Momentous development in EU law for the digital market: the EU Commission is expected to publish today the #DataGovernanceAct proposal for a Regulation. From a new European Board, to fiduciary duties, to data intermediaries, data cooperatives (!) and data altruism… 1/

There are plenty of things to look out for! Here is my top list of hot topics, based on the leaked version that circulated among Brussels tech media a couple of weeks back. First: lots of “data sovereignty” undertones to key rules, sometimes sliding into data localization … 2/n

Exhibit A: The title regulating the re-use of data held by public sector bodies allows such re-use by different actors “within the Union”, with an additional specification that “the processing of such data shall be limited to the European Union” 3/

Exhibit B: Data intermediaries, sometimes known as data trusts, but officially labeled under the leaked proposal ‘Providers of Data Sharing Services’ must be established within the Union or EEA if they want to be authorized for data intermediary services 4/n

Exhibit C: Entities engaging in data collection on the basis of data altruism must either be established in the EU or EEA, or be an international organization subject to lawful data transfers under the GDPR. In short, these data sovereignty undertones are worth following 5/n

The Providers of Data Sharing Services will have an interesting array of services they can provide: Supporting ‘data holders’ (e.g. a company holding data) to make their data available to users; supporting data subjects with their #GDPR requests and creating data spaces …6/n

And services related to the creation of “data cooperatives”, which would allow a group of data subjects to collectively exercise their GDPR rights; Side note: it’s the first time I’m hearing of data cooperatives! If you’ve heard of them or know any research, please share! 7/

Remarkably, the draft regulation will likely introduce a fiduciary duty of the data intermediary with regard to the data subject. In this particular scenario, a #FiduciaryDuty might make sense indeed, as opposed to other data processing scenarios 8/n

There are many other noteworthy aspects to this draft Proposal. Really, do keep your eyes on it. Its interaction with the GDPR is fascinating. While the GDPR is often referred to in provisions, its vocabulary has not been transposed. 9/n

e.g., there are no controllers & processors here, but data holders & data users; the Regulation also refers to “joint exploitation of data” which probably will trigger alarm bells with the EDPS, EDPB, advocates. It also has references to specific anonymization techniques 10/n

It specifically integrates GDPR rules on lawful grounds for processing, especially when it comes to sensitive data, and on withdrawal of consent when it comes to data altruism. But, in any case, keep in mind that the proposal covers BOTH personal and non-personal data 11/n

One interesting bit: it seems we will have a new European Board, this time a European Data Innovation Board! The Commission is not taking any more risks and seems to want to keep it under its wing, even though it will have representatives of Member States as members 12/n

Some after thoughts: this type of data regulations are the ultimate test for data protection law: how strong is it? Is it really up to be the necessary “rules of the road” on this new "data highway"? But most of all, they will reveal the tension btwn data protection & privacy 13/

All in all, fascinating developments. All of the info above came from a leak published by Politico a couple of weeks back, so let’s see how the Proposal actually looks like. Looking forward to the debates! And all your input friends! 14/END