A new law now coming into force in the EU requires manufacturers to tell users what data their devices are collecting – and how users can access it. This should bring some advantages for consumers - at least in theory. — Photo: Christin Klose/dpa
BRUSSELS: In the average 'smart home', a vast amount of data is collected: from connected refrigerators and voice assistants to smart TVs – everything stores information.
The European Union wants users in the bloc to benefit more from the data generated by these digital devices.
Under the new EU Data Act, users are granted more enhanced rights to the data collected by their connected devices. Manufacturers are now required to disclose what information is being collected and how users can access it.
The EU Data Act officially came into force at the beginning of 2024 and is now being implemented as of September 12. It aims to make it easier for consumers to view their device data and share it with other services if needed, such as for repair purposes.
Ultimately, the goal is to make services cheaper and more accessible. Here are the key points of the new regulations:
Which devices are covered by the law?
It might be easier to ask which devices are not covered. According to the EU regulation, the rules apply to all so-called connected products – physical devices that collect or generate data about their use or environment and can communicate this data via electronic communications, physical connection, or on-device access.
For example, a coffee machine that can transmit data via cable for repair purposes falls under the Data Act, as do "smart" devices controlled via wireless connections or apps.
What kind of data?
The law broadly defines data as any digital representation of actions, facts or information. This could include videos, images, or audio recordings made by a device. The key factor is whether or not the device generates or collects data about its usage, performance or environment – less so how it does so.
The list of affected sectors and devices is extensive: smartphones, smartwatches, modern kitchen appliances, air conditioners, e-bikes, and cars are all included, as are industrial machines and airplanes.
Does the device need to be new?
No, the right to access generated data also applies to devices already purchased and in use.
Interestingly, if you sell your fitness tracker or TV, you must inform the new owner how to access the device's data. The EU Data Act does not differentiate between first-hand and second-hand ownership.
From September 2026, the Data Act will also require manufacturers to equip new products with simple interfaces for user data access, meaning these rights must be considered during product development.
What benefits does this bring to users?
Previously, manufacturers often kept the rights to all data generated by their devices. Now, both individuals and businesses will have more control over the data. Users will be able to access, delete or share their data.
This is particularly promising for repairs or other services. For example, a car owner could choose to share specific data with their insurance provider. In theory, exemplary driving behaviour could lead to lower insurance premiums.
However, the European consumer protection organisation BEUC has criticised the law for having too many exceptions, which could limit its practical benefits. BEUC Managing Director Agustín Reyna called the law a "missed opportunity."
How can users access their data?
The EU regulation provides two options for access: direct or indirect. Where possible, users should be able to access their data directly. Manufacturers must inform users at the time of purchase how to do this.
If direct access is not possible or not desired by the manufacturer, a simple request – such as via a dedicated web portal–should suffice.
The response, including the requested data, should be provided without significant hurdles.
What else does the EU hope to achieve with the Data Act?
The EU envisions freer data sharing leading to the creation of new business opportunities or the growth of existing ones. The goal is for data to ultimately lead to more economic value being created.
Additionally, authorities will be allowed to access private-sector data in exceptional cases, such as during wildfires or floods.
Major cloud providers like Amazon Web Services, Microsoft and Google are now required to prevent illegal data access and make it easier for users to switch providers. – dpa
