European UnionData Act, Information, Good Faith and Technical Aspects of Switching Cloud Providers (Articles 26, 27 and 30)
Regulation (EU) 2023/2854, Arts. 26, 27 and 30
In force since .
A switching and interoperability rule binding private bodies.
- Private right of action
- No
- Obligation class
- Disclosure
As of .
What it requires
- If you provide a data processing service, give the customer information on the available procedures for switching and porting to your service, including the available switching and porting methods and formats and the restrictions and technical limitations known to you (Art. 26, point (a)).
- Give the customer a reference to an up-to-date online register that you host, with details of all the data structures and data formats and the relevant standards and open interoperability specifications in which the exportable data are available (Art. 26, point (b)).
- Cooperate in good faith with the other parties, including destination providers, to make the switching process effective, enable the timely transfer of data and maintain the continuity of the service (Art. 27).
- If your service is limited to infrastructural elements such as servers, networks and the virtual resources needed to operate the infrastructure, take all reasonable measures in your power to help the customer achieve functional equivalence in the destination service of the same service type, and, as source provider, provide capabilities, adequate information, documentation, technical support and, where appropriate, the necessary tools (Art. 30(1)).
- For any other data processing service, make open interfaces available free of charge to an equal extent to all your customers and to the concerned destination providers, with enough information on the service to enable software that communicates with it for data portability and interoperability (Art. 30(2)).
- For those other services, ensure compatibility with the common specifications or harmonised standards for interoperability at least 12 months after their references are published in the central Union standards repository, and keep the online register under Article 26, point (b), up to date in line with that duty (Art. 30(3) and (4)).
- Where no such specifications or standards have been published for the service type, export all exportable data in a structured, commonly used and machine-readable format at the customer's request (Art. 30(5)).
- Before concluding a contract for a service that Article 31 takes outside part of this Chapter, tell the prospective customer which obligations of the Chapter do not apply (Art. 31(3)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The competent authorities that each Member State designates to be responsible for the application and enforcement of the Regulation (Article 37(1)), which for Articles 23 to 31, 34 and 35 must have experience in the field of data and electronic communications services (Article 37(4), point (b)); an entity falls under the competence of the Member State where it is established (Article 37(10)).
Settledness
- As of
- Open questions
- Will the Digital Omnibus (procedure 2025/0360(COD)) be adopted with the Council mandate's Article 31(1a), which would excuse certain contracts concluded on or before from Chapter VI other than Article 29?
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32023r2854
What this law does
Article 26 requires the provider to give the customer information on the available switching and porting procedures, methods and formats and on the known restrictions and technical limitations, and a reference to an up-to-date online register of the data structures, data formats and standards in which the exportable data are available.
Article 27 requires all parties involved, including destination providers, to cooperate in good faith to make the switching process effective, enable the timely transfer of data and maintain the continuity of the service.
Article 30(1) requires a provider of infrastructure-only services to take all reasonable measures to facilitate functional equivalence in the destination service, and the source provider to facilitate switching with capabilities, adequate information, documentation, technical support and, where appropriate, tools. Article 30(2) requires every other provider to make open interfaces available to an equal extent to all customers and the concerned destination providers, free of charge.
Article 30(3) requires those providers to ensure compatibility with common specifications or harmonised standards for interoperability at least 12 months after their references are published in the central Union standards repository. Article 30(4) requires those providers to update the online register referred to in Article 26, point (b), in line with Article 30(3).
Article 30(5) requires a provider, where no common specifications or harmonised standards have been published for the service type, to export all exportable data in a structured, commonly used and machine-readable format at the customer's request. Article 30(6) does not require a provider to develop new technologies or services, to disclose or transfer digital assets protected by intellectual property rights or constituting a trade secret, or to compromise security and integrity of service.
Article 31(1) excludes from Article 30(1) and (3) a data processing service of which the majority of main features has been custom-built for an individual customer, or whose components were all developed for an individual customer, where it is not offered at broad commercial scale via the provider's service catalogue.
Article 31(2) excludes the obligations of Chapter VI for a data processing service provided as a non-production version for testing and evaluation purposes and for a limited period of time. Article 40(1) leaves the rules on penalties for infringements of the Regulation to the Member States, which must make them effective, proportionate and dissuasive. Article 50 applies the Regulation from .
The Permanent Representatives Committee agreed the Council's mandate for negotiations with the European Parliament on the Digital Omnibus on . The Digital Omnibus text in that mandate would insert Article 31(1a), which would add an exclusion from Chapter VI other than Article 29 for a data processing service, other than one within Article 30(1), adapted to the specific needs of the customer under a contract concluded on or earlier.
When LexLint raises it
When your app profile says your app provides cloud services.