Regelverk för datadelning inom citylogistik: nulägesanalys

Almost all data sharing regulations have origins from the EU. At EU level, three trends can be identified for data sharing. The first trend is that data sharing more and more is regulated by legislation. Current regulations are being amended and many new regulations are underway within the EU. Data sharing legislations are thus in an expansive phase. There are also many reasons why the EU believes that a certain regulatory framework is needed, such as: • Information security: Historically, information security has generated a large amount of activity in the field of regulatory framework. This includes, for example, cyber security and preventing data breaches. • Human health: Human health is also a reason to regulate data sharing. Examples of regulations in this area are the GDPR and sharing of sensitive personal data. • Consumer protection: There are also regulations aimed at strengthening consumer protection and ensuring that, for example, digital services are safe for consumers to share data in. • A free and efficient internal market: For the EU, it is important to create an internal market for data sharing. Many regulations are aimed at ensuring that SMEs can compete with large companies. Example of legislation in this area is the Platform Regulation. • Increased innovation power: For the EU, it is also important to increase innovation capacity in the internal market. One way is to protect innovations through, for example, copyright and trade secrets rules. • Increased transparency and trust: To create an internal market, people and companies also need to feel safe sharing data. Example of legislation within this area is the proposed Data Governance Act. • Fundamental rights and freedoms: Finally, the EU is reassessing in many regulatory frameworks in terms of respect of fundamental human rights and freedoms. Examples of regulations in this area are the GDPR and the e-Privacy regulation. The EU is also working on developing a code on this theme. The code shall guide the future work on the develop of new legislation. The second trend is for the EU to encourage industry organizations to develop voluntary rules on data sharing (code of conduct) to accelerate the creation of an internal market for data sharing. An example of this is the Code of Conduct for sharing agricultural data in agreements. The Free Flow of non-personal data regulation would also like to see industry organizations develop principles for data sharing. The third trend is that the EU would like to see us all make more data publicly available or that we donate data, both from authorities and individuals (open data and altruism). Examples of this are the Open Data Directive and the forthcoming Data Governance Act. In this lies a conflict of interest between information security and open data that is not easy to solve. The challenge lies in the fact that each individual dataset itself does not have to reveal anything sensitive. However, if many datasets are added together, aggregated data can reveal too much. The EU is also interested in data sharing for certain sectors, of which vehicles and mobility is an area that is becoming more and more regulated in terms of data sharing. Here, a lot of new regulations are expected that will have a major impact on the sector, both in terms of vehicle development but also in terms of the development of new business models. The trend is towards vehicle manufacturers being increasingly forced to share data with authorities. When it comes to logistics, the pressure from new legislation about data sharing is not as clear. The existing legislation is more about the safe distribution of goods in a crisis or regarding sharing data from certain goods e.g., tobacco. What problems does the EU address in its mobility and vehicle regulations? • Human health: Compared to the general regulatory framework, there is a clear emphasis on human health and data sharing in the regulations. It is both about data sharing related to air quality but also road safety. • Consumer protection: There are also regulations aimed at strengthening consumer protection, e.g., for manufacturers to inform consumers about how much exhaust fumes a particular vehicle emits so that the consumer can make an informed choice based on this aspect between different manufacturers. • A free functioning efficient internal market: Examples of legislation in this area are the access of independent branded workshops to data from connected vehicles to increase competition. At EU level, there are several regulatory frameworks in the pipeline that will have a major impact on what we want to explore in our project. In the HITS2024 project, we want to explore and test efficient city logistics based on different vehicle concepts and logistics solutions. At EU level, a forthcoming e-Privacy Regulation is being discussed. The regulation will dictate how data from vehicles is allowed to be transfer to a cloud solution i.e., the connection as such. The e-Privacy Regulation is closely related to the GDPR, but there are also differences between these regulations. The GDPR accepts consent and balancing of interests to collect personal data while the e-Privacy Regulation only accepts consent (at the time of writing). The challenge for the automotive industry, for example, is that an autonomous vehicle can only collect personal data based on balancing interests because it is not doable to work with consent. However, if the e-Privacy Regulation in its current state is approved, the data will not be allowed to leave the vehicle because there is no consent. Another challenge is the upcoming AI Act. The AI Act distinguishes between technologies that already have an international regulatory framework for, e.g., type approval of a truck and technology where only the EU regulates the issue, e.g., machines. But a vehicle consists of many different “parts” and not all parts are type approved. How do you fit different technologies and different legislation together in an autonomous truck? In the logistics area, the upcoming Data Act can be of great importance as it will be about data sharing between companies. Until now, coordination between different data regulations has not always been optimal. The same phenomenon has been regulated in different regulations. There is a risk that different regulations in the future will find it difficult to co-exist with each other. How will, for example, GDPR, e-Privacy regulation and Data Act work together in a vehicle and logistics context? Developments in this area need to be followed