The Free Flow of Data initiative of the EU

Data driven services are a hot topic in the tech area, enabling business models such as predictive maintenance for machines, targeted marketing and data-based medical treatments. It is expected that the emerging data economy will enable business growth and modernize public services, and companies increasingly rely on data analytics as a major source of revenue. According to a high growth forecast scenario, the value of the European data economy will increase to € 739 billion by 2020, representing 4% of the GDP of the European Union. But for this to happen, it is a key requirement that data will be continuously accessible and allowed to move freely within the single market, accompanied by the high-performance computing necessary to analyze it.

Existing restrictions

However, new research reveals that data restrictions and requirements to store data in a particular state are a growing problem, internationally and in the EU, with around 50 data localization restrictions in national laws throughout the EU alone.

While the new General Data Protection Regulation (GDPR) explicitly forbids localization requirements within the European Union unless they are for national security (or a couple of other) reasons, it only sets rules for personal data; non-personal data are outside the scope of the current framework. This means that there are currently no effective means to ban restrictions on the free movement of such non-personal data at national and regional levels. EU Member States and a range of tech companies have requested the Commission to intervene and strike down national restrictions on non-personal data. In May 2017, the governments of 15 EU Member States wrote a letter to Commission President Jean-Claude Juncker asking for legislation to eliminate those data localization requirements.

Free flow of data initiative

In response to these requests Andrus Ansip, Vice-President of the EU Commission for the Digital Single Market, has said on May 10th, 2017: “We have already agreed on strong EU rules for personal data protection; we now need to make sure that non-personal data can flow freely to assist connected cars and eHealth services.”

He announced that the EU Commission will propose new legislation in order to guarantee the “free flow of data” in autumn of 2017. The initiative is part of the Digital Single Market strategy adopted by the EU Commission in May 2015 (more detailed information on the initiatives are available on the dedicated website of the EU Commission). Up to now, 35 legislative proposals and policy initiatives have been drafted (see overview table on the proposals made under the Digital Single Market strategy), with the further action aimed at enabling the European Data Economy to develop to its full potential. According to Mr. Ansip, the proposal on the cross-border free flow of non-personal data will be based on principles such as free movement of data, data portability and availability of certain data for regulatory control purposes. However, similarly to the existing rules for personal data under the GDPR, exceptions from the planned free flow of data principle are expected where data is required to be stored in one Member State for national security reasons.

Access to data, liability

In addition, the Commission plans to prepare an initiative in spring 2018 to improve access to and reuse of public and publicly funded data, for example in the areas of public transport and public utilities. The Commission also intends to work on liability and other emerging data issues, e.g. ownership of non-personal data.

Alongside the data flow legislation, the Commission is also assessing whether it will create new rules on liability for products using large amounts of data and on companies’ abilities to access commercial data. This has sparked concerns in the car industry over how it will affect vehicles that produce an increasing amount of data and use internet functions (automated driving). The Commission is expected to suggest further action, which is expected to be taken next year.

Impact of the initiative

The free flow of data initiative is a welcome step to facilitate data driven services. However, restrictions on cross-border data flows are a worldwide and growing problem, with countries outside the EU such as China and Russia pushing for national boundaries for data use.

Some EU officials also suggested that EU legislation on free flow of data could have an effect on Germany’s controversial draft law which would force social media platforms to remove posts including hate speech or face steep fines of up to €50 million. The bill also includes two restrictions requiring data to be stored in Germany. Even though the commission approved the German draft law on June 9th, 2017, it could still take Germany to court after the law is passed, either on the basis of a new EU data flow law or if it breaches EU platform liability rules or fundamental rights. But other EU countries are considering new legislation reacting to hate speech on online platforms, too. So, an EU-wide approach should be considered.