Source: EURLEX
Language: en
Format: md

EN

![](./../../../resource.html?uri=IMMC:EESC-2020-05545-AC.ENG.xhtml.EESC_2020_05545_AC_ENG_xhtml_06001.jpg)

INT/921

Data governance

OPINION
  
 
  
European Economic and Social Committee
  
 
  
Proposal for a Regulation of the European Parliament and of the Council
  
on European data governance
  
(Data Governance Act)
  
[COM(2020) 767 final]

Rapporteur: Giuseppe GUERINI

Co-rapporteur: Marinel Dănuț MUREŞAN 

|  |  |
| --- | --- |
| Referral | Council of the European Union, 11/12/2020  European Parliament, 14/12/2020 |
| Legal basis | Article 114 of the Treaty on the Functioning of the European Union |
|  |  |
|  |  |
| Section responsible | Single Market, Production and Consumption |
| Adopted in section | 31/03/2021 |
| Adopted at plenary | 27/04/2021 |
| Plenary session No | 560 |
| Outcome of vote  for/against/abstentions) | 234/3/13 |

  

1.Conclusions and recommendations

1.1The European Economic and Social Committee (EESC) welcomes the proposal for a regulation on data governance, which complements and supplements Directive (EU) 2019/1024 (Open Data Directive), focusing on data subject to the rights of others that are held by public sector bodies.

1.2The EESC believes that this initiative is appropriate and necessary given that the processing, storage and sharing of digital data are becoming increasingly important both for the economy and for social and civic reasons: individuals, administrations and businesses are subject to a complex, interlinked regulatory framework.

1.3The EESC considers it essential to adopt a harmonised framework of rules able to inspire citizens, consumers, SMEs and, in particular, micro enterprises to trust that their data will be properly protected, in order to foster opportunities for economic operators and R&D institutes to develop.

1.4The EESC supports the Commission's objective of applying this regulation to administrations, public bodies and public law entities, taking an approach that covers all public sector actors regardless of their form.

1.5Where data management and processing using artificial intelligence tools relate to the sphere of work, the EESC believes it is important to provide for appropriate forms of prior consultation and negotiation on their issues with the social partners. Organised civil society also has to be involved when such tools affect citizens' rights.

1.6The EESC supports the proposal to identify national authorities responsible for ensuring appropriate oversight of the new rules.

1.7The EESC supports the establishment of contact points in each Member State. It recommends that they be accessible to all interested parties to ensure that they operate efficiently and to encourage good cooperation with civil society organisations and social partners.

1.8The EESC welcomes the proposal to lay down a regulation for organisations dealing with "altruistic data" management, and supports the requirement for these organisations to have legal personality as not-for-profit entities and pursue objectives of general interest, autonomously and independently from other organisations pursuing for-profit data management objectives.

1.9The EESC considers recognising the usefulness of a cooperative model for establishing data management and exchange as a way of favouring citizens and micro, small and medium-sized enterprises, self-employed workers and the professions to be a particularly interesting possibility provided for by the regulation.

1.10The cooperative model could also be a very useful tool for neutral shared data management. To this end, the EESC encourages the Commission and the Member States to support citizens, SMEs and SME organisations in order to take initiatives to develop mutual organisations for the management and exchange of data.

1.11The EESC believes that the protection of personal data, together with the protection of digital identity and privacy, are fundamental aspects of data governance directly linked to respect for human dignity and fundamental rights. For this reason, it considers it essential to recognise property rights for personal data in order to enable European citizens to control the way their data is used.

2.The Commission proposal

2.1The Commission proposal examined in this opinion aims to:

I.make public sector data available for re-use, in situations where such data is subject to the rights of others;

II.allow for sharing of data among businesses;

III.allow personal data to be used in accordance with the GDPR;

IV.allow data use on altruistic grounds.

2.2The proposal incorporates and complements Directive (EU) 2019/1024 on open data and the re-use of public sector information (Open Data Directive), focusing on data subject to the rights of others that are held by public sector bodies.

2.3The proposal is based on Article 114 of the Treaty on the Functioning of the European Union. It aims to approximate the laws and administrative measures laid down by the Member States with a view to guaranteeing the flow of data in the European Union under a harmonised legislative framework able to consolidate the single market as regards the movement of data held by public bodies.

2.4Chapter I of the regulation defines its scope, identifying:

I.the conditions for the re-use, within the EU, of certain categories of data held by public sector bodies;

II.a notification and supervisory framework for the provision of data-sharing services;

III.a framework for voluntary registration of entities which collect and process data made available for altruistic purposes.

2.5Chapter II creates a mechanism for re-using certain categories of public sector data which is conditional on the respect of the rights of others. The rights of third parties may have to be safeguarded on grounds of protection of personal data or in order to protect intellectual property rights and professional confidentiality.

2.6Member States will have to set up a single contact point supporting researchers and innovative businesses as they identify suitable data, and are required to put structures in place to support public sector bodies with suitable technical resources and legal assistance.

2.7Chapter III aims to increase trust in sharing personal and non-personal data and to lower transaction costs linked to B2B and C2B data sharing by creating a notification regime for bodies intending to operate in the data sharing field and a set of rules on their activities. These providers will have to comply with the requirement to remain neutral as regards the data exchanged. They cannot use such data for other purposes.

2.8Chapter IV facilitates the altruistic sharing of data voluntarily made available by individuals or companies for the common good. It establishes the possibility for organisations engaging in data altruism to register as a 'Data Altruism Organisation recognised in the EU' in order to increase trust in their operations.

2.9A common European data altruism consent form will also be developed to lower the costs of collecting consent and to facilitate data portability.

2.10Chapter V sets out the requirements for the functioning of the competent authorities designated to monitor and implement the notification framework for data-sharing service providers and entities engaged in data altruism. It also contains provisions to safeguard individuals' rights and, particularly, on the right to lodge administrative complaints against the decisions of such bodies and on the means of judicial redress.

2.11Chapter VI establishes the 'European Data Innovation Board' which will facilitate the emergence of best practices by Member States' authorities. These best practices will focus on processing requests for the re-use of data and ensuring consistent practice regarding the notification framework for data-sharing service providers and for data altruism.

2.12Chapter VII allows the Commission to adopt implementing acts concerning the European data altruism consent form, and Chapter VIII contains transitional provisions for the functioning of the general authorisation scheme for data-sharing providers and sets out final provisions.

3.General comments

3.1The Commission proposal is appropriate and necessary given that the processing, storage and sharing of digital data are becoming increasingly important both for the economy and for social and civic reasons: individuals, administrations and businesses are subject to a complex, interlinked regulatory framework.

3.2Advanced use of digital data can enable new products to be developed and conventional production processes to be made more efficient, stimulate research, combat global warming and improve use of energy and water resources, while protecting people's health increasingly effectively.

3.3To be used efficiently and virtuously, it must be possible to share and exchange vast quantities of data. This involves harnessing the computing power of artificial intelligence machines to process and exploit the data in the service of ever more ambitious objectives in the common interest. One example of this is exchanging data so as to promote early diagnosis of illnesses by means of medical imaging.

3.4The sheer complexity and quantity of data being produced, extracted and transferred every second has resulted in the mushrooming of businesses, organisations and bodies specialising in managing data or acting as data intermediaries. These entities exchange data either for commercial purposes or in the general interest, pursuing the common good (primarily for scientific research).

3.5In the current economic and technological context, data is a valuable and useful resource connected to ethical, economic and political issues, with considerable impact on competitiveness and competition not only between businesses but also between Member States. The Commission's move to define a proportionate, clear framework for the public governance of data is therefore appropriate – a framework which aims to protect both the economic and strategic value of data in the various contexts where the ability to hold and process digital data is key.

3.6With regard to sensitive data, particularly health data, the EESC considers it useful to design and generalise good operating practice, such as that adopted by Microsoft, for example, which has decided to warn its customers when certain government authorities have asked the company to disclose these customers' personal data.

3.7The EESC acknowledges and supports the Commission proposal's primary purpose: to establish conditions which will enable individuals, consumers, self-employed workers, professionals and businesses (particularly small and micro enterprises) to share their data, confident that they will be managed by regulated, properly supervised organisations. This will boost trust and promote the formation of a regulatory framework which complies fully with the values and principles of the European Union.

3.8The EESC points out, as it has already stated in its previous opinions, that when dealing with the issue of data governance and artificial intelligence tools, a European regulatory framework is needed to ensure transparency and traceability of algorithms, human oversight of AI tools and respect for fundamental rights.

3.9It should also be stressed that, when these artificial intelligence tools are introduced in the workplace, the Commission must lay down rules to reinforce social dialogue and negotiation through prior consultation of workers' representatives and must encourage the establishment of national committees/observatories on the deployment of artificial intelligence tools, involving all stakeholders: consumers, small and medium-sized businesses, professional associations and workers' and organised civil society representatives.

3.10It is also important for the regulation to pave the way for approving the general conditions for use of data management services, so that clauses in contracts for transfer of or access to data which breach EU protection standards can be annulled by courts. To this end, the EESC recommends harmonising and strengthening the consent principle by simplifying the procedure for accepting or refusing cookies.

4.Specific comments

4.1The EESC considers that the Commission proposal is in line with the proportionality and subsidiarity principles enshrined in the Treaties, as it develops and proposes rules which do not go too far in sacrificing private interests to the objective of sharing and ensuring the virtuous use of data.

4.2Therefore, a regulation which will guarantee uniform rules applicable across the board in the internal market is the most suitable instrument; a patchwork of national rules would be ineffective and result in excessive compliance costs for European businesses, especially SMEs, hindering the proper flow of data.

4.3The regulatory instrument chosen is therefore the best suited to further the development of a European market in which data can move virtuously thanks to a harmonised regulatory framework able to inspire citizens, consumers and small and medium-sized businesses to trust that their data will be properly protected and to provide opportunities for economic operators and R&D institutes to develop and grow.

4.4The EESC supports the Commission's objective of applying this regulation to administrations, public bodies and public law entities, in line with standard practice for public procurement. It will thus take a facts-based approach, ensuring that the rules are comprehensive, covering all public sector actors regardless of their form, and properly upheld.

4.5Given the general shape of the new rules, the proposed regulation is both proportionate and consistent that public undertakings be exempt from them, since these bodies increasingly use entrepreneurial and market-based models.

4.6The EESC supports the provisions set out in Article 6, whereby "[p]ublic sector bodies which allow re-use of the categories of data referred to in Article 3(1) may charge fees for allowing the re-use of such data" and "[a]ny fees shall be non-discriminatory, proportionate and objectively justified and shall not restrict competition". In this regard, it should be pointed out that businesses, SMEs, micro and small organisations and social economy organisations provide authorities with a substantial amount of data, sometimes at considerable cost, and the impact of this on SMEs, in particular, should be taken into account when tariffs are set.

4.7The EESC also endorses the provision whereby the methodology for calculating fees must be published in advance and be based on the costs of managing and sharing the data, rather than on some other cost-setting system along the lines of a data licence.

4.8The EESC flags up the need to ensure that data exchanges comply with the provisions of Article 101 TFEU as regards distortion of competition. It will be important to ensure compliance with the Commission's guidelines on horizontal cooperative agreements in the form of the exchange of information. This will avoid situations whereby bodies which exchange information distort market transparency, opening the door to collusion between direct competitors and diminished competition, to the detriment of consumers and small and micro enterprises and thus distorting proper market competition.

4.9The EESC is very much in favour of identifying national authorities (Articles 12 and 20) responsible for ensuring appropriate oversight regarding the enforceability of the new rules established by the Commission. It endorses the list of requirements to be fulfilled by these authorities, as set out in Article 23.

4.10In order to prevent inappropriate use of databases at national or European level, supervision of the use of data should be carried out by the various national authorities involved, working together and with the European Commission.

4.11With regard to altruistic data organisations and the general conditions for recognising them, the Committee welcomes the proposal's stipulation that these organisations should be legal entities operating on a not-for-profit basis and in the general interest, and above all that they should be autonomous and independent, particularly from other organisations pursuing commercial or for-profit data management objectives.

4.12Such provisos and the establishment of a public register of altruistic data organisations would meet the need to ensure transparency and protect the rights and interests of the individuals and businesses which are the object of the altruistic exchange of data. This would increase the trust of all parties involved.

4.13The EESC firmly believes it is useful for a contact point to be set up in each Member State, as provided for in Article 8 of the proposal. This contact point must be highly accessible to all interested parties to ensure that it operates efficiently and to encourage good cooperation with civil society organisations and social partners.

4.14The EESC also welcomes the fact that Chapter III of the regulation raises the possibility of establishing cooperatives to manage and exchange data. This mechanism would serve the interests of people (workers, consumers, entrepreneurs) and small and one-person companies which would not be in a position to access or process large amounts of data on their own. In this connection, the EESC encourages the Commission and the Member States to support SME organisations in order to take collective initiatives to develop mutual organisations of this kind for the management and exchange of data.

4.15Cooperatives and other structures based on cooperation would indeed seem particularly well suited for managing intermediary activities and data exchange or sharing between citizens (workers, consumers, entrepreneurs) and companies. Cooperatives in particular would enable the data management interests of the data subjects and the cooperative data holder – which in this case would be owned by the same data subjects – to coincide, and thus such structures would allow for participatory governance shared between citizens, companies and entrepreneurs which both provide and use the data. This mechanism could support the climate of trust and openness which is a prerequisite for good data governance in the EU's single digital market.

4.16In this regard, the EESC believes that effective cooperation is needed with civil society organisations, social partners and professional organisations.

4.17With regard to the protection of personal data, the EESC points out that European law considers the protection of privacy and respect for human dignity to be a vital part of the fundamental and inviolable rights of individuals. However, sometimes the proper protection of these rights is threatened by misuse of data collected with consent that has been freely given but not always sought through simple enough procedures. There are also more serious cases where data is misappropriated with real identity theft. In some Member States courts of justice have repeatedly condemned data theft. Recognising theft means recognising the right to ownership of the data.

4.18The EESC therefore recommends recognising European property rights on digital data in order to enable people (workers, consumers, entrepreneurs) to control and manage the use of their data or prohibit their use. This would open the door to collective actions with clear legal legitimacy which aim to prevent or control access to people's data and to facilitate the management of those data in order to create the European digital market.

Brussels, 27 April 2021

Christa SCHWENG

The president of the European Economic and Social Committee

\*

\*
   \*

N.B.: Appendix overleaf

  

APPENDIX
  
to the opinion
  
of the European Economic and Social Committee

The following section opinion text was rejected in favour of an amendment adopted by the assembly, but obtained at least one quarter of the votes cast:

1.6
   The EESC supports the proposal to identify national authorities responsible for ensuring appropriate oversight of the new rules. In this regard, it points out that the authorities responsible for safeguarding personal data which are already in place in the Member States could be responsible for implementing the rules referred to in the Commission's proposal, drawing on their expertise, without new authorities being created.

4.9
   The EESC is very much in favour of identifying national authorities (Articles 12 and 20) responsible for ensuring appropriate oversight regarding the enforceability of the new rules established by the Commission. It endorses the list of requirements to be fulfilled by these authorities, as set out in Article 23. On this point, and without prejudice to Member States' discretion in terms of organisation, the EESC points out that the authorities responsible for safeguarding personal data, which are already operational, have considerable technical and regulatory expertise in this field. They could therefore implement the rules covered by the Commission’s proposal themselves, without new authorities being created.

Outcome of the vote:

Votes in favour of deleting the text:
   124

Against:
   
   94

Abstentions:
   
   27

\_\_\_\_\_\_\_\_\_\_\_\_\_

[Top](#document1)