Article 12 — Conditions for Providing Data Intermediation Services

Legal Provision

Conditions for providing data intermediation services: establishes the requirements around data intermediation services.

Scope

Applies to data intermediary services.

Requirement type

Duty: data intermediation services must operate in a neutral, transparent, secure, and fair manner when facilitating data sharing between parties.

Actions to demonstrate compliance

A. Binary (yes/no): if these elements are present, there is evidence towards demonstrating compliance.

• Separation of data intermediation activities from other business activities through a separate legal entity, in order to maintain the privacy of the data that is processed within the scope of data intermediation services.
• Policy prohibiting use of shared data for purposes other than intermediation.
• The existence of documented pricing and commercial terms.
• The existence of procedures ensuring fair and non-discriminatory access to services.
• The existence of fraud and abuse prevention procedures.
• The existence of consent and permission management tools, including withdrawal mechanisms
• Mechanisms set in place continuity of service and data access in case of insolvency.
• Maintenance of log records for data intermediation activities.
• Security measures for storage, processing, and transmission of data.
• Interoperability measures and use of recognised/open standards where appropriate.

B. Non-binary (require a contextual assessment): building on the binary actions, a contextual assessment of these points is required.

• Fairness and neutrality (non-discrimination) of the provider’s operations and commercial practices.
• Adequacy of security, confidentiality, and access control measures.
• Effectiveness of fraud prevention and misuse detection mechanisms.
• Effectiveness and completeness of logging and monitoring practices.
• Adequacy of business continuity and insolvency arrangements.
• Effectiveness of interoperability and data portability arrangements.

Monitoring requirement

• Monitoring of the effectivity of the framework (e.g., security, transparency, and fairness).

Consequences of non-compliance

• Penalty determined by Member State.