Article 1

This amendment preserves a stronger and more reliable oversight framework for data intermediation services. Maintaining mandatory registration helps ensure transparency, accountability and effective supervision, particularly where sensitive or high-risk data processing activities are involved, and contributes to greater trust and legal certainty within the European data-sharing ecosystem.

The debates surrounding the codification of the case-law of the Court of Justice on the concept of pseudonymised data have revealed an urgent need to clarify the legal status of this category of data. Such debates cannot be settled by a mere definition of personal data, but only through guidelines enabling economic operators to take all appropriate risk-mitigation measures so as to ensure their legal certainty and their due diligence. In order to produce guidelines informed by the best practices of data holders, this amendment establishes a voluntary registration scheme. This scheme will feed the work of the European Data Innovation Board, which, in cooperation with the European Data Protection Board and the Commission, will be able to issue such guidelines.

For data processing services handling high-value or sensitive data — whether personal data, open public data or economic data (industrial data, trade secrets) — a voluntary registration scheme would allow operators to make themselves known to the European Data Innovation Board, to take part in its work and to share their best practices with operators subject to the same obligations.

The Regulation pays sustained attention to the risks arising from transfers — whether forced or voluntary — of sensitive data to third countries, and to the risk of disruption of digital services through unilateral measures of an extraterritorial nature. A voluntary registration scheme for providers on which the performance of a function in the general interest or the continuity of an essential service in the Union depends would enable such providers to make themselves known to the European Data Innovation Board and would inform the definition of protective measures against such extraterritorial reach.

The Regulation seeks to lift the ambiguity surrounding the status of pseudonymised data in order to make high-value datasets available for the research and development of innovative solutions and processes. A voluntary registration scheme for providers of data processing services which process sensitive data on the basis of legitimate interest, pursuant to Article 6(1)(f) of Regulation (EU) 2016/679, would allow these operators to make themselves known to the European Data Innovation Board and to share their practices as regards, in particular, the arrangements for obtaining consent where required and the measures taken to mitigate re-identification risks. This would inform the work of the Board and the development of guidelines enabling operators to secure their legal certainty and their due diligence.

Data protection is key, especially access to this data and the persons who have access to this data.

Smart contracts are increasingly used as automated execution mechanisms for data-sharing arrangements, including triggering, authorising, restricting, or logging access to data and related services. Where deployed in connected products, digital ecosystems, or data spaces, such applications may determine or materially influence the conditions under which data are made available, accessed, or transferred between parties. In such cases, operators and deployers of smart contract-based systems function as technical intermediaries in the execution of data-sharing obligations under this Regulation and should therefore fall within its scope to ensure enforceability, transparency, and non-discriminatory access conditions.

The amendments ensure that Data Act access rights do not override trade secrets, IP or EU cybersecurity objectives. Industrial and IoT data can reveal know-how, algorithms, control logic, production methods or R&D results when combined, sequenced or analysed in bulk. Disclosure without the trade secret holder’s consent would weaken innovation, expose EU manufacturers to unfair competition and security risks, and reduce trust in data sharing, while preserving coherence with the Trade Secrets Directive, NIS2 and the Cyber Resilience Act.

Respect for data protection is crucial under all circumstances.