(Photo: © DALL.E / perfectpixelhunter_123RF / okapidesign)
January 2025
It is underestimated despite having a wide scope of application in the lift sector. A specialist IT lawyer has compiled the most important effects and obligations for companies on behalf of the LIFTjournal.
By Christian Schultz, LL.M
What is the Data Act? The Data Act is a new European Union regulation. A great deal of valuable data accrues when using connected products. The Data Act regulates use of this data in a fundamentally new manner. Currently, the Data Act is the most underestimated of the new EU digitalisation laws. The most important provisions will already apply from 12 September 2025 – consequently, action already needs to be taken.
What data does the Data Act cover? The important point to bear in mind regarding the Data Act is that is also applies to "machine data". Hence, unlike the familiar General Data Protection Regulation (GDPR), the Data Act (Diagram 1) also covers so-called non-personal data. This means the Data Act is also relevant to industrial companies, which previously had few points of contact with agreements on data use in their core business.
What products does the Data Act apply to? The Data Act applies to connected products and related services. As a result, the area affected for the lift sector is huge. Given that lifts already consist of a multitude of connected components, the Data Act is relevant to companies along the entire distribution chain – from manufacturing and distribution to maintenance. For example, a connected product is a smart component that records the location of the lift, maintenance data or usage statistics.
What new obligations does the Data Act introduce for the makers of lifts or components? One of the most important changes is that manufacturers will in future need contractual permission of users in order to be able to utilise certain usage data of their products. Purely factual access to the data is no longer sufficient. There must be a contractual agreement with the user.
How will the Data Act affect the use of machine data? The Data Act reorganises the balance of forces between data holders and users. In future, users will have legal control on whether and how their generated data can be used. Consequently, data holders should ensure that they promptly conclude a contractual agreement with the users to enable data holders to use valuable usage data in the future too. "Users" in this context normally does not mean every individual passenger but instead the respective owner associations and if applicable the tenants of the building, for example.
Does the collected usage data have to be provided to the users? Yes, both the raw data as well as the relevant metadata if meaningful use of the raw data is otherwise not possible. Excluded from this by contrast is raw data that has undergone investment heavy enrichment and the findings based on this. Data covered by the obligation can be provided either directly in the product itself (display, interface, QR code) or at least on request.
Does such usage data also have to be provided to people other than the users? Yes, if the user requests this. However, there are restrictions: if trade secrets are affected by making usage data available, precise confidentiality measures must be agreed beforehand (for example, confidentiality agreements and technical security measures). If no fair agreement comes about for all parties or one party fails to adhere to the agreements reached, the data holder can refuse or suspend the access. But withholding the usage data without justification can result in fines.
How do I conclude an agreement with the end customer? Suppliers and manufacturers without end customer contact in particular should ensure that the agreement on data usage is passed along the entire distribution chain. This creates "extended contact" to the users and at the same time permits recourse if the clause is not passed on despite agreement.
What must be done now? Companies should now analyse what data is currently being generated by the use of connected products or services and how this data is intended to be used in the company. draw up a data usage agreement and supplement existing contracts.
The author is a specialist lawyer for IT law and senior associate at the international business law firm Fieldfisher.
More information: fieldfisher.com
Digitalpaper
Write a comment