Our lawyers speak out

💡LAW no. 2024-449 of 21 May 2024 aimed at securing and regulating the digital space (SREN Law) has been enacted!

This long-awaited law applies the provisions of several European regulations, in particular Regulation (EU) No 2022/868 on European data governance (DGA) and Regulation (EU) No 2023/2854 on data (Data Act).

🔍 The DGA establishes a new regime for providers supplying a data intermediation service (PSID). This service ‘is intended to establish commercial relationships for the purpose of sharing data between an indeterminate number of data subjects and data holders on the one hand and data users on the other (…).’ Exceptions to the PSID regime are specified at a minimum. These exceptions include the sharing of data within a closed group, including in the context of supplier or customer relationships or collaborations established by contract, in particular those whose main purpose is to guarantee the functionalities of objects and devices connected to the Internet of Things.

📌This new regime is associated with strict obligations for PSIDs. In addition to the obligation to notify the competent authority in their Member State, PSIDs must guarantee the neutrality and security of shared data, and transparency vis-à-vis businesses and individuals.

📌This new regime is associated with strict obligations for PSIDs. In addition to the obligation to notify the competent authority in their Member State, PSIDs must guarantee the neutrality and security of the data shared, and transparency vis-à-vis the businesses and individuals using their space. The requirement for neutrality means that the activity must be carried out within a separate legal entity.

The aim is to establish an environment of trust for the development of data marketplaces in Europe.

Designated by the new SREN law, the Autorité de régulation des communications électroniques, des postes et de la distribution de la presse (Arcep) is now the competent authority in France for data intermediation services.

💭 ARCEP will therefore be at the heart of this new system and the questions that arise regarding its scope and application, in particular:

• is the PSID regime mandatory or optional?
• What interpretation should be given to the exceptions to this regime, in particular the ‘closed group’ exception?

📄 According to our analysis, the PSID regime is mandatory as soon as the criteria of the definition are met.

🔸The obligations under the regime would therefore apply to any company providing intermediation services in France, even if it fails to notify ARCEP of its activity.

📄 ARCEP will be responsible for verifying the application of the regime on a case-by-case basis and, if necessary, justifying any exceptions.

The ‘closed group’ exception will undoubtedly be frequently invoked by players in the sector to avoid the restrictive PSID regime.One possible interpretation would be that the ‘closed group’ would involve a specific number of companies or individuals concerned, as opposed to a group ‘open to all’.

👉 However, care will have to be taken to avoid the pitfall of an exception which, if applied too widely, ends up destroying the principle.

📈 At a time when the battle for AI, and more broadly for digital technologies, is raging, the development of data marketplaces is a strategic issue for Europe.

Our firm is committed to clarifying these key concepts. Keep up to date with the latest legal developments by following our practice!