Article 5

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, such as the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.;

Justification

The amendments ensure that Data Act access rights do not override trade secrets, IP or EU cybersecurity objectives. Industrial and IoT data can reveal know-how, algorithms, control logic, production methods or R&D results when combined, sequenced or analysed in bulk. Disclosure without the trade secret holder’s consent would weaken innovation, expose EU manufacturers to unfair competition and security risks, and reduce trust in data sharing, while preserving coherence with the Trade Secrets Directive, NIS2 and the Cyber Resilience Act.

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate with sufficient evidence that the product data and related service data constiute a trade secret within the meaning of Article 2(1) of Directive 2016/943, that such trade secrets cannot be eliminated or sufficiently mitigated through design measures pursutant to Aritcle 3(1), and, despite the technical and organisational measures taken by the third partyuser pursuant to paragraph 96 of this Article, it is highly likely to suffer serious and demonstrable economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third partyuser poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent user or trade secret protection compared to that under Union law. For the purposes of this Regulation, that'serious economic damage' does not include normal competitive effects arising from lawful access under the Data Act. The data holder mayshall refuse on a case-by-case basis a request for access toidentify the specific data inthat questionconstitutes a trade secret and shall not classify entire datasets as trade secrets. ThatAny such demonstration shall be duly substantiated on the basis of objective elements, suchverifiable asand specific evidence, taking into account, in particular, the enforceability of trade secretssecret protection in third countries, the nature and level of confidentiality of the data requestedconcerned, the design measures applied pursuant to Article 3(1), and the uniqueness and novelty of the connected product. ItSuch demonstration shall be provided in writing to the third partyuser without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.;Where the data holder refuses to share specific data on the basis of trade secret protection, it shall notify the competent authority designated pursuant to Article 37 without undue delay and no later than five working days after communicating the refusal to the user. The competent authority shall review the substantiation provided and issue a binding decision within sixty calendar days of receipt of the notification. A refusal shall be permitted only on a case-by-case basis and shall be duly reasoned, proportionate and limited to the specific data strictly necessary to protect the trade secret. It shall not prejudice the rights of users under this Regulation. Any claim relating to third-country entities shall be supported by concrete evidence demonstrating a specific risk of unlawful access, use or disclosure. Access may be refused only where the data holder demonstrates, on the basis of objective and verifiable evidence, that disclosure would create a serious and specific risk of unlawful acquisition, use or disclosure of the trade secret that cannot be adequately mitigated through confidentiality measures, technical safeguards or contractual arrangements.

11. The Commission, in consultation with the European Data Innovation Board (EDIB) and representatives of data holders, users, and third parties shall publish a list of high-risk sectors with regards to the disclosure of trade secrets. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or, in high-risk sectors, that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elementsobjectiveevidence, such as the enforceability of trade secrets protection in third countries, the verifable insufficiency of specific technical and organisational measures taken by the user pursuant to paragraph 6 of this Article, the high likelihood of suffering serious economic damage, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37 no later than five working days after the refusal was communicated to the third party.; The competent authority shall approve or reject the data holder’s refusal to share data pursuant to this paragraph based on a review of the evidence submitted by the data holder, and provide in writing an explanation for its decision to the data holder and third party within 60 calander days. The third party has the right to be heard before the competent authority decides to approve or reject the data holder’s refusal to share data pursuant to this paragraph. The Commission shall issue guidelines, in consultation with the European Data Innovation Board (EDIB) and representatives of data holders, users, and third parties on the application of this paragraph, such as the assessment of serious economic damage, third-country entity direct or indirect control, and the enforceability of trade secrets protection in third countries.

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question.In any circumstance, where the data holder who is a trade secret holder assesses a risk of disclosing trade secrets, the data holder may refuse a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, such as the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product.The assessment shall be based on the definition of trade secrets stated in Article 2 (1) of Directive (EU) 2016/943 of the European Parliament and of the Council. ItThe refusal shall be provided in writing to the third partyuser without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.;

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question.In any circumstance, where the data holder who is a trade secret holder assesses a risk of disclosing trade secrets, the data holder may refuse a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, such as the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product.The assessment shall be based on the definition of trade secrets stated in Article 2 (1) of Directive (EU) 2016/943 of the European Parliament and of the Council. ItThe refusal shall be provided in writing to the third partyuser without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.;’

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question.In any circumstance, where the data holder who is a trade secret holder assesses a risk of disclosing trade secrets, the data holder may refuse a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, such as the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product.The assessment shall be based on the definition of trade secrets stated in Article 2 (1) of Directive (EU) 2016/943 of the European Parliament and of the Council. ItThe refusal shall be provided in writing to the third partyuser without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.;

11. In exceptional circumstances, whereWhere the data holder who is a trade secret holder is able to demonstratefinds that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, suchin asparticular the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.;Where the data holder refuses to share data pursuant to this paragraph, it shall notify the third party requesting access to the data. The Commission shall consult stakeholders and adopt guidelines on the application of paragraph 5(11). These shall identify specific third-country jurisdictions and types of data or practices that inherently pose a high risk to trade secrets in particular where the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law. The Commission shall provide a simplified template based on the list of objective criteria to help data holders to substantiate 'serious economic damage,' and where access may be granted even if data is highly sensitive and under what conditions

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, such as the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.; Where a third party’s request for access relates to data reflecting the user’s economic activity, scale of operations and output, the data holder shall inform the user in advance of the request received, specifying the nature of the data requested and the decisions taken regarding the activation of the refusal mechanism. This information obligation is without prejudice to the user’s right under Article 5 to designate the third party recipient of the data.

Justification

L’emendamento estende in modo simmetrico all’articolo 5, paragrafo 11, del regolamento (UE) 2023/2854 l’obbligo informativo introdotto all’articolo 4, paragrafo 8, dall’Emendamento 6. La ratio è la medesima. Quando la richiesta di accesso riguarda dati che riflettono l’attività e il dimensionamento economica dell’utente e delle sue produzioni, l’utente deve essere messo nella condizione di conoscere la richiesta e le determinazioni del detentore dei dati, anche quando la richiesta provenga da un terzo. L’emendamento è formulato in modo da non incidere sul diritto dell’utente di designare autonomamente terze parti destinatarie dei propri dati, disciplinato dall’articolo 5 del regolamento nella sua struttura complessiva.

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, such as the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.; Where a third party’s request for access relates to data reflecting the user’s economic activity and scale of operations and their output, the data holder shall inform the user in advance of the request received, specifying the nature of the data requested and the decisions taken regarding the activation of the refusal mechanism. This information obligation is without prejudice to the user’s right under Article 5 to designate the third party recipient of the data. (Our intention is to amend this article by adding a section of text at the end of the article in question.)

11. In exceptional circumstances, whereWhere the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, such as the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay.The refusal shall be provided in writing to the third party without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.;

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, such as the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrateestablish, on the basis of reasonable grounds, that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serioussignificant economic damage from the disclosure of trade secrets or of industrial, strategic or sensitive data whose disclosure would be liable to harm economic security, privacy or public order, or that the disclosure of tradesuch secretsdata to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, including as a result of the foreseeable onward transmission of the data to such entities, that data holder may refuse on a case-by-case basis a request for access to the specific data in question. That demonstrationassessment shall be dulyreasonably substantiated on the basis of objective elements, such as the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, the reasonably foreseeable chain of onward transmission of the data, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.;

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious and irreparable economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, suchin asparticular the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.; The data holder and the competent authority shall inform the third party of their rights and the relevant procedure under paragraph 12.

11. In exceptional circumstances, where the data holder who is a trade secret holder is able to demonstrate that, despite the technical and organisational measures taken by the third party pursuant to paragraph 9 of this Article, it is highly likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a high risk of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, that data holder may refuse on a case-by-case basis a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, suchin asparticular the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay. Where the data holder refuses to share data pursuant to this paragraph, it shall notify the competent authority designated pursuant to Article 37.;

Justification

Article 5(11), as currently drafted in the Data Act, establishes an exhaustive framework for demonstrating, based on objective elements, the risk of serious economic damage resulting from the disclosure of trade secrets. Replacing ‘in particular’ with ‘such as’ would transform that framework into an open-ended list of criteria, allowing reliance on additional unspecified elements and broadening the grounds for refusal. To preserve legal certainty, the original wording should be retained.

In Article 5, paragraph 10 the following subparagraph is added

4a. Article 5 is amendment as follows: the following paragraph 13a is inserted:

4a. In Article 5, paragraph 9 is being replaced by the following:

Trade secrets shall be preserved and shall be disclosed to third parties only to the extent that such disclosure is strictly necessary to fulfil the purpose agreed between the user and the third party. The data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata, and shall agree with the third party all proportionate technical and organisational measures necessary to preserve the confidentiality of the shared data, such as model contractual terms, confidentiality agreements, strict access protocols, technical standards and the application of codes of conduct.9. Trade secrets shall be preserved and shall not be disclosed to third parties without the consent of their respective trade secret holder."

Justification

The amendments ensure that Data Act access rights do not override trade secrets, IP or EU cybersecurity objectives. Industrial and IoT data can reveal know-how, algorithms, control logic, production methods or R&D results when combined, sequenced or analysed in bulk. Disclosure without the trade secret holder’s consent would weaken innovation, expose EU manufacturers to unfair competition and security risks, and reduce trust in data sharing, while preserving coherence with the Trade Secrets Directive, NIS2 and the Cyber Resilience Act.

10. Where there is no agreement on the necessary measures referred to in paragraph 9 of this Article or if the third party fails to implement the measures agreed pursuant to paragraph 9 of this Article or undermines the confidentiality of the trade secrets, the data holder may withhold or, as the case may be, suspend the sharing of data identified as trade secrets. The decision of the data holder shall be duly substantiated and provided in writing to the third party without undue delay.4 b. In such cases, the data holder shall notify the competent authority designated pursuant to Article 37 that it has withheld or suspended data sharing and identify which measures have not been agreed or implemented and, where relevant, which trade secrets have had their confidentiality undermined.In Article 5, paragraph 10 is deleted. ""

Justification

The amendments ensure that Data Act access rights do not override trade secrets, IP or EU cybersecurity objectives. Industrial and IoT data can reveal know-how, algorithms, control logic, production methods or R&D results when combined, sequenced or analysed in bulk. Disclosure without the trade secret holder’s consent would weaken innovation, expose EU manufacturers to unfair competition and security risks, and reduce trust in data sharing, while preserving coherence with the Trade Secrets Directive, NIS2 and the Cyber Resilience Act.