The EU Data Act, in pursuit of the objectives of the European Data Strategy, has introduced a framework to remove barriers to the sharing of data generated in the context of the Internet of Things (IoT), in order to enable a fair distribution of its value.
The regulation stipulates that connected products and related services must be designed and manufactured in a way that enables users, be they consumers or businesses, to access, use and share generated data easily and securely.
In this context, the guidance provided by the European Commission in its FAQs on the Data Act of February 2025 is of significant value, which offer insights into various complexities that operators face in complying with the regulation.
These include, for instance, the relationship between the Data Act and the GDPR: the latter legislation, in the event of conflict, prevails over the former, which as such does not regulate the protection of personal data, but rather strengthens data sharing through clear rules on data access and use in the context of the European data economy. However, the Data Act can also be complementary to the GDPR (as in the case of real-time portability right established for data from IoT devices), as well as restrict the legitimate reuse of data (as established for third parties receiving data at the user's request).
In the context of the regulation of connected products and related services, the Commission provided guidance to facilitate the identification of the different types of data to be considered subject to the regulation (such as ‘product data’, ‘data from a related service’, ‘readily available data’, etc.), also clarifying the exclusion from the application of the regulation in relation to certain doubtful cases (e.g., ‘highly enriched data’, consisting of inferred or derived data or resulting from additional investments, and content protected by IP rights).
Further indications of significant relevance concern the meaning of the definitions of ‘related product’ and ‘related service’ and the application of the provisions applicable to them to certain specific hypotheses, such as that of second-hand connected products and data generated by a connected product placed on the EU market in its use abroad.
