Data Act

We work alongside the Client in mapping connected products and related services, using our own assessment checklists calibrated to the Data Act. The service starts with one or more dedicated sessions to agree a shared approach to completing the checklists, to obtain a uniform and sufficiently detailed level of information for each device and service, even across different divisions or business lines. Where useful, at the start of the mapping we analyse an initial sample of completed checklists, chosen by the Client, to steer and validate the effectiveness of the exercise. Together with the Client we also define the criteria for classifying the data generated. The service is personalised to the number and type of products and services offered and to the Client’s organisational complexity. The added value is a solid, well-ordered knowledge base on which all the subsequent Data Act compliance work can be properly built.

We support the Client in analysing and allocating the roles and responsibilities provided for by the Data Act (data holder, user, data recipient) in its relationships with commercial partners. In practice, we verify with the partners what the correct allocation is, establishing who — between the Client and the partner — acts as data holder for the data generated by each connected product or related service, distinguishing the situations where the Client manufactures or develops the product directly from those where it is supplied by third parties. On this basis we define the allocation of obligations and crystallise the outcome in the agreements between the parties. To get there, we analyse the structure of the supply chain and the Client’s business model. Our aim is to prevent disputes and simplify the management of compliance obligations.

We prepare the transparency notices for end customers on the data generated using connected products and related services. In practice, we identify the information due under Article 3 of the Data Act — applicable both where the Client is the data holder and where the partner is — and distinguish, for each device or service, the readily available data, to which access must be free of charge, from enriched data, to which access may be granted for a fee. We then prepare the template notices to be provided to customers. In terms of style, we work on clear, complete communication that strengthens customer trust and reduces exposure to disputes.

We work alongside the Client in supplementing its contracts with partners, customers and third-party data recipients with the clauses required by the Data Act for the use and sharing of non-personal data generated by connected products and related services. We prepare template clauses that govern roles and responsibilities and make clear who acts as data holder; we supplement, in line with the Client’s needs, the agreements with partners and the relationships with customers and, where necessary, we draft the contractual texts from scratch. The document sets are built as benchmarks, which the Client can adapt to its different scenarios and business lines.
We take as much account as possible of the Client’s network of commercial relationships and organisational complexity. We build a contractual framework that safeguards data sharing and reduces the risks of inadequately regulated relationships.

We develop policies and procedures for data management in IoT environments and draft the contracts between the parties involved. This is made possible by an analysis of the ecosystem of connected devices and the related data flows. The policies and procedures establish a governance system for the collection of, access to, and sharing and retention of the data generated. We also prepare the contracts governing roles, responsibilities and rights between manufacturers, suppliers, users and recipients.

We prepare the contractual terms for making data available to third parties under Article 5 of the Data Act. This involves developing template contracts applicable where the Client is the data holder of connected product and related service data and must share them with third-party recipients at the end customer’s request, built on predefined scenarios and usable as benchmarks. We also check for the absence of unfair terms unilaterally imposed on micro, small and medium-sized enterprises, within the limits set by the Data Act. Working with the Client at the drafting stage, we aim for terms that are both compliant and balanced, taking account of the Client’s business model and the types of data shared.

We assist the Client in defining the internal procedures for handling data access and sharing requests, where appropriate in coordination with the access and portability rights provided for by the GDPR. In practice, we govern how the Client receives and manages users’ requests to access the data generated by connected products or to share them with third parties, defining roles, timescales, authorisation flows and controls, and ensuring, where necessary, alignment with personal data protection obligations.
We aim to create a clear, documented internal process that allows requests to be answered promptly and compliantly, reducing exposure to disputes and defaults.

We work alongside the Client in complying with the Data Act obligations on switching and exit between data processing service providers, including cloud services. Our assistance consists of analysing the contracts in place with providers, checking for the clauses required by the Data Act on notice periods, transition timescales, portability of data and digital assets and the gradual withdrawal of switching charges, and defining the contractual changes needed, including with a view to the operational phase of the migration.

We assist the Client in handling requests to make data available received from public sector bodies (B2G). On the merits, we assess the lawfulness of and grounds for the requests received — in particular whether an exceptional need exists within the meaning of the Data Act — and support the Client in preparing the responses or, where the conditions are met, in formulating refusals or requests for amendment, ensuring the proper handling of any data disclosed.
The objective is to allow the Client to meet its cooperation obligations without giving up its data and interests.

For Data Act compliance too, we offer our Legal Desk service to the businesses affected by the Regulation. It is a multidisciplinary legal assistance and advisory service whose availability and, above all, speed the Client can always count on. The service meets the need to outsource the handling of legal issues in less complex business contexts and can also be a valuable support to the in-house legal department in more structured organisations.
The involvement of a pool of senior professionals — organised by area of specialisation — allows the Client to capitalise on the advisory experience gained, ensuring constant regulatory updates in its sector. The multidisciplinary approach also delivers attractive economies of scale.

Our areas of work include:

• Mapping of connected products and related services and allocation of roles and responsibilities;
• Preparation of transparency notices and of the terms for making data available;
• Supplementing contracts with customers, partners and third parties in the light of the Data Act;
• Internal procedures for handling data access and portability requests;
• Assistance with switching and exit between data processing service providers;
• Handling of data requests from public sector bodies;
• Contracts and data governance in IoT environments.

For each Client the service involves a “contact lawyer”, who coordinates the work and has an ongoing relationship with the company. The presence of this figure brings:

• A stronger relationship of trust with the Client;
• The progressive personalisation of the service, as knowledge of the company context steadily grows;
• The guarantee of a constant legal presence, which also plays a proactive role towards the Client.

As for how the service is offered, the methodology is that of a typical help desk: maximum freedom and flexibility for the Client to set upfront an annual budget for the initiative, so as to make the most of its economies of scale.
The expected result is to turn what has perhaps been perceived until now as the cost of regulatory compliance into an insurance policy — or an investment — in the peace of mind of doing things properly

Our services also include training sessions on the Data Act and on the management of data generated by connected products and related services. Our training is designed to offer both a general grounding in the principles of the legislation and more specific, technical and operational content, tailored to the Client’s sector and to any special regulations that apply. As part of our ongoing advisory work, we also deliver dedicated training sessions on the correct use and implementation of the documentation and procedures adopted.
All our learning services are modulated and adapted to the specific needs of the Client and can be delivered both in class and at distance; timing, duration and recipients of such sessions are always defined in advance and agreed upon with the Client, with the possibility to arrange single sessions for personnel with specific duties and competences within the company.
We furthermore offer drafting of learning materials (e.g. awareness raising materials, simulations of possible scenarios with fictional characters, legal text easily accessible via hypertext) which can also be uploaded into e-learning platforms including animations, sounds, multiple answers questions and randomized answers.
We also offer a range of “ready-to-go” solutions, thanks to a consolidated collaboration with our technological partner Mediamed Interactive, which allows us to offer to our Clients a product based on the more evolved and widespread training platforms, so that our Clients can enjoy both standard sessions or more tailored sessions.