IT projects

What compensation are data owners entitled to claim if they are required to disclose data from connected products to third parties? Dr Martin Schirmbacher explains the requirements set out in the Data Act regarding fair, reasonable and non-discriminatory contractual terms.

In episode 47 of the Data Navigator podcast, Dr Martin Schirmbacher and Dr Hubertus von Rönne address a topic that, since the Data Act came into force, has repeatedly been cited as a supposed counter-argument against claims for the disclosure of data: the GDPR. One of the reasons for this discussion is the third think tank organised by the Federal Commissioner for Data Protection and Freedom of Information on the Data Act, which took place last week. The starting point is clear: the Data Act expressly applies to personal data as well. In the event of a conflict, the GDPR takes precedence. In practice, however, such conflicts arise far less frequently than is often assumed. The decisive factor here is what is known as ‘relative personal reference’. Whether data is personal is not assessed in the abstract, but from the perspective of the respective data controller. Dr Martin Schirmbacher and Dr Hubertus von Rönne illustrate this principle using the example of a bus driver: for Berlin’s public transport authority, driver data is personally identifiable, as they know who was driving which bus at what time. For the bus manufacturer, which only receives vehicle data without any personal registration details, this link is generally missing. In the case of a wind farm, the situation may be the reverse: the manufacturer knows its maintenance staff, whilst the wind farm operator is usually unable to identify them. It follows that: The same data set may be personal data for one party and not for another. In scenarios governed by the Data Act, it is often precisely the data recipient who cannot establish a link to an individual. If, however, the recipient does establish a link to an individual, they require a legal basis under the GDPR. Legitimate interests are particularly relevant in this context. The manufacturer, in turn, may rely on Article 6(1), first sentence, point (c) of the GDPR for the data transfer, as the disclosure is made on the basis of a legal obligation under the Data Act. Finally, Dr Martin Schirmbacher and Dr Hubertus von Rönne outline the responsibilities of the supervisory authorities. The Federal Network Agency is generally responsible for complaints relating to the Data Act. As soon as personal data is involved, it must involve the Federal Commissioner for Data Protection and Freedom of Information. The state data protection authorities remain responsible for traditional infringements of the GDPR – for example, if a farmer complains that a manufacturer is processing their personal data.

Episode 46 of the Data Navigator podcast focuses on data rooms, digital sovereignty and the question of how Europe can create trustworthy data infrastructures. The guest is Ulrich Ahle, CEO of Gaia-X and previously long-standing CEO of the FIWARE Foundation. He has more than thirty years’ experience in the IT sector – including stints at Nixdorf Computer, Siemens and Atos – and was also mayor of Etteln, ‘Germany’s most digital village’. In the interview, Ulrich Ahle explains why Gaia-X does not want to be a European hyperscaler. Rather, the aim is to establish a set of rules and an open-source infrastructure that enables decentralised, trustworthy data spaces based on European values. Key components of Gaia-X are digital identities and a compliance framework with various levels of sovereignty. At the highest level, only European providers are to be able to meet the requirements – in particular to prevent access via extraterritorial regulations such as the US Cloud Act. A practical example is Catena-X, the automotive industry’s data space. Of particular relevance here is the digital battery passport, which will become mandatory from 18 February 2027. It is intended to provide a wide range of information covering the entire life cycle of a battery – from raw materials and the carbon footprint to residual capacity. Data rooms can help to make complex supply chains more transparent and significantly simplify data exchange compared with bilateral solutions. Ulrich Ahle will also discuss Gaia-X’s role in implementing the Data Act. The combination of data room technology and statutory data access rights could help to increase the willingness to share data. This is because, in trusted data rooms, it is technically possible to specify who is permitted to use data, what it may be used for, and for how long. Another key focus is the international development of data rooms. As the Data Act applies only in Europe, but global supply chains require cross-border data flows, Gaia-X is working on a geographical expansion of the Trust Framework – for example, with a view to Japan, Korea, Canada or Brazil. China and various African countries are also exploring similar concepts. Ulrich Ahle’s key message is that the technology for data rooms is now largely in place. What matters now is practical application, operational implementation and viable business models. Only if data rooms are brought to market on a permanent basis can they realise their full potential for digital sovereignty, data usage and European competitiveness.

This article highlights the regulatory aspects that Swiss board members should bear in mind when deploying artificial intelligence within their organisations. Cornelia Mattig outlines the key developments in the Swiss and international regulatory landscape and explains, in practical terms, why AI should be understood not only as a technological challenge but also as a strategic and compliance-related one.

This article explains how companies can use transcription tools in their day-to-day operations in a legally compliant and responsible manner. It focuses on internal guidelines as a key management tool for appropriately addressing data protection risks, confidentiality issues and employment law requirements.

Episode 44 of the Data Navigator podcast focuses on FRAND in the Data Act – specifically, the conditions under which data owners must disclose IoT data to third parties and what they are permitted to charge for this. Martin Schirmbacher and Hubertus von Rönne explain the details of the new legal framework. The starting point is the familiar triangle: a user (e.g. a wind farm operator) instructs the manufacturer (e.g. Vestas) to send operational data directly to a third party (e.g. the start-up Turbit). To this end, a contract must be concluded between the manufacturer and the third party (see Art. 8 Data Act), and remuneration is governed by Art. 9 DA, all on FRAND terms. The user, however, may request the data free of charge. Martin and Hubertus go through in detail which costs the manufacturer is permitted to charge (provision costs, onboarding, margin where applicable, and investment costs – though the latter, for example, not vis-à-vis SMEs), which billing models the Commission’s draft guidelines provide for, and what ‘non-discriminatory’ means in practice. Key principle: The value of the data itself must not be priced. The conclusion: Remuneration issues will develop differently depending on the sector. At present, progress is often still stalling on fundamental issues: What data is actually being shared, and how should it be categorised? The call remains: producers, users and data recipients must come together within their respective sectors and also discuss the terms of data provision.

Artificial intelligence is fundamentally transforming drug development – making it faster, more efficient and data-driven. However, the more powerful the systems become, the greater the regulatory challenges. New guidelines from Swissmedic, the WHO and international organisations show that without clear governance, there is a risk to patient safety and market integrity. Companies are faced with the question of how to ensure both innovation and compliance at the same time.

The Data Act harbours many ambiguities. We have collected and answered the most frequently asked questions about the Data Act from presentations and client work. Is your question not included? Then please get in touch with us!