The European Union’s Data Act marks a huge shift in the governance of data (both personal and non-personal) generated by connected products and hosted by data processing service providers, including cloud applications. It facilitates access to and use of data by consumers and businesses, raising complex intellectual property, trade secret, data privacy and antitrust issues. Its extraterritorial effect means that US companies are potentially within scope, even if they do not have a presence in the EU. This will require complex changes to the systems, business models and customer terms of a number of US businesses.
Principles
- The EU Data Act fundamentally changes data access and portability obligations.
- The Data Act establishes new rights and obligations governing access to, use of, and sharing of data generated by connected products and cloud-based services, requiring businesses to reassess how they collect, manage, and provide access to data.
- The Data Act has significant extraterritorial implications for U.S. businesses.
- S companies that manufacture connected products, provide data processing services, or serve customers in the European Union may be subject to the Data Act even without a physical presence in the EU, making it essential to understand its scope and jurisdictional reach.
- Compliance requires balancing data-sharing obligations with other legal protections.
- Organizations must navigate the intersection of the Data Act with intellectual property, trade secret, privacy, cybersecurity, and competition laws while implementing compliant data-sharing practices and contractual protections.
- Early planning and governance are critical to effective compliance.
- Businesses should evaluate product design, cloud service arrangements, customer agreements, internal governance, and technical capabilities to meet compliance deadlines, reduce regulatory risk, and adapt to the Data Act’s evolving requirements.
Syllabus
- Objectives of the EU Data Act
- Structure of the Data Act
- Extraterritorial reach of the Act – implications for U.S. companies
- Products and services covered by the Data Act
- Data access and sharing obligations: connected devices
- Data switching rights and impact on cloud providers
- Data sharing and trade secrets
- Penalties and enforcement mechanisms
- Compliance timelines
- Practical steps for US businesses
