Recital 24c

The alignment of the two re-use regimes should not lower the level of protection of the data and documents concerned. Public sector bodies hold large volumes of protected and personal data whose re-use may entail risks to privacy, commercially sensitive information and information-system security. When determining the conditions for re-use, public sector bodies and competent bodies should therefore assess, in particular, the risks of re-identification, unauthorised access and cyber threats to data integrity and confidentiality, and apply proportionate state-of-the-art safeguards, including anonymisation, pseudonymisation, aggregation, disclosure-control methods, encryption and secure processing environments. Those safeguards should reflect the nature of the data, the context of the re-use and the level of risk, without unduly limiting the economic and social value of the data. Where anonymisation or similar techniques are used, residual re-identification risks should be assessed in light of the means reasonably likely to be used.

This structural evolution of data use has increased the importance of data reuse as a source of competitive advantage, reinforcing existing asymmetries in bargaining power in data-sharing relationships, in particular where a limited number of undertakings are able to deploy data across multiple services and markets and sometimes collected in an unlawful manner.