Chapter IX- Implementation and enforcement (Art. 37-42) - Digital Horizon by Hannes Snellman

Art. 37 Data Act - Competent authorities and data coordinators arrow_right_alt

Each Member State shall designate one or more competent authorities to be responsible for the application and enforcement of this Regulation (competent authorities). Member States may establish one or more new authorities or rely on existing authorities.
Where a Member State designates more than one competent authority, it shall designate a data coordinator from among them to facilitate cooperation between the competent authorities and to assist entities within the scope of this Regulation on all matters related to its application and enforcement. Competent authorities shall, in the exercise of the tasks and powers assigned to them under paragraph 5, cooperate with each other.
The supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 shall be responsible for monitoring the application of this Regulation insofar as the protection of personal data is concerned. Chapters VI and VII of Regulation (EU) 2016/679 shall apply mutatis mutandis.

The European Data Protection Supervisor shall be responsible for monitoring the application of this Regulation insofar as it concerns the Commission, the European Central Bank or Union bodies. Where relevant, Article 62 of Regulation (EU) 2018/1725 shall apply mutatis mutandis.

The tasks and powers of the supervisory authorities referred to in this paragraph shall be exercised with regard to the processing of personal data.

Without prejudice to paragraph 1 of this Article:
1. for specific sectoral data access and use issues related to the application of this Regulation, the competence of sectoral authorities shall be respected;
2. the competent authority responsible for the application and enforcement of Articles 23 to 31 and Articles 34 and 35 shall have experience in the field of data and electronic communications services.
Member States shall ensure that the tasks and powers of the competent authorities are clearly defined and include:
1. promoting data literacy and awareness among users and entities falling within the scope of this Regulation of the rights and obligations under this Regulation;
2. handling complaints arising from alleged infringements of this Regulation, including in relation to trade secrets, and investigating, to the extent appropriate, the subject matter of complaints and regularly informing complainants, where relevant in accordance with national law, of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another competent authority is necessary;
3. conducting investigations into matters that concern the application of this Regulation, including on the basis of information received from another competent authority or other public authority;
4. imposing effective, proportionate and dissuasive financial penalties which may include periodic penalties and penalties with retroactive effect, or initiating legal proceedings for the imposition of fines;
5. monitoring technological and relevant commercial developments of relevance for the making available and use of data;
6. cooperating with competent authorities of other Member States and, where relevant, with the Commission or the EDIB, to ensure the consistent and efficient application of this Regulation, including the exchange of all relevant information by electronic means, without undue delay, including regarding paragraph 10 of this Article;
7. cooperating with the relevant competent authorities responsible for the implementation of other Union or national legal acts, including with authorities competent in the field of data and electronic communication services, with the supervisory authority responsible for monitoring the application of Regulation (EU) 2016/679 or with sectoral authorities to ensure that this Regulation is enforced consistently with other Union and national law;
8. cooperating with the relevant competent authorities to ensure that Articles 23 to 31 and Articles 34 and 35 are enforced consistently with other Union law and self-regulation applicable to providers of data processing services;
9. ensuring that switching charges are withdrawn in accordance with Article 29;
10. examining the requests for data made pursuant to Chapter V.

Where designated, the data coordinator shall facilitate the cooperation referred to in points (f), (g) and (h) of the first subparagraph and shall assist the competent authorities upon their request.

The data coordinator, where such competent authority has been designated, shall:
1. act as the single point of contact for all issues related to the application of this Regulation;
2. ensure the online public availability of requests to make data available made by public sector bodies in the case of exceptional need under Chapter V and promote voluntary data sharing agreements between public sector bodies and data holders;
3. inform the Commission, on an annual basis, of the refusals notified under Article 4(2) and (8) and Article 5(11).
Member States shall notify the Commission of the names of the competent authorities and of their tasks and powers and, where applicable, the name of the data coordinator. The Commission shall maintain a public register of those authorities.
When carrying out their tasks and exercising their powers in accordance with this Regulation, competent authorities shall remain impartial and free from any external influence, whether direct or indirect, and shall neither seek nor take instructions for individual cases from any other public authority or any private party.
Member States shall ensure that the competent authorities are provided with sufficient human and technical resources and relevant expertise to effectively carry out their tasks in accordance with this Regulation.
Entities falling within the scope of this Regulation shall be subject to the competence of the Member State where the entity is established. Where the entity is established in more than one Member State, it shall be considered to be under the competence of the Member State in which it has its main establishment, that is, where the entity has its head office or registered office from which the principal financial functions and operational control are exercised.
Any entity falling within the scope of this Regulation that makes connected products available or offers services in the Union, and which is not established in the Union, shall designate a legal representative in one of the Member States.
For the purpose of ensuring compliance with this Regulation, a legal representative shall be mandated by an entity falling within the scope of this Regulation that makes connected products available or offers services in the Union to be addressed in addition to or instead of it by competent authorities with regard to all issues related to that entity. That legal representative shall cooperate with and comprehensively demonstrate to the competent authorities, upon request, the actions taken and provisions put in place by the entity falling within the scope of this Regulation that makes connected products available or offers services in the Union to ensure compliance with this Regulation.
An entity falling within the scope of this Regulation that makes connected products available or offers services in the Union, shall be considered to be under the competence of the Member State in which its legal representative is located. The designation of a legal representative by such an entity shall be without prejudice to the liability of, and any legal action that could be initiated against, such an entity. Until such time as an entity designates a legal representative in accordance with this Article, it shall be under the competence of all Member States, where applicable, for the purposes of ensuring the application and enforcement of this Regulation. Any competent authority may exercise its competence, including by imposing effective, proportionate and dissuasive penalties, provided that the entity is not subject to enforcement proceedings under this Regulation regarding the same facts by another competent authority.
Competent authorities shall have the power to request from users, data holders, or data recipients, or their legal representatives, falling under the competence of their Member State all information necessary to verify compliance with this Regulation. Any request for information shall be proportionate to the performance of the underlying task and shall be reasoned.
Where a competent authority in one Member State requests assistance or enforcement measures from a competent authority in another Member State, it shall submit a reasoned request. A competent authority shall, upon receiving such a request, provide a response, detailing the actions that have been taken or which are intended to be taken, without undue delay.
Competent authorities shall respect the principles of confidentiality and of professional and commercial secrecy and shall protect personal data in accordance with Union or national law. Any information exchanged in the context of a request for assistance and provided pursuant to this Article shall be used only in respect of the matter for which it was requested.

107

Recital 107

In order to ensure the application and enforcement of this Regulation, Member States should designate one or more competent authorities. If a Member State designates more than one competent authority, it should also designate from among them a data coordinator. Competent authorities should cooperate with each other. Through the exercise of their powers of investigation in accordance with applicable national procedures, competent authorities should be able to search for and obtain information, in particular in relation to the activities of entities within their competence and, including in the context of joint investigations, with due regard to the fact that oversight and enforcement measures concerning an entity under the competence of another Member State should be adopted by the competent authority of that other Member State, where relevant, in accordance with the procedures relating to cross-border cooperation. Competent authorities should assist each other in a timely manner, in particular when a competent authority in a Member State holds relevant information for an investigation carried out by the competent authorities in other Member States, or is able to gather such information to which the competent authorities in the Member State where the entity is established do not have access. Competent authorities and data coordinators should be identified in a public register maintained by the Commission. The data coordinator could be an additional means for facilitating cooperation in cross-border situations, such as when a competent authority from a given Member State does not know which authority it should approach in the data coordinator’s Member State, for example where the case is related to more than one competent authority or sector. The data coordinator should act, inter alia, as a single point of contact for all issues related to the application of this Regulation. Where no data coordinator has been designated, the competent authority should assume the tasks assigned to the data coordinator under this Regulation. The authorities responsible for the supervision of compliance with data protection law and competent authorities designated under Union or national law should be responsible for the application of this Regulation in their areas of competence. In order to avoid conflicts of interest, the competent authorities responsible for the application and enforcement of this Regulation in the area of making data available following a request on the basis of an exceptional need should not benefit from the right to submit such a request.

Art. 38 Data Act - Right to lodge a complaint arrow_right_alt

Without prejudice to any other administrative or judicial remedy, natural and legal persons shall have the right to lodge a complaint, individually or, where relevant, collectively, with the relevant competent authority in the Member State of their habitual residence, place of work or establishment if they consider that their rights under this Regulation have been infringed. The data coordinator shall, upon request, provide all the necessary information to natural and legal persons for the lodging of their complaints with the appropriate competent authority.
The competent authority with which the complaint has been lodged shall inform the complainant, in accordance with national law, of the progress of the proceedings and of the decision taken.
Competent authorities shall cooperate to handle and resolve complaints effectively and in a timely manner, including by exchanging all relevant information by electronic means, without undue delay. This cooperation shall not affect the cooperation mechanisms provided for by Chapters VI and VII of Regulation (EU) 2016/679 and by Regulation (EU) 2017/2394.

108

Recital 108

In order to enforce their rights under this Regulation, natural and legal persons should be entitled to seek redress for infringements of their rights under this Regulation by lodging complaints. The data coordinator should, upon request, provide all the necessary information to natural and legal persons for the lodging of their complaints with the appropriate competent authority. Those authorities should be obliged to cooperate to ensure a complaint is appropriately handled and resolved effectively and in a timely manner. In order to make use of the consumer protection cooperation network mechanism and to enable representative actions, this Regulation amends the Annexes to Regulation (EU) 2017/2394 of the European Parliament and of the Council⁽¹⁾ and Directive (EU) 2020/1828 of the European Parliament and of the Council⁽²⁾.

^{(1) Regulation (EU) 2017/2394 of the European Parliament and of the Council of 12 December 2017 on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing Regulation (EC) No 2006/2004 (OJ L 345, 27.12.2017, p. 1).

(2) Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November 2020 on representative actions for the protection of the collective interests of consumers and repealing Directive 2009/22/EC (OJ L 409, 4.12.2020, p. 1).}

Art. 39 Data Act - Right to an effective judicial remedy arrow_right_alt

Art. 40 Data Act - Penalties arrow_right_alt

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. the nature, gravity, scale and duration of the infringement;
2. any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. any previous infringements by the infringing party;
4. the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. any other aggravating or mitigating factor applicable to the circumstances of the case;
6. infringing party’s annual turnover in the preceding financial year in the Union.
For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.

109
110

Recital 109

Competent authorities should ensure that infringements of the obligations laid down in this Regulation are subject to penalties. Such penalties could include financial penalties, warnings, reprimands or orders to bring business practices into compliance with the obligations imposed by this Regulation. Penalties established by the Member States should be effective, proportionate and dissuasive, and should take into account the recommendations of the EDIB, thus contributing to achieving the greatest possible level of consistency in the establishment and application of penalties. Where appropriate, competent authorities should make use of interim measures to limit the effects of an alleged infringement while the investigation of that infringement is ongoing. In so doing, they should take into account, inter alia the nature, gravity, scale and duration of the infringement in view of the public interest at stake, the scope and kind of activities carried out, and the economic capacity of the infringing party. They should also take into account whether the infringing party systematically or recurrently fails to comply with its obligations under this Regulation. In order to ensure that the principle of ne bis in idem is respected, and in particular to avoid that the same infringement of the obligations laid down in this Regulation is penalised more than once, a Member State that intends to exercise its competence in relation to an infringing party that is not established and has not designated a legal representative in the Union should, without undue delay, inform all data coordinators as well as the Commission.

Recital 110

The EDIB should advise and assist the Commission in coordinating national practices and policies on the topics covered by this Regulation as well as in delivering on its objectives in relation to technical standardisation to enhance interoperability. It should also play a key role in facilitating comprehensive discussions between competent authorities concerning the application and enforcement of this Regulation. That exchange of information is designed to increase effective access to justice as well as enforcement and judicial cooperation across the Union. Among other functions, the competent authorities should make use of the EDIB as a platform to evaluate, coordinate and adopt recommendations on the setting of penalties for infringements of this Regulation. It should allow for competent authorities, with the assistance of the Commission, to coordinate the optimal approach to determining and imposing such penalties. That approach prevents fragmentation while allowing for Member State’s flexibility and should lead to effective recommendations that support the consistent application of this Regulation. The EDIB should also have an advisory role in the standardisation processes and the adoption of common specifications by means of implementing acts, in the adoption of delegated acts to establish a monitoring mechanism for switching charges, imposed by providers of data processing services and to further specify the essential requirements for the interoperability of data, of data sharing mechanisms and services, as well as of the common European data spaces. It should also advise and assist the Commission in the adoption of the guidelines laying down interoperability specifications for the functioning of the common European data spaces.

Art. 41 Data Act - Model contractual terms and standard contractual clauses arrow_right_alt

The Commission, before 12 September 2025, shall develop and recommend non-binding model contractual terms on data access and use, including terms on reasonable compensation and the protection of trade secrets, and non-binding standard contractual clauses for cloud computing contracts to assist parties in drafting and negotiating contracts with fair, reasonable and non-discriminatory contractual rights and obligations.

111

Recital 111

In order to help enterprises to draft and negotiate contracts, the Commission should develop and recommend non-binding model contractual terms for business-to-business data sharing contracts, where necessary taking into account the conditions in specific sectors and the existing practices with voluntary data sharing mechanisms. Those model contractual terms should be primarily a practical tool to help in particular SMEs to conclude a contract. When used widely and integrally, those model contractual terms should also have the beneficial effect of influencing the design of contracts regarding access to and the use of data and therefore lead more broadly towards fairer contractual relations when accessing and sharing data.

Art. 42 Data Act - Role of the EDIB arrow_right_alt

The EDIB established by the Commission as an expert group pursuant to Article 29 of Regulation (EU) 2022/868, in which competent authorities shall be represented, shall support the consistent application of this Regulation by:

1. advising and assisting the Commission with regard to developing consistent practice of competent authorities in the enforcement of Chapters II, III, V and VII;
2. facilitating cooperation between competent authorities through capacity-building and the exchange of information, in particular by establishing methods for the efficient exchange of information relating to the enforcement of the rights and obligations under Chapters II, III and V in cross-border cases, including coordination with regard to the setting of penalties;
3. advising and assisting the Commission with regard to:
  1. whether to request the drafting of harmonised standards referred to in Article 33(4), Article 35(4) and Article 36(5);
  2. the preparation of the implementing acts referred to in Article 33(5), Article 35(5) and (8) and Article 36(6);
  3. the preparation of the delegated acts referred to in Article 29(7) and Article 33(2); and
  4. the adoption of the guidelines laying down interoperable frameworks for common standards and practices for the functioning of common European data spaces referred to in Article 33(11).

110

Recital 110

The EDIB should advise and assist the Commission in coordinating national practices and policies on the topics covered by this Regulation as well as in delivering on its objectives in relation to technical standardisation to enhance interoperability. It should also play a key role in facilitating comprehensive discussions between competent authorities concerning the application and enforcement of this Regulation. That exchange of information is designed to increase effective access to justice as well as enforcement and judicial cooperation across the Union. Among other functions, the competent authorities should make use of the EDIB as a platform to evaluate, coordinate and adopt recommendations on the setting of penalties for infringements of this Regulation. It should allow for competent authorities, with the assistance of the Commission, to coordinate the optimal approach to determining and imposing such penalties. That approach prevents fragmentation while allowing for Member State’s flexibility and should lead to effective recommendations that support the consistent application of this Regulation. The EDIB should also have an advisory role in the standardisation processes and the adoption of common specifications by means of implementing acts, in the adoption of delegated acts to establish a monitoring mechanism for switching charges, imposed by providers of data processing services and to further specify the essential requirements for the interoperability of data, of data sharing mechanisms and services, as well as of the common European data spaces. It should also advise and assist the Commission in the adoption of the guidelines laying down interoperability specifications for the functioning of the common European data spaces.