Art. 11 (2) and (3) Data Act (COM Proposal)

"2. A data recipient that has, for the purposes of obtaining data, provided inaccurate or false information to the data holder, deployed deceptive or coercive means or abused evident gaps in the technical infrastructure of the data holder designed to protect the data, has used the data made available for unauthorised purposes or has disclosed those data to another party without the data holder’s authorisation, shall without undue delay, unless the data holder or the user instruct otherwise:

[...]

(b) end the production, offering, placing on the market or use of goods, derivative data or services produced on the basis of knowledge obtained through such data, or the importation, export or storage of infringing goods for those purposes, and destroy any infringing goods.

3. Paragraph 2, point (b), shall not apply in either of the following cases:

(a) use of the data has not caused significant harm to the data holder;

(b) it would be disproportionate in light of the interests of the data holder."