Formulation of reasoned request
1. Within 80 working days from the submission of a data access application, the Digital Services Coordinator of establishment, taking due account of the prerequisites set out in Article 8 and, where applicable, any other assessment relevant for these purposes, shall decide whether a reasoned request can be formulated and shall undertake one of the following actions:
(a)
formulate a reasoned request, submit it to the data provider and notify the principal researcher of the submission of the reasoned request;
(b)
inform the principal researcher of the reasons why the reasoned request could not be formulated.
2. Where, in duly justified cases, the Digital Services Coordinator of establishment needs additional time to formulate a reasoned request, it shall notify the principal researcher as soon as possible and shall indicate the reasons for the delay as well as a new date for undertaking the actions referred to in paragraph 1.
Prerequisites for formulating a reasoned request
The Digital Services Coordinator of establishment shall decide whether a reasoned request can be formulated taking into account the following elements:
(a)
for each applicant researcher:
(i)
a confirmation of affiliation to a research organisation as defined in Article 2, point (1), of Directive (EU) 2019/790 of the European Parliament and of the Council ( 6 ) ;
(ii)
a declaration of independence from commercial interests relevant to the specific project for which the data are requested;
(iii)
a commitment to making their research results publicly available free of charge;
(b)
information about funding supporting the research project for which the data are requested;
(c)
a description of the data requested, including format, scope and, where possible, the specific attributes, relevant metadata and data documentation, also considering the information made available pursuant to Article 6(4) of this Regulation;
(d)
information on the necessity and proportionality of the access to the data and the information on the time frames of the research for which the data are requested;
(e)
information on the identified risks in terms of confidentiality, data security and personal data protection related to the data that would be accessed, a description of the technical, legal and organisational measures that will be put in place, including, where possible, suggested access modalities, to mitigate such risks when processing the requested data;
(f)
a description of the research activities to be conducted with the requested data;
(g)
a summary of the data access application containing the following elements:
(i)
the research topic;
(ii)
the data provider from which data are requested;
(iii)
a description of the data requested, as referred to in point (c).
Access modalities
1. The Digital Services Coordinator of establishment shall determine the modalities, including the technical, legal and organisational measures, that the data provider is to use for providing access to the data to the vetted researchers.
2. The Digital Services Coordinators shall be allowed to consult the relevant supervisory authorities established pursuant to Article 51 of Regulation (EU) 2016/679.
3. When determining the access modalities, the Digital Services Coordinator of establishment shall take into account the information provided in the data access application, in particular the information referred to in Article 8, point (e), considering also the rights and interests of the data providers and the recipients of the service concerned, including the protection of confidential information, trade secrets, and maintaining the security of their service and the information made available by the data providers pursuant to Article 6(4), point (d).
4. In addition to the elements referred to in paragraph 3, the Digital Services Coordinator of establishment shall, when determining access modalities, take into account the following elements:
(a)
where the access involves the processing of personal data:
(i)
the assessment of the risks concerning processing of personal data as described in Article 8(e), including, where applicable, data protection impact assessments within the meaning of Article 35 of Regulation (EU) 2016/679;
(ii)
envisaged technical and organisational measures as submitted pursuant to Article 8(e);
(b)
relevant network security measures, encryption, access control mechanisms, backup policies, data integrity mechanisms, incident response plans;
(c)
where applicable, information on the intended storage period and the relevant data destruction plans;
(d)
any organisational measures such as internal review processes, restrictions of access rights and information sharing;
(e)
any proposed contractual clauses, such as non-disclosure agreements, data agreements and any other type of written statements, laying down possible conditions of access and processing between the principal researcher and the data provider;
(f)
existence of training on data security and protection of personal data received by the applicant researchers;
(g)
whether secure processing environments is necessary to process the data.
5. Where the Digital Services Coordinator of establishment considers that a secure processing environment is to be used to provide access to the data requested, the Digital Services Coordinator of establishment shall require documentation attesting that the operator of that environment:
(a)
specifies access conditions to the secure processing environment in order to minimise the risk of the unauthorised reading, copying, modification or removal of the data hosted in the secure processing environment;
(b)
ensures that vetted researchers have access only to data covered by the reasoned request, by means of individual and unique user identities and confidential access modes;
(c)
keeps identifiable logs of access to the secure processing environment for the period necessary to verify and audit all processing operations in that environment;
(d)
ensures that the computing power at the disposal of the vetted researchers is appropriate and sufficient for the purposes of the research project;
(e)
monitors the effectiveness of the measures listed in points (a) to (d).
Content of a reasoned request
1. A reasoned request shall contain at least the following elements:
(a)
the date by which the data provider shall give access to the data requested and the date on which such access shall be terminated;
(b)
the access modalities determined pursuant to Article 9;
(c)
the summary of the data access application referred to in Article 8 point (g).
2. The Digital Services Coordinator of establishment may include in the reasoned request the names and contact details of all vetted researchers mentioned in the data access application where this is necessary to enable access to the requested data, in accordance with the access modalities specified in the reasoned request.
3. If providing access involves a transfer of personal data to a third country or international organisation within the meaning of Chapter V of Regulation (EU) 2016/679, the reasoned request shall include information on the need to put in place or refer to an appropriate transfer mechanism to ensure compliance with Regulation (EU) 2016/679.
Publication of an overview of a reasoned request in the DSA data access portal
1. Upon formulation of a reasoned request, the Digital Services Coordinator of establishment shall publish an overview of the reasoned request in the public interface of the DSA data access portal. The overview shall contain all the following:
(a)
the summary of the data access application referred to in Article 8 point (g);
(b)
the access modalities determined pursuant to Article 9.
2. The overview referred to in paragraph 1 shall be updated to reflect any changes resulting from a modification of one or more elements following the examination of an amendment request or the outcome of a mediation in accordance with Article 13.
Procedures for examining amendment requests
1. Upon the receipt of an amendment request pursuant to Article 40(5) of Regulation (EU) 2022/2065, the Digital Services Coordinator of establishment shall inform the principal researcher concerned.
2. When deciding on an amendment request made pursuant to Article 40(5), point (a), of Regulation (EU) 2022/2065, the Digital Services Coordinator of establishment shall take into account the following:
(a)
whether the reasons for the alleged lack of access to data are duly substantiated;
(b)
whether that lack of access to data is permanent or temporary.
3. When deciding on an amendment request made pursuant to Article 40(5), point (b), of Regulation (EU) 2022/2065, the Digital Services Coordinator of establishment shall take into account all the following:
(a)
whether the alleged vulnerabilities and their significance are duly substantiated;
(b)
the likelihood and severity of harm resulting from these alleged significant vulnerabilities;
(c)
the extent to which the access modalities set out in the reasoned request effectively mitigate the risk of such harm occurring.
4. At any time during the assessment of an amendment request, the Digital Services Coordinator of establishment may ask the data provider or the principal researcher for any additional information that it considers necessary to complete its assessment.
5. Such request for additional information shall be made as soon as possible to allow the data provider or the principal researcher sufficient time to respond and, in any event, shall not affect the deadline set in Article 40(6), second subparagraph of Regulation (EU) 2022/2065. Where the data provider or the principal researcher fails to provide the requested information at all or within a period specified by the Digital Services Coordinator of establishment or provides partial information, the Digital Services Coordinator of establishment shall make its decision within the timeframe laid down in Article 40(6) of Regulation (EU) 2022/2065, based on the information that was made available to it within a reasonable delay.
Mediation
1. If the data provider disagrees with the decision of the Digital Services Coordinator of establishment on the amendment request, the data provider may, within a period of five working days from the communication by the Digital Services Coordinator of establishment pursuant to Article 40(6), second subparagraph of Regulation (EU) 2022/2065, request in writing the Digital Services Coordinator of establishment to participate in mediation.
2. The Digital Services Coordinator of establishment shall not be obliged to participate in the mediation process.
3. The written request referred to in paragraph 1, shall include a concise description of the specific elements of the decision, as communicated by the Digital Services Coordinator of establishment pursuant to Article 40(6), second subparagraph of Regulation (EU) 2022/2065, to which the data provider objects.
4. The Digital Services Coordinator of establishment and the data provider shall agree on the appointment of a mediator and initiate the mediation within 20 working days from the submission of the mediation request pursuant to paragraph 3.
5. Before agreeing to the appointment of a mediator, the Digital Services Coordinator of establishment shall verify that the mediator is impartial and independent and possesses the relevant expertise related to the subject matter as described in the written request referred to in paragraph 1.
6. The data provider shall bear all costs of the mediation.
7. The Digital Services Coordinator of establishment shall inform the principal researcher of the mediation request referred to in paragraph 1 without undue delay and may decide to invite the principal researcher to join the mediation as a party. Where the data access application has been submitted to the Digital Services Coordinator of the research organisation, the Digital Services Coordinator of establishment may invite the Digital Services Coordinator of the research organisation to participate in the mediation process. Any party invited to join the mediation by the Digital Services Coordinator of establishment shall not be obliged to participate in the mediation process.
8. Participation in mediation shall not affect the right of the parties to initiate judicial proceedings at any time before, during or after the mediation.
9. The Digital Services Coordinator of establishment shall set a time limit for the mediation, which shall not exceed 40 working days starting on the day of the initiation of the mediation pursuant to paragraph 4.
10. The mediator may terminate the mediation earlier in one of the following cases:
(a)
one of the parties requests explicitly to terminate the mediation;
(b)
it becomes clear that the conduct of the parties during the mediation, including a failure to engage in good faith, makes it unlikely that an agreement will be reached.
11. Where the mediation results in an agreement between the parties, the Digital Services Coordinator of establishment shall take such agreement into account and, where appropriate, modify the reasoned request and inform the principal researcher of the modification.
12. Where the parties fail to reach an agreement, the Digital Services Coordinator of establishment shall notify the data provider that the decision of the Digital Services Coordinator of establishment on the amendment request, as last communicated pursuant to Article 40(6), second subparagraph of Regulation (EU) 2022/2065, shall be considered valid and shall serve as the relevant basis for further steps in the process and inform the principal researcher.
13. The Digital Services Coordinator of establishment shall register in AGORA a summary record of the mediation, prepared by the mediator and signed by all parties. The record shall include the following information:
(a)
the date of the written request for mediation by the data provider;
(b)
the identities and contact details of the parties;
(c)
the start and end dates of the mediation;
(d)
the outcome of the mediation, including any agreement reached or the reason for termination of the mediation.
Independent expert consultation
1. Before formulating a reasoned request, or taking a decision on an amendment request, the Digital Services Coordinator may decide to consult experts.
2. The experts shall be independent and impartial and possess relevant expertise and proven skills and have the capacity and resources to perform the identified task, without incurring undue delay.
3. To attest impartiality, the experts shall sign a declaration confirming that they:
(a)
have no financial or personal ties to the data provider or the applicant researchers;
(b)
have no interest in the outcome of the data access process;
(c)
are free from any conflicts of interest.
4. The Digital Services Coordinator shall encode any consultation carried out pursuant to paragraph 1, along with the expert opinion received in response to the consultation, without undue delay in AGORA.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
