The EU data strategy has many points of contact with the data protection framework and the GDPR.
In addition to the GDPR and the ePrivacy Directive, which is still being updated as the ePrivacy Regulation, as well as the Police Directive (dir. (EU) 2016/680) and Regulation (EU) 2018/1725 on the processing of personal data by European institutions, there are also developments in the digital legislation of the EU to be considered such as: 

• the Data Governance Regulation (DGA)  
• the Digital Markets regulation (DMA) 
• the Digital Services regulation (DSA) 
• the draft of the Artificial Intelligence Act (AIA) 
• the draft of the Data Act (Data Act). 

The last two acts are still at the stage of completing the co-legislative procedure between the two institutions of the Parliament and the Council of the European Union, and many amendments have been made to the text of the original Commission proposals in both cases.

Data Governance Act – DGA

Regulation (EU) 2022/868 on data governance was issued on May 30, 2022.

The regulation is expected to make more data available for sharing. This will impact industries such as health, environment, energy, agriculture, mobility, finance and public administration. The goal is for the identification of an appropriate balance between sharing data, including personal data, to develop the data-driven economy, and protecting the rights and freedoms of data subjects.

In this regard, please refer to the Bulletins of June 23, July 7 and July 21, 2022.

Digital Services Act – DSA

The DSA (EU Regulation 2022/2065), which originated from the Commission’s December 2020 proposal, became effective law following its publication in the EU Official Journal on 10/27/2022. On the original Commission proposal, EDPS had issued an opinion on Feb. 10, 2021.

Subjective scope of application

The DSA “shall apply to intermediary services offered to recipients of the service that have their place of establishment or are located in the Union, irrespective of where the providers of those intermediary services have their place of establishment.” The intermediary entities covered by the DSA are:  

• Internet access providers, domain name registration centers
• Cloud and web hosting service providers
• Online marketplaces, app stores, social networks
• Online platforms and search engines affecting more than 10 percent of recipients established or located in the EU, regardless of the place of establishment of the service providers.

What’s new in the DSA

The DSA made some important new changes: 

• New rules applicable to targeted online advertising (Articles 26, 39, 46, DSA). 
• Online protection of minors (Art. 28, DSA). 
• Additional transparency requirements for online intermediaries (Arts. 15, 39, 42, DSA). 
• New digital service coordinators, i.e., supervisory and enforcement authorities in each member state (Arts. 49-51, DSA).

The DSA also encourages the European Commission to develop EU-wide codes of conduct in the matters covered by the regulation.

Roadmap of the DSA

The DSA will enter into force on November 16, 2022 (Art. 93.1, DSA) and will be fully applicable on February 17, 2024 (Art. 93.2, DSA), specifically: 

• the provisions on transparency reporting requirements for online platform providers (Article 23(2)), the designation of very large online platforms (Articles 25(4-6)), as well as the framework for implementation, cooperation, fines, and enforcement (Chapter IV) (Art. 93, ult. per., DSA) apply from November 16, 2022. 
• DSA rules apply to designated providers of very large online platforms and very large online search engines beginning four months after notification of designation, if that date is before Feb. 17, 2024 (Art. 92, DSA) 
• By February 17, 2024, member states will designate national digital service coordinators (Art. 49.3, DSA).