1. The GDPR as a starting point
Within the European data strategy, the right to data portability under the GDPR forms the basis for interoperability. This right requires organisations, at the request of the data subject, to transmit personal data to another organisation in a structured, commonly used, and machine-readable format (e.g. XML, JSON, or CSV), enabling such data to be processed and (re)used directly.
The Data Act and the Data Governance Act must therefore be read together with the GDPR in order to guarantee the broadest possible right to interoperability.
2. Data processing services under the Data Act
The interoperability rules under the Data Act apply to providers of data processing services, namely digital services that enable on-demand network access (e.g. IaaS, PaaS, or SaaS solutions). Data processing services offering customised or tailored services, however, fall under a different regulatory framework.
The Data Act complements the right to interoperability under the GDPR by requiring interoperability in two distinct situations: on the one hand, where a user switches from one provider (the “source provider”) to another provider (the “destination provider”), and on the other hand, where data is exchanged between data processing services used in parallel.
2.1 Interoperability between data processing services for switching or parallel use
The Data Act establishes minimum requirements applicable to source providers in switching scenarios as well as parallel-use scenarios:
- The ability to export data in a commonly used and machine-readable format;
- Ensuring that users obtain materially comparable outcomes from a destination provider offering the same type of service (“functional equivalence”); and
- Removing all obstacles that may hinder data transfer.
Additionally, the Data Act lays down certain requirements that apply exclusively in the context of switching. For example, a source provider must establish a specific exit strategy together with the user, while complying with strict statutory deadlines.
Other switching-related obligations apply to both the source provider and the destination provider:
- Providing information on available switching procedures, including an up-to-date online register of available data formats and open interoperability specifications (such as USB, 5G, HL7 FHIR, etc.);
- Cooperating in good faith to ensure an efficient switching process and continuity of services; and
- Notification of the relevant technical and organisational measures.
Until 12 January 2027, service providers may still charge the necessary switching costs. In the case of parallel use, providers may continue to charge the necessary costs after 12 January 2027, given the continuous data exchange required in such situations.
2.2 Practical changes to your organisation as a data processing service provider
- Map which non-personal data are processed within the organisation and identify the data formats in which such data are held;
- Assess whether existing contracts with users already contain the necessary contractual provisions and revise them where required;
- Develop a template exit strategy or implement the European standard contractual clauses;
- Publish the required information relating to switching possibilities and international data transfers;
- Develop procedures aimed at preventing abuse of or obstruction to switching processes.
The European Commission has also published standard contractual clauses that organisations may voluntarily use as guidance and a basis for compliance with the interoperability rules. These can be consulted via the following link: Draft Recommendation on non-binding model contractual terms on data access and use and non-binding standard contractual clauses for cloud computing contracts | Shaping Europe’s digital future
3. Data intermediaries under the Data Governance Act
The Data Governance Act designates data intermediaries as neutral third parties that connect data subjects or data holders with (potential) data users in order to promote secure, reliable, and voluntary data sharing. In doing so, the Data Governance Act supports the GDPR’s right to interoperability by creating trust and transparency with respect to the sharing of both personal and non-personal data.
In addition, the Belgian implementing law establishes the national procedures for the enforcement of the Data Governance Act, including the registration of data intermediaries and potential enforcement mechanisms (ranging from warnings to administrative fines).
3.1 Qualification as a data intermediary
The registration of an organisation as a data intermediary is carried out through an application submitted to the FPS Economy, which will assess compliance with the following neutrality requirements:
- Data intermediation services may not be mixed with other services provided by the organisation;
- Data obtained through data intermediation services may not be used for other purposes; and
- The conditions applicable to (potential) data users and data holders, including pricing, may not be dependent upon the acquisition of other services.
3.2 Obligations for data intermediaries
The Data Governance Act imposes the following obligations on data intermediaries:
- Offering ancillary services that facilitate data sharing, such as temporary storage, data conversion, anonymisation, and pseudonymisation;
- Taking the necessary measures to ensure interoperability within one or more sectors, in particular by complying with existing and commonly used standards applicable within the relevant sector;
- Implementing measures to prevent unlawful access to or international transfers of data;
- Ensuring an appropriate level of security throughout the data-sharing process; and
- Maintaining a register of data intermediation services.
3.3 Practical changes to your organisation as a data intermediary
For the qualification as a data intermediary:
- Assess whether a separation between intermediation services and other commercial activities is feasible;
- Prepare an application to submit to the FPS Economy.
During the provision of data intermediation services:
- Verify whether existing and commonly used standards have already been published for the sector in which your organisation operates and implement them where possible;
- Explore opportunities to offer ancillary services;
- Document the measures taken to prevent unlawful access and international data transfers;
- Review existing security measures and update them where necessary;
- Develop and maintain a register of data intermediation services.
Conclusion
The importance of interoperability within the European Union continues to increase. Consequently, statutory interoperability obligations are becoming more extensive and affect an ever-growing number of organisations.
The interoperability obligations under both the Data Act and the Data Governance Act have already entered into force. Organisations should therefore begin addressing these obligations as soon as possible and seek the necessary support in a timely manner.
The Technology, Digital & Data team of Monard Law is available to advise you on the implementation of interoperability obligations under the GDPR, the Data Act, and the Data Governance Act, as well as on other matters relating to innovative technologies, the EU Digital Strategy, privacy, and data protection.
