Navigating the Future of Data Law in Europe: Insights from Susanna Dehmel

The session begins with a warm welcome to participants, expressing hope for their satisfaction by the end of the summer term. The structure of the summer term will be discussed later in the lecture.

Professor Hurland introduces Susanna Dehmel as the honorary speaker, highlighting her prominence in Europe regarding digital law, data law, and internet regulation. He notes her educational background, including her studies in Passau and Cardiff, and her leadership roles, including her position at Bitkom, a significant organization in Germany and Europe.

Susanna Dehmel, a lawyer with over 20 years of experience at Bitkom, presents the association's role in European politics. Bitkom represents over 2,000 member companies, ranging from startups to large tech firms, and actively engages in political discussions in Brussels, providing practical advice on law implementation.

Dehmel outlines the current status of data usage and digitization in Europe, referencing the EU Data Strategy from 2020, which serves as a framework for ongoing legislation, including the Data Governance Act and the Data Act. She emphasizes the importance of these acts in facilitating data sharing and usage among companies.

Dehmel discusses the European Digital Economy and Society Index, noting Germany's position in the middle ranks compared to other European countries. She points out that Germany has not significantly improved in digitalization over recent years, with some countries advancing more rapidly.

Recent surveys among German enterprises reveal a growing dependence on digital imports, with over 50% of companies indicating they could not survive longer than a year without sourcing digital technology services from abroad. This highlights the ongoing discussions surrounding digital sovereignty and the parameters influencing data politics within Europe.

Companies in Germany identify several factors hindering digitalization, including increased energy costs, restrained economic growth, supply chain interruptions, high inflation rates, high interest rates, and the ongoing Russian war against Ukraine. Additionally, federal and state government policies are perceived as significant influences on the digital landscape.

A concerning 60% of companies report underutilization of available data, with 18% stating they do not capture any potential from their data. Only 37% claim to fully or rather fully utilize their data. Among those not using their data effectively, only one-third are taking measures to improve this, while 41% are planning to do so, and a third remain indifferent or unaware of the issue.

Despite every second company expressing a desire to monetize data, only about 25% report that data-driven business models significantly contribute to their success currently. However, expectations for the future are optimistic, with around 45% anticipating a stronger contribution from data-driven models in two years, indicating a gap between current practices and future aspirations.

Awareness of the Data Act among companies is low, with nearly half stating it is not an issue for them. This lack of engagement may be misguided, as legal aspects significantly impact data usage and sharing. When asked about reasons for not offering data, 58% cite data protection concerns, while 44% are unsure of the legal implications, and 41% fear misuse of their data.

Opinions on data spaces are divided among companies. Some view them as beneficial and usable, while others find them too complicated or irrelevant to their business models, reflecting a lack of consensus on their utility and effectiveness in the current digital economy.

The discussion will focus on the Data Strategy 2020, particularly the Data Act and the Data Governance Act, which are crucial components of the legislative framework aimed at enhancing data management and sharing practices. These legislative efforts are interconnected with broader regulatory initiatives affecting the digital economy.

The European Commission aims to establish a single market for data within the EU, facilitating free flow across sectors to enhance innovation, particularly in AI. This strategy emphasizes the availability of high-quality data under European rules and values, ensuring that these values are respected in the process.

Key legislative proposals under the EU data strategy include the Data Governance Act, which focuses on data intermediation services and fair data sharing conditions, and the Data Act, which outlines rules for data sharing and interoperability. Additional measures include the Open Public Data Directive and the Act on High-Value Data Sets, alongside sectoral initiatives like the European Health Data Space.

The European Commission is responsible for drafting the data strategy and legislative acts, with the European Parliament and Council playing roles in their agreement. They established groups such as the Data Sharing and Cloud Computing Contracts Expert Group to create standard contractual clauses and the European Data Innovation Board to coordinate the creation of the European data space.

The Data Spaces Support Center, funded by the European Commission, is designed to assist in developing best practices for data spaces. It acts as a bridge between operational projects and the European Data Innovation Board, which oversees the broader strategy and coordination of data initiatives.

The Data Governance Act, which emphasizes the importance of data sharing, is structured around three pillars. It particularly highlights data intermediation services, which facilitate the exchange between data providers and recipients, allowing entities to assume dual roles as both providers and recipients.

The Data Governance Act (DGA) defines a service aimed at establishing commercial relationships for data sharing among data subjects, data holders, and data users through various means, including legal and technical methods. This complex definition highlights the DGA's role in the data spaces ecosystem, emphasizing the need for intermediaries to manage available data. Article 11 and 12 outline obligations for these intermediaries, including neutrality, insolvency protection, fraud prevention, cybersecurity, fair access, registration, reporting, and documentation duties. The DGA imposes significant barriers for service providers, raising questions about its effectiveness in promoting new data-sharing models and the trustworthiness of existing services, leading to discussions about whether voluntary rules could have sufficed.

The Data Act, described as a larger legislative package, mandates data sharing under specific conditions. It encompasses various topics beyond data sharing, including contract law, government data access, cloud portability, and switching. The act applies to both non-personal and personal data, complicating the separation of these categories. It entered into force at the beginning of 2024, with general application set for September 12, 2025, allowing a 20-month transition period. This timeframe, while seemingly ample, poses challenges due to the need for clarity in provisions and the establishment of new standards for data sharing, which typically require extensive consultation and development.

The discussion highlights the challenges companies face in adapting their processes to comply with the Data Act by September. The Data Act aims to facilitate access to data generated by IoT devices, impacting both manufacturers and consumers. Companies that produce digital devices must adhere to new obligations, allowing consumers and third parties access to device and service data, which could significantly alter the data economy by promoting market openness.

The Data Act is expected to have a substantial impact on the data economy by enabling new business models and services that integrate data from various machines. While this opens opportunities for innovation, it also poses risks for companies that currently hold proprietary data, as they may be required to share it with competitors. The intention behind the regulation is to stimulate competition and encourage the emergence of new players in the market, similar to previous regulations in the financial sector that allowed fintech companies to access customer account data.

The Data Act addresses cloud services in chapters six and eight, aiming to eliminate lock-in effects associated with cloud providers. It seeks to enhance portability, making it easier for companies to switch providers, and to promote interoperability, allowing the use of multiple cloud services simultaneously. The definition of data processing services is broad, encompassing various digital services that provide scalable and elastic computing resources, which could include IoT edge computing.

The Data Act introduces legal, financial, and technical obligations for data processing service providers, aiming to simplify the process for customers. It addresses issues like data portability, making it easier for customers to transfer their data between cloud providers without incurring high fees or facing technical complications. This is particularly relevant for businesses that rely on complex data structures within cloud services.

As the Data Act approaches its general applicability date, there are significant uncertainties regarding compliance among companies. New legal concepts, such as product data switching, pose challenges. The implementation of the Data Act in Germany is still pending, with questions about oversight and penalties remaining unclear. Potential oversight bodies include the Bundesnetzagentur and the Federal Data Protection Officer, but their capacity to manage these responsibilities is also in question.

The Data Act defines data spaces as technical services that facilitate data sharing among multiple owners and users under common rules. These spaces are designed to ensure trustworthy identification methods, security features, and standardized metadata, which are essential for effective data sharing. The operational aspects of data spaces are crucial for enabling seamless data exchange across different platforms.

Various programs and funding initiatives are underway in Europe to enhance data sharing capabilities. These efforts involve complex structures of measures from the European Commission, national governments, and industry associations, all aimed at establishing industry standards and interoperability specifications. The challenges of bilateral data sharing between companies stem from the need for compatibility in data semantics and metadata, as well as clear terms of use, which complicate the willingness of companies to share data.

The speaker discusses the complexities of data standardization efforts across various organizations, highlighting the challenge of coordinating similar initiatives to avoid redundant work. They emphasize the need for better connectivity among numerous data initiatives at the EU level, which span multiple sectors, including automotive and health. The speaker notes that while some projects, like Kina X in the automotive sector, are advanced, others are still in early stages, indicating a diverse landscape of data space projects in Germany and the EU.

The speaker points out that many data space projects in Germany, funded by various ministries, are still in the developmental phase and have yet to demonstrate economic sustainability. They stress that while initial funding has supported groundwork, these projects must now prove their ability to generate new business models or efficiency gains for participating companies. The speaker expresses skepticism about the timeline for achieving these results, suggesting that it may take considerable time to assess the effectiveness of these initiatives.

The discussion highlights the significant complexity involved in achieving interoperability among data spaces across different sectors. The speaker notes that while sectors may agree on common standards internally, this does not guarantee compatibility with other sectors, which is where the greatest economic potential lies. They raise concerns about how initiatives are aligned across various levels, including national and EU levels, and mention China's ambitious plan to establish 100 data spaces, questioning how this will impact European efforts.

Looking ahead, the speaker mentions the anticipation of a new 'data union' strategy from the EU Commission, expected to be introduced in the current year. They reflect on the previous EU Commission's extensive legislative output, suggesting that the volume of new regulations may have overwhelmed companies. The speaker hints at the need for a more balanced approach in future regulations to facilitate smoother implementation for businesses.

The discussion emphasizes the need for a balanced approach to legislation, suggesting that rather than creating new laws, it may be more beneficial to review existing regulations and reduce compliance burdens for businesses. This perspective aligns with the European Commission's recent acknowledgment that not all issues require new legislation, advocating for adaptations to current laws instead.

The current European Commission, in charge since September 2024, has a diverse structure with various Directorates-General (DGs) focusing on digital topics from different angles. This distribution of responsibilities mirrors the situation in Germany, where digital competencies are also spread across multiple ministries.

Hannah Wilkunan has been tasked with presenting a European Data Union strategy aimed at creating a simplified, clear, and coherent legal framework for data sharing among businesses and administrations. This initiative seeks to respect high privacy and security standards, indicating that despite previous legislative efforts, there remains significant work to achieve this clarity.

Michael McGrath, the Commissioner for Democracy, Justice, Rule of Law, and Consumer Protection, is focused on ensuring that the General Data Protection Regulation (GDPR) aligns with digital transformation needs. His priorities include full enforcement of GDPR across member states and promoting trusted data flows with international partners, highlighting the challenges of balancing privacy with commercial demands.

The Commission is also addressing the need to eliminate overlaps and contradictions in legislation, particularly between the Data Act and GDPR. The current German Federal Data Protection Officer has criticized the notion that these laws do not interfere with each other, suggesting that a more integrated approach is necessary to resolve existing conflicts.

The discussion highlights the importance of coordination among various commissioners to ensure that internal and external EU policies are aligned, particularly in the digital realm. This collaborative effort is essential to address the complexities arising from overlapping laws and to maintain a cohesive strategy across different sectors.

The EU's competitive compass aims to combat fragmentation and goldplating in regulations to ensure a level playing field within the single market. The Commission is committed to pursuing full harmonization and enforcement of laws, which includes simplifying record-keeping under GDPR and enhancing the overall implementation of data protection regulations.

The upcoming Cloud and AI Development Act is expected to support improved access to data, further contributing to the EU's goal of establishing a simplified and coherent legal framework for data management. This initiative is part of a broader strategy announced in February 2025, which aims to facilitate data sharing while ensuring compliance with privacy standards.

The European Commission is set to introduce an AI continent action plan aimed at maximizing opportunities presented by artificial intelligence. This plan will encompass various initiatives, including the establishment of AI factories and addressing data-related issues. The announcement is expected to occur tomorrow, alongside the European work program for the year, which includes a digital package scheduled for the fourth quarter. This package aims to simplify data protection regulations and address shortcomings in existing legislation.

The speaker notes that there is still significant work to be done in renewing original legislation, identifying areas that did not perform as expected, and addressing overlaps between different initiatives. The European Commission plans to introduce omnibus packages that will amend or change several existing acts, indicating a proactive approach to refining digital and data policies.

In response to a question about the future of the presented roadmap following the Trump administration, the speaker emphasizes that much of the ongoing work remains unchanged. Initiatives aimed at enhancing European digital sovereignty and developing competitive cloud capabilities are still in progress. The speaker acknowledges the current insecure environment and the need for pragmatic approaches, including collaboration with American service providers to ensure secure usage of their services while also investing in European alternatives.

The discussion highlights the importance of the Data Act and its provisions on cloud switching and portability, which are becoming increasingly significant in the current unpredictable landscape. The ability to quickly change providers is essential, yet there is also a desire to access a wide range of services. The speaker suggests that while transitioning from American services may not be feasible, efforts should focus on securing these services and enhancing interoperability within European cloud offerings.

A question arises regarding the need for a new system for data spaces, akin to the financial market where banks serve as intermediaries. The speaker acknowledges this perspective, indicating that the development of a structured data space is essential for facilitating data exchange and collaboration, similar to how financial institutions operate within the capital market.

The discussion highlights the evolving nature of the data market, particularly in light of the Data Governance Act and related legislation. The speaker notes that while the intent of the European Commission is to regulate and expedite the market's development, the actual pace of evolution remains uncertain. There are differing opinions on whether legislation will facilitate or complicate market growth, especially given the dominance of large players and proprietary systems that make data access challenging for new entrants.

The speaker emphasizes the challenges faced by companies trying to offer multimodal mobility services, particularly due to the monopolistic nature of national railroad companies in Europe. Access to essential data from these large entities is crucial for new service providers, and while the regulatory framework may create opportunities, it also imposes compliance obligations that could hinder the market's agility.

The speaker explains the varying legal statuses of initiatives aimed at improving data sharing, particularly in the health sector. For instance, the European Health Data Space Act mandates member states to create conditions for sharing health data across the EU, addressing the fragmented laws that currently impede such sharing. However, many projects remain unfunded or are part of funding programs, with notable collaborations involving companies like BMW, SAP, Siemens, and Bosch, indicating a blend of public and private investment.

In response to a question about the timeframe for realizing the goals of data space projects, the speaker reflects on the progress of initiatives like Kina X, which is in its third or fourth year and is now operational. In contrast, the manufacturing sector is still in the early stages of development. The speaker advises stakeholders to expect timelines measured in years rather than months, underscoring the complexity and gradual nature of establishing effective data governance frameworks.

The discussion begins with an overview of the summer term structure, highlighting upcoming topics and guest lectures. The focus will be on the Digital Services Act (DSA) and its implications, particularly regarding liability issues for host providers in Europe, which will be revisited in connection with the previous winter term discussions.

On April 29th, Professor Dr. Ario Ventura from Lisbon will present on the topic of fake news and the liability of host providers, referencing Donald Trump's criticisms of the DSA. Following this, on May 6th, a lecture by a speaker from Tashkent will address the control of large platforms through antitrust mechanisms, linking to the Digital Markets Act (DMA).

The schedule includes discussions on the DMA and the Data Governance Act, with a focus on the concept of European data spaces. Additionally, there will be a presentation on the European Health Data Act (EHDA) by a representative from the Dutch bank, emphasizing the importance of these legislative frameworks.

The term will conclude with discussions on the AI regulations and a final Q&A session on July 8th, where students will also learn about drafting their essays. A special meeting on April 28th will present a list of potential essay topics, while students are encouraged to propose their own subjects.

Plans for a final gathering in September are discussed, aimed at fostering community among students, especially those in Germany. This event will provide an opportunity for students to meet in person rather than through virtual platforms, enhancing their overall experience.

The session concludes with acknowledgments and a reminder of the next lecture scheduled for the following week at 12:15. The professor expresses hope for a productive term ahead and encourages students to engage actively in the upcoming discussions.