the data , the data holder shall provide information on the basis for the calculation of the costs


### 1. a public sector body or a union institution , agency or body shall be entitled to share data received under this chapter with individuals or organisations in view of carrying out scientific research or analytics compatible with the purpose for which the data was requested , or to national statistical institutes and eurostat for the compilation of official statistics. ### 1. a public sector body or a union institution , agency or body shall be entitled to share data received under this chapter with individuals or organisations in view of carrying out scientific research or analytics compatible with the purpose for which the data was requested , or to national statistical institutes , the members of the european system of central banks , and eurostat for the compilation of official statistics.


### 1. providers of a data processing service shall take the measures provided for in articles 24 , 25 and 26 to ensure that customers of their service can switch to another data processing service , covering the same service type , which is provided by a different service provider. in particular , providers of data processing service shall remove commercial , technical , contractual and organisational obstacles , which inhibit customers from: ### 1. providers of a data processing service shall take the measures provided for in articles 24 , 25 and 26 to ensure that customers of their service can switch to another data processing service , covering the same service type , which is provided by a different service provider. in order to provide for effective services switching , providers of data processing service shall remove commercial , technical , contractual and organisational obstacles , which discourage customers from:


### terminating , after a maximum notice period of 30 calendar days , the contractual agreement of the service; ### terminating , after a maximum notice period of 60 calendar days , the contractual agreement of the service , or a mutually agreed longer notice period on a contractual basis provided that both parties are able to equally influence the contractual content.


### 1. from [date x+3yrs] onwards , providers of data processing services shall not impose any charges on the customer for the switching process. ### 1. from [the date of entry into force of this regulation] onwards , providers of data processing services shall not impose any charges on the customer who are consumers for the switching process.


### 1. providers of data processing services that concern scalable and elastic computing resources limited to infrastructural elements such as servers , networks and the virtual resources necessary for operating the infrastructure , but that do not provide access to the operating services , software and applications that are stored , otherwise processed , or deployed on those infrastructural elements , shall ensure that the customer , after switching to a service covering the same service type offered by a different provider of data processing services , enjoys functional equivalence in the use of the new service. ### 1. providers of data processing services that concern scalable and elastic computing resources limited to infrastructural elements such as servers , networks and the virtual resources necessary for operating the infrastructure , but that do not provide access to the operating services , software and applications that are stored , otherwise processed , or deployed on those infrastructural elements , shall provide assistance and take all necessary measures in their power , including in cooperation with the data processing service provider of the destination service , to facilitate the customer , after switching to a service covering the same service type offered by a different provider of data processing services , with the aim of achieving functional equivalence in the use of the new service.


### 4. where the open interoperability specifications or european standards referred to in paragraph 3 do not exist for the service type concerned , the provider of data processing services shall , at the request of the customer , export all data generated or co-generated , including the relevant data formats and data structures , in a structured , commonly used and machine-readable format. ### 4. where the open interoperability specifications or european standards referred to in paragraph 3 do not exist for the service type concerned , the provider of data processing services shall , at the request of the customer , export all data generated or co-generated , including the relevant data formats and data structures , in a structured , commonly used and machine-readable format. the exporting data processing service shall ensure that the customer , after switching to a service covering the same service type offered by a different provider of data processing services , can enjoy functional equivalence in the use of the new service.


### 1. providers of data processing services shall take all reasonable technical , legal and organisational measures , including contractual arrangements , in order to prevent international transfer or governmental access to non-personal data held in the union where such transfer or access would create a conflict with union law or the national law of the relevant member state , without prejudice to paragraph 2 or 3. ### 1. providers of data processing services shall take all reasonable technical , legal and organisational measures , including contractual arrangements , in order to prevent international transfer and governmental access to such non-personal data held in the union where such transfer or access would create a conflict with union law or the national law of the relevant member state , without prejudice to paragraph 2 or 3.


### the addressee of the decision may ask the opinion of the relevant competent bodies or authorities , pursuant to this regulation , in order to determine whether these conditions are met , notably when it considers that the decision may relate to commercially sensitive data , or may impinge on national security or defence interests of the union or its member states. ### the addressee of the decision may ask the opinion of the commission , its bodies or relevant competent bodies or authorities , pursuant to this regulation , in order to determine whether these conditions are met , notably when it considers that the decision may relate to commercially sensitive data , or may impinge on national security or defence interests of the union or its member states.


### the addressee of the decision may ask the opinion of the relevant competent bodies or authorities , pursuant to this regulation , in order to determine whether these conditions are met , notably when it considers that the decision may relate to commercially sensitive data , or may impinge on national security or defence interests of the union or its member states. ### the addressee of the decision shall ask the opinion of the relevant competent bodies or authorities , pursuant to this regulation , in order to determine whether these conditions are met , notably when it considers that the decision may relate to commercially sensitive data , or may impinge on national security or defence interests of the union or its member states.


### 4. the commission may , in accordance with article 10 of regulation (eu) no 1025/2012 , request one or more european standardisation organisations to draft harmonised standards that satisfy the essential requirements under paragraph 1 of this article ### 4. the commission may , in accordance with article 10 of regulation (eu) no 1025/2012 , request one or more european standardisation organisations to draft harmonised standards that satisfy the essential requirements under paragraph 1 of this article and are developed inan and are developed in an open , transparent , technology-neutral , and inclusive manner in accordance with the chapter ii of regulation (eu) no 1025/2012.


### 4. the commission may , in accordance with article 10 of regulation (eu) no 1025/2012 , request one or more european standardisation organisations to draft european standards applicable to specific service types of data processing services. ### 4. the commission may , in accordance with article 10 of regulation (eu) no 1025/2012 , request one or more european standardisation organisations to define the scope of a specific service type and to draft european standards applicable to specific service types of data processing services.


### 5. the commission may , in accordance with article 10 of regulation (eu) no 1025/2012 , request one or more european standardisation organisations to draft harmonised standards that satisfy the essential the requirements under paragraph 1 of this article. ### deleted