We speak a lot about the forthcoming Digital Markets Act (DMA), but only to a limited extent about the Data Governance Act (DGA). What is the DGA? Released on November 25, 2020, the DGA is a regulation to establish a single Market for data through data-sharing and data pooling of public and private personal and non-personal data. The regulation defines a framework for data-sharing/pooling by public and private entities but does not impose any obligation to share data. So, why a DGA?
(source: European Commission)
Data is the blood of the digital economy. It enables firms to improve or to create new products and services. Data is necessary to train algorithms and artificial intelligence (AI), the vital organs of the digital economy. However, to unlock the power of AI, one needs lots of data. To unlock the power of new or complementary data-driven services such as a parking map, where a driver can see in real-time free parking spaces, one needs data. Data can be collected either in-house (first-party data) or through third-parties (third-party data). Data collection is costly and requires significant time and investments. So, from a law and economics perspective, data-sharing is an efficient tool as it will avoid the need to invest in the same collection of data, namely it will avoid over-investment in the collection of data, which is a lost surplus for the society, as the latter pays twice for the same resource. So, if data-sharing is beneficial, why public and private parties do not share data?
The answer is simple. Data is an important asset and parameter of competition, which can be legally protected (e.g., protection of personal data, protection of intellectual property rights, commercial confidentiality). Firms might thus not have the ability or incentive to share data. In some circumstances though, data-sharing is possible by enforcing regulations or Court’s decisions (e.g., the data portability right of personal data under the GDPR, the essential facility doctrine under competition law, and some sectorial regulations (e.g., automotive industry)). Nevertheless, data-sharing is not a common practice. For instance, the data portability right (art. 20 GDPR) is still unknown (only 10% of users are aware of such right)  and highly criticized by competition experts (unclear data coverage, a controversial scope, impossibility to share real-time data, the rudimentary definition of the technical formal, and transfer from one provider to another is not mandatory). Accordingly, the right has not been designed to promote competition. So, if data-sharing is already legally possible, why a new regulation?
(data-sharing in practice)
Data-sharing is a matter of trust. One needs a clear framework about how data is shared and how data-sharing is accessible and protected. The DGA establishes this framework. In that end, the regulation creates the following rules: (i) a mechanism for re-using certain categories of protected public sector data; (ii) a mandatory notification regime for data-sharing services providers; and (iii) a voluntary registration regime for entities engaged in data altruism, namely voluntary sharing of personal and non-personal data for purposes of general interest (e.g., scientific research). Both the notification and registration regimes will be monitored and implemented by a competent authority with the power to impose administrative and financial penalties in case of non-compliance with the rules, subject to judicial review. Furthermore, a “European Data Innovation Board” will be created. It will be in charge to advise and assist the Commission in developing best practices, and to facilitate the cooperation between Member States’ authorities.
The regulation is thus expected to provide a greater incentive for data-sharing thanks to greater trust. The regulation will also enable the emergence of data intermediaries such as Personal Information Management Systems (PIMS). The latter are intermediaries for consumer data between consumers and online service providers in which a consumer can already access and manage f