European UnionData Act, International Governmental Access and Transfer of Non-Personal Data (Articles 28 and 32)
Regulation (EU) 2023/2854, Arts. 28 and 32
In force since .
A foreign government access rule binding private bodies.
- Private right of action
- No
- Obligation class
- Transfer, Disclosure
As of .
What it requires
- If you provide a data processing service, publish on your website, and keep up to date, the jurisdiction to which the ICT infrastructure deployed for each of your services is subject (Art. 28(1), point (a)).
- Publish on your website, and keep up to date, a general description of the technical, organisational and contractual measures you have adopted to prevent international governmental access to or transfer of non-personal data held in the Union where that access or transfer would conflict with Union law or the national law of the relevant Member State (Art. 28(1), point (b)).
- List those websites in the contracts for all the data processing services you offer (Art. 28(2)).
- Take all adequate technical, organisational and legal measures, including contracts, to prevent international and third-country governmental access to and transfer of non-personal data held in the Union where the transfer or access would conflict with Union law or the national law of the relevant Member State (Art. 32(1)).
- Treat a third-country court or administrative decision requiring you to transfer or give access to non-personal data held in the Union as recognised or enforceable only if it rests on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or the Member State (Art. 32(2)).
- Where there is no such agreement and compliance would risk putting you in conflict with Union or national law, transfer or give access only where the third-country system requires the decision to set out its reasons and proportionality and to be specific, your reasoned objection is subject to review by a competent third-country court or tribunal, and that court or tribunal is empowered to take duly into account the relevant legal interests of the provider of the data that Union or Member State law protects (Art. 32(3), points (a) to (c)).
- Where the conditions in Article 32(2) or (3) are met, provide the minimum amount of data permissible in response to the request, on a reasonable interpretation of it (Art. 32(4)).
- Inform the customer of a third-country authority's request to access its data before complying, except where the request serves law enforcement purposes and for as long as necessary to preserve the effectiveness of the law enforcement activity (Art. 32(5)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The competent authorities that each Member State designates to be responsible for the application and enforcement of the Regulation (Article 37(1)), which for Articles 23 to 31, 34 and 35 must have experience in the field of data and electronic communications services (Article 37(4), point (b)); an entity falls under the competence of the Member State where it is established (Article 37(10)).
Settledness
- As of
- Open questions
- Will the Digital Omnibus (procedure 2025/0360(COD)) be adopted with the Council mandate's widening of Article 32(1) to further addressees and to national security interests?
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32023r2854
What this law does
Article 28(1) requires a provider of data processing services to make available on its websites, and keep up to date, the jurisdiction to which the ICT infrastructure deployed for its individual services is subject and a general description of the measures it has adopted to prevent international governmental access to or transfer of non-personal data held in the Union where that would create a conflict with Union law or national law.
Article 28(2) requires those websites to be listed in the contracts for all data processing services the provider offers. Article 32(1) requires a provider to take all adequate technical, organisational and legal measures, including contracts, to prevent international and third-country governmental access to and transfer of non-personal data held in the Union where that would create a conflict with Union law or the national law of the relevant Member State.
Article 32(2) makes a third-country court or administrative decision requiring transfer of or access to non-personal data held in the Union recognised or enforceable only if based on an international agreement in force between the requesting third country and the Union or a Member State. Article 32(3) permits transfer or access without such an agreement, where compliance would put the addressee in conflict with Union or national law, only where the conditions in its points (a) to (c) are met.
Article 32(4) requires the provider, where those conditions are met, to provide the minimum amount of data permissible on a reasonable interpretation of the request. Article 32(5) requires the provider to inform the customer of a third-country authority's request before complying, except where the request serves law enforcement purposes and for as long as necessary to preserve the effectiveness of the law enforcement activity.
Article 31(2) excludes the obligations laid down in Chapter VI, which includes Article 28, for a data processing service provided as a non-production version for testing and evaluation purposes and for a limited period of time. Article 40(1) leaves the rules on penalties for infringements of the Regulation to the Member States, which must make them effective, proportionate and dissuasive. Article 50 applies the Regulation from .
The Permanent Representatives Committee agreed the Council's mandate for negotiations with the European Parliament on the Digital Omnibus on .
The Digital Omnibus text in that mandate would extend the Article 32(1) duty to public sector bodies, re-users of data or documents, data intermediation services providers and recognised data altruism organisations, and would widen the conflict test to criminal law provisions of Member States and national law provisions protecting their essential security interests.
When LexLint raises it
When your app profile says your app provides cloud services.