Article 32w – Conditions for re-use of certain categories of protected data

Public sector bodies which are competent under national law to grant or refuse access for the re-use of certain categories of protected data shall make publicly available the conditions for allowing such re-use and the procedure to request the re-use via the single information point referred to in Article 32aa. Where they grant or refuse access for re-use, they may be assisted by the competent bodies referred to in Article 32z (1). Member States shall ensure that public sector bodies are equipped with the necessary resources to comply with this Article and Article 32x.

Re-use of certain categories of protected data shall not affect the protected nature of those data or documents and shall only be allowed:

in compliance with intellectual property rights. (b) if data or documents that are considered confidential in accordance with Union or national law on commercial or statistical confidentiality, are not disclosed, as a result of allowing re-use, unless such re-use is allowed based on the data holder’s permission in accordance with paragraph 5. (c) in compliance with Regulation (EU) 2016/679. (3) To ensure the preservation of the protected nature as referred to in paragraph 2, public sector bodies may establish the following requirements:

to grant access for the re-use of data only where the public sector body or the competent body, following the request for re-use, has ensured that those data have been:

anonymised, in the case of personal data;

modified, aggregated or treated by any other method of disclosure control, in the case of commercially confidential information, including trade secrets or content protected by intellectual property rights;

to access and re-use the data remotely within a secure processing environment that is provided or controlled by the public sector body;

to access and re-use the data within the physical premises in which the secure processing environment is located in accordance with high security standards, provided that remote access cannot be allowed without jeopardising the rights and interests of third parties. In the case of re-use allowed in accordance with the first subparagraph, point (a)(i), the re-use of data or documents shall be subject to the rules on public sector open data set out in Section 2. This is without prejudice to Article 32y, which prevails in case of conflict. In the case of re-use allowed in accordance with the first subparagraph, points (b) and (c), the public sector bodies shall impose conditions that preserve the integrity of the functioning of the technical systems of the secure processing environment used. (4) The public sector body shall reserve the right to verify the process, the means and any results of processing of certain categories of data undertaken by the re-user to preserve the integrity of the protection of the data. It shall also reserve the right to prohibit the use of results that contain information jeopardising the rights and interests of third parties. The decision to prohibit the use of the results shall be comprehensible and transparent to the re-user. (4a) Unless national law provides for specific safeguards on applicable confidentiality obligations relating to the re-use of certain categories of protected data, the public sector body shall make the re-use of data provided in accordance with paragraph 3 conditional on the adherence by the re-user to a confidentiality obligation that prohibits the disclosure of any information that jeopardises the rights and interests of third parties and that the re-user may have acquired despite the safeguards put in place. Re-users shall be prohibited from re-identifying any data subject and shall take technical and operational measures to prevent re-identification and to notify any data breach resulting in the re-identification of the data subjects concerned to the public sector body. In the event of the unauthorised re-use of non-personal data, the re-user shall be obliged, without delay, where appropriate with the assistance of the public sector body, to inform the natural or legal persons whose rights and interests may be affected. (5) Where the re-use of data that are protected on the grounds of commercial or statistical confidentiality or of intellectual property rights of third parties cannot be allowed in accordance with paragraphs 3 and 4, re-use shall only be possible: with the permission from the data holders whose rights and interests may be affected by such re-use. The public sector body shall make best efforts, in accordance with Union and national law, to provide assistance to potential re-users in seeking permission from the data holders whose rights and interests may be affected by such re-use, where this is feasible without a disproportionate burden on the public sector body. Where it provides such assistance, the public sector body may be assisted by the competent bodies referred to in Article 32z.