European Data Union Strategy: let’s not avoid the difficult questions
The EU’s Data Union Strategy aims to boost AI-friendly data use, streamline rules, and expand global data flows. But GDPR remains off the table. Unfair B2B data sharing, lack of incentives for public institutions need more attention.
The European Commission’s consultation on the European Data Union Strategy ends on Friday, July 18th. It’s an important document, meant to “streamline existing data rules”, namely, the Open Data Directive, the Data Act, and the Data Governance Act.
While some critics argue that the above legislations need more time to be fully evaluated, the consultation document draws a clear picture of what the strategy will and won’t address. The Commission wants to:
- Stimulate data use and investment by enabling broader access to data - especially for generative AI, through voluntary sharing, funding, and improved tools.
- Simplify the data governance framework by streamlining rules, reducing administrative burdens, and improving interoperability and compliance mechanisms.
- Develop an international data strategy to strengthen cross-border data flows, protect EU data abroad, and boost Europe’s role in shaping global digital standards.
Things-that-must-not-be-named: the GDPR
The very first sentence of the European Data Union Strategy (EDUS) consultation summary hints that the General Data Protection Regulation (GDPR) is outside the scope of the process: “while still upholding privacy and security standards”. The GDPR is also never explicitly mentioned anywhere in the document.
It’s true that simplifying the GDPR falls within Commissioner McGrath’s portfolio, and on July 16th, the Commissioner will meet with a select group of chosen ones to discuss its implementation and potential simplification.
Discussing the European data economy without addressing the GDPR simultaneously is problematic, as the EU’s definition of personal data is extremely broad, limiting Open Data and other initiatives and ambitions under GDPR constraints. Largely voluntary data sharing mechanisms don’t help to facilitate data sharing between European industry players either.
EU Member States have a theoretical opportunity to create legal exemptions under Article 6(f) of the GDPR, yet many choose to interpret “personal data” in the strictest way possible, often without introducing exemptions that would serve legitimate public interests.
Unfortunately, the GDPR remains an untouchable and highly sensitive topic, with Commission representatives often arguing that it is “too politically vulnerable to be reopened”.
Practical problems that the Data Governance Act, Data Act, and Open Data Directive have not yet solved
#1 B2B data sharing between European players is still far from fair. In theory, the Data Act is supposed to protect startups and smaller data-driven companies from unfair practices, especially when large industry players hoard data and block access.
In practice, however, many big European companies still control the playing field, using complex or one-sided contracts that technically allow access, but under terms that are completely unreasonable for smaller players.
Dispute resolution mechanisms? Sure, they exist, but if you're a startup or a small company focused on building your product and reputation, the last thing you want is to get tangled in endless legal back-and-forths with a dominant firm.
#2 State-owned institutions are asked to open data without being compensated properly. We wrote about this before - state-owned institutions that store and manage public data experience either additional costs or lose revenue from opening data that is normally sold commercially.
Moreover, if the ministries or other public bodies overseeing the work of state-owned institutions don’t set very clear and sector-specific KPIs, these institutions are free to meet the general KPIs without much benefit to the local data business.
If the EU doesn’t follow Latvia’s example, where the government compensates national registries for lost revenue, we can’t expect public institutions to be motivated to open high-value datasets.
#3 We’re measuring open data maturity, but not business experience with open data infrastructure
The EU and individual Member States have done a lot to create data portals, and yes, we do have the Open Data Maturity Index. But what’s missing is real business feedback on things like: a) how easy the systems are to work with; b) how valuable the datasets actually are; c) how responsive public administrations are to requests.
Comparing your progress to that of other countries (and a little bit of shame) is a strong motivator in many EU Member States, so it’s worth revisiting this idea.
Egle Markeviciute
