The European Parliament and Council of the EU have reached a provisional agreement on a new Data Act that aims to regulate how consumer and corporate data can be used and accessed in the bloc. The agreement was welcomed by EU industry chief Thierry Breton, who called it a “milestone in reshaping the digital space” that will create “a thriving [EU] data economy that is innovative & open — on our conditions.”

In short, the legislation aims to give end users in the EU more control over the data generated when using connected devices, Reuters notes. As a press release from the European Commission (which proposed the act last year) explains, this includes letting users access the data generated by smart objects, machines, and devices, and share it with outside parties if they so choose. 

The preliminary agreement includes new freedoms to move data between different cloud providers, measures to promote development of interoperability standards, and rules to give public sector bodies the ability to access and use data to, for example, deal with public emergencies. On the flip side, there are also safeguards that attempt to prevent unlawful data transfers. 

But there have been fears that the Data Act’s attempt to compel companies to share data could result in the leaking of trade secrets, Reuters notes, resulting in measures being added to the legislation to allow companies to decline data sharing requests if they could face “serious and irreparable economic losses” as a result. 

The Data Act has been described as the “final, and potentially most important” part of the European Union’s so-called digital transformation. It’s one of five pieces of legislation that aim to overhaul the bloc’s digital rules alongside the Digital Markets Act, Digital Services Act, Artificial Intelligence Act, and the related, yet distinct, Data Governance Act.

Following the provisional agreement reached this week, the Data Act will now need to be formally approved by both the Council and the European Parliament before becoming law. Companies will then have to abide by its rules roughly 20 months later, meaning it’s likely to be a couple of years before the Data Act’s measures come into effect.