Article 32ea

Article 32ea

Recognition of Data Expert Representatives

1.A data intermediation services provider registered in the public Union register referred to in Article 32a(1), point (a), of this Regulation may apply to the competent authority designated under Article 32b for additional recognition as a data expert representative. 2. The competent authority shall recognise data intermediation services provider as a data expert representative where it demonstrates that:

(a)it is institutionally and functionally independent of any data controller, processor or data altruism organisation whose data-processing terms it would negotiate or assess;

(b)it has access to the legal, technical and economic expertise necessary to advise data holders on the processing of their data and to negotiate the terms of such processing on their behalf;

(c)it has adopted internal rules, made publicly available, which govern the avoidance and management of conflicts of interest, the continuing professional education of its personnel, and the distinct separation of any remuneration received from third parties from the assets and instructions of the individuals it represents;

(d)it has subscribed to professional indemnity insurance or an equivalent guarantee proportionate to the scale of its activities; and

(e)it has accepted, in writing, the fiduciary duties set out in Article 32ed.

(f)it is not an undertaking designated as a gatekeeper pursuant Regulation (EU) 2022/1925 or an entity affiliated with such a gatekeeper within the meaning of that Regulation nor an undertaking that operates a Very Large Online Platform or a Very Large Online Search Engine designated under Regulation (EU) 2022/2065 or an entity affiliated with such a Very Large Online Platform or Very Large Online Search Engine.

3.The Commission shall, by means of delegated acts adopted pursuant to Article 45, establish mandatory minimum requirements covering disclosure obligations, transparency standards, fiduciary conduct, conflicts of interest management, and interoperability applicable to expert representatives. Those requirements shall be reviewed at least every three years following consultation with the European Data Innovation Board.

4.The act of recognition under this Article shall be subject to a yearly review by the relevant competent authority, and may be suspended or withdrawn where the conditions set out in paragraph 2 cease to be met or where the expert representative has materially breached its fiduciary duties.

5.The Commission shall maintain a public Union register of recognised expert representatives, as part of the register referred to in Article 32a(1), point (a).

6.Competent authorities under Regulation (EU) 2023/2854 and, concerning the proceasing of personal data, supervisory authorities under Regulation(EU) 2017/679, shall conduct unannounced audits on data controllers and may request from any data controller the documentation necessary to demonstrate compliance with the provisions set out in this Chapter.