Art. 21 Sharing of data obtained in the context of an exceptional need with research organisations or statistical bodies | Data act regulation | Data act

This article governs how public sector bodies, the Commission, the European Central Bank, and Union bodies may further share data they have already obtained under Chapter V (the exceptional need provisions).

It permits onward sharing to researchers, analytics organisations, and statistical bodies, but attaches strict conditions to who can receive that data and how they must handle it.

The article essentially extends the obligations of the original data request framework to these secondary recipients, while also preserving a right for the original data holder to be informed and to challenge the sharing.

Important points:

Public sector bodies, the Commission, the European Central Bank, and Union bodies may only share data onward for scientific research, analytics, or official statistics purposes, and only with not-for-profit or public-interest organisations free from significant commercial influence.
Individuals or organisations receiving the data under this article must comply with the same obligations as the original requesting bodies under Articles 17(3) and 19, but may retain the data for up to six months after the requesting body has erased it.
Data holders must be notified without undue delay before any onward sharing occurs, and data holders who disagree with the transmission may lodge a complaint with the competent authority.

1. A public sector body, the Commission, the European Central Bank or a Union body shall be entitled to share data received under this Chapter:
  1. with individuals or organisations in view of carrying out scientific research or analytics compatible with the purpose for which the data was requested; or
  2. with national statistical institutes and Eurostat for the production of official statistics.
1. Individuals or organisations receiving the data pursuant to paragraph 1 shall act on a not-for-profit basis or in the context of a public-interest mission recognised in Union or national law. They shall not include organisations upon which commercial undertakings have a significant influence which is likely to result in preferential access to the results of the research.
1. Individuals or organisations receiving the data pursuant to paragraph 1 of this Article shall comply with the same obligations that are applicable to the public sector bodies, the Commission, the European Central Bank or Union bodies pursuant to Article 17(3) and Article 19.
1. Notwithstanding Article 19(1), point (c), individuals or organisations receiving the data pursuant to paragraph 1 of this Article may keep the data received for the purpose for which the data was requested for up to six months following erasure of the data by the public sector bodies, the Commission, the European Central Bank and Union bodies.
1. Where a public sector body, the Commission, the European Central Bank or a Union body intends to transmit or make data available under paragraph 1 of this Article, it shall notify without undue delay the data holder from whom the data was received, stating the identity and contact details of the organisation or the individual receiving the data, the purpose of the transmission or making available of the data, the period for which the data is to be used and the technical protection and organisational measures taken, including where personal data or trade secrets are involved. Where the data holder disagrees with the transmission or making available of data, it may lodge a complaint with the competent authority designated pursuant to Article 37 of the Member State where the data holder is established.