Collaborative Governance Structures for Interoperability in the EU’s new data acts

Abstract

This contribution analyses the EU’s new data acts. Interoperability is a common denominator of the EU’s new data acts. This paper demonstrates that the new data acts provide various approaches or concepts of collaborative governance to regulate interoperability. Although the EU’s new data acts are far from a uniform governance concept, we detected certain institutional arrangements organising the collaboration between private self-regulatory bodies, other private stakeholders and public bodies to lay down rules for interoperability.

I. Introduction

Interoperability is a common denominator of the EU’s new data acts. The reason is obvious: interoperability is a fundamental condition for effective information sharing in the EU administrative space as well as in the EU’s digital economy.

Remarkably, the various new data acts quite often refer more or less explicit to each other’s interoperability provisions. Thus, they provide a collaborative governance structure for interoperability. In addition, these acts demand collaboration of various private and public actors for the development or adoption of interoperability standards or safeguards.

Traditionally, interoperability is conceived as a mainly technical problem. Consequently, interoperability safeguards are often provided in technical standards established by private standardisation organisations or directly by industry actors in different modes of self-regulation. However, interoperability standards for inter-administrative (G2G) data exchange clearly exceed the realm of industry self-regulation. The same applies in the case of informational public–private partnerships with either government to business or citizen data-sharing (G2B/C) under the open government data paradigm or business to government data-sharing (B2G) to overcome informational asymmetries at the expense of public authorities. Furthermore, due to market power asymmetries, even data exchange among private actors (B2B, B2C or C2B) have motivated the European legislator to regulate such private data sharing including the basic interoperability standard setting. Important features of this regulation are participation of various stakeholders and supervision by public authorities. Consequently, collaborative governance is an important characteristic of the new legislative framework for interoperability.

The focus of this paper is as follows: Firstly, Section II. clarifies the understanding of “interoperability” in the new data acts. Secondly, Section III. presents an overview about the complex and fragmented new legislative framework for the EU’s future common data spaces in a broad sense composed by various new acts with sometimes overlapping titles. Instead of discussing the complex rulebooks in detail, we will rather highlight their core content as well as their relevance for administrative law. Section IV. then focusses on structural characteristics of the new interoperability rules. We will demonstrate that the new data acts provide various approaches or concepts of collaborative governance. Although the rulebook is far from a uniform governance concept, Section V. detects certain institutional arrangements organising the collaboration between private self-regulatory bodies, other private stakeholders and public bodies. Finally, Section VI. draws a conclusion and offers an outlook.

II. Understanding “interoperability”

As already mentioned, standardisation organisations often set interoperability safeguards in technical standards. This comprises the definition of interoperability, which the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC) established in 2017 in their technical standard for cloud computing. ISO and IEC define interoperability for cloud computing as “the ability of two or more systems or applications to exchange information and to mutually use the information that has been exchanged.” ¹ Also, reference is made to different dimensions of interoperability such as transport, syntactic, semantic, behavioural and policy interoperability. ²

The technical approach of ISO and IEC is important in the context of the EU’s new data acts because the Data Act ³ refers to the cited standard of the standardisation organisations. In recital 100 the Data Act states that the criteria specified in the Act have the same meaning as the interoperability aspects defined in the ISO and IEC technical specifications for cloud computing. It is therefore only consistent that the Data Act defines interoperability very similarly to the ISO and IEC technical standard. ⁴ In addition, the Data Act provides that open interoperability specifications for data processing services shall address the same interoperability dimensions as defined by ISO and IEC. ⁵

In contrast, the Interoperable Europe Act ⁶ highlights that interoperability is not only a technical problem. ⁷ The Interoperable Europe Act does not even define technical interoperability. However, the Act refers to the European Interoperability Framework. ⁸ In the Communication from 2017 containing the most recent implementation strategy for the European Interoperability Framework, the Commission defines technical interoperability as applications and infrastructures connecting systems and services. ⁹ This seems to be in line with the transport dimension as defined by ISO and IEC and mentioned in the Data Act. The same applies to the definition of the semantic dimension in the Interoperable Europe Act which is a combination of syntactic and semantic interoperability as defined by ISO and IEC and as mentioned in the Data Act. ¹⁰

Against this background, it is remarkable that the Interoperable Europe Act extends the EU’s regulatory approach beyond purely technical dimensions in also addressing legal and organisational dimensions of interoperability as part of an Integrated Public Service Governance reflecting a holistic approach on interoperability. ¹¹ While ISO and IEC merely understand policy interoperability as a compliance check with legal requirements, the Interoperable Europe Act provides an explicitly pro-active approach, demanding legal and organisational frameworks effectively supporting interoperability. ¹² The reason for this difference is clear. ISO and IEC as private standardisation organisations lack the competence to demand legal and organisational reforms especially towards inter-administrative data-sharing which is the focus of the Interoperable Europe Act as will be further shown below. Nevertheless, the EU’s legislative competence to recommend or even demand such reforms of public information law also at national level might be a matter of dispute. ¹³

III. Overview: the EU’s new data acts

This paper, however, focusses on an overview about the complex and fragmented new data acts of the EU. It analyses the core content of the new data acts and their relevance for different categories of information exchange between public and private actors, ie their importance from an administrative law perspective. In our analysis we have identified three categories of information exchange between public and private actors: inter-administrative data sharing (1.), public–private data sharing (2.) and private data sharing (3.). Additionally, there are some horizontal acts that establish rules for every domain of information sharing (4.).

1. Acts regulating inter-administrative data sharing

First, we identify inter-administrative or G2G data sharing as established by well-known sector-specific legislation such as the IMI Regulation ¹⁴ . That Regulation establishes the Internal Market Information System (“IMI”) for administrative cooperation between competent authorities of the Member States and between competent authorities of the Member States and the Commission. Of the EU’s new data acts, the Interoperable Europe Act addresses the process of inter-administrative data sharing and codifies policies under the previously not legally binding European Interoperability Framework. The scope of this Regulation is limited to public sector bodies of Member States and institutions, bodies and agencies of the Union that provide or manage digital information systems as an infrastructure for cross-border public services (Article 1(2)).

2. Acts regulating public-private data sharing

The second category concerns two different cases of public-private data sharing: Firstly, it includes the case when the government shares information with private actors as regulated by the Open Data Directive ¹⁵ or formerly the Public-Sector-Information (PSI) Directive ¹⁶ (G2B or G2C). Secondly, it comprises the case of the inverse perspective when businesses or citizens share data with the government (B2G or C2G). The second case is subject to sector-specific legislation like the Directive on the assessment of the effects of certain public and private projects on the environment ¹⁷ obliging the developer to prepare and submit to the competent authority an environmental impact assessment report. ¹⁸ Other examples are the Digital Services Act ¹⁹ or provisions in the field of financial regulation. ²⁰

3. Acts regulating purely private data sharing

The regulation of purely private data sharing (B2B, B2C, C2B or C2C) constitutes the third category. This category addresses for example the Digital Markets Act ²¹ regulating the portability of user-generated data.

The Data Governance Act ²² also regulates private data sharing but is not limited to it. It establishes rules for G2B, G2C, B2G and C2G data sharing. Chapter II of the Data Governance Act complements the Open Data Directive by laying down new rules on re-use of protected public sector information. Additionally, Chapter IV on data altruism regulates B2G data sharing or private data sharing if this pursues a general interest objective. Furthermore, the terms on European Data Spaces in the Data Governance Act (Article 29(2)(c), 30(f), (g), (h)) apply to all four domains of data sharing.

Another component of the regulatory framework concerning mainly private data sharing is the Data Act, in particular its rules on data sharing between private actors with regard to the internet of things (IoT) in Chapter II. Nevertheless, the Data Act also mandates businesses to share data with public sector bodies, the Commission, the European Central Bank or a Union bodies when there is an exceptional need (Chapter V). ²³ Moreover, the Data Act provides provisions concerning data spaces (Article 33) as well as the switching of data processing services (Article 35), which apply to private as well as public providers or customers. ²⁴

4. Horizontal acts establishing rules for every domain of information sharing

Moreover, there are some horizontal acts that establish rules for every domain of information sharing, like the General Data Protection Regulation, ²⁵ the Regulation on a framework for the free flow of non-personal data in the European Union ²⁶ and the Regulation on electronic identification and trust services for electronic transactions in the internal market ²⁷ .

Interestingly, the EU’s new data acts refer in their interoperability provisions to the European Standardisation Regulation of 2012. ²⁸ As shown in Section IV., the Regulation and the EU’s new data acts will serve as a central enabler of a collaborative governance structure for interoperability.

IV. Interoperability rules in the EU’s new Data Acts & collaborative governance

In our analysis we identified the involvement of private stakeholders in different types of collaboration with public bodies in the EU’s multi-level system of governance as an overarching principle. ²⁹ The new data acts establish a framework for collaborative interoperability governance comprising elements of self-regulation, competences for public bodies to support or request industry standard-setting as well as powers for formal regulatory interventions.

1. Different approaches governing the establishment of data sharing standards

Nevertheless, the new framework is far from a uniform governance concept used in all adopted or proposed legal acts. Instead, we have identified three different approaches governing the establishment of data sharing standards. We label these approaches “legal effect by referencing” (a.); “standardisation request and referencing” (b.) and “consulted rulemaking by the Commission” (c.).

a. Legal effect by referencing

“Legal effect by referencing” leaves the most extensive room for rather autonomous self-regulation by private standardisation organisations. Under this traditional concept, public bodies like the Commission are limited to the option to select privately established standards and to provide them with more or less legally binding effects by way of referencing in official acts or publications. However, the European Standardisation Regulation may provide requirements for a balanced representation and participation of divergent or even conflicting private interests or stakeholders.

b. Standardisation request and referencing

Under the “standardisation request and referencing” approach public bodies or the Commission have an increased influence on the standardisation process. For instance, Article 10 of the European Standardisation Regulation empowers the Commission to request one or more European standardisation organisations to draft harmonised standards. If the harmonised standard satisfies the requirements laid down by the legal acts, the Commission shall publish a reference of the harmonised standard for example in the Official Journal of the European Union.

c. Consulted rulemaking by the commission

The third approach of “consulted rulemaking by the Commission” covers arrangements under which the Commission is empowered to adopt delegated or implementing legal acts as well as mere guidelines. If such rulemaking procedures concern technical standard-setting, the Commission regularly has to consult various stakeholders.

2. Collaborative interoperability governance in the new data acts

Our analysis of the new data acts will unveil that the same area of interoperability, such as the interoperability of data spaces may be regulated by more than one of the new data acts. In addition, according to the new data acts, different collaborative governance regimes may apply for the same area of interoperability – eg of data spaces – depending on the success or failure of requested self-regulation.

a. Interoperable Europe Act

To start with, the Interoperable Europe Act provides two approaches for collaborative interoperability governance:

On the one hand, the European Interoperability Framework shall be subject to consulted Commission rulemaking. The starting point will be a proposal of the newly established Interoperable Europe Board for updating the European Interoperability Framework, which shall serve as a guideline for the proposed Interoperability Assessments. ³⁰ The Commission may adopt that proposal and shall publish the European Interoperability Framework in the Official Journal of the European Union. ³¹

On the other hand, interoperability solutions including ICT specifications and industry standards ³² are developed in the practice of inter-administrative data sharing or by private standardisation organisations. When the Interoperable Europe Board recommends an interoperability solution, it is labelled as an Interoperable Europe solution and the Commission is referencing it by way of its publication on the Interoperable Europe portal. ³³

Both interoperability rules have a semi-binding legal effect: Where a public body intends to set up or significantly modify an information system, it has to carry out an interoperability assessment. ³⁴ Pursuant to Article 3(2) of the Interoperable Europe Act, the interoperability assessment shall identify and assess the effects of the binding requirements on cross-border interoperability, using the European Interoperability Framework as a support tool and evaluate the Interoperable Europe solutions.

b. Data Act and Data Governance Act

The interaction of the Data Act, the Data Governance Act and the European Standardisation Regulation is complex. The Data Act provides rules for two different domains of interoperability: Firstly, requirements for operators of data spaces to facilitate the interoperability of data, data sharing mechanisms and services (a). Secondly, rules for the interoperability of data processing services (b). ³⁵

i. Requirements for operators of data spaces

The relevance of data spaces for the establishment of the European Data Economy cannot be overestimated. ³⁶ In fact, the Commission strives to further establish common European Data Spaces to facilitate sector-specific and cross-sectoral data sharing and data reuse.

Data spaces are regulated in Article 33 of the Data Act. ³⁷ Paragraph 1 of the article lays down the essential requirements that operators of data spaces shall comply with in order to facilitate interoperability. These essential requirements encompass regulations related to interoperability. For example the requirements demand a description of the data structures, data formats and vocabularies, which relate to syntactic and semantic interoperability. ³⁸ Furthermore, the technical means to enable automatic access and transmission of data (ie transport interoperability) shall be sufficiently described. ³⁹ Beside this, requirements related to data quality shall allow the recipient to find, access and use the data: The essential requirements demand a description of the dataset content, data collection methodology, data quality and uncertainty. ⁴⁰

According to Article 33(2) of the Data Act, the Commission is empowered to adopt delegated acts to further specify those essential requirements. Within this specification process the Commission shall consult the European Data Innovation Board (EDIB) (“consulted rulemaking by the Commission”).

As indicated earlier, the Data Governance Act complements the Data Act inter alia concerning the Commission’s rulemaking on data spaces. First, the Data Governance Act requires the consultation of the EDIB by the Commission. ⁴¹ It also regulates the composition of the EDIB. In accordance with the Data Governance Act, the EDIB consists not only of representatives of the competent authorities of the European Union, but also of representatives from industry, research, academia, civil society, standardisation organisations, relevant common European data spaces and other relevant stakeholders. Nevertheless, the Data Act – and not the Data Governance Act – obliges the Commission to further consult experts designated by each Member State before adopting the delegated act. ⁴² Consequently, while the Commission must take into account various opinions of different groups of stakeholders, the final decision of adopting the delegated act is made by the Commission.

Second, the essential requirements in Article 33(1) Data Act reflect the so-called FAIR-Principles for Common European Data Spaces mentioned in the Data Governance Act requiring that data spaces should make data findable, accessible, interoperable and re-usable ⁴³ . The Commission should consider this when further specifying the essential requirements through delegated acts.

As mentioned, the new data acts regulate interoperability of data spaces at various levels of detail. Besides the specification of essential requirements in delegated acts, the Data Act provides rules on even more detailed technical standards. In addition, concerning such interoperability standards for data spaces, different collaborative governance regimes may apply depending on the success or failure of requested self-regulation.

The Data Act empowers the Commission to request one or more European standardisation organisations to draft harmonised standards ⁴⁴ that satisfy the essential requirements of Article 33(1) Data Act including their specifications in delegated acts of the Commission. ⁴⁵ If the standardisation organisation’s proposal satisfies the specified requirements, the Commission shall publish a reference of the drafted harmonised standard in the Official Journal of the European Union. ⁴⁶ The operators of data spaces shall be presumed to be in conformity with the essential requirements, if they meet the harmonised standards or parts thereof published by reference in the Official Journal of the EU. ⁴⁷ The procedure to the adoption of harmonised standards is part of our second category of “standardisation request and referencing.”

Again, the Data Act rules will be complemented by already existing rules. In this regard, the general rules on requested standard-setting provided by the European Standardisation Regulation supplement the Data Act rules. ⁴⁸ Although initiated and supervised by the Commission, this second approach for collaborative interoperability governance extensively relies on self-regulated standard-setting. The standardisation organisations are free to draft harmonised standards. The Commission can only check whether the harmonised standards meet the requirements.

Where the standardisation organisations fail to draft harmonised standards complying with the essential requirements laid down by this Regulation, the Data Act provides a “safety net” by empowering the Commission to adopt so-called common specifications, ⁴⁹ by way of implementing acts. ⁵⁰ The Commission is obliged to take into account the advice of the EDIB and views of other relevant bodies or expert groups and shall duly consult all relevant stakeholders. ⁵¹ Therefore, the adoption of common specifications resembles a form of “consulted rulemaking by the Commission.”

Furthermore, according to Article 33(11) Data Act the Commission may adopt guidelines providing interoperability specifications for the functioning of common European Data Spaces. The EDIB shall propose these guidelines; a requirement already established in the Data Governance Act ⁵² . Consequently, we classify this arrangement for adopting another layer of soft law for data spaces as consulted rulemaking.

Moreover, the Data Governance Act sets the envisaged content of the guidelines the EDIB proposes. ⁵³ The guidelines address a different layer in comparison to the above-mentioned essential requirements. ⁵⁴ Unlike the essential requirements, these guidelines may include standards and practices to facilitate data sharing in the European Union. They aim to support the development of a functioning European data economy based on data spaces by addressing all aspects of interoperability. ⁵⁵

However, the guidelines that establish interoperability specifications are not legally binding for the operators within data spaces, adding another layer of soft law to the Governance of interoperability in the European Union. In contrast to the harmonised standards and common specifications, the Data Act does not contain provisions stating that operators within data spaces are presumed to be in conformity if they comply with these guidelines. Notwithstanding this, the guidelines will certainly influence the Commission’s future legislative proposals regarding common European Data Spaces. As soft law adopted by the Commission, the guidelines will have a self-binding effect for the Commission.

As shown above, the Data Act contains three different levels of rules regarding interoperability of data spaces in addition to the guidelines for the functioning of common European Data Spaces. These three levels create a cascade of rules, progressively developing an ever more concrete framework for the interoperability of data spaces. In this cascade, the democratic legitimacy originating from the European Parliament and the Council extends into the subsequent levels of interoperability rules.

At the first level, the European Parliament and the Council lay down and adopt the essential requirements in the ordinary legislative procedure as part of the Data Act. ⁵⁶

On the second level, the Commission is empowered to adopt delegated acts to further specify those essential requirements. This delegation of power to the Commission is limited in time and can be revoked at any time by the European Parliament or by the Council. ⁵⁷ Furthermore, the European Parliament or the Council can express their objections and by this prevent the entry into force of the delegated act. ⁵⁸ The European Parliament and the Council thus oversee the Commission’s specification of the essential requirements.

On the third level, standardisation organisations will be requested to propose harmonised standards. It is debatable whether the standardisation organisations have sufficient democratic legitimacy to propose such harmonised standards. ⁵⁹ The fact that the harmonised standards must fulfil the essential requirements laid down in the Data Act speaks in favour of sufficient democratic legitimacy. The Commission shall only publish a reference of such a harmonised standard, if it satisfies the requirements set out in the Data Act. ⁶⁰ Moreover, if the Commission publishes a reference to the harmonised standards in the Official Journal of the European Union it acknowledges it. ⁶¹ Therefore, the level of democratic legitimacy is sufficient.

ii. Interoperability for data processing services

The Data Act also addresses the interoperability of data processing services. Due to the limited effect of self-regulating codes, the Data Act strives to adopt a set of minimum regulatory obligations on providers of data processing services. ⁶² Hence, the providers of data processing services shall ensure the compatibility with open interoperability specifications or standards for interoperability. ⁶³

Concerning the interoperability of data processing services, the Data Act establishes in principle a similar two-tier approach of either requested harmonised standards ⁶⁴ or the adoption of common specifications by way of “consulted Rulemaking by the Commission.” ⁶⁵ The empowerment of the Commission to lay down common specifications by way of implementing acts ⁶⁶ provides a “safety net” in case the standardisation organisations are failing to draft the requested harmonised standards.

The Data Act provides a different concept of standard-setting for establishing common specifications than for the interoperability of data spaces. It obliges the Commission to duly consult all relevant stakeholders, ⁶⁷ but not to consult the EDIB. This is due to the tasks of the EDIB. ⁶⁸ In accordance with the Data Governance Act, the EDIB shall advise the Commission on their activities regarding data spaces. The consultation of the Commission on the interoperability of data processing services is not mentioned. Therefore, these tasks laid down by the Data Governance Act would need to be adjusted to these new tasks of the EDIB to enable a consultation of the Commission by the EDIB on the interoperability of data processing services. ⁶⁹

The concept of laying down interoperability rules for data processing services mirrors not only the two-tier approach of the standard-setting procedure for data spaces, but also the above-mentioned cascade of rules. The Commission shall only publish the reference of a harmonised standard if this harmonised standard meets the criteria set out in Article 35(1) and (2) of the Data Act. ⁷⁰

c. Interim conclusion

To summarise: The Data Act in combination with the Data Governance Act and the European Standardisation Regulation use two different concepts of standard-setting. Under the first approach, harmonised standards shall be developed by private standardisation organisations on request of the Commission which reference these standards in the Official Journal if they fulfil essential quality requirements for interoperability. According to the second concept, the Commission can adopt common specifications by way of implementing acts, where the harmonised standards are insufficient to ensure conformity with the essential requirements. The second concept provides a “safety net” in case of failing self-regulation. Nevertheless, it is based on collaboration with stakeholders from various domains in order to overcome information asymmetries.

V. Institutional arrangements for organising collaborative governance

Altogether, we can identify four institutional arrangements for organising collaborative governance: Standardisation organisations, the EDIB, the Interoperable Europe Board and finally comitology committees.

This part briefly presents some features of the four institutional arrangements: The first tier of collaborative standard setting involves collaboration with competent standardisation organisations. However, the approach of collaboration differs. According to the Data Act, the standard-setting process is part of our concept of “standardisation request and referencing.” Whereas according to the Interoperable Europe Act, the identification of interoperability is part of our concept of “legal effect by referencing.” The details of these collaborations are not regulated in the EU’s new data acts. Instead, they refer to the established arrangements under the European Standardisation Regulation of 2012. ⁷¹

Secondly, the EDIB plays an important role in consulting the Commission in questions arising from interoperability rules applicable to Common European Data Spaces. The EDIB consists of representatives of various national and European competent authorities and shall support the Commission by identifying relevant standards. ⁷² In consultation-processes concerning data spaces, the EDIB involves in addition to its standard membership of public officials a subgroup for stakeholder involvement. This subgroup is composed of relevant representatives from industry, research, academia, civil society, standardisation organisations, relevant common European data spaces and other relevant stakeholders. ⁷³

Thirdly, there are two different institutional arrangements established by the Interoperable Europe Act to support the activities of the Commission: the Interoperable Europe Board and the Interoperable Europe Community. ⁷⁴ The Interoperable Europe Board consists of representatives of each Member State and the Commission. ⁷⁵ While the Board’s focus is the participation of public actors, the Interoperable Europe Community expands the collaboration with public and private stakeholders. They can support the Interoperable Europe Board by contributing to the content of the Interoperable Europe portal. ⁷⁶

Fourthly, under the consulted rulemaking approach the examination procedure according to Article 5 of the Comitology Regulation is a key element for support and control of the Commission by the Member States.

Altogether, in all institutional arrangements – except Comitology – stakeholder participation is a central although not uniform feature. Moreover, one needs to keep in mind that according to the Data Act comitology procedures regarding common specifications for interoperability will be accompanied by at least one of the other three institutional arrangements providing some form of stakeholder participation. ⁷⁷

VI. Conclusion and outlook

We conclude that the EU’s new data acts are establishing a rather comprehensive, while complex collaborative governance structure characterised by the interaction of various public and private bodies comprising self-regulation as well as regulatory interventions or public support of industry standard-setting. Especially, the Commission and the EDIB are playing an important role together with European standardisation organisations in fostering the interoperability of common European Data Spaces. This reflects the insight that interoperability also beyond inter-administrative data-sharing is not merely a technical problem. Instead, it is related to various legal and organisational – or in other words political – issues of data spaces.