European Commission Introduces the Data Act

On February 23, 2022, the European Commission unveiled a proposal for regulating data obtained or generated by “smart” devices, referred to as the Data Act. The Data Act is intended to allow users more access to and control over industrial data connected with them and to promote increased data sharing with third parties, both through individuals choosing to share data and through measures pushing back on power imbalances between SMEs and large companies regarding data access. Additional components of the Data Act include mandating public body access to data in emergency circumstances and requirements regarding international data transfers.

Proponents of the Data Act argue that it will promote new innovations and potential developments stemming from currently-unused data, foster competition, and empower users. Industry critics are pushing back against the Data Act, particularly data sharing mandates, citing trade secret concerns. Privacy advocates wonder how the Data Act will align with the GDPR, particularly regarding data minimization and data protection principles. As the proposal moves forward, anticipate increased discussion on these points.

EPIC has long advocated more direct privacy and human rights protection regarding the Internet of Things, including through public comment, appealing to Congressional members, and agency feedback.