Data Governance Act: Enhancing Trust and Innovation

The Council of the European Union (EU) approved the Data Governance Act (DGA) in June 2022. This landmark regulation aims to establish a robust framework for data sharing within the EU, fostering trust and facilitating innovation. 

Building Trust: A Cornerstone of the DGA

At the heart of the DGA lies the objective of increasing trust in data sharing practices. This is crucial because businesses and individuals are often hesitant to share data due to concerns about privacy, security, and misuse. The DGA addresses these concerns by introducing several key measures.

Firstly, the DGA creates mechanisms for the secure reuse of public sector data that may be considered too sensitive for open release. This could include anonymized health data for research purposes or environmental data for climate change initiatives. The DGA establishes clear guidelines for data access, ensuring responsible use and adherence to data protection regulations.

Secondly, the DGA regulates the emergence of new data intermediary services. These services act as bridges, facilitating data exchange between different entities. The DGA ensures these intermediaries operate transparently, with clear accountability for data handling practices. This fosters trust in the data ecosystem and encourages wider participation.

Finally, the DGA encourages the sharing of data for public benefit initiatives. This could involve sharing anonymized data sets for research in areas like public health or environmental protection. By incentivizing such data sharing, the DGA aims to unlock the potential of data for societal progress.

Unlocking Economic Growth: A Data-Driven Future for the EU

The DGA is not just about building trust; it’s also about harnessing the economic potential of data. By facilitating data sharing across sectors and borders, the DGA can unlock a new wave of innovation and growth.

One can better understand the possibilities unlocked through examples. Imagine a scenario where anonymized data from manufacturing plants is shared securely with logistics companies, leading to optimized supply chains and improved efficiency. Or consider a situation where anonymized financial data is shared with research institutions, fostering the development of new financial products and services. 

Furthermore, the DGA paves the way for the creation of a single European data space. This would essentially be a unified market for data, allowing businesses to access and utilize data resources across the EU seamlessly. This eliminates unnecessary barriers and creates a level playing field, fostering competition and accelerating innovation.

The DGA also benefits Small and Medium-sized Enterprises (SMEs). Often, SMEs lack the resources to collect and manage large data sets. By facilitating access to shared data repositories, the DGA empowers SMEs to leverage valuable data insights and compete more effectively in the marketplace.

The DGA and the General Data Protection Regulation (GDPR): Working in Tandem

It’s important to note that the DGA complements the existing General Data Protection Regulation (GDPR). The GDPR focuses on protecting the privacy rights of individuals, while the DGA establishes a framework for facilitating responsible data sharing within those privacy regulations. Together, these regulations create a robust system for data governance in the EU, balancing economic opportunities with individual privacy rights.

Conclusion

The DGA became applicable in September 2023 and marks a significant step forward for the EU in harnessing the power of data. By building trust, fostering innovation, and creating a single European data space, the DGA has the potential to unlock significant economic growth and societal benefits.

If you’re an organization dealing with copious amounts of data, do visit www.tsaaro.com. 

1. Vermont Breaks New Ground with Comprehensive Data Privacy Law

The U.S. state privacy law landscape has reached a pivotal point with Vermont’s House Bill 121. Passed on May 11 by the Vermont General Assembly, this bill introduces a notable private right of action, marking a significant departure from previous attempts by other states. The bill includes data minimization standards similar to Maryland’s, explicit protections for children’s and consumer health data, mandatory user opt-out mechanisms, and required data protection assessments. Additionally, the bill mandates a review of the private right of action’s effectiveness, signaling a comprehensive approach to state-level data privacy regulation.

https://iapp.org/news/a/pra-novelty-highlight-vermont-s-comprehensive-privacy-bill

1. Singapore Proposes Enhanced Oversight for High-Risk Computer Systems

The Straits Times highlights a proposed amendment to Singapore’s Cybersecurity Act, enhancing the Cyber Security Agency’s oversight of high-risk computer systems. The new bill mandates that operators of critical information infrastructure must report any server outages and cyberattacks.

https://iapp.org/news/b/singapore-lawmakers-give-approval-to-bill-updating-cybersecurity-act

1. Colorado Enacts Pioneering AI Regulation with Senate Bill 205

On May 8, Colorado lawmakers passed Senate Bill 205, the Colorado Artificial Intelligence Act, setting a precedent for other U.S. states. The bill, similar to the EU AI Act, adopts a risk-based approach to AI regulation and imposes rules for high-risk systems, including mandatory disclosure of AI use. As a consumer protection measure, it requires AI developers and deployers to exercise “reasonable care” to prevent algorithmic discrimination in high-risk applications. These applications include areas such as education, employment, finances, housing, healthcare, and legal services. The bill also mandates risk management and governance requirements for high-risk AI deployers.

https://iapp.org/news/a/colorado-awaits-fate-of-ai-regulation-bill

4.  New Zealand Privacy Commissioner Finds No Issues in Credit Reporting Companies’ Practices

The Office of the Privacy Commissioner of New Zealand conducted compliance reviews for three major credit reporting companies for the 2022-23 period, finding that their practices adhered to the Credit Reporting Privacy Code without any issues.

https://iapp.org/news/b/new-zealand-releases-credit-reporters-annual-compliance-reports

5.  California Court to Hear Challenge on Privacy Agency’s Rulemaking Authority

The Superior Court of California in Sacramento has set a hearing for June 21 to discuss the California Privacy Protection Agency’s rulemaking authority. The California Chamber of Commerce is contesting the agency’s power to implement future regulations without providing a grace period for compliance. The CalChamber originally filed the lawsuit to postpone the enforcement of the initial California Privacy Rights Act regulations.

https://iapp.org/news/b/california-state-court-sets-hearing-on-cppa-regulations-process