EU Data Act: can customers share your machine data with competitors?

Who can request sharing, and what can the recipient do?#

The party that can request sharing is the user of the connected product: the business or individual that owns, rents or leases it, or receives a related service. The manufacturer usually acts as the data holder and must respond to the user's choice of recipient, within the limits the regulation sets.

The table summarizes the general position. Each row hides detail and exceptions, which is why the right-hand column matters as much as the middle one.

Where the competitor line is drawn#

The competitor line is drawn at the product, not the service. An independent service company that competes with your maintenance contracts can generally receive a customer's machine data to diagnose and repair your equipment, because opening aftermarket competition is one of the purposes the regulation serves.

What the recipient generally cannot do is use the data to develop a connected product that competes with the one the data came from. A rival machine builder can receive data through its service arm, but turning that data into the design of its own competing machine falls on the wrong side of the line.

Gray zones are real. A multi-brand service firm owned by a competing manufacturer, or a component supplier building a smarter replacement part, raises fact-specific questions. These belong with counsel, and the agreement with each recipient should state the permitted purposes plainly.

What compensation can you ask for?#

Compensation is something a data holder can generally agree with the third-party recipient, not with the user. It must be reasonable and non-discriminatory and may generally include a margin, but when the recipient is a small or medium-sized business, the regulation generally limits it to the costs of making the data available.

To charge with confidence, document what providing the data actually costs: formatting, transmission, storage and the staff time to handle requests. The regulation also expects data holders to explain to the recipient how the figure was calculated, and a clear cost basis helps if a recipient disputes the amount, which can go to a certified dispute settlement body.

Protecting trade secrets when a request arrives#

Trade secrets in machine data, such as control parameters, calibration curves or process recipes, can be protected, but the default is protection through agreed measures rather than refusal. The data holder can require confidentiality steps before sharing and can suspend sharing if those measures are not respected.

Over-claiming trade secrets to avoid sharing invites disputes. A narrow, documented list of sensitive fields is easier to defend than a blanket refusal.

• 1Identify which data fields could reveal trade secrets, product by product.
• 2Prepare standard confidentiality terms and technical measures to offer recipients.
• 3Record what was shared, with whom and under which measures.
• 4Suspend sharing and document the reason if agreed measures are breached.
• 5Reserve outright refusal for exceptional cases of likely serious economic harm, documented and notified as the regulation requires.

Can your sales contract stop sharing with competitors?#

A sales contract generally cannot override the user's rights. Clauses that try to block or penalize sharing with third parties, or that impose terms unfairly on a business customer, may not be binding, so counsel should review standard terms with that in mind.

Contracts still matter. They can set out how requests are made, how recipients are verified, what confidentiality measures apply and what the manufacturer may do with non-personal product data, which is the basis for any licensing of that data.

Distributor and dealer agreements deserve the same review. Where a dealer holds the customer relationship or runs the remote portal, the agreement should say who acts as data holder, who answers requests and how costs are shared, so a request does not fall between two companies.

Illustrative: a packaging machine maker gets its first request#

Illustrative: a fictional US builder of packaging lines has machines in food plants across Europe. One EU customer asks the company to share line data with an independent service firm that competes for its maintenance contracts.

The general counsel verified that the requester was the user under its lease, scoped the readily available data the remote portal held, and offered the service firm standard confidentiality terms covering the machine's control software parameters. The CEO's first instinct was to refuse, but the trade secret concern was narrow and could be handled with measures.

A second request later named the service arm of a rival machine builder. The company agreed terms that stated the permitted purposes and the bar on developing a competing product, and logged both requests. When it later considered licensing its own machine data, it started from a clear record of who had received what.

What this means for licensing your own machine data#

Licensing your own machine data sits alongside these rules rather than inside them. The user's sharing rights do not stop a manufacturer from licensing data, but a manufacturer that wants to use or license non-personal product data generally has to point to its contract with the user as the basis, which counsel reviews deal by deal.

In a SourceX license, that basis is written down at the Rights step of the SourceX five-step transaction, together with a record of past third-party sharing requests where they matter. The SourceX Evidence Packet then documents provenance, licensing rights, permitted use, the privacy record and release authorization. SourceX does not give legal advice and does not decide Data Act questions for suppliers.