EUROPEAN COMMISSION Brussels, 25.11.2020 SWD(2020) 295 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT REPORT

Accompanying the document Proposal for a

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on European data governance







(Data Governance Act) {COM(2020) 767 final} - {SEC(2020) 405 final} - {SWD(2020) 296 final}



Table of contents 1.Introduction: Political and legal context 2.Problem definition 2.1.What is the problem? 2.2.What are the problem drivers? 2.3.How will the problem evolve? 3.Why should the EU act? 3.1.Legal basis 3.2.Subsidiarity: Necessity of EU action 3.3.Subsidiarity: Added value of EU action 4.Objectives: What is to be achieved? 4.1.General objective 4.2.Specific objectives 5.What are the available policy options? 5.1.What is the baseline from which options are assessed? 5.2.Description of the policy options 5.3.Options discarded at an early stage 6.What are the impacts of the policy options? 6.1.Economic impact

6.2.Social and environmental impact 6.3.Impact on SMEs 6.4.Member States’ and stakeholders’ views 7.How do the options compare? 8.Preferred option 9.How will actual impacts be monitored and evaluated? 9.1.Monitoring of the specific objectives 9.2.Monitoring of the preferred option Annex 1: Procedural information 1.Lead DG, Decide Planning/CWP references 2.Organisation and timing 3.Consultation of the RSB 4.Evidence, sources and quality Annex 2: Stakeholder consultation Annex 3: Who is affected and how? 1.Practical implications of the initiative 2.Summary of costs and benefits Annex 4: Analytical methods Annex 5: Subsidiarity grid Annex 6: Governance framework in third countries

1.Introduction: Political and legal context This Impact Assessment accompanies the proposal for a Regulation of the European Parliament and of the Council on data governance. It is the first of a set of measures announced in the 2020 European Strategy for Data. The instrument aims to stimulate the availability of data for use and to strengthen data governance mechanisms in the EU. It would facilitate the following situations: ·the sharing of data among businesses, against remuneration or because of other benefits they derive from sharing; ·making public sector data available for reuse, in situations where such data is subject to the rights of others; ·allowing the reuse of personal data with the help of a ‘personal data space’, designed to help individuals exercise their rights under the General Data Protection Regulation (GDPR); ·making data reusable for altruistic purposes. 1.1Technological, economic and societal context An evolving technological landscape In our increasingly connected world, more and more data is being generated, originating in factories or on farms, in cars or household appliances. The availability of such data is a critical enabler for data-driven innovation, including the development of more personalised and cheaper products, not least using artificial intelligence (AI) and related technologies. Europe has missed the first wave of innovation based on data, mainly data collected from individuals over the Web 2.0. But a second wave of innovation is emerging from objects connected to the Internet-of-Things (IoT). It is expected that the volume of data produced annually in the world will grow from the 33 zettabytes in 2018 to 175 zettabytes by 2025 . The European Strategy for Data indicates that opportunities arise both from the increasing data volumes that are generated in fields in which the EU has a strong basis (such as manufacturing) and the changing technological landscape for data use will offer opportunities for European companies in the data economy. The importance of data for the economy In her 2020 State of the Union address, President von der Leyen stated that ‘A real data economy […] would be a powerful engine for innovation and new jobs.’ According to a study by the International Data Corporation (IDC) for the European Commission, the data economy was estimated to be worth over EUR 324.86 billion at the end of 2019 , representing 2.6% of the Gross Domestic Product (GDP) of the EU-27. The slow-down caused by the COVID crisis in 2020 is expected to be followed by a rebound. Data is the basis for new digital products and services. It is essential for training AI systems. An example is the self-driving car: in addition to the data generated by the car itself, additional third-party data are required for this type of system to operate securely, irrespective of weather conditions, visibility or road-surface quality . Moreover, the use of data drives productivity and resource efficiency gains across all sectors of the economy. Research by the Organization for Economic Cooperation and Development (OECD) suggests that companies that invest in data-driven innovation and data analytics exhibit faster productivity growth than those that do not by approximately 5% to 10% . Data is a critical resource for startups and SMEs, in particular as a business can be set up with very low initial capital. Over 99% of data supplier companies and over 98.8% of data user companies in the EU are SMEs. Some 85% of new jobs created in the data economy over the last years have been created by SMEs . Some 93% of the EU executives surveyed in a recent study by McKinsey believe that better access to data would be important to their organisation (with approximately 40% designating this as very important). More than 50% would be willing to share their data if they either received access to similar data from competitors in return or were paid for the data. It is important to note that the term ‘data sharing’ does not imply that all data will be available for free for all, but may include situations of data exchanged against reward. Societal impact of data A better use of data can lead to improvements in health and well-being, a better environment, strengthened climate action, more efficient public services and safer societies. As demonstrated during the COVID-19 crisis, data is an essential asset for tackling emergencies such as pandemics. More generally, in the health sector, data can help develop better and more personalised treatments. McKinsey estimates that data and digital technologies could lead to savings of approximately EUR 120 billion a year in the EU health sector. In the mobility sector, as well as saving more than 27 million hours of public transport users’ time, up to EUR 20 billion a year could be saved in labour costs of car drivers thanks, amongst others, to real-time navigation that reduces time stuck in traffic. In turn, this has benefits in terms of tackling climate change, due to reduced CO2 emissions and air pollution. Data is also at the core of the open marketplaces that facilitate the collaborative or sharing economy. An example of such marketplaces is Dawex, which acts as orchestrator between data holders and data users and facilitates the exchange of data between companies and organizations. It is estimated that this saves up to 7% of household budget spending and reduces waste by 20%.

1.2Political context Already in March 2019, the European Council conclusions stated that ‘the EU needs to go further in developing a competitive, secure, inclusive and ethical digital economy with world-class connectivity. Special emphasis should be placed on access to, sharing of and use of data, on data security and on AI, in an environment of trust’. The European Strategy for Data of 19 February 2020 responded to such political calls to strengthen Europe’s position globally by making better use of data-driven innovation. In particular, it calls for the creation of common European data spaces. In its conclusions of 2 October 2020, the European Council welcomed the data strategy. It stressed the need to make high-quality data more readily available and to promote and enable better sharing and pooling of data, as well as interoperability. It also welcomed the creation of common European data spaces in strategic sectors. The role of common European data spaces The European Strategy for Data proposes to establish sector- or domain-specific data spaces, as the concrete arrangements in which data sharing and/or data pooling can happen beyond one single Member State. A common European data space will be composed of a secure IT environment for processing of data by an open number of organisations, and a set of rules of legislative, administrative and contractual nature that determine the rights of access to and processing of the data. Data will be made available on a voluntary basis and can be reused against remuneration or for free, depending on the data holder’s decision. The present instrument proposes an overarching framework encompassing horizontal measures relevant for all common European data spaces. The framework will leave room for sector-specific rules, governance mechanisms and standards where relevant. The objective of the initiative is not to create the common European data spaces by law, but to enhance their development by strengthening trust in data sharing and in data intermediaries. The European Strategy for Data was welcomed by the Member States in the Council Conclusions of 9 June 2020. They called on the European Commission ‘to present concrete proposals on data governance and to encourage the development of common European data spaces for strategic sectors of the industry and domains of public interest’. In his opinion on the Data Strategy, the European Data Protection Supervisor (EDPS) underlined the political relevance of working towards common European data spaces: ‘one of the objectives of the Data Strategy should be to prove the viability and sustainability of an alternative data economy model - open, fair and democratic. Unlike the current predominant business model, characterised by unprecedented concentration of data in a handful of powerful players, as well as pervasive tracking, the European data space should serve as an example of transparency, effective accountability and proper balance between the interests of the individual data subjects and the shared interest of the society as a whole’. As stated by President von der Leyen in her State of the Union speech, ‘Europe must now lead the way on digital – or it will have to follow the way of others, who are setting these standards for us.’ The EU must seize the opportunity of this pivotal moment and ensure that it is at the forefront of the second wave of innovation based on data. This urgency is confirmed by the COVID-19 crisis, which has demonstrated the importance of data for an effective response to a global health crisis. Effective responses can only be identified if as much evidence (data) is available as possible to test out as many hypotheses as possible. This was the essence for example of the Exscalate4COV initiative: In the initiative, an ad hoc consortium of 18 partner organisations tested available molecules with drug-like properties in order to identify new treatments against COVID-19. They have been able to identify several molecules for treatment against the virus that are now being tested in clinical trials. This was only made possible because pharmaceutical companies ‘donated’ information on these molecules to European research centres. In the absence of established processes for the sharing of such data, it took 3 months to obtain it. It is also essential that the EU acts quickly because data will play a key role in the economic recovery, not least because of its importance for small and medium-sized enterprises (SMEs) and startups. The Communication ‘Europe’s moment: Repair and Prepare for the Next Generation’ gives a prominent place to measures that accelerate the development of the data economy, including legislative action on data sharing and governance, which is the subject of this impact assessment. 1.3 Legal context 1.3.1 Horizontal legislation The current initiative covers different types of data intermediaries, handling both personal and non-personal data. Therefore, the interplay with the legislation on personal data is particularly important. With the General Data Protection Regulation and ePrivacy Directive, the EU has put in place a solid and trusted legal framework for the protection of personal data and a standard for the world. The legislative framework for the common data spaces would work within the rules of the existing legislation on the protection of personal data. In particular, it would remain the responsibility of each party to identify the suitable legal basis for the processing of personal data within a common European data space. The proposal will build on the mechanisms present in the existing legislation, in particular the portability right under Article 20 GDPR, that give individuals more control over how their data is used. Article 20 of the GDPR gives data subjects the right to move their data (e.g. their social media data, mobility or health data) to another service, or to allow a third party to access that data. This right has a strong potential for reuse of personal data, as identified, amongst others, in the report on competition policy and the digital era prepared for Commissioner Vestager in 2019. Additionally, this right would give individuals the possibility to make some of their data, such as their mobility or health data, available for the common good, if they wish to do so. Similarly, the initiative would not amend existing competition law provisions, and would be designed in full compliance with Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU), which prohibit anti-competitive agreements and the abuse of dominant market power, respectively. The initiative would also be in full compliance with the EU’s international obligations, notably in the multilateral agreements in the World Trade Organisation and in its regional trade agreements. The current proposal would complement the Directive on open data and the reuse of public sector information (Open Data Directive). The Open Data Directive deals with data for which public sector bodies have all the relevant rights. It does not, however, cover public sector data subject to the rights of others (e.g. personal data, data protected by intellectual property rights or trade secrets). Due to these third party rights, such data cannot be made available as open data, i.e. with as little usage restrictions as possible. By facilitating the secure access to such datasets, this proposal encourages the exploitation of data whose reuse is not regulated by the existing Directive. As a consequence, the Implementing Act on High-Value Datasets under the Open Data Directive, which is expected to be adopted in 2021, will also be fully complementary with this initiative. 1.3.2 Sectoral legislation

Sector-specific legislation on data access is in place to address identified market failures in fields such as automotive, payment service providers, smart metering information, electricity network data, intelligent transport systems and electronic freight transport information. The legal instrument for the common European data spaces would support the use of data made available under such rules without altering them or creating new sectoral obligations. 1.3.3 Relationship with other planned initiatives The current legislative initiative has logical and coherent links with the other initiatives announced in the European Strategy for Data. It aims at improving voluntary data sharing within and across common European data spaces. This would be achieved by supporting the emergence of data intermediaries that could organise data spaces as trusted third parties and provide relevant technologies. In addition, it would support the development of technical and legal standards relating to the means of the data exchange which, in turn, will enhance trust in data sharing. The current initiative is a first step in the two-step approach announced in the European Strategy for Data. The initiative will address the urgent need to facilitate data sharing through an enabling governance framework. In a second step, the Commission will address issues about who controls or ‘owns’ the data, i.e. the material rights on who can access and use what data under which circumstances. The introduction of such rights will be examined in the context of the Data Act (2021). Diverging interests of the stakeholders and different views on what is fair in this respect make these issues subject to intense debate, which warrants taking more time. While offering an alternative model to the data handling practices of the Big Tech platforms, the current legislative initiative is also clearly distinct from the Digital Market Act (DMA) and the Digital Services Act (DSA). The DMA, foreseen for Q4 2020, will combine two elements to ensure the proper functioning of the internal market by promoting effective competition in digital markets: (i) a set of clear-cut prohibitions and obligations to address known unfair practices of online platforms with a gatekeeping role, resulting from, among other factors, their control of large amounts of data; and (ii) a market investigation regime which would allow tackling existing and emerging market failures in digital markets, including in relation to data access and use. The DSA, also foreseen for Q4 2020, intends to clarify the responsibilities and obligations of digital services, and in particular online platforms, based on, amongst other elements, an evaluation of the e-Commerce Directive. The interplay with the other initiatives announced in the Data Strategy is illustrated in the image below: Overview of envisaged data actions. Source: European Commission The European Strategy for Data also proposes the creation of sectoral data spaces in areas such as mobility and health, and announces sector-specific initiatives, including legislative action for the specific sectors. The Commission is, for example, working on a review of the current EU type approval legislation for motor vehicles. The initiative aims at ensuring fair and safe access to vehicle data and ultimately to offer better access to more services based on car data. This initiative is envisaged for 2021. The image below shows the interplay of the horizontal framework with the sectoral initiatives. Source: European Commission The development of common European data spaces will be supported financially under the Digital Europe programme and the Connecting Europe Facility2. The current legislative initiative and the financing from these programmes will mutually reinforce each other. 2.Problem definition Source: European Commission 2.1.What is the problem? As described in Chapter 1, the economic and societal potential of data use is enormous, in terms of new products and services based on novel technologies, more efficient production, and tools for combatting societal challenges. The problem that this initiative addresses is that this potential is not realised due to limited data sharing in the EU. A number of obstacles (low trust in data sharing, issues related to the reuse of public sector data and data collection for the common good, technical obstacles) stand in the way of data sharing becoming more prevalent. These problem drivers are described in section 2.2. The importance of data sharing In order to leverage the value of data in the economy and society, more economic operators and organisations promoting societal interests need to be able to use data. This will include data held by others, as it is not cost-efficient if every company or organisation collects similar or even identical data in parallel to others. Digital data can be copied at virtually no cost, and can be used simultaneously by different actors for an unlimited numbers of times. These characteristics distinguish data from traditional economic resources. In order to harness such potential, more data needs to be shared among operators and organisations, including against monetary and other rewards, to have a sufficient amount of data available for innovation in the market. Given the fact that the availability of resources feeding data-driven innovation benefits the entirety of the data-driven economy in the EU, the socioeconomic benefits will positively impact all the vertical sectors directly or indirectly linked to the ever-growing EU data economy.

According to the OECD, data access and reuse could generate social and economic benefits worth up to 1.5% of GDP in the case of publicly held data, and between 1% and 2.5% of GDP when also including privately held data . Data access and sharing can increase the value of data to holders (direct impact), but it can also help create 10 to 20 times more value for data users (indirect impact), and 20 to 50 times more value for the wider economy and society (induced impact). An unfulfilled potential Difficulties in accessing and using data held by others have been reported repeatedly. According to the OECD, ‘individuals, businesses, and governments often face barriers to data access, which may be compounded by reluctance to share’. In the recent public online consultation on the Data Strategy, almost 80% of companies reported problems in data access. When asked about the nature of such difficulties, 72.1% of these companies reported ‘technical aspects relating to both data interoperability and transfer mechanisms’ and 43.5% the ‘impossibility to find data of the relevant quality’ (multiple choices possible). Other issues relate to outright denial of data access (65%) or prohibitive prices or other conditions (41.7%). This suggests that technical difficulties are an important barrier to data sharing. A 2018 report by Deloitte highlights the considerable potential for increasing the level of data sharing, in particular of machine-generated non-personal data, in Europe over the next decade. The report suggests that only between 43% and 58% of the potential of data sharing along a value chain is realised and only 20% and 40% of the potential of sharing between sectors. The report estimates that leveraging this potential would create, in monetary terms, EUR 35 billion of value in agriculture by raising yields; reduce costs from road vehicle damage, maintenance and repairs by EUR 40 billion; and generate efficiencies in resource management and prevent drug counterfeiting in the healthcare sector, saving EUR 14 billion. It could create as much as EUR 1.3 trillion of value in manufacturing by improving productivity by 2027. The untapped potential of data sharing is confirmed by a recent study on ecosystems (focusing on health, construction and automotive and mobility) carried out by McKinsey. Why would companies and individuals share their data? What are the incentives for companies to share their data? Direct monetisation is currently not the main reason for data sharing. Respondents to a survey conducted by the MIT Technology Review indicate that data sharing helps to obtain greater speed and visibility across supply chains, and to support faster and more innovative product development. Incentives for companies to share data include increased access to data of other contributors in exchange for giving access to their own data, analytical results derived from the shared data, the availability of services such as predictive maintenance services or licence fees, as well as reduced time and costs of product marketing. The incentive for individuals to share data can vary. It can come from the wish to contribute to research on rare diseases or to make local transport more efficient (in the case of data altruism). It can also be driven by possibilities to obtain better advice on their personal situation or more personalised or cheaper services in exchange for the use of the data. The role of platforms in the data economy The consumer-oriented data economy has given rise to the development of intermediaries that cover the entire value chain, from data collection (collection through websites, smartphones or connected objects such as thermostats) to storage and processing (cloud infrastructures) and services. This has led to economies of scope and scale in terms of data (i.e. the capacity to not only have large volumes of data at their disposal but also data on a variety of human activities), resulting in huge advantages in rolling out additional data-driven services, including in the field of AI. As European industry begins to interconnect factories, suppliers and other business partners and clients, to deliver better, more personalised products in a more efficient (and thus cheaper) manner, questions related to the organisation of such data flows arise. According to many bilateral interactions with stakeholders, there is a high level of distrust in integrated tech service providers as platforms for industrial data exchange. Large players like Airbus, Siemens, GE or MAN therefore sometimes opt for creating their own platforms. However, these can be exposed to similar criticism from their business partners (notably SMEs, but also suppliers), who may be in a weaker bargaining position to determine data use by such platforms. The current initiative thus represents an important first step in creating a new model for the data economy. This has the potential to meet new market demands and allow the EU to become more competitive in the data-driven world economy, while maintaining its data sovereignty and its full compliance with its international obligations in trade agreements. Such a model is necessary as an alternative to the current business model dominated by Big Tech platforms. It would be built on a division of functions and the development of common European data spaces as collaborative ecosystems in which data would be usable by a broader range of organisations (public and private) based on a collective governance of data sharing. These data spaces will constitute the core tissue of an interconnected and competitive data economy in the EU. 2.2.What are the problem drivers? 2.2.1. Low trust in data sharing Based on the views expressed in the series of stakeholder consultations organised by the European Commission on data sharing, companies do not necessarily trust that, if they share data, the reuser will use it in line with the contractual agreement. For example they fear that their data could be made available to third parties. As shown in a 2017 Commission consultation, 20% of companies do not engage in data sharing because of this fear. Some companies fear that they might lose their competitive advantage within their market or in prospective markets if they engage in data sharing. The OECD also reports that this is one of the major concerns for both organisations and individuals with regard to data-sharing constellations. Furthermore, in the 2020 consultation, several companies highlighted the difficulty they face when trying to access datasets of other companies, which may be reluctant to share data due to this fear. For example, one insurance company explained that: ‘Companies are reluctant to share data since it is the fundamental basis of their competitive advantage. Therefore, it is critical to introduce appropriate safeguards to develop a trusted environment.’ Some emerging technologies can track and trace data use within a data ecosystem. This can improve trust, but the use of these technologies in more open ecosystems is not yet widespread. The lack of trust leads to high transaction costs, related to finding a suitable data-sharing partner; negotiating, drafting and monitoring the contract, and; developing interoperability solutions for transferring, transforming and cleaning the data. This has been highlighted by stakeholders (especially SMEs) since 2017. The OECD confirms that these high transaction costs might heavily affect those in a weaker position, notably individuals (consumers) and SMEs. Bringing the offer and demand for data together in new market places is a pre-requisite to solving the problem. These new market places are, however, at risk of not being able to scale up sufficiently due to the lack of sufficient trust in them. It is clear that this can happen only upon the condition of a sufficient level of trust in intermediaries for market actors to buy-in. Without this, it is unlikely that they will be able to scale up. Both existing companies and start-ups propose data marketplaces, platforms or trusts and personal data intermediaries as a means to improve findability of relevant data, lower the costs of transacting in data and propose exploitation of shared resources . These data intermediaries can reduce transaction costs, for example by proposing standardised clauses in data-sharing contracts, providing a platform for data sharing, offering solutions for data interoperability, and helping data holders who may not have the necessary skills to ensure compliance with data protection law . These facilitators generally aim to remain neutral in the data exchange that they accommodate, meaning that they do not accumulate data or monetise on the data exchanged.

Personal data intermediaries are a specific category of data intermediaries. They seek to empower individuals to exercise their rights under data protection law and manage their own personal data . Already in 2016, the EDPS highlighted the potential of these solutions. The 2020 online consultation showed that close to 80% of the 201 citizens responding consider that ‘it should be made easier for individuals to give access to existing data held about them, in line with the GDPR’. In the same group of citizens, 43% considered that this could be achieved through practical solutions that allow individuals to exercise control, such as mobile and online dashboards or apps. 2.2.2. Issues related to the reuse of public sector data and collecting data for the common good Data sharing is hampered by an absence of appropriate structures and processes, notably to facilitate data altruism and the reuse of publicly held data that is subject to the rights of others. a)Limited data-handling capacity and reuse culture in the public sector The GDPR has increased awareness on personal data protection in companies, data subjects, the public sector and academia alike . While this is a very positive development, the increased awareness is not always matched by a high level of expertise in the public sector on the rules and exceptions. The consultation supporting the review of the Public Sector Information Directive showed that public sector bodies had difficulties in managing risks related to the reuse of data subject to the rights of others, especially personal data. In addition, public sector bodies have signalled that dealing with requests to reuse this specific category of data represents a major issue for them, as they lack the technical and legal capacity to process these requests. The potential value of this type of data held by the public sector (such as health data or micro-statistics) is often high for machine learning and research. The challenge is to find ways to make it possible to extract knowledge from the data, while fully preserving privacy or other rights that may be attached to the data. Technical mechanisms exist that allow controlled processing of data that is subject to the rights of others (‘safe reading rooms’). Some Member States (notably France, Finland and Germany) have established specific bodies underpinned by legislation that offer such technical mechanisms, creating secure and privacy-enhancing conditions for the reuse of such data. In 2018, the Centre d’accès sécurisé aux données (Centre for secure access to data) was established by the French government and the National School for Statistics and other partners to allow the secure processing of statistical micro-data. Finnish legislation recently established the data permit authority Findata with the aim of providing researchers with a one-stop-shop service for receiving a permit to process data from a range of public registers for health and social protection. Similarly, the German government has adopted legislation that will enable research on the basis of medical reimbursement data. In Germany 38 Forschungsdatenzentren (secure data research infrastructures) have been set up in order to facilitate access to sensitive data for researchers and more are being established. In spite of these initiatives, the overall capacity of the public sector across the EU to handle these types of requests remains low, since public sector bodies are often not equipped to make the data available for use in a way that is compliant with data protection rules. At the same time, offers to public sector bodies (cities, hospitals) from large companies to collaborate on projects involving data can lead to situations in which the company gets de facto an exclusive access to the data. b)Lack of means to manage consent-based sharing of personal data at scale Individuals are increasingly willing to share their personal data for the common good and research. This is confirmed by a 2017 public consultation that gathered more than 1 400 replies, in which 81% of respondents believed that ‘sharing of health data could be beneficial to improve treatment, diagnosis and prevention of diseases across the EU’. In addition, in the 2019 Eurobarometer, six in ten respondents indicated that they would be willing to securely share some of their personal information to improve public services. Pilot initiatives for individuals to give access to their data for altruistic reasons do exist. They remain, however, limited in scale. One example is a citizen-driven model of collaborative governance and management of health data called Salus Coop. Other examples are the pilot projects in La Rochelle, Nantes and Lyon. Nantes has used data made available by citizens to develop an energy transition scheme for the city. La Rochelle intends to improve mobility services and public transport through insights gained from such data. Lyon aims to help socially excluded families and to simplify the life of citizens who do not speak French. During the COVID-19 crisis, the German Robert Koch Institut developed the Corona Datenspende-App, allowing individuals to provide their fitness tracker and smart watch data to help determine patterns of the spread of the virus . Such opportunities were already identified in the Villani Report, which recognised the potential of ‘civic data sharing’, i.e. data contributed by individuals for the benefit of public services or research. Despite these efforts, researchers, innovators and public sector organisations lack the means to collect personal data at scale, based on the consent of the data subject or following the exercise of their right to data portability provided by the GDPR. This is confirmed by the 2020 public consultation, which showed that almost 70% of participating citizens considered there are not enough mechanisms to give their consent to the processing of their data or they simply do not know about them (18.4%). Therefore, personal data sharing for the common good remains underdeveloped and it is difficult to establish sufficiently large data pools . There are currently no clear rules and processes in place in a large majority of the Member States that address the issue of data altruism. For health data, only Denmark has already put in place a data altruism mechanism and Germany plans to roll it out in 2023, while 15 EU Member States are viewing the idea favourably. A key barrier is that there are currently no mechanisms to examine and attest whether the organisations behind such schemes are trustworthy and actually use the data for the proclaimed altruistic purposes. 2.2.3 Technical obstacles to data reuse a)Interoperability problems for data use across sectors The 2019 workshops on common European data spaces highlighted a series of issues regarding standardisation within the different sectors. For instance, in industrial and agricultural settings, data and service providers have selected architectures, ways to describe the data and data formats for their platforms, which make it difficult to exchange data. This problem is even stronger at the cross-sectoral level. The value of data is often derived from combining datasets from diverse sources, possibly coming from different sectors. A 2018 study by Deloitte estimated that, depending on the sector, between 24% and 36% of the benefits of data sharing will come from sharing between the sectors. Standards are an important tool for this to happen, both from a technical and legal point of view. However, commonly accepted standards are failing to emerge in domains where stakeholders have conflicting interests. The OECD states that ‘one of the most frequently cited barriers to data sharing and reuse is the lack of common standards, or the proliferation of incompatible standards’. This is confirmed by the 2020 public consultation, where 91.5% of the respondents agreed that standardisation is necessary to improve interoperability and ultimately data reuse across sectors. Some 91.1% of respondents agreed that future standardisation activities need to better address the use of data across sectors of the economy or domains of society. b)Limited findability of data that is fit for a given purpose and the related uncertainty about data quality

Companies often struggle to find or obtain the data that they need. In the public online consultation on the Data Strategy, almost 80% of companies reported problems in data access. When asked about the nature of such difficulties, 43.5% of those companies signalled the ‘impossibility to find data of the relevant quality’ (multiple choices possible). In the course of targeted consultation activities undertaken in 2019 , stakeholders confirmed that findability of data is one of the main barriers to trading data. For example, stakeholders in the environmental field stated that, while there is no shortage of environmental data, these data are not easily findable, comparable and accessible, that there is a need for harmonised standards and work on data quality, and that these issues could be addressed through the common data spaces . The measurable cost of not having research data compliant with standards developed by the FAIR initiative (aiming to make research data findable, accessible, interoperable and reusable) is estimated at EUR 10.2 billion per year in Europe. Next to findability or discovery of existing data, information about the quality of data is key. It allows the reuser to assess whether certain data is fit for the given purpose. This is especially important for big data analytics and AI, including machine learning, to avoid bias in the results. A low level of data quality can have particularly severe consequences in certain sensitive domains, such as health or critical infrastructures. A 2018 study on data sharing between companies in Europe on behalf of the Commission confirmed the importance of data quality: 73% of the 129 companies surveyed indicated that poor or insufficient data quality hampers data sharing . In the 2020 online consultation, stakeholders also signalled this problem. As an example, the Netherlands Vehicle Authority (RDW) commented that: ‘The main condition to ensure the reuse of a dataset is availability in general, quality of data, quality of meta-data, findability, actuality and accuracy.’ 2.3.How will the problem evolve? According to the OECD, with the increasing use of AI and the Internet of Things (IoT) the supply of, and demand for, data will increase even in traditionally less data-intensive fields, and this to a level that very few organisations will be able to meet alone. Therefore, even in the absence of EU action, the use of data and data sharing are expected to grow, but would encounter the following limitations: 1. Consolidation of market actors’ power: without measures to overcome the generalised low trust and uncertainty related to data sharing, the high transaction costs (see 2.2.1) are unlikely to change. Big Tech platforms already enjoy a high degree of market power in several digital markets. In the absence of measures, including this initiative, they could enter the data-sharing market and offer services as data intermediaries without substantial competition - an evolution that some industrial players, for example in the banking sector, fear. Smaller companies would then be confronted with a business dilemma of not being able to offer new data-based services or products, or of sharing data through such Big Tech platforms even if this means losing some of the value of the data to the platforms. Some stakeholders consider the significant amounts of data held by Big Tech platforms to be the single biggest barrier to entry in the digital economy. 2. Full economic and societal value derived from data remains untapped: limited data availability would lead to less innovation in the EU and a slower development of AI, as underlined in the Villani Report. It is likely that the public sector in some Member States would facilitate the use of data that cannot be made available as open data, while others would not, thus creating a growing gap between the Member States. Data altruism would take off through more standalone initiatives, but this would not lead to data pools of the necessary scale and cross-border dimension. 3. Lack of cross-border data-driven innovation, products and services: cross-sector standardisation efforts would be slow or could be dominated by large players who are already working across the different sectors, as indicated in the support study for this Impact Assessment. Without a harmonised set of rules, Member States would continue to legislate in highly diverging ways, which would lead to an even more fragmented landscape. This would make it difficult for companies to develop pan-European products and services, and research results would not be representative for the whole of the EU. 4. Dependency on third countries: data research and the development of AI systems would move abroad, where rules are less stringent. The EU could experience a brain drain of professionals, researchers and companies moving their operations to third countries. The ambition to foster data infrastructures that would make Europe more autonomous, as announced in the Data Strategy, is also relevant for limiting the dependency on third countries. 3.Why should the EU act? 3.1.Legal basis This initiative is part of the 2020 European Strategy for Data that aims to reinforce the Single Market for Data. With a growing digitalisation of the economy and society, there is a risk of Member States increasingly legislating data-related issues in an uncoordinated way, which would intensify fragmentation in the internal market. Setting up the governance structures and mechanisms that will create a coordinated approach to using data across sectors and Member States would help stakeholders in the data economy to capitalise on the scale of the internal market. This would be in full respect of the provisions on anti-competitive practices and the ban on the abuse of dominant market power, as laid out in Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU). Thus, Article 114 TFEU is identified as the relevant legal basis for this initiative. 3.2.Subsidiarity: Necessity of EU action In the EU, the key sectors of the economy span across borders, with the suppliers, producers and clients established in different Member States. Data flows form an intrinsic part of digital activity and mirror these EU-wide supply chains and collaborations. Any initiative aiming to organize such data flows must address the EU single market in its entirety. Companies active in the data economy should be able to benefit from the size of the internal market by rolling out EU-wide products and services. Datasets available in individual Member States often do not have the richness and diversity to allow big data pattern detection or machine learning. In addition, data-based products and services developed in one Member State may need to be customised to the preferences of customers in another, and this requires local data. Data needs to be able to flow easily through EU-wide and cross-sector value chains, making it easier to launch a cross-border service or to replicate an existing data-based service from one Member State to another. As they become increasingly aware of the importance of data sharing, including the reuse of data held by public sector bodies, Member States have started to legislate on different aspects of the data economy. This creates a risk of legislative and administrative fragmentation. France, Germany and Finland, for example, are setting up administrative structures and processes to allow the reuse of publicly held data, the use of which is subject to the respect of rights of others. In Denmark, the Statistical Office has the role of granting permits for research to be carried out using several data sources, including smart metering information . Other Member States have not taken any legislative action in this field. EU action would offer a common vision to these national endeavours and ensure that the barriers and bottlenecks which are common across the entire EU economy can be tackled in a coherent manner across the internal market. EU-level intervention is ultimately best suited to increase the levels of data reuse across the economy, as it can lay down the elements that ensure comparable access and use conditions in all data spaces. It is unlikely that national intervention would be equally efficient. 3.3.Subsidiarity: Added value of EU action Considering the importance of economies of scale for the development of data technologies and services, coordinated action at EU level can bring greater value to the European economy and society than action by individual Member States. A Single Market for Data would ensure that data from the public sector, businesses and citizens can be accessed and used in the most effective and responsible manner possible, while businesses and citizens keep control of the data they generate and investments made into their collection are respected. Companies would be able to market their products and services in all Member States. Companies and research organisations would advance representative scientific developments and market innovation in the EU as a whole, which is particularly important in situations where EU coordinated action is necessary, like the COVID-19 crisis. Furthermore, only concerted action by the Member States can ensure that a European model of data sharing, with trusted data intermediaries for B2B data sharing and for personal data spaces, can take off. Mutual recognition of certification/labelling mechanisms and of a trust scheme for data altruism will make it possible to collect and use the data at the necessary scale. A ‘light touch’ enabling legislation, as proposed in this initiative, will ensure that the Member States move in the same direction and at the same speed. In the 2020 consultation, 86.4% of the respondents agreed that data governance mechanisms are needed to capture the potential of data, in particular for cross-sector data use. This shows a clear added value and relevance of EU intervention to establish a coordinated approach to data sharing.

4.Objectives: What is to be achieved? 4.1.General objective The general objective of this intervention is to leverage the potential of data for the economy and society. This would be brought about by facilitating a higher level of data sharing across the entire EU Digital Single Market. The economy would be boosted by increased innovation and competitiveness. Such benefits would, for example, materialise in terms of better and personalised products for customers and of important efficiency gains in industry. Society as a whole would benefit from evidence-based policies and from the availability of more data that would help to address societal challenges (e.g. combating climate change, improving healthcare systems, addressing the challenges of ageing societies across the EU). This initiative would lay the foundations to tackle the problem drivers identified in Chapter 2, and ensure that the Member States’ actions on data are aligned. It would benefit the different common European dataspaces, by: -increasing trust in data sharing; -strengthening mechanisms that increase data availability; -overcoming technical obstacles to the use of data. The initiative would underpin a new, ‘European’ approach for data that would work as an alternative to an integrated platform model, dominated by Big Tech but potentially also by any other player with a high degree of market power. The policy interest behind the advancement of such a model is to truly empower individuals to exercise their rights under the GDPR and to give companies more control over the data that they generate and over its value. Overview: Intervention logic. Source: European Commission 4.2.Specific objectives 4.2.1 Reinforcing trust in data sharing Trust is a key prerequisite for data sharing. Therefore, the first specific objective of the initiative is to create trust in data sharing as such. Common European dataspaces should become environments in which businesses and individuals can trust that the data they exchange or pool is secure and processed in compliance with applicable legislation as well as with the conditions they set on the use of such data. Where such a data space is organised by a specific intermediary, businesses and individuals should be able to trust those. When businesses prefer not to make recourse to an intermediary, they would benefit from a framework composed of technical standards and their related governance (‘data-sharing schema’) as an alternative means to create trust. Increased trust in data sharing and the citizens’ and companies’ assurance that their ‘sensitive data’ (personal data, commercially sensitive information) is processed in line with relevant legislation and the limitations they set in contractual obligations, would serve as an incentive to share the data with selected partners. Such assurances should also apply with respect to demands to access data by governmental authorities, including from third countries that do not comply with due process requirements. The considerations that are at the heart of the CJEU judgment in case C-311/18 (Schrems II), examining the impact of broad investigative powers of intelligence authorities and invalidating the Privacy Shield are very relevant in this context. 4.2.2 Making more public sector data available for reuse and facilitating the collection of data to be used for the common good The second specific objective is to make more data available for reuse for businesses, in particular SMEs and start-ups, public administrations and researchers, by addressing the problems caused by mainly the lack of institutional capacities and expertise in the public sector, as well as by the lack of mechanisms for collecting data for the common good. Actions should focus on data that could be made available for reuse by others on the basis of the existing legislative framework and where data holders could agree to this. This concerns i) data held by public sector bodies that cannot be made accessible as ‘open data’ but could be used under legal and technical restrictions/processed in trusted and secure environments, and ii) data that individuals would agree to make available for reuse for research, official statistics or other altruistic or innovative purposes. Targeted measures would address situations in which more technical, legal and organisational support would be necessary to make such data available. 4.2.3 Overcoming technical obstacles: improving data findability, data quality and data interoperability across sectors and countries Interoperability of data is a precondition for using the data in different contexts. Therefore, the third specific objective is to improve data interoperability to increase data sharing across sectors, Member States and different types of organisations.

First, interoperability and generic standards could allow data to be reused across sectors and Member States more smoothly. Second, businesses, researchers and other actors should be able to easily find the data they need and ascertain that the quality of such data is fit for purpose. Concerns about data quality affect all sorts of data-sharing situations, including for public interest purposes. This, together with the issues around interoperability, stand in the way of increasing data sharing. 5.What are the available policy options? In Chapter 2 the following problem drivers were identified: lack of trust in data sharing, issues related to the reuse of public sector data and collecting data for the common good, and technical obstacles to data reuse. The specific objectives defined in Chapter 4 aim to overcome these issues by: reinforcing trust in data sharing, making more data available for use in the common European data spaces, and overcoming technical obstacles. In order to achieve the specific objectives, four intervention areas were identified: -mechanisms to enhance the reuse of public sector data that cannot be made available as open data: these would ensure that more data from public sector databases becomes available for use in a trusted way, and would increase the findability of such data; -measures addressing data intermediaries, both in situations of B2B and C2B data sharing: this intervention area would increase trust in data sharing; -measures to facilitate data altruism: these would ensure that more data becomes available for the common good, and would increase trust in altruism schemes; -mechanisms to coordinate and steer horizontal aspects of data governance: these would contribute to overcoming technical problems, in particular issues related to interoperability. The work of the support study for this Impact Assessment was split into four separate streams, corresponding to these four intervention areas. A cost-benefit analysis and a multi-criteria analysis was carried out for each of the areas. The study gathered evidence through case studies and workshops (on the use of data subject to the rights of others and on possible structures of data governance) as well as market research (on data intermediaries) and legal analyses (in particular on data altruism). 5.1.What is the baseline from which options are assessed? In the baseline scenario, existing horizontal EU practices such as the exchange of good practices between sectors and Member States would continue. An EU study predicts that in the absence of policy and legal frameworks supporting the data economy, the value of the data economy, i.e. the overall impact of the exchange of data on the economy, would still increase from its current 2.6% of EU GDP, but only to 3.9% of EU GDP. On a more granular level, in the baseline scenario Member States would remain free to take their own approach with regards to the reuse of data held by public bodies and the use of which is subject to the rights of others. As a result, it is uncertain whether such data would become more available for reuse for research and development purposes. More likely, the currently observed difficulties in allowing the reuse of datasets containing personal data would remain unchanged. Likewise, interoperability issues across sectors and Member States would likely persist while data holders would have no incentive to ensure their data is of the highest possible quality and accuracy. Fragmentation as regards access to, and combination of, data of sufficient quality would continue. 5.2.Description of the policy options A number of possible policy options of different strengths can be considered. In addition to the ‘no action’ scenario, they vary from putting in place an EU-level coordination mechanism underpinned by non-binding acts to fully-fledged legislation. The legislative intervention in turn can be split into measures of lower and higher intensity, measured against the extent to which they deviate from the organisational and legal status quo. The range of options can be expressed as follows: ·Policy option 0: No horizontal action at EU level – baseline scenario ·Policy option 1: Coordination at EU level and soft regulatory measures ·Policy option 2: Regulatory intervention with low intensity

·Policy option 3: Regulatory intervention with high intensity The measures under all policy options would be combined with investments in common European data spaces foreseen under the Digital Europe programme (DEP) and the Connecting Europe Facility 2 (CEF). More specifically, the European Commission plans to invest EUR 2 billion to foster the development of data processing infrastructures, tools, architectures and mechanisms for data sharing and to federate energy-efficient and trustworthy cloud infrastructures and related services. In particular, the Commission will co-finance technical solutions (common standards, profiles and technical specifications) for federating European cloud capacities in order to ensure portability, trust, data protection, security and interoperability. Such funding is independent from this initiative, since it will support the creation of a technical infrastructure for the development of common European data spaces, without directly affecting the legal and governance arrangements for data sharing. On the other hand, the effects and the efficiency of the spending will be augmented by the impact of the legislation, which aims at reinforcing trust in data sharing and increasing the overall amount of data being shared. The assessment does not take into account the interplay with further legislative measures, in particular the Data Act, which will deal with the issue of fairness in data access and use, and the rights and obligations of persons and organisations on data. 5.2.1 Policy option 0: Baseline scenario - No horizontal action at EU level In the baseline scenario, no horizontal action is taken at EU level on data governance and interoperability of common European data spaces. However, action may be taken at sectoral or Member State level. 5.2.2 Policy option 1: Coordination at EU level and soft regulatory measures only EU coordination and soft measures have been used in the area of data sharing over the past decade, with limited impact. Under this scenario, the Commission would adopt a Recommendation or guidelines. An exchange of good practices could be organised between the Member States on an ad hoc basis. Investment actions would support the deployment of data infrastructures that can underpin the common European data spaces in specific sectors. 5.2.3 Policy options 2 and 3: Regulatory intervention with low or high intensity Policy options 2 and 3 consider regulatory intervention of low and high intensity respectively. Both policy options have similar objectives, but may lead to a different level of impact in terms of costs, benefits and administrative burden. Both regulatory options are presented together in the following sections in order to clarify the difference between them. A)Mechanisms for the enhanced reuse of public sector data This intervention would allow for more data to be made available for reuse. It builds on the experience of some Member States in the areas of statistics, mobility and health, which have spurred further data-driven innovation in their countries. The regulatory intervention would require that Member States ensure that public sector bodies set in place the organisational structures and mechanisms to enhance the use of public sector data, the reuse of which is conditional on the respect of rights of others, and which therefore cannot be made available for reuse under the Open Data Directive. This concerns public sector databases that include information on individuals or company information (e.g. information on financial systems, or on the approval of pharmaceutical drugs). Very few public sector bodies currently have mechanisms in place that allow certain types of data analyses (e.g. data mining) on such data. The policy options considered are as follows. ·Under the low intensity option, individual public sector bodies allowing the reuse of data subject to the rights of others would need to allow such reuse in line with a set of harmonised conditions. Member States would have to establish one single entry point (one-stop shop) through which reusers can contact public registers holding the data. The one-stop shop would provide advice to reusers. Member States would have to comply with a broad obligation to have capacity and services in place to facilitate further compatible uses of the data. They would be free to decide upon the exact form of these mechanisms, taking into account differences between individual sectors. In practice this would mean that a reuser from Member State A could contact the single entry point in country B to see how to get access to a certain type of data. The single entry point would channel the request to the relevant public sector body or bodies. These public sector bodies would receive technical and legal support for making re-use possible, but would remain responsible for the operations. Member States would have to invest in this support system. ·The high intensity option would oblige Member States to create one single data authorisation body as a central decision-making point. It would be competent to decide on all further compatible uses. In practice this would mean that reusers would be served by a single organisation that would offer technical solutions for querying the data (e.g. safe digital reading rooms, or mechanisms to bring algorithms to the data) and would, where relevant, issue permits for data re-use. This would require national legislation to be in place underpinning the operations of the organisation, including in terms of compliance with data protection legislation. It could also imply a change in the way in which public registries are managed. Both options would include a prohibition for exclusive arrangements for data held by the public sector and set out the conditions under which situations having de facto the effect of granting exclusive access would be lawful. This would avoid discriminatory practices, and in particular the risk that powerful players in the market get exclusive access to the data (e.g. health data). Neither option would create a right to re-use. They would both build on situations where re-use of the public data is allowed in the Member States for commercial or non-commercial purposes. In the design of the options, a number of dimensions were considered, such as centralisation of the decision-making on who can use what type of public register data as compared to the responsibility of individual bodies, and how to assist potential reusers (other than by centralising the decision-making). Under both options, Member States would have to ensure that these mechanisms comply with a number of harmonised, compulsory criteria that would ensure trust in the mechanisms, also across borders. Member States would be required to provide a secure data processing environment to allow innovative processing of data to which access can be granted under conditions controlled by the public sector (a ‘safe reading room for data’). Whenever data is being transferred to a reuser, assurances should be in place that ensure compliance with the GDPR and preserve the commercial confidentiality of the data. Both options would benefit from the use of the technical infrastructures and tools developed with the support of the DEP and CEF programmes to ensure interoperability between the solutions offered by Member States.

B)A certification/labelling framework for data intermediaries In order to lower transaction costs for data sharing or pooling within common European data spaces, businesses and/or individuals may want to have recourse to data-sharing intermediaries. In light of distrust in platform business models, novel service providers are emerging but with limited brand recognition. Their business model is based on transaction fees or regular subscriptions. It excludes own use of the data the exchange of which they offer to facilitate. The emergence of data intermediaries (providers of data-sharing services), such as ‘data marketplaces’, is largely supported by stakeholders. Almost 60% of respondents to the 2020 online consultation considered that they are useful enablers in the data economy. Both in reply to the online consultation and in a workshop on data intermediaries held in May 2020, stakeholders mentioned that this new type of facilitator would increase opportunities for cross-sectoral innovation. They underlinedthe importance of the neutrality of data intermediaries as a tool for businesses’ and individuals’ data sovereignty, contrary to what has been seen until today with existing data aggregators. A certification or labelling framework would allow novel data intermediaries to increase their visibility as trustworthy organisers/orchestrators of data sharing or pooling. Legislation would define a set of core criteria that should be met by all certified/ labelled intermediaries in order to demonstrate their neutrality: absence of conflict of interest, no competition with data users (e.g. no development of own data apps in competition with others, so as to avoid any risks of self-preferencing) and commitment to not discriminate between companies that would like to offer data services (openness obligation). Two types of intermediaries would be covered by this scheme: those addressing business users and those addressing individuals (providers of ‘personal data spaces’). Furthermore, they should be able to ensure through technical and organisational measures that the data are transferred in compliance with the stated preferences of the company or individual. The two policy options considered are as follows. ·Under the lower intensity option, labelling/certification would be voluntary for actors involved in data sharing. The awarded labels would be equally valid in all Member States. In practice, the provision of data intermediary services remains an unregulated activity. Data intermediaries could obtain a label or certificate in order to show that their business model is in line with a series of requirements set at the EU level. The label/certificate would not be a requirement for offering data intermediary services in the EU. ·Under the higher intensity option, the certification of providers of data-sharing services would be compulsory. A compulsory scheme would ensure that all data intermediaries operating in the Union would comply with the requirements. Certification would be complementary to existing certification frameworks (e.g. under the GDPR and the Cybersecurity Act). In practice, data intermediary services would have to comply with the requirements of the certification scheme before they would be able to start operating and offering data-sharing services. This would make data sharing a regulated activity. Under both options, the labels/certificates could be awarded by public authorities or by private conformity assessment bodies, based on criteria developed at the European level. Self-regulation was discarded, as a) there is no natural industry forum for this emerging market and b) it was deemed that the stakeholders involved would not be able to agree upon strict criteria of neutrality. Self-regulation would also potentially lead to the emergence of different solutions in different sectors and countries, thus increasing fragmentation. Currently there is no such self-regulatory certification scheme in place. C)Measures facilitating data altruism In order to address the lack of means to manage consent-based sharing of personal data and the availability of data in general, the regulatory intervention would require Member States to enable data altruism by putting in place the necessary laws and processes that allow companies and individuals to make their data available for the wider common good based on consent. As the 2020 online consultation showed, a large proportion of respondents (87%) consider that there are not sufficient mechanisms in place for altruistic data sharing, while 83.3% see the need for such enabling tools and mechanisms to be able to share their data for the common good. Thus, it is the lack of tools, not of willingness, that hampers data sharing for the common good. The two options considered are as follows. ·The lower intensity option would require that Member States have in place certification schemes for data altruism mechanisms and/or organisations offering such mechanisms. Certification would be voluntary. Certificates would be issued by private certification bodies, or by a public authority. Certification would be complementary to existing certification frameworks. In practice, an organisation engaging in data altruism could apply for certification to show that it is a trusted intermediary (this would be voluntary). The application would be handled by a public authority or a private certification body. ·The higher intensity option would require Member States to have in place an authorisation scheme for data altruism mechanisms and/or organisations offering such mechanisms. Organisations that seek to perform activities facilitating data altruism would have to comply with the requirements and seek authorisation before launching their operations. The authorisation would be compulsory, and would be handled and issued by a designated national authority (which could be an existing body). The authorisation could be general (allowing data activities to start upon notification) or ex ante (approval by the competent authority is a prior requirement for starting the activities). The granted authorisations would be equally valid in all Member States. Member States’ authorities would monitor compliance. As such, a mandatory authorisation regime would act as a filter and an entry barrier for entities that wish to start providing such mechanisms. It would create an intervention that is of higher intensity than a voluntary certification scheme. In practice, data altruism activities in the EU could only be carried out by organisations that have sought an authorisation from a public authority.

At the core of both options is the wish to ensure that data altruism mechanisms (operated by public sector organisations, NGOs and other private sector organisations) are truly altruistic. The scheme should prevent attempts to describe a data-sharing activity as altruistic, when in fact the consent to commercial usages is ‘hidden’ in long and hard-to-understand consent statements. Furthermore, organisations engaging in data altruism should be able to ensure through technical and organisational measures that the data are used in compliance with the stated preferences of the company or individual. In line with the rights conferred by the GDPR, these mechanisms for data altruism would be based on consent under Article 7 GDPR and build on the portability right provided by Article 20 GDPR. In line with the GDPR, they should also provide for individuals to withdraw consent for the processing of their data. Both options also foresee the development of a European data altruism portability and consent form similar to those existing in the field of blood, tissue and organ donation, which could be tailored to specific sectors and types of data, to be able to easily give and withdraw consent. For the higher intensity option, only a public authorisation scheme would qualify. This would be justified given the importance of trust and the nature of acts of data altruism, where people and companies are making their data (sometimes sensitive data) available for the common good (e.g. improving traffic conditions, contributing to health research). For the lower intensity regulatory intervention, both certification by a public authority and by private conformity assessment bodies are possible. For this lower intensity intervention, the Impact Assessment study focused on certification by private conformity assessment bodies, in view of assessing the impact of two clearly contrasting options, representing the key parameters at stake. As for the labelling/certification of data intermediaries under B), centralising the authorisation in a European body was discarded due to reasons of costs and political feasibility. D)Mechanism to coordinate and steer horizontal aspects of governance (European Data Innovation Board) A European Data Innovation Board would be created to coordinate efforts in Member States and at European level to support data-driven innovation, to lower transaction costs and prevent further sectoral fragmentation. It would coordinate national efforts to make more public sector data available, play a role in the certification or labelling of trusted providers of data-sharing services and take a lead in governing standardisation and the prioritisation on standardisation around data sharing, in particular across sectors. The achievements on prioritisation would feed into the Commission’s ICT rolling plan for standardisation. The two options considered are as follows. ·In the lower intensity option, the European Data Innovation Board would be a formal Expert Group, with a secretariat provided by the Commission. It would include among its members representatives of the sectoral data spaces and other interested parties, aiming for a balanced representation of the different sectors (avoiding duplication with existing expert groups). It would be responsible for facilitating the exchange of national practices and policies on data altruism and the use of public data that cannot be made available as open data, and advising on the prioritisation of standards for cross-sector data reuse for the Commission’s rolling plan for ICT standardisation, and on the establishment and maintenance of a schema of standards (technical and legal) related to problems common to all data-sharing situations irrespective of a sector. It would also be tasked with facilitating the exchange of national best practices on voluntary labels for trusted providers of data-sharing services. As a Commission expert group, it would include experts from authorities from each Member State. It would not interfere with the roles and powers of the Member State authorities, given that it would only advise the Commission and support it in facilitating the exchange of national practices. In practice, the European Data Innovation Board would advise and support the Commission on matters related to data sharing, focusing on cross-sector issues. ·In the higher intensity option, the European Data Innovation Board would be a self-standing European body with legal personality, in which representation of sectoral data spaces would be ensured. It would be supported by a secretariat. In addition to the above functions, it would supervise the award process of voluntary labels and, where relevant, authorisations performed by the designated Member State authorities. In this sense, the relationship between the Board and the Member State authorities would be closer, as they would be overseen by this European level body. It would keep a register of the organisations that obtained a label or authorisation. These functions go beyond the power of a Commission expert group and can only be entrusted to an independent body. In practice, the European Data Innovation Board would advise the Commission, but also carry out activities autonomously, including supervisory functions. In designing the options, the possibility of setting up an informal Commission expert group was also examined. It was found that the political importance of the subject matter warrants the establishment of a formal group or a self-standing independent body. The examples that served as inspiration both for the form and the tasks of the body are either formal expert groups (e.g. European Union Ecolabelling Board) or independent bodies (e.g. European Data Protection Board - EDPB, European Union Agency for Cybersecurity - ENISA). Bringing the required functions under the remit of the EDPB was also explored. The EDPB deals with the specific issue of personal data protection. Data sharing additionally requires expertise in competition law, and in sector-specific data access and usage regimes, as well as a technical knowledge of technical sharing mechanisms and standards. Also, the composition of the decision-making instance in the EDPB, currently composed of representatives of national data protection authorities, would need to be modified or at least complemented, which would require amending the legislative text of the GDPR. Therefore, this possibility was not discussed further. Summary table Policy options 2 and 3 for regulatory intervention with lower and higher intensity Intervention area Regulatory intervention with low intensity Regulatory intervention with high intensity Mechanisms for enhanced reuse of public sector data The reuse of public sector data that is subject to the rights of others would have to comply with basic EU-wide rules (in particular non-exclusivity). Individual public sector bodies allowing this type of reuse would need to be technically equipped to ensure that privacy and confidentiality are fully preserved. Member States should have a single entry point (one-stop shop) in place for persons or organisations that seek to reuse this data. Member States should have capacity and services in place to support public sector bodies for this type of reuse. The reuse of public sector data that is subject to the rights of others would have to comply with basic EU-wide rules (in particular non-exclusivity). Member States should create a single data authorisation body competent to licence further compatible uses of data contained in any public register that is subject to the rights of others. Certification/labelling framework for data intermediaries Voluntary labelling scheme for data intermediaries offering B2B data-sharing services and those offering personal data spaces. A key criterion to obtain the label/certification: the data intermediary cannot use the data as part of its business model. Compulsory certification scheme for data intermediaries offering B2B data-sharing services and those offering personal data spaces. A key criterion for obtaining the label/certification: the data intermediary cannot use the data as part of its business model. Measures facilitating data altruism Obligation on Member States to have legal and administrative arrangements in place to enable data altruism. Voluntary certification scheme for data altruism mechanisms and/or organisations offering such mechanisms. Certification issued by private certification bodies or a public authority. Obligation on Member States to have legal and administrative arrangements in place to enable data altruism. Compulsory authorisation scheme for data altruism mechanisms and/or organisations offering such mechanisms. Authorisation issued by a public authority. European Data Innovation Board The European Data Innovation Board would be a light coordination mechanism at EU level in the form of a formal Expert Group, hosted by the Commission. It would be composed of representatives of the Member States and of representatives for the different domains (health, statistics, etc). It would facilitate the exchange of national practices on the items covered by the legal instrument, and would address cross-sector standardisation issues. The European Data Innovation Board would be an independent European structure with legal personality and supported by a secretariat (e.g. inspired by the structure of EDPB). In addition to the functions under the lower intensity option, it would be tasked with supervisory functions and keeping registers of awarded labels and authorisations.

Source: European Commission Relation with sectoral initiatives: The relation between the horizontal framework and the sectoral initiatives is shown in the image at the end of Chapter 1. The horizontal framework will provide the building bricks for individual data spaces so that they can be established faster. The governance of the individual data spaces should, however, reflect the needs of the sector and the set-up of the stakeholder ecosystem and thus be defined by the sector itself and not be prescribed by the horizontal framework. A specific data space may have its own standards (which can be either EU standards or standards devised by stakeholders). Existing governance frameworks, such as the eHealth network in the area of health, will not be affected. The European Data Innovation Board will include representatives of individual common European data spaces as they emerge. The horizontal framework would leave room for sector-specific lex specialis rules. 5.3.Options discarded at an early stage No options were discarded from the outset. 6.What are the impacts of the policy options? 6.1.Economic impact The Impact Assessment support study considered as the baseline the total economic value of the data economy for the EU-27 in 2020, which is EUR 325 billion (2.6% of GDP). This number takes into account a correction linked to COVID-19’s impact on the overall EU economy. The graphs below illustrate the expected evolution, compared to the baseline scenario, of the direct economic value of data under the lower and higher intensity scenarios, as well as the preferred option of a package of lower and higher intensity interventions (see Chapter 8). The fact that the results of the top-down (based on contribution to GDP) and bottom-up (validation calculation based on cost-benefit analyses) approaches are almost identical confirms the solidity of the methodology. The graph shows the compared economic impact of the different policy packages for the indicated years. Policy package 1 includes low intensity regulatory intervention in all four areas, policy package 2 contains high intensity regulatory intervention in all areas, while policy package 3 denotes the preferred, mixed option. Source: SMART 2019/0024 In 2028, the value of the data economy would increase from EUR 533.5 billion (3.87% of GDP) under the baseline scenario: -to between EUR 540.5 and 544.0 billion if the lower intensity regulatory intervention was introduced (from 3.92% to 3.94% of GDP); -to between EUR 542.7 and 547.3 billion if the higher intensity regulatory intervention was introduced (from 3.93% to 3.97% of GDP). The impacts are calculated until 2025 on the basis of the value of the data economy as projected by the International Data Corporation (IDC) for the baseline. The IDC forecast projects a growth of the data economy of approx. 8% per year. The IDC forecast for the growth of the EU data economy, however, ends in 2025. In order to calculate impacts beyond 2025, the support study took a conservative approach and calculated the impacts on the basis of the GDP growth rate forecast of the OECD (1.5% per year). For this reason, the impacts beyond 2025 are based on a much lower per annum growth rate. At first sight, the gains (of between EUR 7 and EUR 10.5 billion for the lower intensity option and between EUR 9.2 and EUR 13.8 billion for the higher intensity option) seem relatively small compared to the overall size of the data economy that is taken as the baseline for the calculation. It should, however, be borne in mind that they are based on a conservative approach, focusing on the direct impact, and only to a very limited extent on the indirect impact, of the set of measures under consideration. Indeed, the calculations in the support study do not cover the full range of potential impacts of the measures on the economy and society. This also explains the large gap between the impact, as calculated in the impact assessment study, and more general studies that look at the potential of data sharing for the economy and society. Examples are the estimated EUR 1.3 trillion in increased productivity by 2027 in manufacturing through IoT data, or savings of approximately EUR 120 billion a year in the EU health sector. Ultimately, as estimated by the OECD, the economic value of improved data sharing could amount to up to 2.5% of GDP. This broader potential should be kept in mind when assessing the effects of the measures. The initiative is a necessary first step in the process of creating common European data spaces. It can make data markets in different sectors function better by creating trust. However, the full range of benefits from the measures rely on actors in the common data spaces seizing the opportunities offered by these building blocks. The measures taken by the initiative would act as a catalyst to increase data sharing across the EU. This would lead to the creation of more efficient services and new products based on data, including AI. This catalyst effect would not only benefit the data economy, but the EU economy and society as a whole. The Commission has announced that it intends to invest EUR 2 billion in data infrastructures through the DEP and CEF programmes. These investments in the creation of a European data sharing and processing infrastructure will lower the cost for technically implementing the policy options proposed in the current instrument. At the same time the proposed legislation will reinforce the impact of the investment by increasing trust and making more data accessible. The exact effect of the envisaged investments on the different options are hard to establish, and have not been taken into account into the calculations. The support study to this Impact Assessment shows that SMEs in particular stand to benefit from the initiative: in addition to benefits from higher interoperability, standardisation and simplified access to public sector data, they would benefit from the certification/labelling schemes. The one-off costs of certification/labelling (EUR 20 000-50 000 for a voluntary label, and EUR 35 000-75 000 for a compulsory certification) for data intermediaries would be countered by the high gains in both client base and revenue (25-50% increase). Member States would incur costs to establish the necessary mechanisms to provide services and to carry out the different tasks, in particular in relation to the measures to facilitate the use of public sector data that cannot be available as ‘open data’. However, as outlined below, the direct economic gains alone would outweigh these costs under both scenarios. Besides, Member States would recuperate a large part of the investments through fees for the different services related to reuse, and data holders would benefit from significant cost reductions.

A harmonised horizontal governance framework across the EU would create a level playing field for all the Member States. The initiative would ensure a minimum level of harmonisation across the EU, while leaving a certain leeway for the Member States in terms of how to organise public registries and authorisation mechanisms, building on existing structures. It would create certainty for data users across the EU and for those who want to make data available, and increase trust in data intermediaries and in mechanisms for making more data available for use. Even though some differences between the Member States would remain (e.g. in terms of the supply of public sector data), overall the measures would be an important step towards a more harmonised framework and the creation of a real internal market for data. The positive impacts of the initiative are expected to be spread across the EU rather than benefiting specific countries. Data-focused start-ups are emerging across the EU, in larger and in smaller Member States. For example, in Romania and Bulgaria the share of data companies’ total revenues in 2019 as part of the total revenues of all companies was 3.5% and 3.9% respectively, which is similar to France (3.8%) . Highly harmonised conditions for reuse would help reusers from all Member States, regardless of their size or economy. 6.1.1. Baseline scenario In the absence of EU intervention, the data economy would continue to grow to an estimated EUR 533.5 billion in 2028. Without an alternative European model, there would be a risk of platformisation and the hegemony of the Big Tech companies in this field. There would only be a moderate increase in data use, which would limit the capacity for productivity gains in all sectors, in particular in the traditional sectors that are currently undergoing a major paradigm shift due to data-driven innovation. Industry-driven initiatives paired with national initiatives to support data sharing in sectors that are key to the particular Member State (e.g. industrial manufacturing in Germany and France, logistics or agriculture in the Netherlands, forestry in Finland) would emerge, but remain limited in terms of impact. Companies would remain wary of data sharing: they would either encounter significant costs in doing it themselves, or face the choice of relying on integrated tech vendors (which would have stronger negotiating power) or on start-ups (with no brand recognition and capacity to become a relevant player in facilitating data sharing). Individuals may come across initiatives, for example driven by the research communities, asking them to make available data on altruistic grounds, but would not be provided with trusted means to do so. Similarly, researchers would be faced with uncertainty when collecting consent on this basis and would thus be more reticent to make use of this mechanism, resulting in losses in advances in science. Overall, this would lead to a scenario in which large, integrated tech companies that have already collected large volumes of data would further strengthen their position to decide on data access. They would become centre points of additional ecosystems as they expand into new activities such as health, insurance or finance. Furthermore, they would be able to reinforce their position by acquiring additional data or start-ups that are dependent on them. This would have an impact on the quality of machine-leaning outcomes (e.g. facial recognition algorithms), and result in concerns regarding data quality and bias. 6.1.2. Coordination at EU level and soft regulatory measures The impact of this policy option depends on the uptake of the Commission’s Recommendations or guidelines by Member States. Experience with the two existing soft law measures related to data sharing shows that, due to their non-binding character, they have been taken up with different intensities and at a different pace by actors in the data economy and Member States. Therefore, this policy option would be unlikely to provide the swift and harmonised action necessary for the EU to become a key player in this emerging market. Soft measures alone cannot be relied upon to prevent the further development of regulatory divergences between Member States. Additionally, coordination at EU level would also be achieved under policy options 2 and 3. Mechanisms to enhance the reuse of public sector data subject to the rights of others The impacts of this policy option would rely on the willingness of Member States to set up structures (such as a one-stop shop akin to the Health Data Hub, or a single data authorisation body like Findata), which would also be subject to a set of uniform conditions. According to a workshop organised in the context of the support study, only an estimated nine to 13 Member States would likely implement such recommendations. In addition, the level of ambition of such guidelines or recommendations would likely be inversely proportional to the number of Member States adopting them. Ensuring that similar requirements in relation to the use of such public sector data are available throughout the EU is a matter of legislation and cannot be achieved by soft law. Certification/labelling framework for data intermediaries Stakeholders interviewed in the context of the support study generally considered that this policy option would have little added value compared to the baseline scenario. Developing requirements for any label in this emerging market would be difficult as it was deemed that industry would not be able to agree upon strict criteria of neutrality. Moreover, soft measures would not guarantee a fair and representative selection of certification criteria/requirements for the various types of data intermediaries active in the EU. This policy option could lead to the adoption of different labels in the Member States and sectors and, thus, to further fragmentation. Measures facilitating data altruism Similarly to the baseline scenario, individuals would not have trusted means to share their data on altruistic grounds. The Commission could host expert exchanges and publish guidance to support individuals and researchers, who would also face uncertainty. Such guidance would, however, not provide sufficient assurances to consumers or researchers for concrete use-cases. Some interviewed Member States considered that an EU-level coordination mechanism for data altruism mechanisms would reduce their workload by avoiding multiple bilateral discussions, but would not necessarily accelerate the discussions. In addition, they considered that only the Member States that are already actively pursuing data altruism mechanisms would likely participate. Private sector interviewees considered that coordination at EU level could take very long and not result in concrete action. As adoption of the measures would be voluntary, this could widen the data altruism gap between different Member States and companies. Last, but not least, protecting individuals against data altruism mechanisms that are not truly altruistic is a matter of legislation and cannot be guaranteed by soft-law measures. European level mechanisms for coordination of standardisation The costs of an informal group of 10 experts participating in four 3-day meetings per year would amount to around EUR 24 000 per year. In addition, the employers of the participating experts would incur costs. The costs related to the adoption of standards would be borne by industry, as this option does not entail any mandatory standards. However, it was found that the creation of an informal expert group for governance aspects of data sharing would be unlikely to have any effects at all, due to its informal nature. Indeed, according to the study team’s estimates, it would increase the number of data users only by 0.1%.

Multi-criteria analysis A multi-criteria analysis (see Chapter 7) was not performed for this policy option because, as indicated above, its effectiveness is limited and dependent on uptake by Member States (and hence it is not quantifiable). Furthermore, during the interviews and workshops conducted with stakeholders in the context of the support study, shortcomings were identified for each intervention area. 6.1.3. Policy option 2: Lower intensity legislation This policy option entails the softer and less expensive options in all four intervention areas. The measures are expected to yield considerable benefits in the form of enhanced reuse of public sector data, elevated trust in data intermediaries and data altruism, as well as better coordination in the field of standardisation. Compared to the baseline scenario, it would also directly contribute to the growth of the data economy by between EUR 7 and EUR 10.5 billion in 2028. Mechanisms to enhance the reuse of public sector data subject to the rights of others – one-stop shop Under this option, public sector bodies which grant permissions for the reuse of data subject to the rights of others would need to be technically equipped in a way that ensures that privacy and confidentiality are fully preserved. Member States would have to set up a one-stop shop for reusers and support mechanisms to provide public sector bodies with the necessary legal and technical expertise. This option would foster trust through transparency between data reusers and data holders, as well as trust among the general public – particularly if the one-stop shop provides expert guidance to citizens on their rights under data protection laws. Benefits to public sector bodies, researchers and businesses as reusers include: ·Time and resources saved in identifying the data holder with the desired data and in accessing already interoperable data across sectors; ·Increased fairness in access to such data, i.e. all reusers would have equal access to valuable information on how to acquire permission to re-use that data, which would likely result in an increase in such reuse; ·Access to expert guidance, potentially resulting in time and resources savings related to legal training; ·Access to data of a higher quality (since holders would have an incentive to ensure quality knowing that the data would be reused) and potentially to better tailored data (since data holders would have a clearer views of reusers’ needs). Benefits to individual public sector bodies (as data holders) would include: ·Access to expert guidance, potentially resulting in time and resources savings related to legal training; ·Access to technical guidance on how to allow data reuse, resulting in a decreased risk of data breach and the associated costs; ·Time and resources saved by not providing, and maintaining, a secure data processing environment; ·Access to an increased amount of research resulting from a higher demand for such data – leading to better policymaking. In order to determine and calculate the costs and benefits of this intervention area, national experiences with such mechanisms (e.g. Findata, Centre d’accès sécurisé aux données, Forschungsdatenzentren) were taken into account.

Mechanisms to enhance the reuse of public sector data subject to the rights of others: Costs and benefits Costs Benefits One-off investment of €10.6 million for Member States to establish the mechanisms to handle the data and create the one-stop shops. Income across the Member States for providing services would amount to approximately €41.8 million per year (assuming an average fee of €500 per application). Annual maintenance costs for Member States of €600 000 per year. Public sector bodies across the EU would save around €684 million/ year due to the lower cost of data processing and management. Cost savings for reusers of €49.2 million /year as a result of easier reuse of data (e.g. easier data discovery). Voluntary certification/labelling scheme Data intermediaries would bear the cost of obtaining and maintaining the certification or label as well as implementation costs to ensure compliance with the requirements. However, as this would be a purely voluntary mechanism, SMEs would not be disproportionately burdened. Data reusers might be impacted by indirect transaction and implementation costs, as the certified intermediaries might increase the user charges to cover the cost of certification. The benefits mainly include the increased trust between actors, leading to further efficiency gains, time savings, increase of the client base and data transactions and therefore increase in revenues, allowing data intermediaries to scale up, both regarding gains in client base and revenue. As an indirect benefit, there would be a competition increase for data intermediaries in both the B2B and C2B markets. Certification/labelling would have a cumulative benefit in terms of company growth. Increased trust in the market could also lead to an increase in funding, as investors would consider it safer to invest in certified companies. Data holders would have the opportunity to monetise more from data sharing wh