Article 32c

(c) where they offer additional tools and services to data holders or data subjects for the specific purpose of facilitating the exchange of data, such as temporary storage, curation, conversion, encryption, anonymisation and pseudonymisation, such tools and services are used only at the explicit request or approval of the data holder or data subject;the data intermediation services provider shall provide the tools and services necessary for facilitating the exchange of data, such as temporary storage, preservation, conversion, encryption, anonymisation and pseudonymisation, and shall implement appropriate technical and organisational measures to prevent the re-identification of pseudonymised data, personal data breaches and any unlawful acquisition, use, disclosure or transfer of data for which it provides data intermediation services; where the data are made available in pseudonymised or anonymised form, the provider shall apply state-of-the-art techniques aimed at preserving and reinforcing privacy protection.

(iii) the value-added services are offered through a functionally separate entity that is legally, organisationally and operationally separate from the data intermediation service provider;

(iii) the value-added services are offered through a separate legal person. SMEs/SMCs may offer value-added services through a functionally separate entity;

(e) the data intermediation services provider offering services to data subjects acts in the data subjects’ best interest where it facilitates the exercise of their rights, in particular by informing and, where appropriate, advising data subjects in a concise, transparent, intelligible and easily accessible manner about intended data uses by data users and standard terms and conditions attached to such uses before data subjects give consent. Data intermediation service providers shall not use data made available through their services for advertising, insurance, profiling, ranking, price discrimination, training of AI systems or any purpose other than putting those data at the disposal of data users in accordance with the instructions of the data holder or data subject.