Data from smart devices

On this page:

• Smart devices and related services
• The rights of users to the data from their smart devices
• Contractual arrangements when sharing data
• Sharing personal information and data
• Reports and our oversight
• Collaborations with other regulators
• Sources

Smart devices and related services

Smart devices collect data about their performance, usage, or environment, often with the help of sensors. They can send and receive this data over the internet or a cable. Examples of smart devices are smartphones, computers or laptops, thermostats, and watches that are connected to the internet. Modern cars, too, are usually smart devices.

Businesses are using more and more smart devices. For example, agricultural and production machines are increasingly 'smart'. Many smart devices are also used in health care and logistics.

In many cases, apps or other digital services are linked to smart devices. Such a related service can be necessary for using or operating the smart device, for example, an app to control a smart thermostat, or an app that navigates your electric car to the nearest charging point.

The rights of users to the data from their smart devices

Users of smart devices and related services are entitled to:

• clear information about what data the smart device collects, and how it uses it
• access to their data in a secure and easy manner, and free of charge
• sharing data or having data shared with third parties

Users can be individuals, businesses, or government agencies that have the right to use a smart device or related service. That means they do not necessarily need to be the owner of the smart device or related service.

Data holders have the right or obligation to use the data of users or to make that data available. Smart-device manufacturers are often data holders. However, data holders can also be other businesses, such as businesses that develop and offer related services.

Clear information about data

Sellers, rental companies, leasing companies, or suppliers must provide clear information about the data that their smart devices or related services collect. They must provide this information before the user buys, rents, or leases the smart device. Clear information enables users to make well-informed decisions.

Users of a smart device have the right to know, among other things:

• what type of data the smart device collects
• in what way the smart device collects data
• how they gain access to the collected data

Users of a related service have the right to know, among other things:

• what type of data the related service collects
• in what way the related service collects data
• how they gain access to the collected data
• for what purpose the collected data is used
• whether any other parties are able to gain access to the data

The information must be clear, comprehensible, and available in Dutch or English. If any information changes, users must receive the new information.

If you buy a smart device as a consumer, you must also get information on updates and any interactions with other services, devices, or networks (in Dutch).

Access to data

Users have the right to access data collected by the smart device or related service. This concerns all data that is directly derived from the use of smart devices or related services. The data holder can edit this data to make it accessible for users. Users do not have the right to access copyrighted data.

Access can be direct or indirect.

With direct access, the user can access the data themselves, without the help of the data holder, for example, through a web portal or an app.

If direct access is not technically possible, the data holder must provide indirect access to the data. The user must be able to request such access online in an easy manner.

Access to data must always be free of charge for users. If users can access their data, they can use it themselves, for example, by combining data from different sources. In that way, they are able to work more efficiently and save costs. For example, they are able to plan better, reduce waste, or respond to market changes sooner.

Sharing data with third parties

Users have the right to share the data from smart devices or related services with other individuals or organizations. Sharing data with such third parties can be useful for users. For example, third parties can improve their maintenance on the smart device, or give users targeted advice. Think of a mechanic that performs maintenance on an agricultural machine, or an advisor that helps a business owner with a smart thermostat consume energy more efficiently.

Users are allowed to share their own data with a third party, or they can directly ask the provider to share their data with a third party. Data holders are required to cooperate with data sharing. Only in exceptional situations are they allowed to refuse to do so, for example, if the data holder’s trade secrets become public as a result of the sharing, or if sharing compromises the safety of the product.

The data holder is not allowed to send data to certain parties, for example, to the largest providers of online services: the 'gatekeepers' (in Dutch).

If a third party receives data from a data holder, it cannot simply use that data for all kinds of purposes, either. Rules apply to such situations. For example, third parties can only use the data for the user's requested purpose. Also, they must comply with the arrangements made with the data holder. Third parties cannot share the data with other parties without the user’s explicit consent. And they cannot use the data for the production of competing products or services.

Contractual arrangements when sharing data

Users, data holders, and third parties can make contractual arrangements with each other about the sharing of data as well as about access to that data, for example, about what types of data must be shared, for what purpose third parties can use the data, or the fee that data holders can charge for sharing data.

Sharing personal information and data

If the data that has been shared also contains personal data, the rules regarding the protection of personal data also apply, such as the General Data Protection Regulation (GDPR). Any processing of personal data must have a lawful basis, for example, consent from the person to whom the data relates. The Dutch Data Protection Authority (AP) (external website) enforces compliance with these rules.

The GDPR and the Data Act exist side by side. Individuals and businesses must therefore comply with both the GDPR as well as the Data Act. If the rules of the GDPR and those of the Data Act are in conflict with each other, the GDPR always prevails. Later this year, ACM, together with the Dutch Data Protection Authority (AP), will publish more information about the relationship between the GDPR and the Data Act.

Reports and our oversight

Users can file a report (in Dutch) with us, if, for example, they do not get clear information about data from their smart devices, of if a data holder refuses to give a user access to data, or refuses to share data with another party, and they are unable to come to a solution together.

Reports help us find out what businesses do not comply with the rules, and where we need to focus our efforts.

Additionally, parties always have the opportunity to go to court.

Collaborations with other regulators

ACM and the Dutch Data Protection Authority (AP) (external website) enforce compliance with the Data Act. As data coordinator, we ensure a well-functioning collaboration with the AP.

All reports about the sharing of data from smart devices or related services go through our central reporting hub (in Dutch). If the data that the report is about also contains personal information, we will forward the report to the AP. In that case, the AP may contact you.

When dealing with international parties, we work together with regulators from other EU member states.

Sources

• Data Act (DA) (external website)
• Data sharing guidelines