New rules agreed at EU level yesterday, which could have given consumers more protection and better rights to decide what happens to data they generate through their use of connected products, are a missed opportunity.

Who can access this data and what it can be used for has important implications. Timely access to the data, or lack of it, can mean the difference between consumers having to pay more at a car dealership or having the option to go to a third-party repairer on the corner that is potentially cheaper. Letting consumers decide who to share their data with, can help them access greater and better product functionalities and services, which in turn favours innovation that benefits consumers.

The Data Act should have opened up these possibilities. However, due to a myriad of exemptions, companies can prevent data access and sharing, and thus consumers could find they still have little control over the access and use of the data from their connected devices.

Ursula Pachl, Deputy Director General of the European Consumer Organisation (BEUC), said:
“What started as an important part of the jigsaw to give consumers more of a say in the data economy has ended up being a missed opportunity. The EU institutions have given too much flexibility to companies who can now prevent consumers from sharing data with other service providers on the basis it constitutes a trade secret, for example.”

On the positive side, there will at least be some protections for consumers. For example, consumers will be protected against their data being shared with other companies to profile them. The Data Act will also contain a prohibition against the use of deceptive design, often called dark patterns, for example to push consumers to agree to more data processing than they would normally accept. Overall, however, we expect this law will mainly serve businesses, not consumers.