Is the Data Act really a virtuous text?

The "Data Act" (REGULATION (EU) 2023/2854 of 13 December 2023 on harmonised rules on fair access to and use of data) is a technical text, in some places difficult to read, presented as the tool of "economic sovereignty" that will allow European citizens and businesses to get rid of the yoke of large non‑European players by regaining the freedom to freely exploit or have their data freely exploited,  in this era when, with the rise of AI, data is more monetizable than ever.

Most commentators specify "data generated by a connected product or service", and give as an example (source thedigitalnewdeal.org): "An SME trapped by an exclusive contract will be able to develop its own predictive models; a farmer entrusts his farm data to a European supplier; a local authority to promote sensors installed by a foreign service provider".

That is very good. Except that the text of the Data Act is much wider. It requires (Ch. VI) indiscriminately all providers of "data processing services" to insert clauses in their contracts allowing their customers to release themselves from the contract with very short notice and to recover all their "data". The definitions of these services and data are very general and are by no means limited to connected data:

‘Data  «means any digital representation of acts, facts or information and any compilation of such acts, facts or information, including in the form of sound, visual or audio‑visual recording”

‘Data processing service' means a digital service that is provided to a customer and that enables ubiquitous and on‑demand network access to a shared pool of configurable, scalable and elastic computing resources of a centralised, distributed or highly distributed nature that can be rapidly provisioned and released with minimal management effort or service provider interaction;

All service providers in IAAS, PAAS, or SAAS mode are concerned. European providers selling value‑added SaaS services in a highly competitive market will have to allow their customers to terminate their contracts for convenience at any time, even though their business model is based in part on their ability to engage customers over a firm period of time to build loyalty. This includes european EDM providers, invoicing and accounting service providers, archiving service providers, electronic signature service providers, etc.

The latter were already sometimes struggling to defend themselves, especially vis‑à‑vis their American competitors. The Data Act literally shoots them in the foot by imposing on them, through a series of mandatory clauses (Art. 25 Data Act), terms of termination and reversibility described in an abstruse way, including in particular (Art. 26 b): "a reference to an up‑to‑date online register hosted by the provider of data processing services, with details of all the data structures and data formats as well as the relevant standards and open interoperability specifications, in which the exportable data referred to in Article 25(2), point (e), are available.”

The Data Act also includes a Ch. IV dedicated to unfair clauses in general terms and conditions between companies, making unwritten any clause which, for example, does not propose the requirements of termination for convenience dictated by the regulation. 

It seems that "penalties related to early termination" can be charged (Art. 29.4), but these should not be too high, as they are not considered to violate the prohibition imposed by Art. 23 of the Data Act to oppose obstacles to the change of supplier.

In this context, claiming the full payment of the firm period for which the customer had committed himself as a termination fee will certainly be considered an obstacle.

And what will happen if the customer has paid his commitment period in advance, making it possible to ensure the supplier's cash flow? Or if the acquired licence was the subject of a financial lease? The supplier will have to reimburse, even though he has not committed any fault?

In the absence of any clarification on this point in the text, the Data Act does not apply to current contracts, in application of the principle of non‑retroactivity of the law laid down by Art. 2 of the French Civil Code, doctrine and case law. But it requires SaaS providers to rethink the way they sell their services to limit the impact of potential terminations, and to review their terms and conditions to add the mandatory clauses and rigorously regulate data restitution and termination system.

The Data Act is not only an instrument of "digital sovereignty». It is a perverse text that will have significant side effects on a certain number of European suppliers by exposing them to terminations for convenience without fair remuneration, and by imposing an additional layer of compliance on them due to the multitude of complex and difficult to read obligations relating to data restitutions and the change of supplier.