Hacker News Reader

Comment by kuizu | Hacker News Reader

Wasn't the EU Data Act (https://digital-strategy.ec.europa.eu/en/policies/data-act) put in place to exactly prevent these kind of scenarios (Article 4 and 5)?

"where the user cannot directly access the data from the connected product or related service, the data holder must make the readily available data and necessary metadata accessible to the user without undue delay, in the same quality as available to the data holder, easily, securely, free of charge, in a structured, commonly used, machine-readable format, and continuously/in real time where relevant and technically feasible."

There is even special EU guidance for vehicle data for it: https://digital-strategy.ec.europa.eu/en/library/guidance-ve...

View on HN

Indeed, this seems to be exactly the area where the Data Act could be used to regain access. Unfortunately it seems that it's not possible to directly sue (e.g.) Volkswagen to get access, unlike the GDPR where you have direct standing under article 79 [1].

There doesn't seem to be much written about enforcing the Data Act, so I looked at the regulation directly. Article 39 [2] seems to require to first lodge a complaint with the competent authority as designated by the member state of your residence. Then when that authority invariably fails to act – I have no idea which timeframe we're talking about here – you can "in accordance with national law, either have the right to an effective judicial remedy or access to review by an impartial body with the appropriate expertise". But then you are suing that authority, and not the company directly (edit: I was originally unsure about who to sue under article 39, but 39(3) does clarify that it is the authority).

I would very much like to be wrong about this. I can imagine Muñoz vs. Superior Fruiticola applies [3] ("it must be possible to enforce that obligation by means of civil proceedings"), but I'm not at all sure, and it's a much weaker route than the one which the GDPR explicitly describes.

Would anyone know or have better references on how to enforce the Data Act, preferably individually?

[1] https://gdpr-info.eu/art-79-gdpr/

[2] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:...

[3] https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...

The hoops the EU goes through to be both a federal and also not a federal entity at the same time is crazy

Just let the EU enforce these laws like the US DOJ or FTC would. If I had to file a complaint with the Alabama FCC or the Mississippi Federal Reserve to get relief under federal regulations I would quite simply not bother

Hard pass. I think it’s fair, less corrupt, and more interesting that the Belgian DPA rules over Belgian privacy complaints.

We might argue they will produce better/worse results than another DPA. Okay. But the whole point of much EU policy is that the member states preside over stuff themselves. That seems better than a (more) centralised bureaucracy.

But the EU is incredibly bureaucratic. I'm not saying the US is perfectly functional, especially recently, but a lot of the processes involved here are incredibly Byzantine to accommodate enforcement not being at the top

Not in this case I think. This affects customers Europe wide and it should be solved at EU level.

It probably will be once all the appeals have finished.

You can't just bypass national courts and go straight to the EU.

Volkswagen has an EU Data Act site:

https://drivesomethinggreater.com/eu-data-act

Reply on news.ycombinator.com