Article 32o

the following Chapters VIIa, VIIb and VIIc are inserted: ‘CHAPTER VIIa Voluntary registration of data intermediation services and data altruism organisations’ Article 32a Public Union registers for voluntary data intermediation services and data altruism organisations

The Commission shall keep and regularly update public Union registers of:

recognised data intermediation services providers and

recognised data altruism organisations.

Data intermediation services providers registered in the public Union register referred to in paragraph 1 point (a) may use the label ‘data intermediation services provider recognised in the Union’ in its written and spoken communication, as well as a common logo referred to in paragraph 4.

Data altruism organisations registered in the public Union register referred to in paragraph 1 point (b) may use the label ‘data altruism organisation recognised in the Union’ in its written and spoken communication, as well as the common logo referred to in paragraph 4.

In order to ensure that data intermediation services providers recognised in the Union and data altruism oganisations recognised in the Union are easily identifiable throughout the Union, the Commission is empowered to adopt implementing acts establishing a design for the common logo. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 46(1a). Article 32b Competent authorities for the registration of data intermediation services providers and data altruism organisations

Each Member State shall designate one or more competent authorities responsible for the application and enforcement of this Chapter in accordance with Article 37(1).

The competent authorities shall be set up in a manner so that their independence from any recognised data intermediation services provider or recognised data altruism organisation is guaranteed. Article 32c General requirements for registration of recognised data intermediation services providers In order to qualify for registration in the public Union register referred to in Article 32a paragraph 1 point (a), data intermediation services providers shall meet all of the following requirements:

they do not use the data for which it provides data intermediation services for purposes other than to put them at the disposal of data users;

the data they collect with respect to any activity of a natural or legal person for the purpose of the provision of the data intermediation service, including the date, time and geolocation data, duration of activity and connections to other natural or legal persons established by the person who uses the data intermediation service, are used only for the development of that data intermediation service, which may entail the use of data for the detection of fraud or cybersecurity.

where they offer additional tools and services to data holders, data subjects or data users for the specific purpose of facilitating the exchange of data, such as temporary storage, curation, conversion, encryption, anonymisation and pseudonymisation or other relevant privacy-enhancing technologies, such tools and services are used only at the explicit request or approval of the data holder or data subject or data user; (d) where data intermediation service providers offer services to their clients other than data intermediation services and the additional tools and services referred to in point (c), they fulfil the following conditions: (i) such other services are explicitly requested by the data holder, data subject or data user;

the data are not used for other purposes than performing the requested service; (iii) the data intermediation services are offered through an entity functionally separate from entities offering other services; (iv) the undertaking seeking to offer the other services is not designated as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925;

the commercial terms, including pricing, for the provision of data intermediation services to a data holder or data user are not dependent upon whether the data holder or data user uses other services provided by the data intermediation services provider or by a related entity;

the data intermediation services provider offering services to data subjects acts in the data subjects’ best interest where it facilitates the exercise of their rights, in particular by informing and, where appropriate, advising data subjects in a concise, transparent, intelligible and easily accessible manner about intended data uses by data users and standard terms and conditions attached to such uses before data subjects give consent.

the data intermediation services provider ensures that the procedure for access to its service is fair, transparent and non-discriminatory for both data subjects and data holders, as well as for data users, including with regard to prices and terms of service;

the data intermediation services provider maintains a log record of the data intermediation activity;

the data intermediation services provider takes necessary technical or organizational measures to ensure an appropriate level of security for the storage, processing and transmission of non-personal data. Point (d)(iii), of the first sub-paragraph does not apply to micro and small sized enterprises. Article 32d General requirements for registration of recognised data altruism organisations In order to qualify for registration in the public Union register referred to in Art. 32a paragraph 1 point (b), a data altruism organisation shall meet all of the following requirements:

they carry out data altruism activities;

they are a legal person established pursuant to national law to meet objectives of general interest as provided for in national law, where applicable;

they operate on a not-for-profit basis and are legally independent from any entity that operates on a for-profit basis;

they carry out their data altruism activities through a structure that is functionally separate from their other activities. Article 32e Registration in public Union register

Data intermediation services provider which meets the requirements set out in Article 32c may submit an application for registration in the public Union register of recognised data intermediation services providers to the competent authority referred to in Article 32b in the Member State in which they have their main establishment. A data altruism organisation which meets the requirements set out in Article 32d may submit an application for registration in the public Union register of recognised data altruism organisations to the competent authority referred to in Article 32b in the Member State in which they have their main establishment.

Data intermediation services providers and data altruism organisations that have no main establishment in the Union shall designate a legal representative in one of the Member States. The legal representative shall be mandated to be addressed in addition to or instead of the data intermediation services provider or data altruism organisation by competent authorities or data subjects and data holders. The legal representative shall cooperate with and comprehensively demonstrate to the competent authority, upon request, the actions taken and provisions put in place by the data intermediation services provider or the data altruism organisation to ensure compliance with this Regulation. Article 37(11) and (12) do not apply to data intermediation services providers and data altruism organisations. The data intermediation services provider or data altruism organisation shall be deemed to be under the jurisdiction of the Member State in which the legal representative is located. The designation of a legal representative shall be without prejudice to any legal actions which could be initiated against the data intermediation services provider or data altruism organisation.

Competent authorities shall establish the necessary application forms.

Where a data intermediation services provider has submitted all necessary information pursuant to paragraph 3 of this Article, and complies with the requirements set out in Article 32c, the competent authority shall, within 12 weeks after the receipt of the application for registration, take a decision on whether the provider complies with the criteria set out in Article 32c. Where the competent authority requests the applicant to provide additional information necessary to assess compliance with Article 32c, the time limit shall be suspended until the competent authority has received that information. In duly justified cases, where the assessment of compliance requires additional time due to the complexity or novelty of the services, the competent authority may extend the time limit once by a maximum of 12 weeks and shall inform the applicant accordingly, stating reasons. Where the provider complies with the criteria, the competent authority shall submit the relevant information to the Commission which shall register the providers in the public Union register as a recognised data intermediation services provider. The first subparagraph shall also apply where a data altruism organisation has submitted all necessary information pursuant to paragraph 3, and complies with the registration requirements set out in Article 32d. The registration in the public Union register shall be valid in all Member States.

The competent authority may charge fees for the registration in accordance with national law. Such fees shall be proportionate and objective and be based on the administrative costs related to the monitoring of compliance. In the case of small-mid caps, small and medium-sized enterprises, and start-ups, the competent authority may charge a discounted fee or waive the fee.

Registered entities shall notify within a reasonable time the competent authority of any subsequent changes to the information as provided during the application process or where they cease their data intermediation or data altruism activities in the Union.

The competent authority shall without delay and by electronic means notify the Commission of any notification pursuant to paragraph 6. The Commission shall without undue delay update the public Union register. Article 32f Duties of recognised data altruism organisations

Recognised data altruism organisations shall inform data subjects or data holders prior to any processing of their data in a clear and easily comprehensible manner of the following:

the objectives of general interest and, if applicable, the specified, explicit and legitimate purpose for which personal data is to be processed, and for which it permits the processing of their data by a data user;

the location of the processing and the objectives of general interest for which it permits any processing carried out in a third country, where the processing is carried out by the recognised data altruism organisation.

Recognised data altruism organisations shall not use the data for other objectives than the objectives of general interest for which the data subject or data holder allows the processing. The recognised data altruism organisation shall not use misleading marketing practices to solicit the provision of data.

Recognised data altruism organisations shall provide electronic means for obtaining consent from data subjects or permissions to process data made available by data holders as well as for their withdrawal.

Recognised data altruism organisations shall, without delay, inform data holders in the event of any unauthorised transfer, access or use of the non-personal data that it has shared.

Where recognised data altruism organisations facilitate data processing by third parties, including by providing tools for obtaining consent from data subjects or permissions to process data made available by data holders, they shall, where relevant, specify the third-country in which the data use is intended to take place. Article 32g Monitoring of compliance

The competent authorities referred to in Article 32b shall supervise whether recognised data intermediation services providers and recognised data altruism organisations comply with the requirements laid down in this Chapter, including whether they continue to comply with the requirements for registration laid down therein. Those competent authorities may also monitor and supervise the compliance of data intermediation services providers and recognised data altruism organisations, on the basis of a request by a natural or legal person.

The competent authorities shall have the power to request from recognised data intermediation services providers or recognised data altruism organisations, or their legal representative, all the information that is necessary to verify compliance with the requirements laid down in this Chapter. Any request for information shall be proportionate to the performance of the task and shall be reasoned.

Where a competent authority finds that a recognised data intermediation services provider or a recognised data altruism organisation does not comply with one or more of the requirements laid down in this Chapter, it shall notify that entity, or its legal representative, of those findings and give it the opportunity to state its views, within 30 days of the receipt of the notification.

The competent authority shall have the power to require the cessation of the noncompliance referred to in paragraph 3 either immediately or within a reasonable time limit and shall take appropriate and proportionate measures with the aim of ensuring compliance.

If a recognised data intermediation services provider or a recognised data altruism organisation does not comply with one or more of the requirements laid down in this Chapter even after having been notified in accordance with paragraph 3, that entity shall:

lose its right to use the label referred to in Article 32a in written and spoken communication;

be removed from the public Union register referred to in Article 32a. Any decision revoking the right to use the label as referred to in the first subparagraph, point (a), shall be made public by the competent authority and shall be notified to the Commission. The Commission shall remove the entity from the public Union register. CHAPTER VIIb Free flow of non-personal data within the Union’ Article 32h Prohibition of localisation requirements for non-personal data within the Union

Data localisation requirements for non-personal data shall be prohibited, unless they are justified on grounds of public security in compliance with the principle of proportionality or laid down on the basis of Union law.

Member States shall immediately communicate to the Commission any draft act which introduces a new data localisation requirement or makes changes to an existing data localisation requirement in accordance with the procedures set out in Articles 5, 6 and 7 of Directive (EU) 2015/1535 of the European Parliament and of the Council.’ Chapter VIIc Re-use of data and documents held by public sector bodies Section 1 General Provisions Article 32i Subject matter and scope

This Chapter establishes a set of rules governing the re-use and the practical arrangements for facilitating the re-use of the following:

existing data and documents held by public sector bodies of the Member States, including certain categories of protected data;

existing data and documents held by public undertakings that are:

active in the areas referred to in Chapter II of Directive 2014/25/EU of the European Parliament and of the Council;

acting as public service operators pursuant to Article 2 of Regulation (EC) No 1370/2007 of the European Parliament and of the Council;

acting as air carriers fulfilling public service obligations pursuant to Article 16 of Regulation (EC) No 1008/2008 of the European Parliament and of the Council; or (iv) acting as Community shipowners fulfilling public service obligations pursuant to Article 4 of Council Regulation (EEC) No 3577/92 ;

research data pursuant to the conditions set out in Article 32t.

This Chapter does not apply to the following:

data and documents the supply of which is an activity falling outside the scope of the public task of the public sector bodies concerned as defined by law or by other binding rules in the Member State, or, in the absence of such rules, as defined in accordance with common administrative practice in the Member State in question, provided that the scope of the public tasks is transparent and subject to review;

data and documents held by public undertakings and:

produced outside the scope of the provision of services in the general interest as defined by law or other binding rules in the Member State;

related to activities directly exposed to competition and therefore, pursuant to Article 34 of Directive 2014/25/EU, not subject to procurement rules;

data and documents, such as sensitive data or documents, which are excluded from access by virtue of the access regimes in the Member State on grounds of the protection of national security (namely, State security), defence, or public security;

data and documents held by public service broadcasters and their subsidiaries, and by other bodies or their subsidiaries for the fulfilment of a public service broadcasting remit.

Section 2 of this Chapter does not apply to:

data or documents, such as sensitive data or documents, which are excluded from access by virtue of the access regimes in the Member State, including on grounds of:

statistical confidentiality;

commercial confidentiality (including business, professional or company secrets);

data or documents access to which is restricted by virtue of the access regimes in the Member States,

including cases whereby citizens or legal entities have to prove a particular interest to obtain access to documents; (ii) on grounds of protection of personal data, as well as parts of data or documents accessible under those regimes which contain personal data the re-use of which has been defined by law as being incompatible with the legal framework for the protection of individuals with regard to the processing of personal data or as undermining the protection of privacy and the integrity of the individual, in particular under Union or national law regarding the protection of personal data;

logos, crests and insignia; (d) data or documents for which third parties hold intellectual or industrial property rights; (e) data or documents held by cultural establishments other than libraries, including university libraries, museums and archives; (f) data or documents held by educational establishments of secondary level and below, and, in the case of all other educational establishments, data other than those referred to in paragraph 1, point (c); (g) data or documents other than those referred to in paragraph 1, point (c), held by research performing organisations and research funding organisations, including organisations established for the transfer of research results; (h) data or documents access to which is excluded or restricted on grounds of critical entity or critical infrastructure protection related information as defined in points (1) and (4) of Article 2 of Directive (EU) 2022/2557.

Section 3 of this Chapter does not apply to:

data and documents that are not certain categories of protected data;

data or documents held by public undertakings;

data or documents held by cultural establishments and educational establishments;

data and documents covered by Section 2 of this Chapter. Section 3 does not create any obligation on public sector bodies to allow the re-use of data or documents, nor does it release public sector bodies from their confidentiality obligations under Union or national law.

This Chapter builds on, and is without prejudice to, Union and national access regimes, in particular with regard to the granting of access to and disclosure of official data or documents.

The obligations imposed in accordance with this Chapter shall apply only insofar as they are compatible with the provisions of international agreements on the protection of intellectual property rights, in particular the Berne Convention for the Protection of Literary and Artistic Works (Berne Convention), the Agreement on Trade-related Aspects of Intellectual Property Rights (TRIPS Agreement and the World Intellectual Property Organization Copyright Treaty (WCT).

The right for the maker of a database provided for in Article 7(1) of Directive 96/9/EC shall not be exercised by public sector bodies in order to prevent the re-use of data and documents or to restrict re-use beyond the limits set by this Chapter.

This Chapter governs the re-use of existing data and documents held by public sector bodies and public undertakings of the Member States, including data and documents to which Directive 2007/2/EC of the European Parliament and of the Council applies.

This Chapter is without prejudice to Union and national law and international agreements to which the Union or Member States are party on the protection of categories of data or documents referred to in Article 2(53). (10) This Chapter shall enter into application as of [18 months after the publication in the Official Journal of the European Union of this Regulation]. Article 32j Non-discrimination

Any applicable conditions for the re-use of data or documents shall be nondiscriminatory, transparent, proportionate and objectively justified with regard to the categories of data or documents and the purposes of re-use and the nature of the data or documents for which re-use is allowed. Those conditions shall not be used to restrict competition. This principle shall equally apply for comparable categories of re-use, including for cross-border re-use.

If data or documents are re-used by a public sector body as input for its commercial activities which fall outside the scope of its public tasks, the same charges and other conditions shall apply to the supply of the data or documents for those activities as the ones that apply to other re-users. Article 32k Exclusive arrangements

The re-use of data or documents shall be open to all potential actors in the market, even if one or more market actors already exploit added-value products based on those data or documents. Agreements or other arrangements or practices pertaining to the re-use of data or documents, which have as their objective or effect to grant exclusive rights or to restrict the availability of data or documents for re-use by entities other than the parties to such agreements, arrangements or practices, shall be prohibited.

By way of derogation of paragraph 1, where an exclusive right is necessary for the provision of a service of general interest, such a right may be granted to the extent necessary for the provision of the service or the supply of the product under the following conditions:

the exclusive right is granted through an administrative act or contractual agreement in accordance with applicable Union and national law and in compliance with the principles of transparency, equal treatment and nondiscrimination.

the agreements or administrative acts granting the exclusive right, including the reasons as to why it is necessary to grant such a right, shall be transparent and shall be made publicly available online, in a form that complies with relevant Union law on public procurement and national law.

except for exclusive rights related to the digitisation of cultural resources, the validity of the reason for granting exclusive rights concerning data and documents within the scope of Section 2 shall be subject to regular review, and shall in any event, be reviewed every three years.

exclusive arrangements established on or after 16 July 2019 shall be made publicly available online at least two months before they come into effect. The final terms of such arrangements shall be transparent and shall be made publicly available online.

By way of derogation of paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the period of exclusivity shall in general not exceed 10 years. Where that period exceeds 10 years, its duration shall be in accordance with applicable Union and national law subject to review during the 11th year and, if applicable, every seven years thereafter.

In the case of an exclusive right referred to in paragraph 3, the public sector body concerned shall be provided free of charge with a copy of the digitised cultural resources as part of those arrangements. That copy shall be available for re-use at the end of the period of exclusivity.

For certain categories of protected data, the duration of an exclusive right to re-use data shall not exceed 12 months. Where a contract is concluded or administrative act is adopted, the duration of the arrangement shall be the same as the duration of the exclusive right.

Agreements or other arrangements or practices that, without expressly granting an exclusive right, aim at, or could reasonably be expected to lead to, a restricted availability for the re-use of data and documents within the scope of Section 2 by entities other than parties to such arrangements shall be made publicly available online at least two months before their coming into effect. The effect of such legal or practical arrangements on the availability of data for re-use shall be subject to regular reviews and shall, in any event, be reviewed every three years. The final terms of such arrangements shall be transparent and made publicly available online.

For existing exclusive arrangements, the following shall apply:

exclusive arrangements concerning data and documents within the scope of Section 2 existing on 17 July 2013 that do not qualify for the exceptions set out in paragraphs 2 and 3 and that were entered into by public sector bodies shall be terminated at the end of the contract and in any event not later than 18 July 2043;

exclusive arrangements concerning data and documents within the scope of Section 2 existing on 16 July 2019 that do not qualify for the exceptions set out in paragraphs 2 and 3, and that were entered into by public undertakings, shall be terminated at the end of the contract and in any event not later than 17 July 2049; Article 32l General principles relating to charging

Any charges set out under Section 2 or Section 3 shall be transparent, nondiscriminatory, proportionate and objectively justified and shall not restrict competition.

In the case of standard charges for the re-use of data or documents, any applicable conditions and the actual amount of those charges, including the calculation basis for such charges, shall be established in advance and published, through electronic means.

In the case of charges for the re-use other than those referred to in paragraph 2, the factors that are taken into account in the calculation of those charges shall be indicated at the outset. Upon request, the holder of the data or documents in question shall also indicate the way in which such charges have been calculated in relation to a specific re-use request.

Public sector bodies shall ensure that any charges can also be paid online through widely available cross-border payment services, without discrimination based on the place of establishment of the payment service provider, the place of issue of the payment instrument or the location of the payment account within the Union. Article 32la Procedure for re-quests for re-use (1) Public sector bodies shall, through electronic means where possible and appropriate, process requests for re-use and shall make the data or document available for re-use to the applicant or, if a licence is needed, finalise the licence offer to the applicant within a reasonable time that is consistent with the time frames laid down for the processing of requests for access to data or documents. (2) Unless shorter time limits have been established in accordance with national law, public sector bodies and in the case of protected data public sector bodies or the competent bodies referred to in paragraph 1 of Article 32z shall process the request and shall deliver the data or documents for re-use to the applicant or, if a licence is needed, finalise the licence offer to the applicant as soon as possible and in principle within 20 working days of receipt. In case of particularly complex requests, that period shall not exceed two months of receipt and in case of requests relating to protected data, that period shall not exceed three months of receipt. (3) In the event of a negative decision, the public sector bodies shall communicate the grounds for refusal to the applicant on the basis of the relevant provisions of the access regime in that Member State or the provisions of this Regulation. Where a negative decision is based on point (d) of paragraph 3 of Article 32i, the public sector body or competent body shall include a reference to the natural or legal person who is the rightsholder, where known, or alternatively to the licensor from which the public sector body has obtained the relevant material. Libraries, including university libraries, museums and archives, shall not be required to include such a reference. (4) Any natural or legal person directly affected by a decision as referred to in paragraph 1 shall have an effective right of redress in the Member State where the relevant body is located. Such a right of redress shall be laid down in national law and shall include the possibility of review by an impartial body with the appropriate expertise, such as the national competition authority, the relevant access-to-documents authority, the supervisory authority established in accordance with Regulation (EU) 2016/679 or a national judicial authority, whose decisions are binding upon the public sector body or the competent body concerned. (5) This Article shall not apply to the following entities:

public undertakings;

educational establishments, research performing organisations and research funding organisations. Article 32m Information on means of redress Public sector bodies shall ensure that applicants for re-use of data or documents are informed of available means of redress relating to decisions or practices affecting them. Any decision on re-use shall contain a reference to the means of redress where the applicant wishes to challenge the decision. Section 2 Re-use of public sector open data Subsection 1 Scope and General Principles Article 32n General principle for re-use of public sector open data

Data or documents in scope of this Section shall be re-usable for commercial or noncommercial purposes in accordance with Section 1 and Section 2 Subsection 3.

For data or documents in which libraries, including university libraries, museums and archives hold intellectual property rights and for data or documents held by public undertakings, where the re-use of such data or documents is allowed, those data or documents shall be re-usable for commercial or non-commercial purposes in accordance with Section 1 and Section 2 Subsection 3. Subsection 3 Conditions for re-use Article 32p Available formats

Without prejudice to Subsection 5, public sector bodies and public undertakings shall make their data available in any pre-existing format or language by electronic means, in formats that are open, machine-readable, accessible, findable and re-usable, together with their metadata. Both the format and the metadata shall, where possible, comply with formal open standards. Public sector bodies and public undertakings shall make their documents available in any pre-existing format or language. (2) Wherever possible and appropriate, public sector bodies and public undertakings shall produce and make available data or documents falling within the scope of this Section in accordance with the principle of ‘open by design and by default’.

Paragraph 1 shall not imply an obligation for public sector bodies to create or adapt data or documents or provide extracts in order to comply with that paragraph where this would involve disproportionate effort, going beyond a simple operation.

Public sector bodies shall not be required to continue the production and storage of a certain type of data or document with a view to the re-use of such data or documents by a private or public sector organisation.

Public sector bodies shall make dynamic data available for re-use immediately after collection, via suitable APIs and, where relevant, as a bulk download.

Where making dynamic data available for re-use immediately after collection, as referred to in paragraph 5, would exceed the financial and technical capacities of the public sector body, thereby imposing a disproportionate effort, those dynamic data shall be made available for re-use within a time frame or with temporary technical restrictions that do not unduly impair the exploitation of their economic and social potential.

Paragraphs 1 to 6 shall apply to existing data or documents held by public undertakings which are available for re-use.

The high-value datasets, as listed in accordance with Article 32v(1) shall be made available for re-use in machine- readable format, via suitable APIs and, where relevant, as a bulk download.’ Article 32q Principles governing charging for public sector open data

The re-use of data or documents within the scope of this Section shall be free of charge. However, the recovery by the public sector body holding the data or documents of the marginal costs incurred for the reproduction, provision, extensive searches and dissemination of such data or documents as well as for anonymisation of personal data and measures taken to protect commercially confidential information and other information protected by law may be allowed.

Paragraph 1 shall not apply to the following entities:

public sector bodies that are required to generate revenue to cover a substantial part of their costs relating to the performance of their public tasks;

libraries, including university libraries, museums and archives;

public undertakings.

Member States shall publish online a list of the public sector bodies referred to in paragraph 2, point (a).

In the cases referred to in paragraph 2, points (a) and (c), the total charges shall be calculated in accordance with objective, transparent and verifiable criteria. Such criteria shall be laid down by Member States. The total income from supplying and allowing the re-use of data or documents over the appropriate accounting period shall not exceed the cost of their collection, production, reproduction, dissemination and data storage, together with a reasonable return on investment, and where applicable, the anonymisation of personal data and measures taken to protect commercially confidential information. Charges shall be calculated in accordance with the applicable accounting principles.

Where charges are made by the public sector bodies referred to in paragraph 2, point (b), the total income from supplying and allowing the re-use of data or documents over the appropriate accounting period shall not exceed the cost of collection, production, reproduction, dissemination, data storage, preservation and rights clearance and, where applicable, the anonymisation of personal data and measures taken to protect commercially confidential information, together with a reasonable return on investment. Charges shall be calculated in accordance with the accounting principles applicable to the public sector bodies involved. (6) Charges higher than the charges provided for in paragraphs 1, 4 and 5 may be set out for the re-use of data and documents by very large enterprises. Any such charges shall be proportionate and based on objective criteria, taking into account the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. In addition to the elements listed in paragraph 1 of this Article, such charges may cover the cost of collection, production, reproduction dissemination and data storage and where applicable the cost of anonymisation or measures to protect the confidentiality of the data or documents, together with a reasonable return on investment.

The re-use of the following shall be free of charge for the re-user:

subject to Article 32v paragraph (3), (4) and (5), the high-value datasets, as listed in accordance with paragraph 1 of that Article;

research data referred to in point (c) of paragraph 1 of Article 32i. Article 32r Standard licences

The re-use of data or documents shall not be subject to conditions, unless such conditions are objective, proportionate, non-discriminatory and justified on grounds of a public interest objective.

When re-use is subject to conditions, those conditions shall not unnecessarily restrict possibilities for re-use and shall not be used to restrict competition.

In Member States where licences are used, public sector bodies and public undertakings shall ensure that the standard licences for the re-use of public sector data or documents, which can be adapted to meet particular licence applications, are available in digital format and able to be processed electronically.

Public sector bodies and public undertakings may establish special conditions for the re-use of data and documents by very large enterprises. Such conditions shall be proportionate and should be based on objective criteria. They shall be established taking into consideration the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. Article 32s Practical arrangements

Member States shall make practical arrangements facilitating the search for data or documents available for re-use, such as asset lists of main data or documents with relevant metadata, accessible where possible and appropriate online and in machinereadable format, and on data portals that are linked to the asset lists. Where possible, Member States shall facilitate the cross-linguistic search for data or documents, in particular by enabling metadata aggregation at Union level. Member States shall also encourage public sector bodies to make practical arrangements facilitating the preservation of data or documents available for re-use.

Member States shall, in cooperation with the Commission, ensure simple access to datasets, in particular by providing a single point of access and by progressively making available suitable datasets held by public sector bodies with regard to the data or documents to which this Section applies, as well as to data held by Union institutions, in formats that are accessible, readily findable and re-usable by electronic means. Subsection 4 Research data Article 32t Research data

Member States shall support the availability of research data by adopting national policies and relevant actions aiming at making publicly funded research data openly available (‘open access policies’), following the principle of ‘open by default’ and compatible with the FAIR principles. In that context, concerns relating to intellectual property rights, personal data protection and confidentiality, security and legitimate commercial interests, shall be taken into account in accordance with the principle of ‘as open as possible, as closed as necessary’. Those open access policies shall be addressed to research performing organisations and research funding organisations. (2) Without prejudice to Article 32i, paragraph 3, point (d), research data shall be reusable for commercial or non-commercial purposes in accordance with Section 1 and Section 2 Subsection 3, insofar as they are publicly funded and researchers, research performing organisations or research funding organisations have already made them publicly available through an institutional or subject-based repository. In that context, legitimate commercial interests, knowledge transfer activities and preexisting intellectual property rights shall be taken into account. Subsection 5 High-value datasets Article 32u Thematic categories of high-value datasets

The thematic categories of high-value datasets shall be as set out in Annex I.

The Commission is empowered to adopt delegated acts in accordance with Article 45(2) in order to amend Annex I by adding new thematic categories of highvalue datasets reflecting technological and market developments. Article 32v Specific high-value datasets and arrangements for publication and re-use

The Commission shall adopt implementing acts laying down a list of specific highvalue datasets belonging to the categories set out in Annex I and held by public sector bodies and public undertakings among the data or documents to which this Section applies. Such specific high-value datasets shall be:

available free of charge, subject to paragraphs 3, 4 and 5;

machine readable;

provided via APIs; and

provided as a bulk download, where relevant. Those implementing acts may specify the arrangements for the publication and re-use of high-value datasets. Such arrangements shall be compatible with open standard licences. The arrangements may include terms applicable to re-use, formats of data and metadata and technical arrangements for dissemination. Investments made by the Member States in open data approaches, such as investments into the development and roll-out of certain standards, shall be taken into account and balanced against the potential benefits from inclusion in the list. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).

The identification of specific high-value datasets pursuant to paragraph 1 shall be based on the assessment of their potential to:

generate significant socioeconomic or environmental benefits and innovative services;

benefit a high number of users, in particular SMEs and SMCs;

assist in generating revenues; and

be combined with other datasets. For the purpose of identifying such specific high-value datasets, the Commission shall carry out appropriate consultations, including at expert level, conduct an impact assessment and ensure complementarity with existing legal acts, such as Directive 2010/40/EU of the European Parliament and of the Council, with respect to the re-use of data or documents. That impact assessment shall include a cost-benefit analysis and an analysis of whether providing high-value datasets free of charge by public sector bodies that are required to generate revenue to cover a substantial part of their costs relating to the performance of their public tasks would lead to a substantial impact on the budget of such bodies. With regard to high-value datasets held by public undertakings, the impact assessment shall give special consideration to the role of public undertakings in a competitive economic environment.

By way of derogation from paragraph 1, second subparagraph, point (a), the implementing acts referred to in that paragraph shall provide that the availability of high-value datasets free of charge is not to apply to specific high-value datasets held by public undertakings where that would lead to a distortion of competition in the relevant markets.

The requirement to make high-value datasets available free of charge pursuant to point (a) of the second subparagraph of paragraph 1 shall not apply to libraries, including university libraries, museums and archives. Section 3 Re-use of certain categories of protected data held by public sector bodies Article 32w Conditions for re-use of protected data

Public sector bodies which are competent under national law to grant or refuse access for the re-use of data or documents belonging to certain categories of protected data shall make publicly available the conditions for allowing such re-use and the procedure to request the re-use via the single information point referred to in Article 32aa. Where they grant or refuse access for re-use, they may be assisted by the competent bodies referred to in Article 32z (1). Member States shall ensure that public sector bodies are equipped with the necessary resources to comply with this Article and Article 32x.

Re-use of data or documents shall not affect the protected nature of those data or documents and shall only be allowed:

in compliance with intellectual property rights. (b) if data or documents that are considered confidential in accordance with Union or national law on commercial or statistical confidentiality, are not disclosed, as a result of allowing re-use, unless such re-use is allowed based on the data holder’s permission in accordance with paragraph 5.

in compliance with Regulation (EU) 2016/679.

To ensure the preservation of the protected nature as referred to in paragraph 2, public sector bodies may establish the following requirements:

to grant access for the re-use of data or documents only where the public sector body or the competent body, following the request for re-use, has ensured that those data or documents have been:

anonymised, in the case of personal data;

modified, aggregated or treated by any other method of disclosure control, in the case of commercially confidential information, including trade secrets or content protected by intellectual property rights;

to access and re-use the data or documents remotely within a secure processing environment that is provided or controlled by the public sector body;

to access and re-use the data or documents within the physical premises in which the secure processing environment is located in accordance with high security standards, provided that remote access cannot be allowed without jeopardising the rights and interests of third parties. In the case of re-use allowed in accordance with the first subparagraph, point (a)(i), the re-use of data or documents shall be subject to the rules on public sector open data set out in Section 2. This is without prejudice to Article 32y, which prevails in case of conflict. In the case of re-use allowed in accordance with the first subparagraph, points (b) and (c), the public sector bodies shall impose conditions that preserve the integrity of the functioning of the technical systems of the secure processing environment used.

The public sector body shall reserve the right to verify the process, the means and any results of processing of data or documents undertaken by the re-user to preserve the integrity of the protection of the data or documents. It shall also reserve the right to prohibit the use of results that contain information jeopardising the rights and interests of third parties. The decision to prohibit the use of the results shall be comprehensible and transparent to the re-user. Unless national law provides for specific safeguards on applicable confidentiality obligations relating to the re-use of certain categories of protected data, the public sector body shall make the re-use of data or documents provided in accordance with paragraph 3 conditional on the adherence by the re-user to a confidentiality obligation that prohibits the disclosure of any information that jeopardises the rights and interests of third parties and that the re-user may have acquired despite the safeguards put in place. In the event of the unauthorised re-use of non-personal data, the re-user shall be obliged, without delay, where appropriate with the assistance of the public sector body, to inform the natural or legal persons whose rights and interests may be affected.

Where the re-use of data or documents that are protected on the grounds of commercial or statistical confidentiality or of intellectual property rights of third parties cannot be allowed in accordance with paragraphs 3 and 4, re-use shall only be possible: with the permission from the data holders whose rights and interests may be affected by such re-use. The public sector body shall make best efforts, in accordance with Union and national law, to provide assistance to potential re-users in seeking permission from the data holders whose rights and interests may be affected by such reuse, where this is feasible without a disproportionate burden on the public sector body. Where it provides such assistance, the public sector body may be assisted by the competent bodies referred to in Article 32z. Article 32x Requirements for transfers of non-personal protected data to third countries by re-users

Where a re-user intends to transfer certain categories of protected data that are nonpersonal to a third country, it shall inform the public sector body of its intention to transfer such data and the purpose of such transfer at the time of requesting the re-use . In the case of re-use based on the data holder’s permission the re-user shall, where appropriate with the assistance of the public sector body, inform the natural or legal person whose rights and interests may be affected of that intention, purpose and the appropriate safeguards. The public sector body shall not allow the re-use unless the natural or legal person gives permission for the transfer.

Public sector bodies shall transmit non-personal confidential data or data protected by intellectual property rights to a re-user which intends to transfer those data to a third country other than a country designated in accordance with paragraph 5 only if the re-user contractually commits to:

complying with the obligations imposed in accordance with intellectual property rights and Union or national law on commercial or statistical confidentiality even after the data is transferred to the third country;

accepting the jurisdiction of the courts or tribunals of the Member State of the transmitting public sector body with regard to any dispute related to compliance with intellectual property rights and Union or national law on commercial or statistical confidentiality.

The Commission may adopt implementing acts establishing model contractual clauses for complying with the obligations referred to in paragraph 2 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).

Public sector bodies shall, where relevant and to the extent of their capabilities, provide guidance and assistance to re-users in complying with the obligations referred to in paragraph 2.

Where justified because of the substantial number of requests across the Union concerning the re-use of non- personal data in specific third countries, the Commission may adopt implementing acts declaring that the legal, supervisory and enforcement arrangements of a third country:

ensure protection of intellectual property and trade secrets in a way that is essentially equivalent to the protection ensured under Union law;

are being effectively applied and enforced; and

provide effective judicial redress.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).

Specific Union legislative acts may deem certain non-personal data categories held by public sector bodies to be highly sensitive for the purposes of this Article where their transfer to third countries may put at risk Union public policy objectives, such as safety and public health or may lead to the risk of re-identification of nonpersonal, anonymised data. Where such an act is adopted, the Commission shall adopt delegated acts in accordance with Article 45 supplementing this Regulation by laying down special conditions applicable to the transfers of such data to third countries. If required by a specific Union legislative act referred to in the first subparagraph, such special conditions may include terms applicable for the transfer or technical arrangements in this regard, limitations with regard to the re-use of data in third countries or categories of persons entitled to transfer such data to third countries or, in exceptional cases, restrictions with regard to transfers to third countries. The re-user to whom the right to re-use non-personal data was granted may transfer the data only to those third countries for which the requirements set out in paragraphs 2, 4 and 5 are met. Article 32y Fees for the re-use of protected data

Public sector bodies which allow re-use of certain categories of protected data may charge fees for allowing the re-use of such data. (2) Where fees are charged, Member States shall take measures to provide incentives for the re-use of certain categories of protected data for non-commercial purposes, such as scientific research purposes, and by startups, SMEs and SMCs in accordance with Union State aid rules. In that regard, public sector bodies may make the data available at a discounted fee or free of charge, in particular to start-ups, SMEs and SMCs, civil society, research and educational establishments. To that end, a list of categories of re-users to which data or documents for re-use is made available at a discounted fee or free of charge may be established. That list, together with the criteria used to establish it, shall be made public.

Any fees shall be derived from the costs related to conducting the procedure for requests for the re-use of certain categories of protected data and limited to the necessary costs in relation to:

the reproduction, provision and dissemination of data;

the clearance of rights; (c) anonymisation of personal data and preparation of commercially confidential data as provided for in Article 32w(3) ;

the maintenance of the secure processing environment;

the acquisition of the right to allow re-use in accordance with this Section by third parties outside the public sector; and

assisting re-users in seeking consent from data subjects and permission from data holders whose rights and interests may be affected by such reuse.

The criteria and methodology for calculating fees shall be laid down by the Member States and published. The public sector body shall publish a description of the main categories of costs and the rules used for the allocation of costs.

Public sector bodies may charge higher fees than those allowed in accordance with paragraph 2 and 3 of this Article with respect to very large enterprises, based on objective criteria, taking into account the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. Any such calculated fees shall be proportionate. In addition to the elements listed in paragraph 3 of this Article, they can cover the cost of collection and production of the data, together with a reasonable return on investment. Article 32z Competent bodies

For the purpose of carrying out the tasks referred to in this Article, each Member State shall designate one or more competent bodies , which may be competent for particular sectors, but that collectively need to cover all sectors, to assist the public sector bodies which grant or refuse access for the re-use of certain categories of protected data. Member States may either establish one or more new competent bodies or rely on existing public sector bodies or on internal services of public sector bodies that fulfil the conditions laid down in this Section.

The competent bodies may be empowered to grant access for the re-use of certain categories of protected data pursuant to Union or national law which provides for such access to be granted. (3) The assistance referred to in paragraph 1 shall include, where necessary:

providing technical support by making available a secure processing environment for providing access for the re-use of data or documents;

providing guidance and technical support on how to best structure and store data to make that those data or documents easily accessible; (c) providing technical support for anonymization, pseudonymisation and state-ofthe-art privacy-preserving methods, and the commercially confidential information, including trade secrets or content protected by intellectual property rights;

assisting the public sector bodies, where relevant, to provide support to re-users in requesting consent for re-use from data subjects or permission from data holders in line with their specific decisions, including on the jurisdiction in which the data processing is intended to take place and assisting the public sector bodies in establishing technical mechanisms that allow the transmission of requests for consent or permission from re-users, where practically feasible;

providing public sector bodies with assistance in assessing the adequacy of contractual commitments made by a re-user pursuant to Article 32x(2). Article 32aa Single information point

Each Member State shall designate a single information point. That point shall make available easily accessible information concerning the application of Articles 32w, 32x and 32y. The single information point may be linked to sectoral, regional or local information points.

The single information point shall be competent to receive enquiries or requests for the re-use of the certain categories of protected data and shall transmit them, where possible and appropriate by automated means, to the competent public sector bodies, or the competent bodies referred to in Paragraph 1 of Article 32z, where relevant.

The single information point may include a separate, simplified and welldocumented information channel for SMEs, SMCs, start-ups and research establishments addressing their needs and capabilities in requesting the re-use of certain categories of data referred to in Article 2(54).

The single information point shall make available by electronic means a searchable asset list containing an overview of all available data and document resources including, where relevant, those document resources that are available at sectoral, regional or local information points with relevant information describing the available data or documents, including at least the conditions for their re-use.

The Commission shall establish a European single access point offering a searchable electronic register of data or documents available in the national single information points and further information on how to request data or documents via those national single information points. 18aa. Article 33 is amended as follows:

Point (d) in paragraph 1 is replaced by the following: 'where applicable, the means to enable the interoperability of tools for automating the execution of data sharing agreements shall be provided.'

the second subparagraph of paragraph 2 is replaced as follows: 'The Commission shall when adopting delegated acts take into account the advice of the EDIB. 18a. Article 37 is amended as follows:

Paragraph (1) is replaced by the following:

‘Each Member State shall designate one or more competent authorities to be responsible for the application and enforcement of this Regulation, with exception of Chapters VIIb and VIIc (competent authorities). Member States may establish one or more new authorities or rely on existing authorities.’ (b) paragraph 3 is deleted.

paragraph 5 is amended as follows: (-i) point f is replaced by the following:

cooperating with competent authorities of other Member States and, where relevant, with the Commission, or the EDIB, or BEREC, to ensure the consistent and efficient application of this Regulation, including the exchange of all relevant information by electronic means, without undue delay, including regarding paragraph 10 of this Article;' (ii) point g is replaced by the following:

cooperating with the relevant competent authorities responsible for the implementation of other Union or national legal acts, including with authorities competent in the field of data and electronic communication services, with the supervisory authority responsible for monitoring the application of Regulation (EU) 2016/679 or with sectoral authorities to ensure that this Regulation is enforced consistently with other Union and national law, including the exchange of all relevant information;’

paragraph 17 is added:

'BEREC shall facilitate regular exchanges among national competent authorities responsible for the application and enforcement of Articles 23 to 31 and Articles 34 and 35 of this Regulation and shall collect and disseminate, among those national competent authorities, best practices for the application and enforcement of those articles.’

the following Chapters VIIa, VIIb and VIIc are inserted: ‘CHAPTER VIIa Voluntary registration of data intermediation services and data altruism organisations’ Article 32a Public Union registers for voluntary data intermediation services and data altruism organisations

The Commission shall keep and regularly update public Union registers of:

recognised data intermediation services providers and

recognised data altruism organisations.

Data intermediation services providers registered in the public Union register referred to in paragraph 1 point (a) may use the label ‘data intermediation services provider recognised in the Union’ in its written and spoken communication, as well as a common logo referred to in paragraph 4.

Data altruism organisations registered in the public Union register referred to in paragraph 1 point (b) may use the label ‘data altruism organisation recognised in the Union’ in its written and spoken communication, as well as the common logo referred to in paragraph 4.

In order to ensure that data intermediation services providers recognised in the Union and data altruism oganisations recognised in the Union are easily identifiable throughout the Union, the Commission is empowered to adopt implementing acts establishing a design for the common logo. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 46(1a). Article 32b Competent authorities for the registration of data intermediation services providers and data altruism organisations

Each Member State shall designate one or more competent authorities responsible for the application and enforcement of this Chapter in accordance with Article 37(1).

The competent authorities shall be set up in a manner so that their independence from any recognised data intermediation services provider or recognised data altruism organisation is guaranteed. Article 32c General requirements for registration of recognised data intermediation services providers In order to qualify for registration in the public Union register referred to in Article 32a paragraph 1 point (a), data intermediation services providers shall meet all of the following requirements:

they do not use the data for which it provides data intermediation services for purposes other than to put them at the disposal of data users;

the data they collect with respect to any activity of a natural or legal person for the purpose of the provision of the data intermediation service, including the date, time and geolocation data, duration of activity and connections to other natural or legal persons established by the person who uses the data intermediation service, are used only for the development of that data intermediation service, which may entail the use of data for the detection of fraud or cybersecurity.

where they offer additional tools and services to data holders, data subjects or data users for the specific purpose of facilitating the exchange of data, such as temporary storage, curation, conversion, encryption, anonymisation and pseudonymisation or other relevant privacy-enhancing technologies, such tools and services are used only at the explicit request or approval of the data holder or data subject or data user; (d) where data intermediation service providers offer services to their clients other than data intermediation services and the additional tools and services referred to in point (c), they fulfil the following conditions: (i) such other services are explicitly requested by the data holder, data subject or data user;

the data are not used for other purposes than performing the requested service; (iii) the data intermediation services are offered through an entity functionally separate from entities offering other services; (iv) the undertaking seeking to offer the other services is not designated as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925;

the commercial terms, including pricing, for the provision of data intermediation services to a data holder or data user are not dependent upon whether the data holder or data user uses other services provided by the data intermediation services provider or by a related entity;

the data intermediation services provider offering services to data subjects acts in the data subjects’ best interest where it facilitates the exercise of their rights, in particular by informing and, where appropriate, advising data subjects in a concise, transparent, intelligible and easily accessible manner about intended data uses by data users and standard terms and conditions attached to such uses before data subjects give consent.

the data intermediation services provider ensures that the procedure for access to its service is fair, transparent and non-discriminatory for both data subjects and data holders, as well as for data users, including with regard to prices and terms of service;

the data intermediation services provider maintains a log record of the data intermediation activity;

the data intermediation services provider takes necessary technical or organizational measures to ensure an appropriate level of security for the storage, processing and transmission of non-personal data. Point (d)(iii), of the first sub-paragraph does not apply to micro and small sized enterprises. Article 32d General requirements for registration of recognised data altruism organisations In order to qualify for registration in the public Union register referred to in Art. 32a paragraph 1 point (b), a data altruism organisation shall meet all of the following requirements:

they carry out data altruism activities;

they are a legal person established pursuant to national law to meet objectives of general interest as provided for in national law, where applicable;

they operate on a not-for-profit basis and are legally independent from any entity that operates on a for-profit basis;

they carry out their data altruism activities through a structure that is functionally separate from their other activities. Article 32e Registration in public Union register

Data intermediation services provider which meets the requirements set out in Article 32c may submit an application for registration in the public Union register of recognised data intermediation services providers to the competent authority referred to in Article 32b in the Member State in which they have their main establishment. A data altruism organisation which meets the requirements set out in Article 32d may submit an application for registration in the public Union register of recognised data altruism organisations to the competent authority referred to in Article 32b in the Member State in which they have their main establishment.

Data intermediation services providers and data altruism organisations that have no main establishment in the Union shall designate a legal representative in one of the Member States. The legal representative shall be mandated to be addressed in addition to or instead of the data intermediation services provider or data altruism organisation by competent authorities or data subjects and data holders. The legal representative shall cooperate with and comprehensively demonstrate to the competent authority, upon request, the actions taken and provisions put in place by the data intermediation services provider or the data altruism organisation to ensure compliance with this Regulation. Article 37(11) and (12) do not apply to data intermediation services providers and data altruism organisations. The data intermediation services provider or data altruism organisation shall be deemed to be under the jurisdiction of the Member State in which the legal representative is located. The designation of a legal representative shall be without prejudice to any legal actions which could be initiated against the data intermediation services provider or data altruism organisation.

Competent authorities shall establish the necessary application forms.

Where a data intermediation services provider has submitted all necessary information pursuant to paragraph 3 of this Article, and complies with the requirements set out in Article 32c, the competent authority shall, within 12 weeks after the receipt of the application for registration, take a decision on whether the provider complies with the criteria set out in Article 32c. Where the competent authority requests the applicant to provide additional information necessary to assess compliance with Article 32c, the time limit shall be suspended until the competent authority has received that information. In duly justified cases, where the assessment of compliance requires additional time due to the complexity or novelty of the services, the competent authority may extend the time limit once by a maximum of 12 weeks and shall inform the applicant accordingly, stating reasons. Where the provider complies with the criteria, the competent authority shall submit the relevant information to the Commission which shall register the providers in the public Union register as a recognised data intermediation services provider. The first subparagraph shall also apply where a data altruism organisation has submitted all necessary information pursuant to paragraph 3, and complies with the registration requirements set out in Article 32d. The registration in the public Union register shall be valid in all Member States.

The competent authority may charge fees for the registration in accordance with national law. Such fees shall be proportionate and objective and be based on the administrative costs related to the monitoring of compliance. In the case of small-mid caps, small and medium-sized enterprises, and start-ups, the competent authority may charge a discounted fee or waive the fee.

Registered entities shall notify within a reasonable time the competent authority of any subsequent changes to the information as provided during the application process or where they cease their data intermediation or data altruism activities in the Union.

The competent authority shall without delay and by electronic means notify the Commission of any notification pursuant to paragraph 6. The Commission shall without undue delay update the public Union register. Article 32f Duties of recognised data altruism organisations

Recognised data altruism organisations shall inform data subjects or data holders prior to any processing of their data in a clear and easily comprehensible manner of the following:

the objectives of general interest and, if applicable, the specified, explicit and legitimate purpose for which personal data is to be processed, and for which it permits the processing of their data by a data user;

the location of the processing and the objectives of general interest for which it permits any processing carried out in a third country, where the processing is carried out by the recognised data altruism organisation.

Recognised data altruism organisations shall not use the data for other objectives than the objectives of general interest for which the data subject or data holder allows the processing. The recognised data altruism organisation shall not use misleading marketing practices to solicit the provision of data.

Recognised data altruism organisations shall provide electronic means for obtaining consent from data subjects or permissions to process data made available by data holders as well as for their withdrawal.

Recognised data altruism organisations shall, without delay, inform data holders in the event of any unauthorised transfer, access or use of the non-personal data that it has shared.

Where recognised data altruism organisations facilitate data processing by third parties, including by providing tools for obtaining consent from data subjects or permissions to process data made available by data holders, they shall, where relevant, specify the third-country in which the data use is intended to take place. Article 32g Monitoring of compliance

The competent authorities referred to in Article 32b shall supervise whether recognised data intermediation services providers and recognised data altruism organisations comply with the requirements laid down in this Chapter, including whether they continue to comply with the requirements for registration laid down therein. Those competent authorities may also monitor and supervise the compliance of data intermediation services providers and recognised data altruism organisations, on the basis of a request by a natural or legal person.

The competent authorities shall have the power to request from recognised data intermediation services providers or recognised data altruism organisations, or their legal representative, all the information that is necessary to verify compliance with the requirements laid down in this Chapter. Any request for information shall be proportionate to the performance of the task and shall be reasoned.

Where a competent authority finds that a recognised data intermediation services provider or a recognised data altruism organisation does not comply with one or more of the requirements laid down in this Chapter, it shall notify that entity, or its legal representative, of those findings and give it the opportunity to state its views, within 30 days of the receipt of the notification.

The competent authority shall have the power to require the cessation of the noncompliance referred to in paragraph 3 either immediately or within a reasonable time limit and shall take appropriate and proportionate measures with the aim of ensuring compliance.

If a recognised data intermediation services provider or a recognised data altruism organisation does not comply with one or more of the requirements laid down in this Chapter even after having been notified in accordance with paragraph 3, that entity shall:

lose its right to use the label referred to in Article 32a in written and spoken communication;

be removed from the public Union register referred to in Article 32a. Any decision revoking the right to use the label as referred to in the first subparagraph, point (a), shall be made public by the competent authority and shall be notified to the Commission. The Commission shall remove the entity from the public Union register. CHAPTER VIIb Free flow of non-personal data within the Union’ Article 32h Prohibition of localisation requirements for non-personal data within the Union

Data localisation requirements for non-personal data shall be prohibited, unless they are justified on grounds of public security in compliance with the principle of proportionality or laid down on the basis of Union law.

Member States shall immediately communicate to the Commission any draft act which introduces a new data localisation requirement or makes changes to an existing data localisation requirement in accordance with the procedures set out in Articles 5, 6 and 7 of Directive (EU) 2015/1535 of the European Parliament and of the Council.’ Chapter VIIc Re-use of data and documents held by public sector bodies Section 1 General Provisions Article 32i Subject matter and scope

This Chapter establishes a set of rules governing the re-use and the practical arrangements for facilitating the re-use of the following:

existing data and documents held by public sector bodies of the Member States, including certain categories of protected data;

existing data and documents held by public undertakings that are:

active in the areas referred to in Chapter II of Directive 2014/25/EU of the European Parliament and of the Council;

acting as public service operators pursuant to Article 2 of Regulation (EC) No 1370/2007 of the European Parliament and of the Council;

acting as air carriers fulfilling public service obligations pursuant to Article 16 of Regulation (EC) No 1008/2008 of the European Parliament and of the Council; or (iv) acting as Community shipowners fulfilling public service obligations pursuant to Article 4 of Council Regulation (EEC) No 3577/92 ;

research data pursuant to the conditions set out in Article 32t.

This Chapter does not apply to the following:

data and documents the supply of which is an activity falling outside the scope of the public task of the public sector bodies concerned as defined by law or by other binding rules in the Member State, or, in the absence of such rules, as defined in accordance with common administrative practice in the Member State in question, provided that the scope of the public tasks is transparent and subject to review;

data and documents held by public undertakings and:

produced outside the scope of the provision of services in the general interest as defined by law or other binding rules in the Member State;

related to activities directly exposed to competition and therefore, pursuant to Article 34 of Directive 2014/25/EU, not subject to procurement rules;

data and documents, such as sensitive data or documents, which are excluded from access by virtue of the access regimes in the Member State on grounds of the protection of national security (namely, State security), defence, or public security;

data and documents held by public service broadcasters and their subsidiaries, and by other bodies or their subsidiaries for the fulfilment of a public service broadcasting remit.

Section 2 of this Chapter does not apply to:

data or documents, such as sensitive data or documents, which are excluded from access by virtue of the access regimes in the Member State, including on grounds of:

statistical confidentiality;

commercial confidentiality (including business, professional or company secrets);

data or documents access to which is restricted by virtue of the access regimes in the Member States,

including cases whereby citizens or legal entities have to prove a particular interest to obtain access to documents;

on grounds of protection of personal data, as well as parts of data or documents accessible under those regimes which contain personal data the re-use of which has been defined by law as being incompatible with the legal framework for the protection of individuals with regard to the processing of personal data or as undermining the protection of privacy and the integrity of the individual, in particular under Union or national law regarding the protection of personal data;

logos, crests and insignia; (d) data or documents for which third parties hold intellectual or industrial property rights; (e) data or documents held by cultural establishments other than libraries, including university libraries, museums and archives; (f) data or documents held by educational establishments of secondary level and below, and, in the case of all other educational establishments, data other than those referred to in paragraph 1, point (c); (g) data or documents other than those referred to in paragraph 1, point (c), held by research performing organisations and research funding organisations, including organisations established for the transfer of research results; (h) data or documents access to which is excluded or restricted on grounds of critical entity or critical infrastructure protection related information as defined in points (1) and (4) of Article 2 of Directive (EU) 2022/2557.

Section 3 of this Chapter does not apply to:

data and documents that are not certain categories of protected data;

data or documents held by public undertakings;

data or documents held by cultural establishments and educational establishments;

data and documents covered by Section 2 of this Chapter. Section 3 does not create any obligation on public sector bodies to allow the re-use of data or documents, nor does it release public sector bodies from their confidentiality obligations under Union or national law.

This Chapter builds on, and is without prejudice to, Union and national access regimes, in particular with regard to the granting of access to and disclosure of official data or documents.

The obligations imposed in accordance with this Chapter shall apply only insofar as they are compatible with the provisions of international agreements on the protection of intellectual property rights, in particular the Berne Convention for the Protection of Literary and Artistic Works (Berne Convention), the Agreement on Trade-related Aspects of Intellectual Property Rights (TRIPS Agreement and the World Intellectual Property Organization Copyright Treaty (WCT).

The right for the maker of a database provided for in Article 7(1) of Directive 96/9/EC shall not be exercised by public sector bodies in order to prevent the re-use of data and documents or to restrict re-use beyond the limits set by this Chapter.

This Chapter governs the re-use of existing data and documents held by public sector bodies and public undertakings of the Member States, including data and documents to which Directive 2007/2/EC of the European Parliament and of the Council applies.

This Chapter is without prejudice to Union and national law and international agreements to which the Union or Member States are party on the protection of categories of data or documents referred to in Article 2(53). (10) This Chapter shall enter into application as of [18 months after the publication in the Official Journal of the European Union of this Regulation]. Article 32j Non-discrimination

Any applicable conditions for the re-use of data or documents shall be nondiscriminatory, transparent, proportionate and objectively justified with regard to the categories of data or documents and the purposes of re-use and the nature of the data or documents for which re-use is allowed. Those conditions shall not be used to restrict competition. This principle shall equally apply for comparable categories of re-use, including for cross-border re-use.

If data or documents are re-used by a public sector body as input for its commercial activities which fall outside the scope of its public tasks, the same charges and other conditions shall apply to the supply of the data or documents for those activities as the ones that apply to other re-users. Article 32k Exclusive arrangements

The re-use of data or documents shall be open to all potential actors in the market, even if one or more market actors already exploit added-value products based on those data or documents. Agreements or other arrangements or practices pertaining to the re-use of data or documents, which have as their objective or effect to grant exclusive rights or to restrict the availability of data or documents for re-use by entities other than the parties to such agreements, arrangements or practices, shall be prohibited.

By way of derogation of paragraph 1, where an exclusive right is necessary for the provision of a service of general interest, such a right may be granted to the extent necessary for the provision of the service or the supply of the product under the following conditions:

the exclusive right is granted through an administrative act or contractual agreement in accordance with applicable Union and national law and in compliance with the principles of transparency, equal treatment and nondiscrimination.

the agreements or administrative acts granting the exclusive right, including the reasons as to why it is necessary to grant such a right, shall be transparent and shall be made publicly available online, in a form that complies with relevant Union law on public procurement and national law.

except for exclusive rights related to the digitisation of cultural resources, the validity of the reason for granting exclusive rights concerning data and documents within the scope of Section 2 shall be subject to regular review, and shall in any event, be reviewed every three years.

exclusive arrangements established on or after 16 July 2019 shall be made publicly available online at least two months before they come into effect. The final terms of such arrangements shall be transparent and shall be made publicly available online.

By way of derogation of paragraph 1, where an exclusive right relates to the digitisation of cultural resources, the period of exclusivity shall in general not exceed 10 years. Where that period exceeds 10 years, its duration shall be in accordance with applicable Union and national law subject to review during the 11th year and, if applicable, every seven years thereafter.

In the case of an exclusive right referred to in paragraph 3, the public sector body concerned shall be provided free of charge with a copy of the digitised cultural resources as part of those arrangements. That copy shall be available for re-use at the end of the period of exclusivity.

For certain categories of protected data, the duration of an exclusive right to re-use data shall not exceed 12 months. Where a contract is concluded or administrative act is adopted, the duration of the arrangement shall be the same as the duration of the exclusive right.

Agreements or other arrangements or practices that, without expressly granting an exclusive right, aim at, or could reasonably be expected to lead to, a restricted availability for the re-use of data and documents within the scope of Section 2 by entities other than parties to such arrangements shall be made publicly available online at least two months before their coming into effect. The effect of such legal or practical arrangements on the availability of data for re-use shall be subject to regular reviews and shall, in any event, be reviewed every three years. The final terms of such arrangements shall be transparent and made publicly available online.

For existing exclusive arrangements, the following shall apply:

exclusive arrangements concerning data and documents within the scope of Section 2 existing on 17 July 2013 that do not qualify for the exceptions set out in paragraphs 2 and 3 and that were entered into by public sector bodies shall be terminated at the end of the contract and in any event not later than 18 July 2043;

exclusive arrangements concerning data and documents within the scope of Section 2 existing on 16 July 2019 that do not qualify for the exceptions set out in paragraphs 2 and 3, and that were entered into by public undertakings, shall be terminated at the end of the contract and in any event not later than 17 July 2049; Article 32l General principles relating to charging

Any charges set out under Section 2 or Section 3 shall be transparent, nondiscriminatory, proportionate and objectively justified and shall not restrict competition.

In the case of standard charges for the re-use of data or documents, any applicable conditions and the actual amount of those charges, including the calculation basis for such charges, shall be established in advance and published, through electronic means.

In the case of charges for the re-use other than those referred to in paragraph 2, the factors that are taken into account in the calculation of those charges shall be indicated at the outset. Upon request, the holder of the data or documents in question shall also indicate the way in which such charges have been calculated in relation to a specific re-use request.

Public sector bodies shall ensure that any charges can also be paid online through widely available cross-border payment services, without discrimination based on the place of establishment of the payment service provider, the place of issue of the payment instrument or the location of the payment account within the Union. Article 32la Procedure for re-quests for re-use

Public sector bodies shall, through electronic means where possible and appropriate, process requests for re-use and shall make the data or document available for re-use to the applicant or, if a licence is needed, finalise the licence offer to the applicant within a reasonable time that is consistent with the time frames laid down for the processing of requests for access to data or documents.

Unless shorter time limits have been established in accordance with national law, public sector bodies and in the case of protected data public sector bodies or the competent bodies referred to in paragraph 1 of Article 32z shall process the request and, in case of a positive decision, shall deliver the data or documents for re-use to the applicant or, if a licence is needed, finalise the licence offer to the applicant as soon as possible and within 20 working days of receipt. In case of particularly complex requests, that period shall not exceed two months of receipt and in case of requests relating to protected data. The period for processing the request shall not exceed three months of receipt whereas this time limit may be extended within reasonable limits in order to deliver the protected data or to provide access for the re-use of the protected data within a secure processing environment.

In the event of a negative decision, the public sector bodies shall communicate the grounds for refusal to the applicant on the basis of the relevant provisions of the access regime in that Member State or the provisions of this Regulation. Where a negative decision is based on point (d) of paragraph 3 of Article 32i, the public sector body or competent body shall include a reference to the natural or legal person who is the rightsholder, where known, or alternatively to the licensor from which the public sector body has obtained the relevant material. Libraries, including university libraries, museums and archives, shall not be required to include such a reference.

Any natural or legal person directly affected by a decision as referred to in paragraph 2 shall have an effective right of redress in the Member State where the relevant body is located. Such a right of redress shall be laid down in national law and shall include the possibility of review by an impartial body with the appropriate expertise, such as the national competition authority, the relevant access-to-documents authority, the supervisory authority established in accordance with Regulation (EU) 2016/679 or a national judicial authority, whose decisions are binding upon the public sector body or the competent body concerned.

This Article shall not apply to the following entities:

public undertakings;

educational establishments, research performing organisations and research funding organisations. Article 32m Information on means of redress Public sector bodies shall ensure that applicants for re-use of data or documents are informed of available means of redress relating to decisions or practices affecting them. Any decision on re-use shall contain a reference to the means of redress where the applicant wishes to challenge the decision. Section 2 Re-use of public sector open data Subsection 1 Scope and General Principles Article 32n General principle for re-use of public sector open data

Data or documents in scope of this Section shall be re-usable for commercial or noncommercial purposes in accordance with Section 1 and Section 2 Subsection 3.

For data or documents in which libraries, including university libraries, museums and archives hold intellectual property rights and for data or documents held by public undertakings, where the re-use of such data or documents is allowed, those data or documents shall be re-usable for commercial or non-commercial purposes in accordance with Section 1 and Section 2 Subsection 3. Subsection 3 Conditions for re-use Article 32p Available formats

Without prejudice to Subsection 5, public sector bodies and public undertakings shall make their data available in any pre-existing format or language by electronic means, in formats that are open, machine-readable, accessible, findable and re-usable, together with their metadata. Both the format and the metadata shall, where possible, comply with formal open standards. Public sector bodies and public undertakings shall make their documents available in any pre-existing format or language. (2) Wherever possible and appropriate, public sector bodies and public undertakings shall produce and make available data or documents falling within the scope of this Section in accordance with the principle of ‘open by design and by default’.

Paragraph 1 shall not imply an obligation for public sector bodies to create or adapt data or documents or provide extracts in order to comply with that paragraph where this would involve disproportionate effort, going beyond a simple operation.

Public sector bodies shall not be required to continue the production and storage of a certain type of data or document with a view to the re-use of such data or documents by a private or public sector organisation.

Public sector bodies shall make dynamic data available for re-use immediately after collection, via suitable APIs and, where relevant, as a bulk download.

Where making dynamic data available for re-use immediately after collection, as referred to in paragraph 5, would exceed the financial and technical capacities of the public sector body, thereby imposing a disproportionate effort, those dynamic data shall be made available for re-use within a time frame or with temporary technical restrictions that do not unduly impair the exploitation of their economic and social potential.

Paragraphs 1 to 6 shall apply to existing data or documents held by public undertakings which are available for re-use.

The high-value datasets, as listed in accordance with Article 32v(1) shall be made available for re-use in machine- readable format, via suitable APIs and, where relevant, as a bulk download.’ Article 32q Principles governing charging for public sector open data

The re-use of data or documents within the scope of this Section shall be free of charge. However, the recovery by the public sector body holding the data or documents of the marginal costs incurred for the reproduction, provision, extensive searches and dissemination of such data or documents as well as for anonymisation of personal data and measures taken to protect commercially confidential information and other information protected by law may be allowed.

Paragraph 1 shall not apply to the following entities:

public sector bodies that are required to generate revenue to cover a substantial part of their costs relating to the performance of their public tasks;

libraries, including university libraries, museums and archives;

public undertakings.

Member States shall publish online a list of the public sector bodies referred to in paragraph 2, point (a).

In the cases referred to in paragraph 2, points (a) and (c), the total charges shall be calculated in accordance with objective, transparent and verifiable criteria. Such criteria shall be laid down by Member States. The total income from supplying and allowing the re-use of data or documents over the appropriate accounting period shall not exceed the cost of their collection, production, reproduction, dissemination and data storage, together with a reasonable return on investment, and where applicable, the anonymisation of personal data and measures taken to protect commercially confidential information. Charges shall be calculated in accordance with the applicable accounting principles.

Where charges are made by the public sector bodies referred to in paragraph 2, point (b), the total income from supplying and allowing the re-use of data or documents over the appropriate accounting period shall not exceed the cost of collection, production, reproduction, dissemination, data storage, preservation and rights clearance and, where applicable, the anonymisation of personal data and measures taken to protect commercially confidential information, together with a reasonable return on investment. Charges shall be calculated in accordance with the accounting principles applicable to the public sector bodies involved. (6) Charges higher than the charges provided for in paragraphs 1, 4 and 5 may be set out for the re-use of data and documents by very large enterprises. Any such charges shall be proportionate and based on objective criteria, taking into account the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. In addition to the elements listed in paragraph 1 of this Article, such charges may cover the cost of collection, production, reproduction dissemination and data storage and where applicable the cost of anonymisation or measures to protect the confidentiality of the data or documents, together with a reasonable return on investment.

The re-use of the following shall be free of charge for the re-user:

subject to Article 32v paragraph (3), (4) and (5), the high-value datasets, as listed in accordance with paragraph 1 of that Article;

research data referred to in point (c) of paragraph 1 of Article 32i. Article 32r Standard licences

The re-use of data or documents shall not be subject to conditions, unless such conditions are objective, proportionate, non-discriminatory and justified on grounds of a public interest objective.

When re-use is subject to conditions, those conditions shall not unnecessarily restrict possibilities for re-use and shall not be used to restrict competition.

In Member States where licences are used, public sector bodies and public undertakings shall ensure that the standard licences for the re-use of public sector data or documents, which can be adapted to meet particular licence applications, are available in digital format and able to be processed electronically.

Public sector bodies and public undertakings may establish special conditions for the re-use of data and documents by very large enterprises. Such conditions shall be proportionate and should be based on objective criteria. They shall be established taking into consideration the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. Article 32s Practical arrangements

Member States shall make practical arrangements facilitating the search for data or documents available for re-use, such as asset lists of main data or documents with relevant metadata, accessible where possible and appropriate online and in machinereadable format, and on data portals that are linked to the asset lists. Where possible, Member States shall facilitate the cross-linguistic search for data or documents, in particular by enabling metadata aggregation at Union level. Member States shall also encourage public sector bodies to make practical arrangements facilitating the preservation of data or documents available for re-use.

Member States shall, in cooperation with the Commission, ensure simple access to datasets, in particular by providing a single point of access and by progressively making available suitable datasets held by public sector bodies with regard to the data or documents to which this Section applies, as well as to data held by Union institutions, in formats that are accessible, readily findable and re-usable by electronic means. Subsection 4 Research data Article 32t Research data

Member States shall support the availability of research data by adopting national policies and relevant actions aiming at making publicly funded research data openly available (‘open access policies’), following the principle of ‘open by default’ and compatible with the FAIR principles. In that context, concerns relating to intellectual property rights, personal data protection and confidentiality, security and legitimate commercial interests, shall be taken into account in accordance with the principle of ‘as open as possible, as closed as necessary’. Those open access policies shall be addressed to research performing organisations and research funding organisations. (2) Without prejudice to Article 32i, paragraph 3, point (d), research data shall be reusable for commercial or non-commercial purposes in accordance with Section 1 and Section 2 Subsection 3, insofar as they are publicly funded and researchers, research performing organisations or research funding organisations have already made them publicly available through an institutional or subject-based repository. In that context, legitimate commercial interests, knowledge transfer activities and preexisting intellectual property rights shall be taken into account. Subsection 5 High-value datasets Article 32u Thematic categories of high-value datasets

The thematic categories of high-value datasets shall be as set out in Annex I.

The Commission is empowered to adopt delegated acts in accordance with Article 45(2) in order to amend Annex I by adding new thematic categories of highvalue datasets reflecting technological and market developments. Article 32v Specific high-value datasets and arrangements for publication and re-use

The Commission shall adopt implementing acts laying down a list of specific highvalue datasets belonging to the categories set out in Annex I and held by public sector bodies and public undertakings among the data or documents to which this Section applies. Such specific high-value datasets shall be:

available free of charge, subject to paragraphs 3, 4 and 5;

machine readable;

provided via APIs; and

provided as a bulk download, where relevant. Those implementing acts may specify the arrangements for the publication and reuse of high-value datasets. Such arrangements shall be compatible with open standard licences. The arrangements may include terms applicable to re-use, formats of data and metadata and technical arrangements for dissemination. Investments made by the Member States in open data approaches, such as investments into the development and roll-out of certain standards, shall be taken into account and balanced against the potential benefits from inclusion in the list. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).

The identification of specific high-value datasets pursuant to paragraph 1 shall be based on the assessment of their potential to:

generate significant socioeconomic or environmental benefits and innovative services;

benefit a high number of users, in particular SMEs and SMCs;

assist in generating revenues; and

be combined with other datasets. For the purpose of identifying such specific high-value datasets, the Commission shall carry out appropriate consultations, including at expert level, conduct an impact assessment and ensure complementarity with existing legal acts, such as Directive 2010/40/EU of the European Parliament and of the Council, with respect to the reuse of data or documents. That impact assessment shall include a cost-benefit analysis and an analysis of whether providing high-value datasets free of charge by public sector bodies that are required to generate revenue to cover a substantial part of their costs relating to the performance of their public tasks would lead to a substantial impact on the budget of such bodies. With regard to high-value datasets held by public undertakings, the impact assessment shall give special consideration to the role of public undertakings in a competitive economic environment.

By way of derogation from paragraph 1, second subparagraph, point (a), the implementing acts referred to in that paragraph shall provide that the availability of high-value datasets free of charge is not to apply to specific high-value datasets held by public undertakings where that would lead to a distortion of competition in the relevant markets.

The requirement to make high-value datasets available free of charge pursuant to point (a) of the second subparagraph of paragraph 1 shall not apply to libraries, including university libraries, museums and archives. Section 3 Re-use of certain categories of protected data held by public sector bodies Article 32w Conditions for re-use of certain categories of protected data

Public sector bodies which are competent under national law to grant or refuse access for the re-use of data or documents belonging to certain categories of protected data shall make publicly available the conditions for allowing such re-use and the procedure to request the re-use via the single information point referred to in Article 32aa. Where they grant or refuse access for re-use, they may be assisted by the competent bodies referred to in Article 32z (1). Member States shall ensure that public sector bodies are equipped with the necessary resources to comply with this Article and Article 32x.

Re-use of data or documents shall not affect the protected nature of those data or documents and shall only be allowed:

in compliance with intellectual property rights. (b) if data or documents that are considered confidential in accordance with Union or national law on commercial or statistical confidentiality, are not disclosed, as a result of allowing re-use, unless such re-use is allowed based on the data holder’s permission in accordance with paragraph 5.

in compliance with Regulation (EU) 2016/679.

To ensure the preservation of the protected nature as referred to in paragraph 2, public sector bodies may establish the following requirements:

to grant access for the re-use of data or documents only where the public sector body or the competent body, following the request for re-use, has ensured that those data or documents have been:

anonymised, in the case of personal data;

modified, aggregated or treated by any other method of disclosure control, in the case of commercially confidential information, including trade secrets or content protected by intellectual property rights;

to access and re-use the data or documents remotely within a secure processing environment that is provided or controlled by the public sector body;

to access and re-use the data or documents within the physical premises in which the secure processing environment is located in accordance with high security standards, provided that remote access cannot be allowed without jeopardising the rights and interests of third parties. In the case of re-use allowed in accordance with the first subparagraph, point (a)(i), the re-use of data or documents shall be subject to the rules on public sector open data set out in Section 2. This is without prejudice to Article 32y, which prevails in case of conflict. In the case of re-use allowed in accordance with the first subparagraph, points (b) and (c), the public sector bodies shall impose conditions that preserve the integrity of the functioning of the technical systems of the secure processing environment used.

The public sector body shall reserve the right to verify the process, the means and any results of processing of data or documents undertaken by the re-user to preserve the integrity of the protection of the data or documents. It shall also reserve the right to prohibit the use of results that contain information jeopardising the rights and interests of third parties. The decision to prohibit the use of the results shall be comprehensible and transparent to the re-user. Unless national law provides for specific safeguards on applicable confidentiality obligations relating to the re-use of certain categories of protected data, the public sector body shall make the re-use of data or documents provided in accordance with paragraph 3 conditional on the adherence by the re-user to a confidentiality obligation that prohibits the disclosure of any information that jeopardises the rights and interests of third parties and that the re-user may have acquired despite the safeguards put in place. In the event of the unauthorised re-use of non-personal data, the re-user shall be obliged, without delay, where appropriate with the assistance of the public sector body, to inform the natural or legal persons whose rights and interests may be affected.

Where the re-use of data or documents that are protected on the grounds of commercial or statistical confidentiality or of intellectual property rights of third parties cannot be allowed in accordance with paragraphs 3 and 4, re-use shall only be possible: with the permission from the data holders whose rights and interests may be affected by such re-use. The public sector body shall make best efforts, in accordance with Union and national law, to provide assistance to potential re-users in seeking permission from the data holders whose rights and interests may be affected by such re-use, where this is feasible without a disproportionate burden on the public sector body. Where it provides such assistance, the public sector body may be assisted by the competent bodies referred to in Article 32z. Article 32x Requirements for transfers of non-personal protected data to third countries by reusers

Where a re-user intends to transfer certain categories of protected data that are nonpersonal to a third country, it shall inform the public sector body of its intention to transfer such data and the purpose of such transfer at the time of requesting the re-use . In the case of re-use based on the data holder’s permission the re-user shall, where appropriate with the assistance of the public sector body, inform the natural or legal person whose rights and interests may be affected of that intention, purpose and the appropriate safeguards. The public sector body shall not allow the re-use unless the natural or legal person gives permission for the transfer.

Public sector bodies shall transmit non-personal confidential data or data protected by intellectual property rights to a re-user which intends to transfer those data to a third country other than a country designated in accordance with paragraph 5 only if the re-user contractually commits to:

complying with the obligations imposed in accordance with intellectual property rights and Union or national law on commercial or statistical confidentiality even after the data is transferred to the third country;

accepting the jurisdiction of the courts or tribunals of the Member State of the transmitting public sector body with regard to any dispute related to compliance with intellectual property rights and Union or national law on commercial or statistical confidentiality.

The Commission may adopt implementing acts establishing model contractual clauses for complying with the obligations referred to in paragraph 2 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).

Public sector bodies shall, where relevant and to the extent of their capabilities, provide guidance and assistance to re-users in complying with the obligations referred to in paragraph 2.

Where justified because of the substantial number of requests across the Union concerning the re-use of non- personal data in specific third countries, the Commission may adopt implementing acts declaring that the legal, supervisory and enforcement arrangements of a third country:

ensure protection of intellectual property and trade secrets in a way that is essentially equivalent to the protection ensured under Union law;

are being effectively applied and enforced; and

provide effective judicial redress.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).

Specific Union legislative acts may deem certain non-personal data categories held by public sector bodies to be highly sensitive for the purposes of this Article where their transfer to third countries may put at risk Union public policy objectives, such as safety and public health or may lead to the risk of re-identification of nonpersonal, anonymised data. Where such an act is adopted, the Commission shall adopt delegated acts in accordance with Article 45 supplementing this Regulation by laying down special conditions applicable to the transfers of such data to third countries. If required by a specific Union legislative act referred to in the first subparagraph, such special conditions may include terms applicable for the transfer or technical arrangements in this regard, limitations with regard to the re-use of data in third countries or categories of persons entitled to transfer such data to third countries or, in exceptional cases, restrictions with regard to transfers to third countries. The re-user to whom the right to re-use non-personal data was granted may transfer the data only to those third countries for which the requirements set out in paragraphs 2, 4 and 5 are met. Article 32y Fees for the re-use of certain categories of protected data

Public sector bodies which allow re-use of certain categories of protected data may charge fees for allowing the re-use of such data. (2) Where fees are charged, Member States shall take measures to provide incentives for the re-use of certain categories of protected data for non-commercial purposes, such as scientific research purposes, and by startups, SMEs and SMCs in accordance with Union State aid rules. In that regard, public sector bodies may make the data available at a discounted fee or free of charge, in particular to start-ups, SMEs and SMCs, civil society, research and educational establishments. To that end, a list of categories of re-users to which data or documents for re-use is made available at a discounted fee or free of charge may be established. That list, together with the criteria used to establish it, shall be made public.

Any fees shall be derived from the costs related to conducting the procedure for requests for the re-use of certain categories of protected data and limited to the necessary costs in relation to:

the reproduction, provision and dissemination of data;

the clearance of rights; (c) anonymisation of personal data and preparation of commercially confidential data as provided for in Article 32w(3);

the maintenance of the secure processing environment;

the acquisition of the right to allow re-use in accordance with this Section by third parties outside the public sector; and

assisting re-users in seeking consent from data subjects and permission from data holders whose rights and interests may be affected by such reuse.

The criteria and methodology for calculating fees shall be laid down by the Member States and published. The public sector body shall publish a description of the main categories of costs and the rules used for the allocation of costs.

Public sector bodies may charge higher fees than those allowed in accordance with paragraph 2 and 3 of this Article with respect to very large enterprises, based on objective criteria, taking into account the economic power, or the ability of the entity to acquire data, including in particular a designation as a gatekeeper under Regulation (EU) 2022/1925. Any such calculated fees shall be proportionate. In addition to the elements listed in paragraph 3 of this Article, they can cover the cost of collection and production of the data, together with a reasonable return on investment. Article 32z Competent bodies

For the purpose of carrying out the tasks referred to in this Article, each Member State shall designate one or more competent bodies , which may be competent for particular sectors, but that collectively need to cover all sectors, to assist the public sector bodies which grant or refuse access for the re-use of certain categories of protected data. Member States may either establish one or more new competent bodies or rely on existing public sector bodies or on internal services of public sector bodies that fulfil the conditions laid down in this Section.

The competent bodies may be empowered to grant access for the re-use of certain categories of protected data pursuant to Union or national law which provides for such access to be granted. (3) The assistance referred to in paragraph 1 shall include, where necessary:

providing technical support by making available a secure processing environment for providing access for the re-use of data or documents;

providing guidance and technical support on how to best structure and store protected data to make those data or documents easily accessible; (c) providing technical support for anonymization, pseudonymisation and state-ofthe-art privacy-preserving methods, and the commercially confidential information, including trade secrets or content protected by intellectual property rights;

assisting the public sector bodies, where relevant, to provide support to re-users in requesting consent for re-use from data subjects or permission from data holders in line with their specific decisions, including on the jurisdiction in which the data processing is intended to take place and assisting the public sector bodies in establishing technical mechanisms that allow the transmission of requests for consent or permission from re-users, where practically feasible;

providing public sector bodies with assistance in assessing the adequacy of contractual commitments made by a re-user pursuant to Article 32x(2). Article 32aa Single information point

Each Member State shall designate a single information point. That point shall make available easily accessible information concerning the application of Articles 32w, 32x and 32y. The single information point may be linked to sectoral, regional or local information points.

The single information point shall be competent to receive enquiries or requests for the re-use of the certain categories of protected data and shall transmit them, where possible and appropriate by automated means, to the competent public sector bodies, or the competent bodies referred to in Paragraph 1 of Article 32z, where relevant.

The single information point may include a separate, simplified and welldocumented information channel for SMEs, SMCs, start-ups and research establishments addressing their needs and capabilities in requesting the re-use of certain categories of data referred to in Article 2(53).

The single information point shall make available by electronic means a searchable asset list containing an overview of all available data and document resources including, where relevant, those document resources that are available at sectoral, regional or local information points with relevant information describing the available data or documents, including at least the conditions for their re-use.

The Commission shall establish a European single access point offering a searchable electronic register of data or documents available in the national single information points and further information on how to request data or documents via those national single information points. 18aa. Article 33 is amended as follows:

Point (d) in paragraph 1 is replaced by the following: 'where applicable, the means to enable the interoperability of tools for automating the execution of data sharing agreements shall be provided.'

the second subparagraph of paragraph 2 is replaced as follows: 'The Commission shall when adopting delegated acts take into account the advice of the EDIB. 18a. Article 37 is amended as follows:

Paragraph (1) is replaced by the following:

‘Each Member State shall designate one or more competent authorities to be responsible for the application and enforcement of this Regulation, with exception of Chapters VIIb and VIIc (competent authorities). Member States may establish one or more new authorities or rely on existing authorities.’

paragraph 3 is deleted. (c) paragraph 5 is amended as follows: (-i) point f is replaced by the following:

cooperating with competent authorities of other Member States and, where relevant, with the Commission, or the EDIB, or BEREC, to ensure the consistent and efficient application of this Regulation, including the exchange of all relevant information by electronic means, without undue delay, including regarding paragraph 10 of this Article;'

point g is replaced by the following:

cooperating with the relevant competent authorities responsible for the implementation of other Union or national legal acts, including with authorities competent in the field of data and electronic communication services, with the supervisory authority responsible for monitoring the application of Regulation (EU) 2016/679 or with sectoral authorities to ensure that this Regulation is enforced consistently with other Union and national law, including the exchange of all relevant information;’

paragraph 17 is added:

'BEREC shall facilitate regular exchanges among national competent authorities responsible for the application and enforcement of Articles 23 to 31 and Articles 34 and 35 of this Regulation and shall collect and disseminate, among those national competent authorities, best practices for the application and enforcement of those articles.’