The EU Data Act: How Will It Affect Your Business?
Twój prezenter(zy)
Caryn Lusinchi
AI Strategy Lead at Nemko Digital
Caryn is a global leader in AI governance, risk management, and quantum computing readiness. She has over a decade of experience as both an AI governance and go-to-market product leader. At the AI governance consultancy Nemko Digital, Caryn helps companies leverage technology responsibly through AI trust, governance, risk and compliance. Previously, with a career spanning public sector, AI/ML startups, Meta, and Google, she thrives in the complex intersection of emerging technologies and evolving regulatory frameworks.
Danny Van Roijen
EU Policy Expert
Danny is a public affairs professional with a career of 20 years, working on European policies and regulations across various technology sectors. He has hands-on experience implementing GDPR and cybersecurity at European level. As a former member of the European Commission's expert groups on eHealth (eHSG) and on Cybersecurity Certification (SCCG), he has played a prominent role in discussions on the digital transformation of healthcare, the secure and ethical use of technology, and the value of data sharing.
Session Resources + Transcript
Summary
The EU Data Act is a comprehensive regulation aimed at standardizing data access and usage rules across the European Union. It targets data sharing agreements between companies, smart devices, and cloud services, impacting a wide range of industries. The Act is designed to promote data democratization and accessibility, primarily affecting medium to large enterprises, but also having implications for smaller startups as they grow. It complements the Data Governance Act and is part of a broader EU data strategy. Compliance with the Act involves understanding its impact on data contracts, smart devices, and cloud service portability, with significant penalties for noncompliance.
Key Takeaways:
- The EU Data Act aims to standardize data access and usage rules across the EU.
- It affects a wide range of industries, particularly those dealing with IoT and smart devices.
- Compliance involves significant changes in data sharing contracts and technical infrastructure.
- Noncompliance can lead to severe financial penalties, similar to GDPR.
- The Act promotes fair data sharing and aims to stimulate the data economy.
Detailed Analysis
Goals and Scope of the EU Data Act
The EU Data Act is part of a broader strategy to enhance data accessibility and sharing across the European Union. It complements the Data Governance Act by focusing on economic and business data sharing, aiming to create a level playing field for data holders and users. The Act targets medium to large enterprises, particularly those involved with IoT devices, cloud services, and data contracts. It is designed to stimulate the data economy by ensuring fair data sharing practices and preventing monopolistic data control. As Danny Van Roijen noted, "The idea is to make sure there are equal rules and a level playing field for different actors."
Impact on Businesses Inside and Outside the EU
The Act primarily affects medium to large enterprises within the EU, but its reach extends globally. Any company with IoT products or services used in the EU must comply, regardless of its location. Caryn Lusinchi emphasized that even startups should view exemptions as temporary, as rapid growth could bring them under the Act's purview. Industries like automotive, healthcare, and med tech are particularly impacted, as they often deal with connected devices and data sharing. The Act's broad scope means that businesses worldwide must consider its implications if they have any EU-based customers.
Comparison with GDPR
While GDPR focuses on personal data protection, the EU Data Act covers a broader range of data types, including non-personal and industrial data. It introduces new rights for data users, including businesses and third parties, expanding beyond the individual-focused rights of GDPR. The Act also targets specific sectors, such as IoT manufacturers and service providers, whereas GDPR applies universally to all personal data processors. As Caryn pointed out, "The only thing these two regulations have in common is the penalties."
Compliance and Noncompliance
Compliance with the EU Data Act requires a cross-functional approach involving legal, product, engineering, and data governance teams. Legal teams must update contracts and terms of service, while engineering teams need to ensure secure data access and sharing capabilities. Noncompliance can result in severe financial penalties, similar to those under GDPR, as well as non-financial sanctions like data erasure. Danny Van Roijen highlighted the importance of understanding the Act's requirements, stating, "It's by design, which means it's not something you slap on at the end of the process."