The EDPB and EDPS adopted a joint opinion on the proposal for a Data Governance Act (DGA). The DGA aims to foster the availability of data by increasing trust in data intermediaries [1] and by strengthening data-sharing mechanisms across the EU. In particular, the DGA intends to promote the availability of public sector data for reuse, sharing of data among businesses and allowing personal data to be used with the help of a ‘personal data-sharing intermediary’. The DGA also seeks to enable the use of data for altruistic purposes.
The EDPB and the EDPS acknowledge the legitimate objective of the DGA to improve the conditions for data sharing in the internal market. At the same time, the protection of personal data is an essential and integral element for trust in the digital economy. With this joint opinion, the EDPB and the EDPS invite the co-legislators to ensure that the future DGA is fully in line with the EU personal data protection legislation, thus fostering trust in the digital economy and upholding the level of protection provided by EU law under the supervision of the EU Member States’ supervisory authorities.
Andrea Jelinek, Chair of the EDPB, said: “The EU’s data protection legal framework does not stand in the way of developing the data economy. Quite the contrary, it enables it: trust in any kind of data sharing can only be achieved by respecting existing data protection legislation. The GDPR is the foundation on which the European data governance model must be built. That is why we underline the need to ensure consistency with the GDPR with regard to the competence of the supervisory authorities, the roles of the different actors involved, the legal basis for the processing of personal data, the necessary safeguards and the exercise of the rights of the data subjects.”
Wojciech Wiewiórowski, EDPS, said: “We understand the growing importance of data for the economy and society as outlined in the European Data Strategy. However, with “big data comes big responsibility”, therefore appropriate data protection safeguards must be put in place. The overarching framework for European data spaces should ensure that the data protection acquis is not affected.”
The EDPB and EDPS consider that the EU legislator should ensure that the wording of the DGA clearly and unambiguously state that this act will not affect the level of protection of individuals’ personal data, nor will any rights and obligations set out in the data protection legislation be altered.
Concerning the reuse of personal data held by public sector bodies, the EDPB and EDPS recommend aligning the DGA with the existing rules on the protection of personal data laid down in the GDPR and with the Open Data Directive. Furthermore, it should be clarified that the reuse of personal data held by public sector bodies may only be allowed if it is grounded in EU or Member State law. Such laws should include a list of clear compatible purposes for which further processing may be lawfully authorised or constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23 of the GDPR.
On data sharing service providers, the joint opinion highlights the need to ensure prior information and controls for individuals, taking into account the principles of data protection by design and by default, transparency and purpose limitation. Furthermore, the modalities upon which such service providers would effectively assist individuals in exercising their rights as data subjects should be clarified.
As for data altruism, the EDPB and the EDPS recommend that the DGA should better define the purposes of general interest of such “data altruism”. Data altruism should be organised in such a way that it allows individuals to easily give, but also, withdraw their consent.
In light of the possible risks for data subjects when their personal data might be processed by data sharing service providers or data altruism organisations, the EDPB and EDPS consider that the declaratory registration regimes for these entities, as laid down in the DGA, do not provide for a sufficiently stringent vetting procedure applicable to such services. Therefore, the EDPB and EDPS recommend exploring alternative procedures that foresee a more systematic inclusion of accountability tools, in particular the adherence to a code of conduct or certification mechanism.
The joint opinion also includes recommendations on the designation of the supervisory authorities as main competent authorities for the control of the compliance with the DGA provisions, in consultation with other relevant sectorial authorities.
______________________________________
[1] See Explanatory Memorandum of the Proposal, page 1
Note to editors: Please note that all documents adopted during the EDPB Plenary are subject to the necessary legal, linguistic and formatting checks and will be made available on the EDPB website once these have been completed.
Questions to the EDPB can be directed to: greet.gysen@edpb.europa.eu and sarah.hanselaer@edpb.europa.eu – www.edpb.europa.eu
Follow us on Twitter: @EU_EDPB
Questions to the EDPS can be directed to Olivier Rossignol: press@edps.europa.eu – www.edps.europa.eu
Follow us on Twitter: @EU_EDPS
EDPB_Press Release_statement_2021_02
