Report on the IMKR Lecture “The Regulation of Data Intermediaries – The Draft Data Governance Act” by Prof. Hennemann
On January 26, 2022, Prof. Dr. Moritz Hennemann, MJur (Oxon.), holder of the Chair of European and International Information and Data Law and director of the Research Center for Legal Issues of Digitalization at the Faculty of Law of the University of Passau, spoke about the draft Data Governance Act (DGA), which is currently undergoing the EU legislative process. After being welcomed by Prof. Rösler, Prof. Hennemann first provided an overview of existing EU legal acts. He then positioned the DGA as one of the next building blocks in the EU’s data strategy. Another legal act expected in this context is the Data Act.
Prof. Hennemann then discussed the objectives and regulatory content of the DGA based on the latest developments (conclusion of the trilogue negotiations in December 2021). In doing so, he emphasized the economic ambitions of the DGA. The objective is to create a level playing field (Recital 2 of the DGA) and thereby stimulate value creation for the Digital Single Market. Building on the recitals, Prof. Hennemann explained the additional regulatory objectives, such as strengthening trust in data intermediaries (Recital 4 of the DGA) and, ultimately, promoting new data-driven services (Recital 22 of the DGA).
Prof. Hennemann emphasized that data trading differs from the traditional trade in goods and commodities due to the fundamental lack of exclusivity and non-rivalry inherent in data. Potential drivers of data trading are data intermediaries that pursue platform-based business models. With the DGA, these service providers have moved onto the legal policy agenda. Art. 2(2)(c) in conjunction with Art. 9(1)(a) of the DGA defines “data intermediaries” as “intermediary services between legal entities and data users.” This personal scope is specified in particular by Recital 22a of the DGA. According to this, the DGA does not apply to cloud services, software manufacturers, or data brokers. The latter “process” data and play an increasingly significant role in the data market.
The provisions of the DGA do not grant data intermediaries preferential treatment in relation to antitrust laws or the provisions of the GDPR. Existing obligations under those legal acts are supplemented by additional original obligations, in particular under Article 11(1) of the DGA. Thus, data intermediaries are subject to, among other things, comprehensive conduct and notification obligations. In this context, Prof. Hennemann questioned whether such a catalog of obligations would, in practice, lead to the intended data exchange. Furthermore, the current legal difficulties – including those related to the GDPR – remain unresolved. In addition to the increased complexity, the question of regulatory jurisdiction has not yet been definitively clarified. The tension between data protection law and antitrust law, already apparent in substantive law, could thus continue when it comes to questions of jurisdiction.
The discussion centered on who would even want to be a data intermediary anymore. A potential competitive advantage for altruistic organizations or NGOs was considered. Prof. Rösler raised the question of whether the DGA draft could promote the availability of legal tech tools (predictive analysis). However, this was difficult to assess, not least because of the DGA’s failure to distinguish between (non-)personal data. Prof. Becker emphasized the potential of data trustees. They centrally manage the ever-increasing number of consents and data sets of individual users with respect to selected services, such as social media. It was also emphasized that a voluntary certification system could offer similar opportunities with less regulatory burden. While the goal of a regulated and trust-building data market is understandable, it appears not to have been fully thought through due to a lack of economic incentives.
