Navigating the EU Data Act: trade secrets vs. transparency

Yes, the EU Data Act is now largely applicable, but what are the actual concerns and opportunities? In my discussions with various organisations, there has been one common fear: does this mean that I have to make all data concerning connected devices, including business-confidential information, available to everyone?

The answer, as often in law, is a big “it depends”. “Available” (Art. 4 & 5 Data Act) does not mean anyone can get it for free – as Art. 8 emphasises, the requirement for data sharing with non-users is “fair, reasonable and non-discriminatory terms and conditions”.

Plus, Art. 5(11) still states that if a data holder can “demonstrate that it is highly likely to suffer serious economic damage from the disclosure of trade secrets”, this can be used to “refuse on a case-by-case basis a request for access [by a third party] to the specific data in question”.

A similar mechanism exists for the withholding of information to users themselves (Art. 4(7)-(8) Data Act).

=> In each case of limitations to responses, though, there is an obligation to inform the relevant authority.
While under the GDPR a refusal of a data subject request *often* leads to information to an authority (on the initiative of the data subject, by way of complaint), the data holder itself (= the controller in GDPR terminology) is the one under an obligation here to inform the authority in case of refusal to provide the full data.

[Some parallels to be drawn here with my concerns re trade secret assessment by data protection authorities in the context of automated decision-making – see post here: https://lnkd.in/eeQaKqdP ]

There will be many challenges coming from the application of the Data Act, not least the situation where users *who work for competitors* will use their rights under the Data Act to try to gather information previously kept secret.

So the key thing is to properly assess what is a “trade secret” vs what has merely been kept hidden or obscure, and what the consequences of (mandatory) transparency might be.

But one thing to remember is that it cuts both ways.
While the Data Act means that you have to make certain data from connected devices available to users and to share it with third parties against fair terms, *you can also use the Data Act to get access to new data*.
 
So don’t see Data Act compliance purely as a cost. See it also as an opportunity to think about which new data is rendered more open to you and to find ways to collaborate more easily with others. Use it as yet another excuse to improve your approach to data governance and to understand what data you hold, and what data you might like to access.

Ultimately, the idea of (slightly more) open data is not a free-for-all, but rather an invitation to find fair terms – and a reminder to use data responsibly.

Data protection cybersecurity privacy”