Art. 17 (2) Data Act - Trialogue Agreement

A request for data made pursuant to paragraph 1 of this Article shall:

(a)     be made in writing and be expressed in clear, concise and plain language understandable to the data holder;

(ab)   be specific with regards to the type of data requested and correspond to data which the data holder has control over at the time of the request;

(b)     be justified and proportionate to the exceptional need, in terms of the granularity and volume of the data requested and frequency of access of the data requested;

(c)     respect the legitimate aims of the data holder, committing to ensuring the protection of trade secrets in accordance with Article 19(2), and the cost and effort required to make the data available;

(d)     concern non-personal data, and only if this is demonstrated to be insufficient to respond to the exceptional need to use data, in accordance with Article 15(1)(a), request personal data in aggregated or pseudonymised form and set out the technical and organisational measures that will be taken to protect the data;

(e)     inform the data holder of the penalties that shall be imposed pursuant to Article 33 by the competent authority referred to in Article 31 in the event of non-compliance with the request;

(f)     be transmitted to the data coordinator referred to in Article 31 where the requesting public sector body is established, who shall make the request publicly available online without undue delay unless it considers that this would create a risk for public security. The Commission, the European Central Bank and Union bodies shall make their requests available online without undue delay and inform the Commission thereof.

(fa)    in case personal data are requested, be notified without undue delay  to the independent supervisory authority responsible for monitoring the application of Regulation (EU) 2016/679 in the Member State where the data holder is established.