How the EU Data Act Shifts Control Back to Users

The EU Data Act is now in its second phase of implementation, shifting the balance of power by granting users rights over the data generated by their connected devices and services. Beyond banning unfair contract terms and eliminating vendor lock-in, the act mandates data portability and ensures fair access – unlocking data once trapped in silos, said Shaun Hurst, principal regulatory advisor at Smarsh.

See Also: Flip the Security Model for Regulated Data Protection

“For us, it’s about ensuring our financial services clients can meet their compliance obligations while maintaining full control of their communications data. It will be interesting to see how the EU Data Act impacts not only us, but also our competitors,” Hurst said.

The Data Act is far broader than existing regulations such as the General Data Protection Regulation, as it applies to all data – personal or not – generated by connected products and services, he said.

“GDPR builds the walls to protect your data, and the EU Data Act is building doors so you can actually use it,” he said.

In this video interview with Information Security Media Group, Hurst also discussed:

• Data processing requirements under the regulation;
• How the EU Data Act could fuel AI innovation abroad;
• Key differences from privacy rules such as GDPR and the Transatlantic Data Privacy Framework.

With over 20 years of experience helping financial services institutions address complex IT challenges, Hurst is a recognized subject matter expert in regulatory requirements, data privacy, eDiscovery, compliance and cloud computing. His 15 years at one of the largest American banks gives him unique insight into the regulatory and operational hurdles facing today’s financial firms.