Personal and non-personal data: the big picture

07/04/2021
Eleonora Lenzi
Ilaria Nanni

The significant and fast-paced process of digitisation that has long characterised the world economy has led the European Union in recent years to consider and consequently implement legislative measures focused on the implementation of a European data policy.

In fact, the spread of Cloud Computing services, the Internet of Things, and the design of Artificial Intelligence systems have prompted the European legislator to draw up a set of rules that have to confront and adapt to the digital era daily, while always trying to keep up with technological progress as far as possible.

The development of innovative structures has enabled the creation of the “digital economy”, which necessarily intersects with the issue of data flows and the related processing and circulation of personal and non-personal data.

Technological innovation, “nurtured” by an enormous mass of personal and non-personal data, needs for its development the free movement of data within the territory of the European Union, without obstacles being placed in the way of their storage, import/export, and this in order to allow a smoother transition between infrastructures and cloud services.

In recent years, the European Commission has thus focused its legislative intervention on the need to ensure the free movement of data between the Member States.

Study, consultation, and in-depth work by the European Commission made possible two important regulations, the first (well known) in 2016 on personal data, the second (less well known but no less important) on non-personal data:

  • Regulation (EU) 2016/679 (GDPR) on the protection of individuals concerning the processing of personal data and on the free movement of such data, which repealed the previous Data Protection Directive 95/46/EC;
  • Regulation (EU) 2018/1807 on the framework applicable to the free movement of non-personal data in the European Union, which applies from 28 May 2019.

As highlighted in the Communication from the Commission to the European Parliament and the Council of 25/05/2019 “thanks to the two regulations, data can freely circulate between member states, enabling users of data processing services to use the data collected in different EU markets to improve their productivity and competitiveness”.

It is particularly important to look in depth at issues relating to non-personal data, their regulation at the European level, and the consequent repercussions in the “data economy”, such as the regulation of the relationship between the cloud service provider and customer, the security certification of services, or the organised collection of data in databases, with a focus on free movement, the contractual forms that can be used and thus the possibilities of exploitation at the economic level.