EU Data Governance Act

A provider intending to offer the data intermediation services listed in Art. 10 must submit a notification to the competent authority for data intermediation services. After notifying, it may start the activity subject to the conditions of that chapter, and the notification entitles it to provide data intermediation services in all Member States. A provider with establishments in more than one Member State is deemed to fall under the jurisdiction of the Member State of its main establishment. The notification must contain the information listed in Art. 11(6), beginning with the provider’s name.

Applies when

Chinese companies operating data trading or matchmaking platforms in the EU. Note that notification is an ex ante step, not an after-the-fact filing: starting the service without notifying is itself an infringement.

Deadline: Notification must be submitted before starting to provide the service.

Applies from: 2023-09-24

Evidence to retain

• · Notification submission and the competent authority acknowledgement
• · Mapping of the service offering to the three Art. 10 categories
• · Screenshot of the entry in the public register

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Providing the Art. 10 services is subject to the conditions in Art. 12, of which the structural requirements matter most: the provider must not use the data for which it provides intermediation services for purposes other than putting it at the disposal of data users, and must provide the service through a separate legal person; the commercial terms including pricing for providing the service to a data holder or data user must not depend on whether, or to what degree, that party uses other services provided by the same provider or a related entity; and data collected on any activity of a natural or legal person for the purpose of providing the service, including date, time and geolocation data, duration of activity, and connections established with other persons, may be used only to develop that intermediation service, which may entail use for fraud detection or cybersecurity, and must be made available to the data holders on request.

Applies when

Chinese companies providing data matchmaking in the EU. The sharpest constraints are the separate-legal-person and no-own-use rules: putting the data exchange and the company’s own model training in one entity, or training in-house models on data flowing through the platform, breaches this Article outright.

Applies from: 2023-09-24

Evidence to retain

• · Incorporation documents of the separate legal person and a description of business separation
• · Technical and organisational controls enforcing the data use restriction
• · Pricing policy and compliance review evidencing no tying
• · Records of the use restriction on activity data and of responses to data holder requests for it

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)

A provider not established in the Union that offers the Art. 10 services within the Union must designate a legal representative in one of the Member States where those services are offered. To ensure compliance, the representative must be mandated to be addressed, in addition to or instead of the provider, by competent authorities for data intermediation services or by data subjects and data holders on all issues related to the services provided; the representative must cooperate with and comprehensively demonstrate to the competent authorities, on request, the actions taken and arrangements put in place by the provider to ensure compliance. The provider is then deemed to fall under the jurisdiction of the Member State where the representative is located, and the designation is without prejudice to legal actions that could be brought against the provider itself.

Applies when

Companies established in China offering data intermediation services into the EU. The representative’s Member State determines jurisdiction and the enforcing authority and should be chosen together with the commercial footprint.

Applies from: 2023-09-24

Evidence to retain

• · Legal representative mandate and scope of authority
• · Rationale for selecting the representative’s Member State
• · Records of the representative’s cooperation with competent authorities

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)