Article 32c – General requirements for registration of recognised data intermediation services providers

Article 32c General requirements for registration of recognised data intermediation services providers In order to qualify for registration in the public Union register referred to in Article 32a paragraph 1 point (a), data intermediation services providers shall meet all of the following requirements:

they do not use the data for which it provides data intermediation services for purposes other than to put them at the disposal of data users;

the data they collect with respect to any activity of a natural or legal person for the purpose of the provision of the data intermediation service, including the date, time and geolocation data, duration of activity and connections to other natural or legal persons established by the person who uses the data intermediation service, are used only for the development of that data intermediation service, which may entail the use of data for the detection of fraud or cybersecurity.

where they offer additional tools and services to data holders, data subjects or data users for the specific purpose of facilitating the exchange of data, such as temporary storage, curation, conversion, encryption, anonymisation and pseudonymisation or other relevant privacy-enhancing technologies, such tools and services are used only at the explicit request or approval of the data holder or data subject or data user;

where data intermediation service providers offer services to their clients other than data intermediation services and the additional tools and services referred to in point (c), they fulfil the following conditions:

such other services are explicitly requested by the data holder, data subject or data user;

the data are not used for other purposes than performing the requested service;

the data intermediation services are offered through an entity functionally separate from entities offering other services;

the undertaking seeking to offer the other services is not designated as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925;

the commercial terms, including pricing, for the provision of data intermediation services to a data holder or data user are not dependent upon whether the data holder or data user uses other services provided by the data intermediation services provider or by a related entity;

the data intermediation services provider offering services to data subjects acts in the data subjects’ best interest where it facilitates the exercise of their rights, in particular by informing and, where appropriate, advising data subjects in a concise, transparent, intelligible and easily accessible manner about intended data uses by data users and standard terms and conditions attached to such uses before data subjects give consent.

the data intermediation services provider ensures that the procedure for access to its service is fair, transparent and non-discriminatory for both data subjects and data holders, as well as for data users, including with regard to prices and terms of service;

the data intermediation services provider maintains a log record of the data intermediation activity;

the data intermediation services provider takes necessary technical or organizational measures to ensure an appropriate level of security for the storage, processing and transmission of non-personal data. Point (d)(iii), of the first sub-paragraph does not apply to micro and small sized enterprises.