Dutch authority calls for pre-registration of data intermediation services under EU data sharing regime

The Data Governance Act (DGA) became EU law last summer, with the national implementation deadline being 24 September 2023. The Act promotes greater data sharing by businesses and public bodies and the concept of regulated ‘data intermediation service providers’, whereby service providers effectively act to facilitate data sharing between data holders, or data subjects, and data users – including, potentially, through online platforms.

In the Netherlands, although the implementing deadline has passed, the national implementation act has not yet been tabled before the Dutch parliament. However, would-be ‘data intermediation service providers’ can now file a preliminary registration with the ACM as supervisory authority.

Data law expert Andre Walter of Pinsent Masons said: “This is an important development on the DGA in the Netherlands. The Dutch consumer & markets authority has taken initiative to call the data intermediation services for preliminary registration to speed up the process, while we are waiting for the lawmaking. The Dutch authority had been proposed as the competent supervisory authority in the implementation act proposal, but is not yet formally approved. This shows how much value is paid to getting this law up and running.”

One of the crucial points under the new EU data sharing regime requires EU member states to appoint a competent supervisory authority, which is responsible for registering data intermediation service providers and declaring their eligibility. The DGA provides that service providers must register with the national supervisory authority if they want to continue to provide services in the EU.

The EU legislation is designed to enhance rights of organisations to access and re-use ‘protected data’ held by public bodies – including confidential data, information protected by intellectual property rights, and data constituting personal data – whilst ensuring that this data is processed in line with the data protection law.

It is set to encourage data subjects and data holders to make their data available for use in support of “objectives of general interest”, such as to support healthcare, combat climate change, or improve public services. The concept is coined as “data altruism” by the legislation.

In the Netherlands’ proposed implementation bill, the ACM is the intended supervisory authority for compliance with the DGA. It will cooperate with the Dutch Data Protection Authority (DPA), which also has a role in the supervision of the DGA.

Under the DGA, there is a registration obligation for data intermediation service providers and ‘data altruistic’ organisations. In addition, they can apply for an EU label to increase confidence in their services. According to the ACM, a registration or an EU label application is possible from the moment that ACM is formally designated as a supervisory authority when the national implementation law becomes effective. Pre-notification ensures that the registration process can be completed efficiently as soon as the ACM has been formally designated.

Service providers and organisations that have filed a preliminary registration or notification with the ACM will be notified when applications for formal registration and the EU label can be definitively submitted. Although there is no clear timetable for when the proposed bill is to become law, this is expected to happen in 2024.