Statement 4/2025 on the European Commission’s Recommendation on draft non-binding model contractual terms on data sharing under the Data Act

1 Adopted Statement 4 /2025 on the European Commission’s Recommendation on draft non - binding model contractual terms on data sharing under the Data Act (version of 22 May 2025) Adopted on 8 July 2025 The European Data Protection Board has adopted the following statement: The European Commission has shared the draft non - binding model contractual terms on data sharing (‘MCTs’) and non - binding standard contractual clauses for cloud computing contracts pursuant to Article 41 of the Data Act with the EDPB, and has presented the m to the EDPB CEH expert subgroup on 27 May 2025. Considering the close link between data access and sharing under the Data Act and the GDPR, insofar as personal data is concerned, the EDPB has reviewed the MCTs and wishes to provide a number of general co mments to the Commission. The EDPB remains available to provide further advice if needed and highlights that this do cument only relates to the MCTs . Moreover, the general comments provided in this document are without prejudice to further observations that the EDPB may provide in the future on the interplay between the Data Act and the Union legislation on the protection of personal data, privacy and confidentiality of communications and integrity of terminal equipment. Context The EDPB notes that the process of developing the MCTs began in 2022. On 27 May 2025, the CEH expert subgroup was informed by the Commission that a swift feedback would be welcomed, considering the Commission’s timeline for their recommendation . Given the complexity of the subject matter and the limited timeframe for feedback, the comments of the EDPB are non - exhaustive and high - level in nature. General comments The EDPB would like to bring the following general comments to the attention of the Commission: 2 Adopted • The EDPB notes that the MCTs appear to have been written for contracting parties with a different standing , since ‘users’ , within the scope of the Data Act 1 , may be a legal person, or a natural person. In case a user is a natural person, it may or may not qualify as a data subject under data protection legislation. In addition, even in case the ‘user’ may qualify as a data subject under data protection legislation, personal data of other natural persons may also be involved 2 . In some instances, the current formulation of the MCTs focuses on interactions between legal persons, which raises concerns about whether the implications for natural persons have been fully considered. In other instances, the persons to whom the terms a pply are not always clearly identified. The EDPB recommends clarifying this further and to also consider whether it might be useful to develop different MCTs depending on whether the user is or is not the data subject. • The EDPB notes that certain terms make a clear distinction between personal data and non - personal data, while others do not. For the terms where such distinction is not made, the EDPB recommends reviewing whether such distinction would support contracting parties to determine the applicable legal framework. For example, the EDPB notes in particular the terms on compensation in Annexes II and III, which are formulated very generally in their current wording and may lead to questions on their scope. The EDPB strongly recommends that the Commission restrict s compensation mechanisms in the annexes II and III to the use o f non - personal data, in accordance with Articles 4(13) Data Act 3 . • The MCTs would benefit from improved clarity and structure. Including a section on definitions would make it easier to understand the MCTs, in particular for notions like ‘consumption data’ . Moreover, the c ross - referencing to relevant provisions in the Data Act and GDPR in the information boxes is recommended to ensure legal coherence. • The EDPB recalls that pursuant to Article 1(5) Data Act, the Data Act is without prejudice to the Union and national law on the protection of personal data, privacy and confidentiality of communications and integrity of terminal equipment, in particular Re gulations (EU) 2016/679 and (EU) 2018/1725 and Directive 2002/58/EC. In the event of a conflict between the Data Act and Union law on the protection of personal data or privacy, or national legislation adopted in accordance with such Union law, the relevan t Union or national law on the protection of personal data or privacy shall prevail. Therefore, the EDPB recommends making this more explicit in the MCTs clarifying that such laws shall prevail over the contractual terms in case of conflict. 1 Article 2(12) Data Act. 2 For instance, in case of connected home equipment used by different family members. 3 See also EDPB - EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) , adopted on 4 May 2022, paras. 15, 59 and 63. As the EDPB stated in several occasions, lastly in the Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms, adopted on 17 April 2024 (executive summary, paras. 130 and 180), personal data cannot be considered as a tradeable commodity. 3 Adopted • The EDPB considers that it should be clearly stated in the information boxes to the MCTs that insofar personal data is concerned, compliance with the MCTs alone does not necessarily result in compliance with the GDPR. Parties may need to implement additional measures to fully mee t data protection requirements. Specific examples where additional measures may be necessary in addition to the MCTs are the terms on the right of the user to access product data and related service data, the right of the user to sh are data with third parties, the need for GDPR compliance by a data holder and data recipient when they process personal data of the user (e.g. the terms must not presume the existence of a legal basis for processing personal data, particularly consent ) , or use of data by the user that is not a data subject. Moreover, the EDPB recalls that the GDPR in some circumstances requires parties to conclude a contract, e.g. in case of a transfer of personal data to a third country or an international organisation, s tandard data protection clauses pursuant to Article 46(2)(d) GDPR may be used as appropriate safeguards. Such standard data protection clauses would need to be concluded in addition to the MCTs . • T he MCTs should better tak e into consideration consumer vulnerability and the power asymmetries , which emerge in the digital economy . Finally, contractual p enalties should be proportionate and must not infringe on the rights of data subjects. For the European Data Protection Board The Chair ( Anu Talus )