*This is an AI-powered machine translation of the original text in Portuguese.

**The image used in this article was created by a generative artificial intelligence.

On 27/11/2023, the final text of the Data Act was approved by the Council of the European Union, a regulation on equitable access and use of data that had been under discussion since February 2022 when it was proposed by the European Commission. In Brazil, Federal Deputy Arlindo Chinaglia (PT) introduced, on 01/11/2023, Bill No. 234/2023 (PLP 234/23), an apparently similar proposal aimed at establishing the "General Data Empowerment Law." At first glance, PLP 234/23 seems similar to the European Data Act, as both deal with expanding access to data for data owners and users. However, an analysis of the two proposals reveals significant differences.

The main objectives of the Data Act are to promote fairness in the allocation of data value among intermediaries in the digital economy, stimulate a competitive data market, make data an accessible asset, promote data-based innovation with greater EU involvement, and facilitate the switch between data processing service providers. To achieve these goals, the Data Act establishes rules on the provision of data from holders to recipients, especially data from connected products (e.g., Internet of Things - IoT) and services to the user of the connected product or service. This is crucial since such data is usually only available to the providers of digital products or services. "User" can be an individual or legal entity—different from the concept of "personal data subject" in the General Data Protection Regulation (GDPR). The "data" referred to in the Data Act includes both personal and non-personal data, such as data generated by connected vehicles, which, under the rules of the Data Act, could be accessed by drivers and shared with insurers, for example.

Thus, the relationship between the Data Act and the GDPR is complementary, as noted by Buttaboni, Casolari, and Floridi (2023) regarding the right to data portability provided in Articles 15 and 20 of the GDPR and expanded in the Data Act. Additionally, in case of conflicts, the Data Act provides for the primacy of the GDPR.

While the Data Act establishes rights for users of products and services that generate data (e.g., the rights of users and data owners regarding the access, use, and provision of data from related products and services in Article 4, and the user's right to share data with third parties in Article 5), the regulatory focus is on competition. The Regulation even references the gatekeepers of the recently approved Digital Markets Act (DMA), restricting data sharing by third parties to this specific group of economic agents. In addition to the DMA, Buttaboni, Casolari, and Floridi (2023) demonstrate that the Data Act fits into a broader context of EU strategies regarding the digital economy, highlighting the Strategic Autonomy Doctrine introduced in 2013, which consolidated the EU's digital sovereignty goal and paved the way for the European Strategy for Data in 2020, and the Data Governance Act approved in 2022, establishing rules for the responsible use of data and aiming to promote an equitable digital environment.

On the other hand, the Brazilian Bill No. 234/2023 aims to create a "Brazilian Data Monetization Ecosystem" to "ensure the participation of data subjects in the economic results arising from the distribution, grouping, sharing, processing, or dissemination of data by data-holding institutions, data transmitters, data recipients, or data transaction initiators" (Article 4). In other words, the project aims to monetize data not only by companies like digital platforms but also by data owners. The justification for Bill No. 234/2023 explains how this idea works using the example of the dWallet tool from the DrumWave company:

"In this context, the emergence of new tools and technologies to enable the monetization of personal data, which are relatively recent and not yet widely used, developed by companies that are working to enable technological means to control the flow of personal data and measure its value. [...] The data monetization ecosystem proposed by DrumWave will allow the user to organize, authenticate, and sell their data to third parties and includes IBM as a partner that will provide Artificial Intelligence, hosting the platform on its hybrid cloud, data agents, certifiers, and 'data apps.'

[...] Thus, once the data of each person is certified, acting as a kind of registry office for these relationships, and transaction values are assigned so that everyone can turn data into financial value, the rights of each party would be contractually defined, protecting property rights and regulating this economic exploitation.

[...] Thus, several companies can act as data agents and have authorization from their customers to transact this data and remunerate these owners correctly. [...] For this purpose, the data subject will 'open an account' for data, or a 'digital wallet,' which DrumWave identifies with the name 'Personal dWallet.' The dWallet is an application that can be incorporated, as currently happens with Pix, into the applications of banks, marketplaces, electronic platforms, and other forms of data capture used by the data subject. This tool will give the person the possibility to certify the data with whom they relate, which can be other individuals, companies, or institutions" (emphasis added).

Therefore, the central point of Bill No. 234/2023 is the creation of the right to property over data, which would underlie contracts for the transfer of data use, amending the General Data Protection Law, the Civil Code, and the Consumer Code. In the LGPD and the Consumer Code, new rights related to ownership, access, and sharing of data by data subjects and consumers would be introduced, among other changes to the LGPD for the introduction of the Monetization Ecosystem. In the Civil Code, new provisions would be introduced to define data as "singular goods" and enable the right to property and contracts for the transfer of data use.

The bill does not define "data" for the purposes of the norm. However, the focus of the proposed legislation is on personal data, specified in various provisions. For example, the definition of "data collection" mentions "personal information" (Article 2, I), and property rights are guaranteed to "owners" over "personal data" (Article 4, I). The Monetization Ecosystem of Data would, a priori, only cover the sharing of different types of "personal data," listed in the subsections of Article 8, and would allow participating institutions to "include other types or sets of data in the scope of the Brazilian Data Monetization Ecosystem, provided that the principles, requirements for sharing, and other provisions of this Law are observed" (Article 8, §1). This focus on personal data is also present in the justification of the project, which aims to monetize personal data by users of internet applications and connected devices. However, the definition of "data owner" (Article 2, XVIII, of Bill No. 234/2023) includes legal entities, unlike the definition of owners of personal data in the LGPD, limited to natural persons.

Thus, the bill calls itself "pioneering," as the regime of ownership over personal data and the Data Monetization Ecosystem have no equivalents in foreign legislation. The project has common points with the European Data Act, as both aim to enable users of connected products and services to access their data and share it with third parties. However, the Data Act does so through obligations imposed on providers of products or services, ensuring the right of access and sharing to users but not ownership. Additionally, the Data Act does not aim to promote the monetization of data by users or to "promote the generation of income and individual savings through the exercise of data ownership rights by data subjects" (as desired by Article 5, IV, of Bill No. 234/2023). The European strategy focuses not on individual financial gain within the digital economy but on the economic regulation of the digital market based on data access.

[1] Council of the European Union. Data Act: Council adopts new law on fair access to and use of data. Press release. November 27, 2023. Available at: https://www.consilium.europa.eu/en/press/press-releases/2023/11/27/data-act-council-adopts-new-law-on-fair-access-to-and-use-of-data/. Accessed on December 4, 2023.

[2] "Article 2 – Definitions

[…] (12) ‘user’ means a natural or legal person that owns a connected product or to whom temporary rights to use that connected product have been contractually transferred, or that receives related services;

(13) ‘data holder’ means a natural or legal person that has the right or obligation, in accordance with this Regulation, applicable Union law or national legislation adopted in accordance with Union law, to use and make available data, including, where contractually agreed, product data or related service data which it has retrieved or generated during the provision of a related service;

(14) ‘data recipient’ means a natural or legal person, acting for purposes which are related to that person’s trade, business, craft or profession, other than the user of a connected product or related service, to whom the data holder makes data available, including a third party following a request by the user to the data holder or in accordance with a legal obligation under Union law or national legislation adopted in accordance with Union law" Data Act. Available at: https://data.consilium.europa.eu/doc/document/PE-49-2023-INIT/en/pdf. Accessed on December 4, 2023.

[3] Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Relevant text for the EEA), Art. 4 (1).

[4] Data Act (op. cit), Art. 1 (2).

[5] Cf. example cited by the Council of the European Union (op. cit.).

[6] Casolari, Federico; Buttaboni, Carlotta; Floridi, Luciano. The EU Data Act in Context: A Legal Assessment. September 26, 2023. pp. 14-16. Available at: https://ssrn.com/abstract=4584781 or http://dx.doi.org/10.2139/ssrn.4584781. Accessed on December 4, 2023.

[7] Data Act (op. cit.), Art. 1(5): "[…] Insofar as users are data subjects, the rights laid down in Chapter II of this Regulation shall complement the rights of access by data subjects and rights to data portability under Articles 15 and 20 of Regulation (EU) 2016/679. In the event of a conflict between this Regulation and Union law on the protection of personal data or privacy, or national legislation adopted in accordance with such Union law, the relevant Union or national law on the protection of personal data or privacy shall prevail."

[8] Data Act (op. cit.), Recitals (passim) and Art. 6(2)(d): "[…] The third party shall not: […] (d) make the data it receives available to an undertaking designated as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925".

Casolari, Federico; Buttaboni, Carlotta; Floridi, Luciano, op. cit., p. 14: "Recital 36 of the DA specifies that data cannot be made available to large providers designated as ‘gatekeepers’ under the Digital Markets Act. Finally, it has to be noted that the obligations flowing from Chapter II are not applicable to data generated by micro or small enterprises."

[9] Casolari, Federico; Buttaboni, Carlotta; Floridi, Luciano. Op. cit. pp. 4-12.

[10] Bill No. 234/2023, Justification, p. 27-28. Available at: https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2401133. Accessed on December 4, 2023.

[11] Bill No. 234/2023, Arts. 49 to 52 and Justification, pp. 34-37.

[12] Law No. 13,709/2018, Art. 5, V. The definition of the LGPD would not be altered, as Bill No. 234/2023 did not include the amendment of this definition among the proposed changes to the LGPD (Art. 49 of Bill No. 234/2023).

[13] Bill No. 234/2023, Justification, p. 27.