Opinion of the European Committee of the Regions — Building a European Data Economy
Date: 2017-10-11
Institutions: Commission for Social Policy, Education, Employment, Research and Culture, European Committee of the Regions
Subjects: EU policy, access to information, computer crime, cross-frontier data flow, data processing, digital technology, knowledge economy, protection of communications, technological change








C_2018054EN.01004301.xml










13.2.2018   


EN


Official Journal of the European Union


C 54/43





Opinion of the European Committee of the Regions — Building a European Data Economy
(2018/C 054/09)












Rapporteur:



Kieran McCarthy (IE/EA), Cork City Council





Reference document:



Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions — Building a European Data Economy
COM(2017) 9 final









POLICY RECOMMENDATIONS

THE EUROPEAN COMMITTEE OF THE REGIONS

Building a European Data Economy: the challenge ahead









1.


underlines the pivotal role of local and regional authorities (LRAs) in implementing the recommendations of the Digital Single Market (DSM), providing digital services for citizens and creating and managing digital infrastructure such as data generation. Digital services also represent the engine of economic growth at local and regional level offering wide-ranging opportunities for innovation, SME creation and entrepreneurship, job creation and societal progress;












2.


shares the European Commission’s view that the EU and Member States should be forerunners, spearheading efforts at European, national and local level in close collaboration with LRAs to bring about greater transformation in governmental procedures and structures by using ICT and data generation to improve the meaningfulness, quality and productivity of work and efficiency of public authorities and to reduce red tape for the general public and business;












3.


asks the Commission to support LRAs in their financing activities, by continuing to authorise priority deployment of the ESIF towards digital infrastructure such as data development and skills development in all European regions, and by recognising technological barriers to digital development projects in rural, mountainous, islands and sparsely-populated areas, which should be seen as services of general economic interest;












4.


points out that disadvantaged regions have neither the basic infrastructure nor the expertise needed to establish a digital data-driven economy and recommends, in this regard, that regulatory assistance be provided for these regions to help them gain access to the European digital single market;












5.


recognises that the collation of data is an important element of the DSM. This emerging global trend holds enormous potential for LRAs and businesses in various fields, ranging from health, environment, food security, climate and resource efficiency to energy, intelligent transport systems and smart cities and regions;












6.


welcomes the Commission’s announcement to tackle restrictions on the free movement of data for reasons other than the protection of personal data within the EU and unjustified restrictions on the location of data for storage or processing purposes;












7.


agrees that the exchange of data currently remains limited. Data market places are slowly emerging, but are not widely used by the public or private sector or through public-private partnerships. Potential users may not be equipped with the right tools and skills to quantify the economic value of their data, and they may fear losing or compromising their competitive advantage when data becomes available to competitors. The owner of the data loses nothing from sharing it: on the contrary, sharing knowledge increases the value of the data;












8.


notes the diversity of data sources and types that are generated by machines or processes and based on emerging technologies, such as the Internet of Things (IOT). These present rich opportunities for different types of market players to scale up IOT enabling technologies, ideas and products — such as manufacturers, researchers and infrastructure providers and in particular smart cities and regions being developed under the remit of LRAs;












9.


insists that the opening-up of machine-read data enhances data sharing and reduces the need for ad hoc and often costly data requests. Sets of comprehensive indicators inform public debate and better decision-making locally and can positively change how policy is developed, delivered, managed and monitored at local and regional authority level;












10.


emphasises that cities and regions have a key role to play in creating data bases of public information, providing data security, in the development of the necessary digital skills, in securing and facilitating funding for broadband infrastructure and networks. The right environment for trans-regional and cross-border exchange of online services can substantially support the creation of high-level services and the data economy;












11.


stresses the contribution that the local and regional level can also make at all stages of collecting data and providing services to citizens and businesses. This includes support for digital and entrepreneurial skills to make full use of new technologies, analysing big data, understanding issues of cybersecurity, increasing their employability and creating new business opportunities. This can be seen in practice in cities and regions of Europe with their good examples of cooperation with national authorities and research centres in the field of public sector innovation and interoperability;












12.


welcomes the EU Commission-led and ERDF-funded Urban Innovative Actions programme whereby cities can identify and test innovative solutions such as data generation for sustainable urban development;












13.


points out that LRAs must have extensive and effective input into laws that will affect their data economy competences; any new regulation can introduce unnecessary red tape and costs for municipalities and regions which in the Committee’s view are not offset by the benefits to citizens;





Balancing transparency and restriction









14.


highlights that citizens expect strong and effective data protection standards, especially in the digital single market. Data protection should never be considered as a barrier but as an integral part of the digital single market. A clear and adapted data protection legal framework for the data economy is therefore crucial;












15.


stresses that it is important to distinguish whether such machine-generated data is personal (i.e. related to a living person) and so subject to the General Data Protection Regulation (GDPR), non-personal or indeed represents a combination of both;












16.


calls for the EU regulatory framework to stay fit for purpose in the digital environment to support innovation, and to exploit the full potential of the Single Market, and investment in the EU economy;












17.


supports the need to provide certainty to both users and manufacturers of data generating devices in relation to their potential liability;












18.


supports the point that the EU needs to make sure that data flows across borders and across sectors, and can be accessed and re-used in an optimal way. A coordinated European approach is essential for the development of the data economy as part of the Digital Single Market;












19.


welcomes the Commission’s vision to use EU trade agreements to set rules for e-commerce and cross border data flows and to tackle new forms of digital protectionism in full compliance with and without prejudice to the EU’s data protection rules;












20.


recognises that to realise the full potential of the European data economy, any Member State action affecting data storage or processing should be guided by a ‘principle of free movement of data within the EU’, as a consequence of their obligations under the free movement of services and the free establishment provisions of the Treaty and relevant secondary legislation;





Fostering the potential of General Data Protection Regulation









21.


welcomes the General Data Protection Regulation (GDPR) and agrees that privacy concerns are legitimate. Strong data-protection rules create the trust that will allow the digital economy to develop across the internal market and for forms of ICT vulnerability and potential virtual criminality to be addressed and effective and coherent preventative strategies to be created;












22.


supports the revised ePrivacy Directive that is proposed to ensure a high level of protection in full coherence with the GDPR;












23.


recommends the availability of data for regulatory or supervisory purposes, which is not called in any way into question, would be better ensured by enhancing the cooperation between national authorities and LRAs, or between such authorities and the private sector, rather than through localisation restrictions;












24.


recognises the real enablers of secure data storage and processing are state-of-the-art ICT management best practices on a scale far larger than individual systems;












25.


stresses that the new package should help improve the prevention, detection and response to cyber incidents and lead to better information sharing and coordination between Member States and the Commission against major cyber incidents. Achieving this will require genuine partnership working involving Member States, EU institutions, local and regional authorities (LRAs), the private sector and civil society;












26.


believes that given that breaches of security are a threat to utility services e.g. transport networks, local water, electricity grid, energy, and given that LRAs use and own many digital information products and services, LRAs have a key role to play in tackling cybercrime, collating cyber-related data and protecting data security;












27.


highlights that cyberattacks tend to exploit one of five major vulnerabilities of digital technologies that are central to smart cities and regions. These include weak software security and data encryption, use of insecure legacy systems and poor maintenance, many interdependencies and large and complex attack surfaces, cascade effects, wherein highly interconnected entities rapidly transmit adverse consequences to each other, and multiple vulnerabilities arising from human error and deliberate malfeasance of employees;












28.


stresses that security vulnerabilities in data generation means that cyberattacks on important urban infrastructure and city management systems have been increasing with implications for human safety and security. A wider set of systemic and coordinated interventions are required that encompass mitigation, prevention, and ensures enactment through both market-led initiatives and governance-led regulation and enforcement;












29.


stresses that the security of the Internet of Things is highly variable, with some systems lacking encryption or usernames and passwords, and others open to infection by malware and firmware modification. The complex interdependencies of IoT mean that it has a large attack surface and multiple vulnerabilities;












30.


notes that within local and regional government and public service/infrastructure providers, advanced security training should be developed and implemented across organisations, but especially for those involved in the e-procurement, rollout and daily running of smart city technologies;












31.


advocates a widening and deepening of mitigation strategies to include security-by-design as a de facto approach for all future smart cities and regions procurement. Such strategies should include a comprehensive assessment of existing urban infrastructures and information systems and remedial security patching or replacement, the formation of core security and computer emergency response teams within city administrations with specialist skills and responsibilities beyond general IT-administration, and a step-change in security training and continuing professional development in both public and commercial sectors;





Developing the generation of data flows









32.


underlines that personal data generation raises questions in all policy areas of local and regional government. LRAs are data developers and controllers — such data is cross-sectoral and touches on areas such as security and justice policy, the economy, communications, education, health, administration, transport, the environment and consumer protection;












33.


emphasises the need for traceability and the clear identification of data sources as a precondition for real control of data in the market. Reliable and possibly standardised protocols for persistent identification of data sources can be necessary to create trust in the system;












34.


supports the idea that LRAs should be granted access to data where this would be in the ‘general interest’ and would considerably improve the functioning of the public sector, for example the optimisation of traffic management systems on the basis of real-time data from private vehicles;












35.


agrees with the prioritisation that any policy measure must take account of this economic reality and of the legal framework on the protection of personal data, while respecting the fundamental rights of individuals;












36.


highlights that comprehensive policy frameworks do not currently exist at local, national or EU level in relation to raw machine-generated data which does not qualify as personal data, or to the conditions of their economic exploitation and tradability;












37.


warns also against imposing excessive constraints on individuals in the exercise of their right to control their own information in order to increase the protection of personal data, depriving them of the possibility of giving consent, particularly in relation to LRAs;












38.


notes the key responsibility of independent data protection authorities for the protection of personal data and the need for additional incentive instruments for processors to reward efforts for data protection i.e. by facilitating the burden of proof for processors who submit to demanding self-regulation standards or codes of conduct;












39.


calls for the legal uncertainties around raw machine-generated data and the lack of intellectual property rights to be addressed. Advantage may be taken of gaps in the regulatory framework, or of the legal uncertainties described above, by imposing unfair standard contract terms on the users or through technical means, such as proprietary formats or encryption;





Improving interoperability









40.


agrees that emerging issues in the data economy are the portability of non-personal data, the interoperability of services to allow data exchange, and appropriate technical standards for implementing meaningful portability;












41.


acknowledges the commitment to support appropriate standards to improve interoperability, portability and security of cloud services, by better integrating the work of open source communities into the standard-setting process at European level;












42.


welcomes the robust approach to portability rules encoded through standards. Notes the scope for sector-specific experimental approaches to be launched and calls for LRAs to be involved in the multi-stakeholder collaboration, which includes standard setters, industry, and the technical community;












43.


insists that a broader understanding of interoperability as something not only relevant to public administration, but to all sectors is essential for the deployment of the IoT and the seamless flow of data across all regions. Availability of common formats, standards and specifications are clear requirements and the regions are contributing to this by undertaking to apply the provisions of the directives on public sector information and, in particular, of the recent European Interoperability Framework, within their own governance environments;












44.


emphasises that the increase in data consumption and simultaneous uses, the trends towards high upload/download speeds, the need for ubiquitous and instantaneous transmissions at the same time responsive and reliable, will require the provision of very high-capacity networks and broadband infrastructure ever closer to the end-user across Europe;












45.


considers that the Commission should take steps to make existing clouds or clouds under development at national, regional and possibly local level interconnectable and interoperable, exploiting the potential for standardisation; at the same time emphasises the importance of implementing measures at local level to ensure the effectiveness of specifications for cloud applications;












46.


urges meaningful portability for non-personal data would also need to take into account broader data governance considerations involving transparency for users, managed access and interoperability to link different platforms together in ways that stimulate innovation;





Conclusions









47.


calls for a strong coordinated approach to assessing data generation risks, especially those deemed detrimental to the development of the EU data economy and the operation of cross-border data services and technologies in the internal market;












48.


insists that any future solutions should also consider the legitimate interests of market players including LRAs that invest in product development, ensuring a fair return on their investments and thereby contribute to innovation. At the same time, any future solutions should ensure a fair sharing of benefits between data holders, processors and application providers within value chains;












49.


stresses that LRAs are in a position to foster innovation and competitiveness in the data economy through tailored demand-and-supply-side solutions including broadband roll-out, the digital economy, e-inclusion and e-government. Moreover, they provide education and training facilities, implement EU-funding initiatives and facilitate beneficial cooperation and exchange with other public authorities including across borders;












50.


calls for an EU Data Generation Systems Platform, similar to the emerging e-Government and Broadband platforms;












51.


concludes that greater acknowledgement should be given to the EU’s cities and regions in the sustainable roll-out of the Digital Agenda and the building of the EU data economy. LRAs are amongst the main target audience of the agenda’s recommendations and must be seen as key drivers and partners for its implementation.





Brussels, 11 October 2017.


The President of the European Committee of the Regions

Karl-Heinz LAMBERTZ