The Regulation of Access to Personal and Non-personal Data in the EU: From Bits and Pieces to a System?

Abstract

As early as 2014, the European Commission started to consider the adoption of legislative and non-legislative measures to stimulate the European data economy by promoting access and reuse of data. For many years, the nature of the data has influenced the rhetoric used and the priorities set in the debates about access to data. While the need for restrictions to create trust and control for individuals has been emphasised in the context of personal data, there has been a much stronger focus on openness and reuse as mechanisms to promote data-driven growth for non-personal data. Interestingly, the European Commission seems to have departed from this dichotomy in its Data Act proposal published earlier this year. Indeed, the scope of this legislative initiative no longer depends on whether data qualifies as personal or not, although the distinction between personal and non-personal data still impacts the extent of data access.

The paper discusses how different types of data and different policy objectives in the area become intertwined and how different regimes regulating access to data can be aligned – despite the current piecemeal regulatory approach. As we will show, overlap between different data access regimes is common, so several regimes can apply in parallel to the same situation. On the one hand, we discuss the relationship between the GDPR’s right to data portability and the IoT data access right created by the Data Act proposal. On the other hand, we discusses how forms of data access beyond the initiative and control of individuals can be brought in line with the GDPR. Before diving into these issues, we provide a background of the policy and academic debate regarding the distinction between personal and non-personal data.

Keywords: Data Access, Data Economy, Data Regulation, Data Sharing, Data Act, Legislative coherence, Personal Data

JEL Classification: K20, K30