Article 9 — Obligation to Make Data Available to Third Parties — shared requirements from Articles 5, 8 and 9

Legal Provision

Obligation to make data available to third parties: establishes the obligation for data holders to make data available to third parties at the request of the user.

Scope

Applies to data holders.

Requirement type

Duty: when the user or representative requests the data holder to make data available to third parties, the data holder must make data available in a comprehensive, structured and machine-readable format, and when possible real time.

Actions to demonstrate compliance

A. Binary (yes/no): if these elements are present, there is evidence towards demonstrating compliance.

• Documented data-sharing procedure.
• Records of request logs.
• Documented data sharing/recipient agreement.
• Use of Model Contractual Term (MCT Annex IV).

B. Non-binary (require a contextual assessment): building on the binary actions, a contextual assessment of these points is required.

• Adequate technical capabilities to share data (e.g., API designed for external recipients, interoperability layer…).
• Contractual agreement that makes data sharing fair and compliant with regulations (see elements below).

Monitoring requirement

• Monitoring of controlled disclosure (verifying proper handling of requests).

Consequences of non-compliance

• Request to make data available.
• Fine determined by Member State.