As part of a set of measures for a European data strategy that aims at making the EU a leader in a data-driven society, the Commission’s proposal for a Data Governance Act will provide a governance framework to support data access and re-use. The webinar, organised by Eurocities in the framework of the Living-in.EU Legal subgroup, aimed to shed light on the impact of the Data Governance Act proposal on European cities.

The webinar started with a presentation by the European Commission (Maria Rosaria Coduti, Policy Officer, Data Policy and Innovation – DG CONNECT, Unit G1) on the policy and legal context of the Data Governance Act. The legal act will help to tap into specific, confidential datasets. The legal act will also create principles for trustworthy intermediaries to boost voluntary data sharing. These intermediaries must be fully trusted; they are required to notify their ambition to act as intermediaries to the competent authority and comply with certain conditions (they must be neutral). The principles of intermediaries also applies to individuals and companies (data altruism). To safeguard the rights of data subjects, a European register of such organisations will be created. In addition, a common data altruism consent form will be developed (uniform format, facilitating the reuse of data EU-wide). The EU Data Innovation Board will be a formal expert group, with representatives of Member States, the Commission, common EU dataspaces in all sectors as well as academia and standards setting organisations. It will also advise on the prioritisation of interoperability standards.

The perspectives of Zaragoza were presented by Daniel Sarasa Funes, Smart City Programme Manager. The city created sandboxes where they can experiment and learn about combining data from different sources. One of the projects is a street commerce dashboard, aiming to revive street commerce after COVID. The data used includes telco data processed by an intermediary that hands over the city hall anonymised data; since the city is not direct user of the data, it is unclear what data rights they have. The other project is a digital twin of the main commercial street. Here the data is brought together from gas and electricity utilities and banks, aiming to understand the exact correlation between energy consumption and sales in small commerce / ATM cash flow. The data used includes personal data (altruism), data from shops (3rd party rights), Point of Sales and ATM as well as the city’s citizen card. The dilemma here is how to contract utilities or banks, given that the sandbox is owned by the city hall and these players may ask for the city to pay. The role of data altruism NGOs could be useful in this case; resulting in a win-win situation, where the city hall gets the data and they provide knowledge back to the ecosystem.

Helsinki´s perspective was presented by Viivi Lähteenoja, Special advisor data policy. Helsinki uses MyData, which allows people to control conditions and flows about the use of their data, to empower people to re-use their data, facilitate an easy everyday life for citizens and reduce administrative costs. Their dilemma is related to data intermediation services, which typically aim to establish commercial relationships between data objects and data users, with the exception to public sector bodies. This can in future be blurred, if services in the city are provided by a mix of public and private bodies. Helsinki also questioned the composition of the planned Data Innovation Board, in particular that of the 'other' stakeholders and called the Commission to also consider including cities in this group.

To conclude the interventions, Pasquale Annicchino, Senior Assistant Professor of Law, University of Foggia, provided some expert reflection and suggestions. He highlighted the growing complexity of the legal ecosystem for data in the EU and the difficulty in reconciling the different pieces of the legal acts by implementers on the ground. The complexity of the smart cities ecosystem (various data sources, cross-domain services) makes the situation even more cumbersome. He called for specific templates to be developed and to foster good practice sharing otherwise the complexity may just incentivise risk adversity. Another difficulty will be handling personal and in particular health data; under the GDPR data is collecting based on consent and in a granular way, but it is unclear what happens if the same data is to be used for secondary reuse like public research. The Data Governance Act also introduces new definitions, such as data holder and data user, while the GDPR uses the notion data subject and these have to be reconciled. Overall, it will be difficult for cities to have a privacy team that addresses all data governance issues; they may need several people with different expertise, so there may be a need to establish an internal task force to map how the regulatory regime will impact their current and future plans with regard to data governance (‘data governance by design’).

The over 70 participants engaged in an active discussion on issues such as how to create local trust with data altruism NGOs, necessary skills of DPOs to work with data altruism NGOs or whether cities can create a data intermediary. In terms of governance, some suggested creating a separate organisation for knowledge on data (beyond open data) and several cities confirmed that they are building in-house capacity for data governance rather than engaging external consultants for this. The need for sample contracts was reiterated; the Finnish template for data sharing agreements was mentioned as a good starting point . Questions were also raised on incentives for data altruism; Member States could have organisational or technical arrangements in place to facilitate data altruism and could also define national policies for data altruism. Data subjects should be able to receive compensation related only to the costs they incur making their data available for objectives of general interest. As regards to the question whether an intermediary could also act as a data altruism organisation, the Commission clarified that altruism organisations under the Data Governance Act must function on not-for-profit basis whilst intermediaries must establish a commercial link with data subjects/holders.

Watch the video from the webinar here

Next meeting of Living-in.EU Legal and Ethics sub-group: 21 April 2022, 10-11.30 on the Data Act.