The new EU Data Act and industrial data ownership in New Zealand

Dieter Adam 22 May, 2024

We are (still) receiving regular complaints from manufacturers who are getting barred from – or charged for – access to production data generated by machinery and equipment they have leased or own.

So, who owns production data generated by the use of manufacturing machinery and equipment? If we look at some widely-used manufacturers (Amada; DMG-Mori; Haas; Mazak; Okuma; Trumpf) and ask Claude 3 and Gemini, we get consistent answers: The machinery manufacturer owns data related to the machine itself. This includes data like machine settings, operational parameters, and diagnostic infor-mation. The user owns the data related to the production process. This includes data like toolpaths, machining programs, and production logs specific to your jobs.

That’s the ‘official’ answer. It doesn’t say anything about data formats, transfer protocols, or the use of vendor-owned software to process the data. It will be tempting for vendors to create additional income streams by ‘guiding’ users to their own proprietary software. That may (not) be ok for manu-facturers who run machinery from a single vendor across their operations, like some sheet metal manufacturers do, but the majority will have CNC machines from several vendors, for example, meaning the use of vendor-proprietary software won’t be an option.

The EU has taken the initiative and developed, and put into force in December 2023, the EU Data Act (https://www.eu-data-act.com ; https://digital-strategy.ec.europa.eu/en/policies/data-act ), which entities in the EU must comply with from September 2025.

The purpose of the act is to

(a) the making available of product data and related service data to the user of the connected product or related service;

(b) the making available of data by data holders to data recipients;

(c) the making available of data by data holders to public sector bodies, the Commission, the European Central Bank and Union bodies, where there is an exceptional need for those data for the performance of a specific task carried out in the public interest;

(d) facilitating switching between data processing services;

(e) introducing safeguards against unlawful third-party access to non-personal data; and

(f) the development of interoperability standards for data to be accessed, transferred and used.

Throughout its development, it was always emphasised that the Act will specifically include industrial (IoT) data in its application.

It will be interesting to see whether vendors will extend the practices prescribed under the Act, which of course only applies to transactions within the jurisdiction of the EU, to markets outside of the EU. I suggest it may be worth suggesting to (reluctant) local agents of international vendors that “What’s sauce for the goose is sauce for the gander” …