i

Download PDF

The Data Act aims to create a Europe-wide legal framework for the access to, use and sharing of data generated in the EU. With this proposal the European Commission aims to create, among other things, a unified environment for improving the exchange and use of data across all sectors of industry.

The European Federation of Data Protection Officers (EFDPO) is a European network of national associations of data protection and privacy officers. We wish to stress that the Data Act will regularly affect datasets that will contain personal data. In practice many datasets contain either personal data only or are mixed, i.e., containing both personal and non-personal data. Only very few data sets can be considered to be free of any personal data.

It is therefore very important to provide clear rules applicable under the Data Act to data sets containing personal data.



The explanatory memorandum issued by the European Commission to the Data Act provides that “this proposal is consistent with existing rules on the processing of personal data (including the General Data Protection Regulation, (‘GDPR’)”, Recital 30 further provides that “processing of such [personal] data is subject to the rules established under Regulation (EU) 2016/679, including where personal and non-personal data in a data set are inextricably linked.”

While this is a simple solution at first sight, there will be many unclear areas on the interplay between the Data Act and the GDPR. In particular this includes questions of the “design” of data sharing in the light of the GDPR rules. E.g., the legal bases for processing of personal data by a new controller and possibility to process data for purposes other than that for which the personal data have been collected within the meaning of Article 6(4) GDPR, the necessity to use pseudonymised data only, etc. This could contradict the basic idea and key objectives of the Data Act. The lack of explicit guidance on the interplay between the Data Act

📌 EFDPO Position Paper on the Proposal for a regulation of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Anupgarh)
🏢 EFDPO European Federation of Data Protection Officers
📍 Anupgarh