This lecture provides a comprehensive overview of data access claims within the European Union, moving beyond the well-known GDPR to explore lesser-known but increasingly relevant legal frameworks for non-personal data. The speaker, a legal professional, delves into the EU's new Data Regulation, which fundamentally changes how non-personal data generated by connected devices (IoT) is handled, emphasizing user and third-party access rights, particularly for real-time, machine-readable data. Complementary laws like the Environmental Information Act and the Geodata Access Act are also discussed, outlining their scope and conditions for data disclosure. The lecture also touches on the Data Governance Act's role in regulating data brokerage and highlights practical challenges and ongoing developments in the interpretation and enforcement of these evolving data laws.
Data Access in the EU: A Legal Overview Beyond GDPR
0:57 Overview of Data Access Claims: The lecture provides an overview of various data access claims, focusing on where and from whom data can be obtained under specific conditions, extending beyond the commonly known GDPR.
2:41 Key Focus Areas: The presentation specifically focuses on the Data Regulation (Data Act), the Environmental Information Act (UIG), and the Geodata Access Act, explaining that other, more specific laws (like Lex Apple Pay) are excluded for brevity.
4:22 The Revolutionary Data Regulation (Data Act): This regulation, effective September 2025, is described as revolutionary for non-personal data in the EU, fundamentally changing how such data (and associated metadata) generated by networked devices (IoT) is handled.
4:41 Example: Vonovia Smoke Detectors: An illustrative example of smoke detectors in apartments highlights the issue of device-generated data (e.g., air quality, temperature) being accessible only via proprietary apps, a problem the Data Regulation aims to solve.
6:45 Exclusions from Data Regulation: The regulation excludes copyrighted content (e.g., Netflix streams) and, under certain circumstances, trade secrets. It also excludes aggregated data (e.g., averages from multiple sensors) and further processed data (e.g., a "room air index" derived from sensor data).
12:01 Tiered Access Model of Data Regulation: The Data Regulation aims for tiered access:
12:10 Direct User Access: IoT devices are to be designed for easy, direct, real-time, free-of-charge, and machine-readable data access for the user.
13:18 Third-Party Access: Third parties can request data access but only at the user's request. While user access is free, data owners can charge third parties, using a "Frant" concept borrowed from patent law.
17:07 Assigning Claims: Theoretically, users could assign their direct, free access claims to third parties under German civil law, though it remains to be seen if the European Court of Justice will permit this.
17:53 Obstacles to Data Access: Potential reasons for refusal include IT security interests (e.g., revealing device vulnerabilities) and trade secrets, though the EU has made it significantly more complicated to assert trade secret exemptions.
20:47 Ethical/Legal Challenges: Discussion includes concerns about exploiting security gaps to access data (not compliant with law) and the impact of antitrust law (DMA) on data access for "gatekeepers" like Google or Zalando, aiming to prevent market power consolidation.
21:58 Data Governance Act: This act regulates data brokerage services, imposing obligations like logging who acquires data, maintaining records, and requiring a public website for data brokers.
23:18 Environmental Information Act (UIG): This act grants access to environmental data (air, water, habitats, energy, waste, environmental impact reports) from federal and state authorities. Access methods range from direct application to online portals.
25:48 Geodata Access Act: This act, which led to geoportal.de, concerns access to geolocated data linked to specific locations (e.g., energy, environmental, forestry, transport data).
26:26 Other Data Laws: Briefly mentions the Data Use Act (focus on machine-readable format and attribution for data use) and the restrictive German Weather Service Act (only warning messages, not raw weather data, are accessible).
27:49 Lack of Case Law: Many of these newer data laws exist and are implemented, but there is little practical case law, suggesting that disputes are often settled outside of court.
28:48 Q&A - Interpolated Data: Interpolated data (e.g., inferring a user's interest in LAN cables from nearby devices) would likely fall under "further processed data" and be excluded from direct access under the Data Regulation.
30:28 Q&A - Research Data Access: Legally, there's often no direct right to access raw research data from institutes, which prioritize "reputation" ("Golum effect"). However, initiatives like the National Research Data Infrastructure (NFDI) promote cultural change towards making data "findable, accessible, interoperable, and reusable" (FAIR principles).
34:52 Q&A - Digital Product Passports: Regulations like the upcoming battery passport (from 2027) will mandate information disclosure. While some data is restricted to authorities, real-time usage and load profiles of devices (non-static, operation-generated data) should be accessible to the user under the Data Regulation, enabling greater insight into product performance and potential defects (e.g., for train maintenance).
37:24 Q&A - Phone Data Scope: The Data Regulation applies to all networked devices and connected services that collect data about their environment and make it available via an interface, implying external communication. While there might be exceptions for certain "borderline" cases, smartphones and tablets could generally fall under this.