Article 5 – Right of the user to share data with third parties

Trade secrets shall be preserved and do not have to be disclosed to third parties, unless the disclosure is strictly necessary to fulfil the purpose agreed between the user and the third party and the data holder and the third party have taken all necessary measures prior to the disclosure to preserve their confidentiality in particular regarding other parties. The data holder or, where they are not the same person, the trade secret holder shall identify the data which are protected as trade secrets, including in the relevant metadata, and shall agree with the third party proportionate technical and organisational measures necessary to preserve the confidentiality of the shared data, in particular in relation to other parties, such as model contractual terms, confidentiality agreements, strict access protocols, technical standards and the application of codes of conduct.

Where the data holder who is a trade secret holder is able to demonstrate that it is likely to suffer serious economic damage from the disclosure of trade secrets or that the disclosure of trade secrets to the third party poses a significant of unlawful acquisition, use, or disclosure to third country entities, or entities established in the Union under the direct or indirect control of such entities, which are subject to jurisdictions offering weaker or non-equivalent protection compared to that under Union law, in particular as regards trade secrets representing industrial manufacturing know-how for entities in the sectors referred to in Annex I and Annex II points 3, 5a, 5d and 5e of Directive (EU) 2022/2555), that data holder may refuse a request for access to the specific data in question. That demonstration shall be duly substantiated on the basis of objective elements, such as the enforceability of trade secrets protection in third countries, the nature and level of confidentiality of the data requested, and the uniqueness and novelty of the connected product. It shall be provided in writing to the third party without undue delay. Data holders who refuse to share data pursuant to the first sub-paragraph shall notify all instances of refusal to the competent authority designated pursuant to Article 37 every 3 months. The Commission shall issue guidelines, in consultation with the European Data Innovation Board (EDIB), on the application of this paragraph, such as the assessment of serious economic damage, the critical economic sectors and the type of data in those critical economic sectors that typically may give rise to serious economic damage when unlawfully disclosed to third parties, and as regards risks for third country disclosure, on the enforceability of trade secrets protection in third countries, and how to assess the control of economic operators by third-country entities.