EUROPEAN COMMISSION Brussels, 29.5.2019 COM(2019) 250 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL EMPTY Guidance on the Regulation on a framework for the free flow of non-personal data in the European Union



Contents 1 Introduction Purpose of this guidance 2 The interaction between the Free Flow of Non-Personal Data Regulation and the General Data Protection Regulation - mixed datasets 2.1 The concept of non-personal data in the Free Flow of Non-Personal Data Regulation Personal data Non-personal data 2.2 Mixed datasets 3 Free flow of data and the removal of data localisation requirements 3.1 Free flow of non-personal data 3.2 Free flow of personal data 3.3 Scope of the Free Flow of Non-Personal Data Regulation 3.4 Activities relating to internal organisation of Member States 4 Self-regulatory approaches supporting the free flow of data 4.1 The porting of data and switching between cloud service providers The notion of portability and the interaction with the General Data Protection Regulation 4.2 Codes of conduct and certification schemes on personal data protection 4.3 Enhancing trust in cross-border data processing – certification of security Final remarks

This document is provided by the European Commission for information purposes only. It does not contain any authoritative interpretation of the Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on a framework for the free flow of non-personal data in the European Union and it does not constitute a decision or position of the European Commission. It is without prejudice to any such decision or position of the European Commission and to the powers of the Court of Justice of the European Union to interpret the Regulation in accordance with the EU Treaties.



1 Introduction In an increasingly data-driven economy, data flows are at the core of business processes in companies of all sizes and in all sectors. New digital technologies are opening up new opportunities for the general public, businesses and public administrations in the European Union (the ‘EU’). To further increase the cross-border exchange of data and boost the data economy, in November 2018 the European Parliament and the Council adopted the Regulation (EU) 2018/1807 on a framework for the free flow of non-personal data in the European Union (the ‘Free Flow of Non-Personal Data Regulation’), based on a proposal from the European Commission (the ‘Commission’). The Regulation applies from 28 May 2019. The principle of free movement of personal data is already laid down in Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the ‘General Data Protection Regulation’). As a result, there is now a comprehensive framework for a common European data space and the free movement of all data within the European Union. The Free Flow of Non-Personal Data Regulation creates legal certainty for businesses to process their data wherever they want in the EU, raises trust in data processing services and counters vendor lock-in practices. This will increase customer’s choice, improve efficiency and stimulate the adoption of cloud technologies, leading to significant savings for businesses in EU. One study shows that businesses in EU can save 20‑50 % of their IT costs by migrating to the cloud. Thanks to the two Regulations, data can flow freely between Member States, allowing users of data processing services to use the data gathered in different EU markets to improve their productivity and competitiveness. Users can therefore take full advantage of the economies of scale provided by the large EU market, improving their global competitiveness and increasing the interconnectivity of the European data economy. The Free Flow of Non-Personal Data Regulation has three notable features: ·It prohibits, as a rule, Member States imposing requirements on where data should be localised. Exceptions to this rule may only be justified on grounds of public security in compliance with the proportionality principle. ·It establishes a cooperation mechanism to make sure that competent authorities continue to be able to exercise any rights they have to access data that are being processed in another Member State. ·It provides incentives for industry, with the support of the Commission, to develop self-regulatory codes of conduct on the switching of service providers and the porting of data. Purpose of this guidance This guidance fulfils Article 8(3) of the Free Flow of Non-Personal Data Regulation, which requires the Commission to publish guidance on the interaction between this Regulation and the General Data Protection Regulation, ‘especially as regards datasets composed of both personal and non-personal data’. This guidance aims to help users - especially small and medium-sized enterprises - understand the interaction between the Free Flow of Non-Personal Data Regulation and the General Data Protection Regulation. The guidance therefore particularly addresses: (i) the concepts of non-personal data and personal data; (ii) the principles of free movement of data and the prohibition of data localisation requirements under both Regulations; and (iii) the notion of data portability under the Free Flow of Non-Personal Data Regulation. It also covers self-regulatory requirements set out in the two Regulations. The Free Flow of Non-Personal Data Regulation only covers ‘data other than personal data’ as defined by the General Data Protection Regulation. The General Data Protection Regulation governs the processing of personal data, which is an essential part of the EU’s data protection framework. It entered into force in the Member States on 25 May 2018. The Regulation lays down harmonised rules to protect people in the EU/EEA with regard to the processing of their personal data and on the free movement of such data. The General Data Protection Regulation: (i) specifies what information constitutes personal data; (ii) establishes legal grounds for their processing; and (iii) defines the rights and obligations to be observed when processing these data, among other provisions. With regard to the principle of free movement of personal data, Article 1(3) of the General Data Protection Regulation provides that ‘the free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.’ In most real-life situations, a dataset is very likely to be composed of both personal and non-personal data. This is often referred to as a ‘mixed dataset’. Section 2.2 below further explains the interaction between the Free Flow of Non-Personal Data Regulation and the General Data Protection Regulation with regard to mixed datasets. For the sake of clarity, there are no contradictory obligations under the General Data Protection Regulation and the Free Flow of Non-Personal Data Regulation. 2 The interaction between the Free Flow of Non-Personal Data Regulation and the General Data Protection Regulation - mixed datasets 2.1 The concept of non-personal data in the Free Flow of Non-Personal Data Regulation

The Free Flow of Non-Personal Data Regulation aims to ensure the free flow of data other than personal data. Throughout its text, the Regulation uses the term ‘data’, which should be understood as ‘data other than personal data as defined in point 1 of Article 4 of the Regulation (EU) 2016/679 [the General Data Protection Regulation]’. Such data, also being referred to as ‘non-personal data’ in this document, are defined by opposition (a contrario) to personal data, as laid down by the General Data Protection Regulation. Personal data The General Data Protection Regulation reads: ‘“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.’ The broad definition of personal data is intentional and has remained essentially unchanged in the General Data Protection Regulation as compared to the previous legislation. Various aspects of the definition of personal data, such as ‘any information’, ‘relating to’, ‘identified or identifiable’, were already addressed by the Article 29 Working Party in its Opinion 4/2007 on the concept of personal data as of 20 June 2007, WP 136. It is common practice in areas like research, to pseudonymise personal data in order to disguise an individual’s identity. Pseudonymisation is the processing of personal data in such a way that it is not possible to attribute them to a specific person without the use of additional information. This additional information is kept separately and is secured through organisational or technical measures (e.g. encryption),. Nonetheless, data which have been pseudonymised are still considered information about an identifiable person if they can be attributed to this person by using additional information. Such data constitute personal data in accordance with the General Data Protection Regulation. Non-personal data Where the data are not ‘personal data’ as defined in the General Data Protection Regulation, they are non-personal. The non-personal data can be categorised by origin as: ·Firstly; data which originally did not relate to an identified or identifiable natural person, such as data on weather conditions generated by sensors installed on wind turbines or data on maintenance needs for industrial machines. ·Secondly; data which were initially personal data, but were later made anonymous. The ‘anonymisation’ of personal data is different to pseudonymisation (see above), as properly anonymised data cannot be attributed to a specific person, not even by use of additional data and are therefore non-personal data. The assessment of whether data is properly anonymised depends on specific and unique circumstances of each individual case. Several examples of re-identification of datasets that were supposedly anonymised have showed that such an evaluation may be demanding. To establish whether an individual is identifiable, one has to look on all means reasonably likely to be used by a controller or by another person to identify an individual directly or indirectly. Examples of non-personal data: ·Data which are aggregated to the extent that individual events (such as a person's individual trips abroad or travel patterns which could constitute personal data) are no longer identifiable, can be qualified as anonymous data Anonymous data are used for instance in statistics or in sales reports (for example to assess the popularity of a product and its features). ·High-frequency trading data in the finance sector, or data on precision farming which help to monitor and optimise the use of pesticides, nutrients and water. However, if non-personal data can be related to an individual in any way, causing them to be either directly or indirectly identifiable, the data must be considered as personal data. For example, if a quality control report on a production line makes it possible to relate the data to specific factory workers (e.g. those who set the production parameters), then the data would qualify as personal data and the General Data Protection Regulation has to be applied. The same rules apply when developments in technology and data analytics make it possible to convert anonymised data into personal data. As the definition of personal data refers to ‘natural persons’, datasets containing the names and contact details of legal persons are in principle non-personal data. However, in certain situations they may be personal data. This will be the case, if, for example, the name of the legal person is the same as that of a natural person who owns it or if the information relates to an identified or identifiable natural person. 2.2 Mixed datasets The Free Flow of Non-Personal Data Regulation and the General Data Protection Regulation approach the free movement of data in the EU from two different angles.

The Free Flow of Non-Personal Data Regulation lays down a general prohibition against data localisation requirements for non-personal data. Article 4(1) of the regulation prohibits data localisation requirements unless they are justified on grounds of public security in compliance with the principle of proportionality. The General Data Protection Regulation, in addition to ensuring a high level of protection of personal data, ensures the free flow of personal data. In accordance with Article 1(3) of the Regulation, the free movement of personal data ‘shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.’ Together, the two Regulations provide for the free movement of ‘all’ data within the EU. The specific provisions are further addressed in Section 3.1 and 3.2. A mixed dataset consists of both personal and non-personal data. Mixed datasets represent the majority of datasets used in the data economy and are common because of technological developments such as the Internet of Things (i.e. digitally connecting objects), artificial intelligence and technologies enabling big data analytics. Examples of mixed datasets: ·a company’s tax record, mentioning the name and telephone number of the managing director of the company; ·datasets in a bank, particularly those with client information and transaction details, such as payment services (credit and debit cards), partner relationship management (PRM) applications and loan agreements, documents mixing data concerning natural and legal persons; ·a research institution’s anonymised statistical data and the raw data initially collected, such as the replies of individual respondents to statistical survey questions; ·a company’s knowledge database of IT problems and their solutions based on individual IT incident reports; ·data related to the Internet of Things, where some of the data allow assumptions to be made about identifiable individuals (e.g. presence at a particular address and usage patterns); and ·analysis of operational log data of manufacturing equipment in the manufacturing industry. Example: customer relationship management services Some banks use customer relationship management (CRM) services provided by third parties that require a client's data to be made available in the CRM environment. Data held in the CRM service will include any information needed to effectively manage the interaction with the customer, such as their postal and email address, their phone number, the products and services they purchase, and sales reports, including aggregated data. These data can therefore include both personal and non-personal customer data. With respect to mixed datasets, the Free Flow of Non-Personal Data Regulation provides that: ‘In the case of a dataset composed of both personal and non-personal data, this Regulation applies to the non-personal data part of the dataset. Where personal and non-personal data in a dataset are inextricably linked, this Regulation shall not prejudice the application of Regulation (EU) 2016/679.’ This means that, in a case of a dataset composed of both personal and non-personal data: ·the Free Flow of Non-Personal Data Regulation applies to the non-personal data part of the dataset; ·the General Data Protection Regulation’s free flow provision applies to the personal data part of the dataset; and ·if the non-personal data part and the personal data parts are ‘inextricably linked’, the data protection rights and obligations stemming from the General Data Protection Regulation fully apply to the whole mixed dataset, also when personal data represent only a small part of the dataset. This interpretation is in line with the right to personal data protection guaranteed by the Charter of Fundamental Rights of the European Union and with Recital 8 of the Free Flow of Non-Personal Data Regulation. Recital 8 thereof provides that ‘the legal framework on the protection of natural persons with regard to the processing of personal data…, in particular [the General Data Protection Regulation]… and Directives (EU) 2016/680 and 2002/58/EC… are not affected by this Regulation.’

Practical example: A company operating within the EU offers its services via a platform. Businesses (customers) upload their documents, which contain mixed datasets on the platform. As a ‘controller’, the business uploading the documents needs to make sure that the processing complies with the General Data Protection Regulation. By processing the dataset on behalf of the controller, the company that offers the services (the ‘processor’) needs to store and process the data in compliance with the General Data Protection Regulation, for instance to make sure that an appropriate level of security related to data is guaranteed, including by means of encryption. The concept of ‘inextricably linked’ is not defined by either of the two Regulations. For practical purposes, it can refer to a situation whereby a dataset contains personal data as well as non-personal data and separating the two would either be impossible or considered by the controller to be economically inefficient or not technically feasible. For example, when buying CRM and sales reporting systems, the company would have to duplicate its cost on software by purchasing separate software for CRM (personal data) and sales reporting systems (aggregated/non-personal data) based on the CRM data. Separating the dataset is also likely to decrease the value of the dataset significantly. In addition, the changing nature of data (see Section 2.1) makes it more difficult to clearly differentiate and thus separate between different categories of data. Importantly, neither of the two Regulations obliges businesses to separate the datasets they are controlling or processing. Consequently, a mixed dataset will generally be subject to the obligations of data controllers and processors and respect the rights of data subjects established by the General Data Protection Regulation. Processing of health data Health data can be part of a mixed dataset. Examples include electronic health records, clinical trials or sets of data collected by various mobile health and wellbeing applications (such as applications for measuring our health status, for reminding us to take our medication or for tracking our fitness progress). The exact division between personal and non-personal data in these datasets is becoming increasingly blurred with technological developments. Consequently, their processing must comply with the General Data Protection Regulation, in particular (given that health data is a special category of data according to the Regulation) with Article 9, which lays out a general prohibition on the processing of special categories of data and exceptions from this prohibition. The data in mixed datasets containing health data can be a valuable source of information, e.g. for further medical research, for measuring the side effects of a prescribed medicine, for disease statistical purposes or for developing new healthcare services or treatments. However, the General Data Protection Regulation must be complied with when carrying out the initial processing operations and when carrying out further data processing operations. Therefore, any such processing of health data must have a valid legal basis and an appropriate justification, be secure and provide for sufficient safeguards. Finally, it is essential for individuals and companies to have legal certainty and trust in the processing of data. This is also vital for the data economy. The two Regulations ensure this and they both pursue the aim of not altering the free movement of data. 3 Free flow of data and the removal of data localisation requirements This section explains the concepts of data localisation requirements under the Free Flow of Non-Personal Data Regulation and of the free movement principle in the General Data Protection Regulation in more detail. Although these provisions target the Member States, it can be informative for businesses to have a more accurate picture of how these two Regulations contribute to the free movement of all data within the EU. 3.1 Free flow of non-personal data The Free Flow of Non-Personal Data Regulation provides that ‘data localisation requirements shall be prohibited, unless they are justified on grounds of public security in compliance with the principle of proportionality.’ Data localisation requirements are defined as ‘any obligation, prohibition, condition, limit or other requirement provided for in the laws, regulations or administrative provisions of a Member State or resulting from general and consistent administrative practices in a Member State and in bodies governed by public law, including in the field of public procurement, without prejudice to Directive 2014/24/EU, which imposes the processing of data in the territory of a specific Member State or hinders the processing of data in any other Member State.’ The definition illustrates that the measures restricting the free movement of data within the EU can take various forms. They may be set out in laws, in administrative regulations and provisions or even result from general and consistent administrative practices. In addition, the prohibition of data localisation requirements covers both direct and indirect measures that would restrict the free movement of non-personal data. Direct data localisation requirements may consist of, for example, an obligation to store data in a specific geographic location (e.g. servers must be located in a particular Member State) or an obligation to comply with unique national technical requirements (e.g. data must use specific national formats). Indirect data localisation requirements, which would hinder the processing of the non-personal data in any other Member State, can come in a variety of forms. They may include requirements to use technological facilities that are certified or approved within a specific Member State or other requirements that have the effect of making it more difficult to process data outside of a specific geographic area or territory within the European Union,. The assessment of whether a specific measure represents an indirect data localisation requirement needs to consider the specific circumstances of each case. The Free Flow of Non-Personal Data Regulation refers to the concept of public security as outlined by the case law of the Court of Justice of the European Union. Public security ‘covers both the internal and external security of a Member State, as well as issues of public safety, in order, in particular, to facilitate the investigation, detection and prosecution of criminal offences. It presupposes the existence of a genuine and sufficiently serious threat affecting one of the fundamental interests of society, such as a threat to the functioning of institutions and essential public services and the survival of the population, as well as the risk of a serious disturbance to foreign relations or the peaceful coexistence of nations, or a risk to military interests.’

Additionally, any data localisation requirement justified by public security reasons must be proportional. In accordance with the Court of Justice of the European Union’s case law, the principle of proportionality requires that the measures adopted are appropriate for ensuring that the pursued objective is met and do not go beyond what is necessary for that purpose. For the sake of clarity, the prohibition of data localisation requirements is without prejudice to already existing restrictions laid down by EU law. Moreover, the Free Flow of Non-Personal Data Regulation does not impose any obligations on businesses or limit their contractual freedom to decide where their data are to be processed. The Member States are required to make details of any data localisation requirement applicable in their territory publicly available on a national online single information point (national websites). They must keep this up-to-date or provide up-to-date details to a central information point established under another EU act. For the convenience of businesses and to provide for their easy access to relevant information across the EU, the Commission will publish links to these information points on the Your Europe portal. 3.2 Free flow of personal data The General Data Protection Regulation provides that ‘the free movement of personal data within the Union cannot be restricted nor prohibited for reasons connected with the protection of natural persons with regard to processing of personal data.’ If a Member State imposes localisation requirements on personal data for reasons other than the protection of personal data, they will have to be assessed against the provisions on the fundamental freedoms and the permitted grounds to derogate from those freedoms in the Treaty on the Functioning of the European Union, and relevant EU legislation, such as the Services Directive and E-commerce Directive. Example: A national law requires that payroll accounts are located in a particular Member State for reasons related to regulatory control e.g. by the national tax authority. Such a national provision would fall outside the scope of Article 1(3) of the General Data Protection Regulation as the reasons are other than the protection of personal data. Instead, this requirement would have to be assessed against the provisions on fundamental freedoms and the permitted grounds to derogate from those freedoms in the Treaty on the Functioning of the European Union. The General Data Protection Regulation recognises that Member States may impose conditions, including limitations, on the processing of genetic data, biometric data or health data. However, as stated in Recital 53 such national limitations should not hamper the free flow of personal data within the EU when these conditions apply to the cross-border processing of such data. This is in line with Article 16 of the Treaty on the Functioning of the European Union, which provides the legal basis for the adoption of rules relating to the right to the protection of personal data and the rules relating to the free movement of such data. 3.3 Scope of the Free Flow of Non-Personal Data Regulation As already mentioned, the Free Flow of Non-Personal Data Regulation aims to ensure the free flow of non-personal data ‘within the Union’. It therefore does not apply to processing operations taking place outside of the EU and to data localisation requirements relating to such processing,. The scope of the Regulation is, in accordance with Article 2(1), therefore limited to the processing of electronic non-personal data in the EU, which is: (a)provided as a service to users residing or having an establishment in the EU, regardless of whether or not the service provider is established in the EU; or (b)carried out by a natural or legal person residing or having an establishment in the EU for its own needs. Examples: Article 2(1)(a) of the Free Flow of Non-Personal Data Regulation: ·A cloud service provider established in the USA provides its processing services to customers residing or established in the EU. The cloud service provider administers its activities via servers located in the EU territory, where the data of its European customers are stored or otherwise processed. The cloud service provider does not have to own EU-based infrastructure, but can e.g. also rent server space in the EU. The Free Flow of Non-Personal Data Regulation applies to such data processing. ·A cloud service provider established in Japan offers its services to European customers. The processing capacities of the provider are located in Japan and all the processing activities take place there. The Free Flow of Non-Personal Data Regulation does not apply in this case, if all the processing activities take place outside of the EU.

Article 2(1)(b) of the Free Flow of Non-Personal Data Regulation: ·A small European start-up from Member State A decides to scale-up its business by opening an establishment in Member State B. To minimise costs, this start-up chooses to centralise the data storage and processing of the new establishment in its server that is located in Member State A. Member States may not forbid such IT-centralisation efforts, except when justified on the grounds of public security in compliance with the principle of proportionality. Although the Free Flow of Non-Personal Data Regulation does not apply if all processing activities for non-personal data are carried out outside of the EU, the General Data Protection Regulation must be respected when personal data are part of the dataset. In particular, the rules for the transfers of personal data to third countries or international organisations under the General Data Protection Regulation must be complied with in any instance. 3.4 Activities relating to internal organisation of Member States The Free Flow of Non-Personal Data Regulation does not oblige Member States to outsource the provision of services related to non-personal data that they wish to provide themselves or to organise them by means other than public contracts. Article 2(3) second subparagraph of the Free Flow of Non-Personal Data Regulation states: ‘This Regulation is without prejudice to laws, regulations, and administrative provisions that relate to the internal organisation of Member States and that allocate, among public authorities and bodies governed by public law defined in point (4) of Article 2(1) of Directive 2014/24/EU powers and responsibilities for the processing of data without contractual remuneration of private parties, as well as the laws, regulations and administrative provisions of Member States that provide for the implementation of those powers and responsibilities.’ There may be legitimate interests that would warrant choosing this kind of ‘self-provisioning’ of data processing services, such as ‘insourcing’ or mutual arrangements between public administrations. Typical examples include the use of a ‘government cloud’ or a government engaging a centralised IT agency to provide data processing services for public institutions and bodies. However, the Free Flow of Non-Personal Data Regulation encourages the Member States to consider the economic efficiency and other benefits of using external service providers,. As soon as the national authorities start ‘outsourcing’ the data processing with the contractual remuneration of private parties, and the processing takes place in the EU, such processing is covered by the Free Flow of Non-Personal Data Regulation, meaning that the principle of the free flow of non-personal data applies to general and administrative practices of the national authorities. Notably, they have to refrain from making data localisation restrictions, e.g. in tenders for public procurement 4 Self-regulatory approaches supporting the free flow of data Self-regulation contributes to innovation and trust among market players and has the potential to be more responsive to changes in the market. This section gives an overview of self-regulatory initiatives for the processing of both personal and non-personal data. 4.1 The porting of data and switching between cloud service providers One of the purposes of the Free Flow of Non-Personal Regulation is to avoid vendor lock-in practices. These practices occur when users cannot switch between service providers because their data is ‘locked’ in the provider’s system, for instance due to a specific data format or contractual arrangements, and cannot be transferred outside of the vendor's IT system. Porting data without hindrance is important to allow users to choose freely between providers of data processing services and thus ensure effective competition in the market. Data portability between businesses is becoming increasingly important across a wide range of digital industries including cloud services. According to Article 6 of the Free Flow of Non-Personal Data Regulation, the Commission shall encourage and facilitate the development of self-regulatory codes of conduct at EU level (‘codes of conduct’) in order to contribute to a competitive data economy. It provides a basis for the industry to develop self-regulatory codes of conduct on the switching of service providers and the porting of data between different IT systems. A number of aspects should be taken into account when developing such codes of conduct on the porting of data, notably: ·best practices for facilitating the switching of service providers and the porting of data in a structured, commonly used and machine-readable format; ·minimum information requirements to ensure that the professional users, before a contract is concluded, are provided with sufficiently detailed and clear information about the processes, technical requirements, timeframes and charges that apply in case a professional user wants to switch to another service provider or the porting of data back to its own IT systems; ·approaches to certification schemes for better comparability of cloud services; and ·communication roadmaps to raise awareness of the codes of conduct.

In the cloud services market, the Commission has started to facilitate the work of the Digital Single Market (DSM) cloud stakeholder working groups, which brings together cloud experts and professional users, including small and medium-sized enterprises. At this stage, one sub-group is developing self-regulatory codes of conduct on the porting of data and switching between cloud service providers (SWIPO working group), and another sub-group working on developing cloud security certification (CSPCERT working group) The SWIPO working group is developing codes of conduct covering the whole spectrum of cloud services; Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). The Commission expects the different codes of conduct to be complemented by model contractual clauses. These will allow sufficient technical and legal specificity in the practical implementation and application of the codes of conduct, which will be of particular importance for small and medium-sized enterprises. The drafting of the model contractual clauses is planned after the development of the codes of conduct (which should be done by 29 November 2019). In line with Article 8 of the Free Flow of Non-Personal Data Regulation, the Commission will evaluate the implementation of the Regulation by 29 November 2022. This will make it possible to assess: (i) the impact on the free flow of data in Europe; (ii) the application of the Regulation, especially to mixed datasets; (iii) the extent to which the Member States have effectively repealed existing unjustified data localisation restrictions; and (iv) the market effectiveness of codes of conduct in the area of porting of data and switching between cloud service providers. The notion of portability and the interaction with the General Data Protection Regulation Both Regulations refer to data portability and the aim to make it easier to port data from one IT environment to another one, i.e. either to another provider’s systems or to on-site systems. This prevents vendor lock-in and fosters competition between service providers. However, the Regulations differ in their approach to portability when it comes to the relationship between the targeted interest groups and the legal nature of the provisions. The right to portability of personal data under Article 20 of the General Data Protection Regulation focuses on the relationship between the data subject and the controller. It concerns the right of the data subject to receive personal data which he or she has provided to the controller, in a structured, commonly used and machine-readable format, and to transmit those data to another controller or to their own storage capacities without hindrance from the controller to which the personal data have been provided. Typically, the data subjects in this relationship are consumers of various online services that wish to switch between these service providers. Article 6 of the Free Flow of Non-Personal Data Regulation does not provide for a right for professional users to port data, but has a self-regulatory approach, with voluntary codes of conduct for the industry. At the same time, it targets a situation where a professional user has outsourced the processing of its data to a third party offering a data processing service.In accordance with Article 3(8) of the Free Flow of Non-Personal Data Regulation, a ‘professional user’ can include ‘both natural and legal persons, including public authorities or bodies governed by public law, using or requesting a data processing service for purposes related to their trade, business, craft, profession or task.’ In practice, the portability under Article 6 of the Free Flow of Non-Personal Data Regulation concerns business-to-business interactions between a professional user (which may in cases that include processing of personal data qualify as ‘controller’ in accordance with the General Data Protection Regulation) and a service provider (similarly, to be qualified in some cases as ‘processor’). Despite the differences, situations may arise where the porting of data would be covered by both the Free Flow of Non-Personal Data Regulation and the General Data Protection Regulation in relation to mixed datasets. Example: A business using a cloud service decides to switch its cloud service provider and to port all the data to a new provider. The switching of the service provider and porting of the data is covered in the contract between the customer and the cloud service provider. If the old cloud service provider adheres to the codes of conduct developed under the Free Flow of Non-Personal Data Regulation, the porting of data has to take place in compliance with requirements specified therein. If the personal data are also part of the ported datasets, the porting needs to comply with all the relevant provisions of the General Data Protection Regulation, in particular ensuring that the new cloud service provider complies with the applicable requirements, such as security. Example: In a case where a bank decides on changing its customer relationship management (CRM) provider, it is possible that some (personal and non-personal) data must be migrated from the old provider to the new one. This data will then be subject to different regulatory requirements, some stemming from the General Data Protection Regulation and other from the Free Flow of Non-Personal Data Regulation. 4.2 Codes of conduct and certification schemes on personal data protection Codes of conduct and certification schemes may by be used to demonstrate compliance with the obligations under the General Data Protection Regulation (see Articles 24(3) and 28(5)). In accordance with Article 40(1) and 42(1) of the General Data Protection Regulation, the Member States, the supervisory authorities, the European Data Protection Board and the Commission should encourage the industry to develop codes of conduct and to establish data protection certification mechanisms. Associations or other bodies representing a specific category of controllers or processors, may prepare a code of conduct for the specific sector. A draft of the code needs to be submitted to the respective competent supervisory authority for approval. If the draft code of conduct relates to processing activities in several Member States, the supervisory authority must submit it to the European Data Protection Board before approving it. The Board will then give its opinion on whether the draft code complies with the General Data Protection Regulation.