EU Data Act B2G Exceptional Need Requests

A Data Act B2G request starts with Article 14: the requester must demonstrate an exceptional need for certain data, including metadata needed to interpret and use it, to carry out statutory duties in the public interest. The data holder must be a legal person other than a public sector body and must hold the requested data.

Article 15 limits exceptional need to two routes. The first is data necessary to respond to a public emergency when the requester cannot obtain it by alternative means in a timely and effective way under equivalent conditions. The second is a non-emergency route for non-personal data only, where a legally assigned public-interest task cannot be fulfilled without specific data and the requester has exhausted other means, including market purchase where available. That non-emergency route does not apply to microenterprises or small enterprises.

A public emergency must be an officially determined or declared exceptional situation that is limited in time and risks serious, lasting effects on living conditions, stability, or economic assets. Article 2 examples include a public-health emergency, a natural disaster, a human-induced major disaster, and a major cybersecurity incident; an event label alone does not satisfy the Article 15 necessity and alternative-means test.

Chapter V does not replace reporting duties, access-to-information rules, or powers used to demonstrate or verify compliance under other Union or national law. A requester should use the legal route that actually grants the power instead of relabelling an existing obligation as exceptional need.

Chapter V also does not apply when public bodies, the Commission, the European Central Bank, or Union bodies act to prevent, investigate, detect, or prosecute criminal or administrative offences, execute criminal penalties, or administer customs or taxation. Those activities remain governed by their own Union and national laws.

Article 17 makes the request itself the control point. It must identify the data required, the metadata needed to interpret it, the exceptional need, the purpose and intended use, the expected duration of use, the data holder chosen, any onward recipients, the legal provision assigning the public task, and the deadlines for both delivery and any decline or modification response.

The request must be written in clear, concise, plain language. It must be specific about data type, correspond to data the holder controls at the time of the request, and be proportionate in granularity, volume, and frequency. It must also address trade secrets, cost and effort, penalties for non-compliance, publication by the relevant data coordinator or EU body, and supervisory-authority notice where personal data is requested.

For a request directed to a data holder established in another Member State, Article 22 requires the requester to notify the competent authority in that Member State first. That authority examines the request and either transmits it to the data holder, with coordination advice where needed, or rejects it on substantiated Chapter V grounds.

For public emergency response, the request should seek non-personal data first. Personal data may be requested only if non-personal data is shown to be insufficient for the emergency need, and the request must specify necessary and proportionate technical and organisational measures, including pseudonymisation and whether anonymisation can be applied before disclosure.

For non-emergency exceptional need, Chapter V is limited to non-personal data. The request should therefore be narrowed to the specific data and metadata needed for the public-interest task, with unsuitable fields removed before extraction.

Article 18 requires the data holder to make data available without undue delay, taking account of technical, organisational, and legal measures. It also gives a controlled route to decline or seek modification where the holder does not control the data, a similar same-purpose request is already outstanding without erasure notice, or the request does not meet Article 17 requirements.

The response window is shorter for public emergencies: a decline or modification request must be made without undue delay and no later than five working days after receipt. For other exceptional-need requests, the outer limit is 30 working days. If the matter cannot be resolved by modification, either side may refer it to the competent authority in the Member State where the data holder is established.

Data received under Chapter V does not become open public-sector information. Article 17 bars reuse under the Data Governance Act and Open Data Directive frameworks, and Article 19 limits use to the purpose stated in the request. The receiving body must protect confidentiality, integrity, transfer security, personal data rights, and trade secrets.

Trade secrets may be disclosed only to the extent strictly necessary for the Article 15 purpose. The data holder or trade secret holder should identify protected data, including relevant metadata. Before disclosure, the public body or EU body must take necessary and appropriate technical and organisational measures to preserve confidentiality.

For public emergency response, Article 20 requires data holders other than microenterprises and small enterprises to provide the necessary data free of charge, with public acknowledgement if requested. A microenterprise or small enterprise responding to an emergency request may claim fair compensation under the Article 20(2) calculation: technical and organisational costs, including specified transformation costs, plus a reasonable margin.

For non-emergency exceptional-need requests under Article 15(1)(b), the data holder is entitled to the same fair-compensation calculation. However, Article 15(2) excludes microenterprises and small enterprises from that non-emergency request route. No compensation is due for an official-statistics task where national law does not allow purchase of the data.

The response file should close the loop. Article 19 requires the public body or EU body to erase data once it is no longer necessary for the stated purpose and to inform the data holder and onward recipients without undue delay, unless archiving is required under public-access-to-documents law.

Onward sharing is possible only within Chapter V limits. Article 21 allows sharing for compatible scientific research or analytics, or with national statistical institutes and Eurostat for official statistics. The data holder must be notified of onward sharing, including recipient identity, purpose, use period, and protection measures. Research or statistical recipients must follow the same core obligations and may keep the data for up to six months after the original recipient erases it.