Article 2

(4b) ‘permission’ means giving data users the right to the processing of non-personal data;

(4c) ‘access’ means data use, in accordance with specific technical, legal or organisational requirements, without necessarily implying the transmission or downloading of data;

(4c) ‘access’ means data use, in accordance with specific technical, legal or organisational requirements, without necessarily implying the transmission or downloading of data;

Justification

This definition of ‘access’ risks undermining the effectiveness of the right of access under the Data Act. By providing that access does not necessarily imply the transmission or downloading of data, it could permit view-only or similarly restrictive solutions that prevent users from making effective use of the data, thereby depriving the right of its practical effect (effet utile). Moreover, Article 4 of the Data Act already comprehensively sets out the rights and obligations of users and data holders regarding access.

(4c) ‘access’ means data use, in accordance with specific technical, legal or organisational requirements, without necessarily implying the transmission or downloading of data;

(4c) ‘access’ means data use, in accordance with specific technical, legal or organisational requirements, without necessarily implying the transmission or downloading of data;

Justification

As per draft report

(4c) ‘access’ means data use, in accordance with specific technical, legal or organisational requirements, without necessarily implying the transmission or downloading of data;

(4c) ‘access’ means data use, in accordance with specific technical, legal or organisational requirements, without necessarily implying the transmission or downloading of data, with the obligation to respect data protection in accordance with the legislation in force, determine who has access and the access period, and establish penalties in the event of uncontrolled data leaks or inadequate data protection;’

Justification

Access to data must be clearly established by identifying the persons who have access to it and the access period.

(aa) (ba) Point (5) is replaced by the following:

(5) ‘connected product’ means an item thatwhose obtainsprimary function is to obtain, generatesgenerate or collectscollect data concerning its use or environment and that is able to communicate product data via an electronic communications service, physical connection or on-device access, and whose primary function is not the storing, processing or transmission of data on behalf of any party other than the user;"

Justification

Since the draft report introduces a new definition of intermediation services we need to delete point 10 of Article 2 of the Data Act (on top of deleting point 38a)

(13) ‘data holder’ means a natural or legal person that has the right or obligation, in accordance with this Regulation, applicable Union law or national legislation adopted in accordance with Union law, to use orand make available data, including, where contractually agreed, product data or related service data, which it has retrieved or generated during the provision of a related service;

(13a) Article 2, paragraph 1, point 22 is replaced by the following

(28a) ‘bodies governed by public law’ means bodies that have all of the following characteristics: (a) they are established for the specific purpose of meeting needs in the general interest, not having an industrial or commercial character; (b) they have legal personality; (c) they are financed, for the most part by the State, regional or local authorities, or by other bodies governed by public law; or are subject to management supervision by those authorities or bodies; or have an administrative, managerial or supervisory board, more than half of whose members are appointed by the State, regional or local authorities, or by other bodies governed by public law;

Justification

This amendment preserves the existing definition in order to maintain greater legal clarity and ensure that the notion of bodies governed by public law continues to be interpreted in a manner consistent with the public-interest objectives of the Regulation.

(28b) ‘public undertaking’ means any undertaking over which a public sector body may exercise directly or indirectly a dominant influence by virtue of their ownership of it, their financial participation therein, or the rules which govern it. A dominant influence on the part of the public sector bodies shall be presumed in any of the following cases in which those bodies, directly or indirectly: (a) hold the majority of the undertaking’s subscribed capital; (b) control the majority of the votes attaching to shares issued by the undertaking; (c) can appoint more than half of the undertaking’s administrative, management or supervisory body;;

(38a) ‘data intermediation service’ means a service which aims to establish relationships of an economic character for the purposes of data sharing between an undetermined number of data subjects or data holders and data users, through technical, legal or other means, including for the purpose of exercising the rights of data subjects in relation to personal data, and which: (1) do not have as their main purpose the intermediation of copyright-protected content; (2) are not jointly procured by several legal persons for exclusive use among them;

Justification

Deleted definition of data intermediation service as in draft report since another definition is provided.

(38a) ‘data intermediation service’ means a service which aims to establish relationships of an economic character for the purposes of data sharing between an undetermined number of data subjects orand data holders on the one hand, and data users on the other hand, through technical, legal or other means, including for the purpose of exercising the rights of data subjects in relation to personal data, and which:

(38a) ‘data intermediation service’ means a service which aims to establish relationships of an economic character for the purposes of data sharing between an undetermined number of data subjects or data holders and data users, through technical, legal or other means, including for the purpose of exercising the rights of data subjects in relation to personal data, and which :

(2a) In Article 2, point 38a, the following point is inserted

(38aa) In Article 2, point 38a, the following point is inserted

Justification

No data intermediation service must exist without personal data protection, for clearly defined time periods.

(38b) ‘data altruism’ means the voluntary sharing of data on the basis of the consent of data subjects to process personal data pertaining to them, or of permissions of data holders to allow the use of their non-personal data without seeking or receiving a reward that goes beyond fair compensation related to the actual costs that they incur where they make their data available for objectives of general interest asin providedaccordance forwith inUnion law, and where applicable national law, where applicable, such as healthcare, combating climate change, improving mobility, facilitating the development, production and dissemination of official statistics, improving the provision of public services, public policy making or scientific research purposes in the general interest;

(38b) ‘data altruism’ means the voluntary sharing of data on the basis of the consent of data subjects to process personal data pertaining to them, or of permissions of data holders to allow the use of their non-personal data without seeking or receiving a reward that goes beyond fair compensation related to the actual costs that they incur where they make their data available for objectives of general interest as provided for in national and Union law, where applicable, such as healthcare, combating climate change, improving mobility, facilitating the development, production and dissemination of official statistics, improving the provision of public services, public policy making or scientific research purposes in the general interest;

(45) ‘small mid-cap’ or ‘SMC’ means a small mid-cap enterprise as defined in Article 2 of the Annex to Commission Recommendation (EU) 2025/1099;

Justification

The Regulation applies differentiated conditions to very large enterprises without defining them, leaving the notion to be construed case by case. The definition retained is effect-based: significant economic power on one or more markets in the digital economy, designation as a gatekeeper or provision of core platform services, worldwide turnover and market capitalisation, and the ability to access, accumulate or aggregate large volumes of data across services or jurisdictions.

(50) ‘research data’ means data , other than scientific publications, which are collected or produced in the course of scientific research activities, within the meaning of Article 4, point (38), of Regulation (EU) 2016/679, and are used as evidence in the research process, or are commonly accepted in the research community as necessary to validate research findings and results; research data does not include data collected or produced in the course of processing whose principal object is to observe, profile or influence the behaviour of natural persons for commercial purposes, in particular for behavioural advertising or the commercial targeting of individuals, even where scientific methods are used;

Justification

The definition of research data conditions the scope of the safeguards attaching to them. Its clarification ensures that data collected or produced in the course of scientific research are covered irrespective of the sector in which the research is carried out, while excluding processing whose principal object is the observation or influencing of behaviour.

(50) ‘research data’ means data, other than scientific publications, which are collected or produced in the course of scientific research activities and are used as evidence in the research process, or are commonly accepted in the research community as necessary to validate research findings and results, including research information, such as abstracts, citations, metadata and other information used to understand and assess research, as well as scientific publications;

(51) ‘re-use’ means the use by natural persons or legal entitiespersons of data or documents held by:

(52) ‘high-value datasets’ means data and documents the re-use of which is associated with important benefits for society, the environment and the economy,public in particular because of their suitability for the creation of value-added services, applications and new, high-quality and decent jobs, and because of the number of potential beneficiaries of the value-added services and applications based on those data and documentsinterest;

(52) ‘high-value datasets’ means datapersonal and non-personal data, as well as documents thewhose re-use of which is associated with important benefits for society, the environment and the economy, in particular because of their suitability for the creation of value-added services, applications and new, high-quality and decent jobs, and because of the number of potential beneficiaries of the value-added services and applications based on those data and documents;

Justification

Article 4(2) of the Treaty on European Union reserves national security to the exclusive responsibility of each Member State. The addition ensures that the categories of protected data expressly include those relating to national security, public security, defence and public order, so that the re-use regime cannot be invoked to obtain access to data falling within the sole competence of the Member States.

54. ‘secure processing environment’ means the physical or virtual environment and organisational means to ensure compliance with Union law in particular with regard to data subjects’ rights, intellectual property rights, and commercial and statistical confidentiality, integrity and accessibility, as well as with applicable national law, and to allow the entity providing the secure processing environment to determine and supervise all data processing actions, including the display, storage, download and export of data and the calculation of derivative data through computational algorithms, ensuring governance, access control, traceability, anonymisation, data minimisation, data protection impact assessments and compliance with security requirements, business confidentiality and protection of data subject rights, as well as interoperability with other secure processing environments, within an EU-wide framework;

Justification

Proper supervision of all data processing actions is necessary, while ensuring data protection in accordance with the legislation in force and without prejudice to data subjects.

(54) ‘secure processing environment’ means the physical or virtual environment and organisational means to ensure compliance with Union law in particular with regard to data subjects’ rights, intellectual property rights, and commercial and statistical confidentiality, integrity and accessibility, as well as with applicable national law, to protect personal data and data relating to identifiable natural persons against re-identification, against personal data breaches, and against unlawful use and trade, and to allow the entity providing the secure processing environment to determine and supervise all data processing actions, including the display, storage, download and export of data and the calculation of derivative data through computational algorithms;

55. ‘re-user’ means a natural or legal person who was granted the right to re-use data or documents held by a public sector body or a public undertaking under Chapter VIIc or to research data or certain categories of protected data, on condition that said person ensures proper data protection, does not transmit the data for material gain, especially without seeking the consent of the holder and without communicating their intention to the persons concerned;

Justification

The transmission of data by a re-user for material gain is not acceptable.

(58) ‘formal open standard’ means a freely accessible standard which has been laid down in written form, detailing specifications for the requirements on how to ensure software interoperability;

(60) ‘data localisation requirement’ means any obligation, prohibition, condition, limit or other requirement provided for in the laws, regulations or administrative provisions of a Member State or resulting from general and consistent administrative practices in a Member State and in bodies governed by public law, including in the field of public procurement, without prejudice to Directive 2014/24/EU, which imposes the processing of data in the territory of a specific Member State or hinders the processing of data in any other Member State; a requirement shall not constitute a data localisation requirement within the meaning of this point where it is justified on grounds of public security, service continuity in the face of unilateral extraterritorial suspension risks, or where it is necessary and proportionate to protect personal data, sensitive data or high-value datasets against access, transfer or use resulting from the extraterritorial application of a third-country law likely to cause harm to the Union or its Member States;

Justification

The growing extraterritorial reach of certain third-country laws exposes personal data, sensitive data and high-value datasets held in the Union to access, transfer or use that may run counter to the Union’s economic security and to the protection of natural persons. This exception, framed around the established grounds of public security and the principles of necessity and proportionality, ensures that the prohibition on data localisation requirements does not prevent Member States from protecting data whose exposure to extraterritorial reach would be liable to cause harm to the Union or its Member States.

(60) ‘data localisation requirement’ means any obligation, prohibition, condition, limit or other requirement provided for in the laws, regulations or administrative provisions of a Member State or resulting from general and consistent administrative practices in a Member State and in bodies governed by public law, including in the field of public procurement, without prejudice to Directive 2014/24/EU, which imposes the processing of data in the territory of a specific Member State or hinders the processing of data in any other Member State;

Justification

The amendment provides legal clarity on the concept of ‘very large enterprise’ by reflecting the realities of data-driven markets, where economic significance is increasingly linked to the ability to generate value from large-scale data processing and reuse. A clear definition ensures consistent, proportionate and predictable application across the Union’s digital acquis.

(ea) In Article 2, the following point is added: