The open data of semi-public bodies

High-Value Datasets must already be available now

A stubborn legal misconception prevails in the Netherlands. Many semi-public institutions and privatised public services believe that they do not have to make any data available, because they do not fall under the Dutch Open Government Act (Wet open overheid, Woo). The legal reality is different. The European Implementing Regulation↗ on High-Value Datasets (HVD) has direct effect. This follows from the fact that it is a regulation, and it is moreover expressly confirmed in the Digital Omnibus (which will, among other things, make some adjustments to the GDPR). The data doors must therefore be opened, and opened now. The EU prescribes this in the interests of science, innovation and economic growth. The message from Brussels is crystal clear: six categories of ‘high-value datasets’ must be made available free of charge, in machine-readable form, in bulk and via APIs. For tech companies, scientists and innovative entrepreneurs this is a gold mine. For the organisations that manage the data, it is an acute compliance obligation.

Who is obliged to supply data?

The answer to this is broader than you think. Many organisations look at their legal form (a B.V. or a foundation) and assume that the open data obligations do not rest on them, because under the Dutch definition they are not government. But the European Union applies a far broader definition (as appears from, among others, the Farrell↗ judgment of the European Court of Justice). Does your organisation carry out a statutory task in the general interest? Do you have special powers, or are you subject to government supervision? Then, for the purposes of these European rules, you are in substance ‘the State’. It is the same definition as in procurement law. Are you in principle subject to the procurement obligation↗? Then you are also obliged to make data available for useful reuse. In the Netherlands this means that the following sectors must already now comply with the directly applicable duty to open up data:

• Grid operators and drinking water companies (such as TenneT, Enexis, Vitens)
• Transport operators holding a concession and infrastructure managers (such as NS, Arriva, Schiphol)
• Health insurers (which implement the mandatory Health Insurance Act (Zorgverzekeringswet, Zvw) and Long-Term Care Act (Wet langdurige zorg, Wlz))
• Private-law independent administrative bodies (ZBOs) and conformity assessment bodies (such as the CBR, the Dutch driving licence authority, or NEN, the Dutch standardisation institute)
• Housing associations (with their statutory social housing task)
• Educational and research institutions (such as private universities (bijzondere universiteiten) and TNO)

Which data must be released, and how?

The Implementing Regulation specifies six categories of high-value datasets: Companies and Company Ownership, Geospatial, Mobility, Meteorological, Earth Observation/Environment and Statistics. This is not a non-committal wish list, but a hard delineation. Think of basic registers of companies, detailed geographical parcels, up-to-date infrastructure and transport networks, and fine-grained economic indicators. All of these data must be made available to those who can usefully reuse them, free of charge, in machine-readable form, in bulk and via APIs. That last point in particular is crucial. It means the definitive end of unsearchable PDF documents or sluggish WOB/Woo requests in which data are supplied in an unusable format. ‘Machine-readable’ and ‘via APIs’ means that the data systems of these (semi-)public bodies must be opened up for seamless, automated integration by external parties. Innovators must be able to plug the data flows directly and in real time into their own software. The mandatory ‘bulk downloads’ moreover enable companies to pull in complete, historical datasets in one go; an absolute requirement for training AI models or carrying out large-scale market analyses.

Who will be interested in these data?

These are examples of parties that can claim these data for useful reuse, once the penny drops that this is legally possible:

Fintech, RegTech & LegalTech

• The Data: Basic company data, articles of association and ownership structures (KvK/Kadaster, the Chamber of Commerce and the Land Registry).

• The Use Case: Drastically reducing the cost of statutory Know Your Customer (KYC) checks, automated due diligence and credit risk analyses.

  Mobility as a Service (MaaS) & Logistics

• The Data: Transport networks, inland waterways, real-time infrastructure data.

• The Use Case: Route planners, transport companies and rapid delivery services that plug their systems directly into the government’s networks for optimal, congestion-free routing and efficient last-mile delivery.

  PropTech & the sustainability sector

• The Data: Geospatial data, reference addresses, parcels and environmental data.

• The Use Case: Property developers, installers (solar panels/heat pumps) and investors who want to know exactly where grid congestion occurs, how land use is structured and which housing blocks are due for renovation.

  InsurTech, Energy Trading & AgriTech

• The Data: Meteorological data (KNMI, the Dutch national weather service), climate, emissions and earth observation.

• The Use Case: Insurers predicting damage risks from climate change, high-frequency traders calculating the output of wind farms, and start-ups in precision agriculture.

  HealthTech & Patient Platforms

• The Data: Aggregated statistics and healthcare data (from insurers and CBS, Statistics Netherlands, among others).

• The Use Case: Start-ups building and benchmarking healthcare solutions, or platforms that provide insight into waiting times and treatment costs in order to make the market more transparent.

So these are considerable volumes of data, including personal data.

But surely that is impossible because of privacy (GDPR)?

That is impossible because of privacy, you may think, but that is incorrect. Personal data too may in principle be claimed, provided that the request is in line with the GDPR. It is a familiar reflex on the part of data holders to use privacy legislation as an absolute shield, but the GDPR is not a blanket prohibition on data sharing; it is an assessment framework. This means that one must be able to rely on Article 6(1)(f) of the GDPR. That provision permits data processing on the basis of a ‘legitimate interest’. As a data recipient or innovator you can argue that your commercial, scientific or societal interest in reusing the data outweighs the interference with the privacy of the data subjects. This of course requires a careful balancing of interests and the right safeguards, such as data minimisation, pseudonymisation or a strict purpose limitation in your software. But the essence is this: a (semi-)public body may not simply brush aside a request for open data with a generic appeal to the GDPR. It is obliged to assess seriously whether the data application can and must go ahead, subject to the appropriate privacy safeguards.

Action is required on three sides of the table

• Are you a data holder (semi-public body)? Do not wait for an amendment to Dutch legislation. The Regulation has direct effect. Failing to offer these datasets on time, failing to offer them in machine-readable form, or offering them against payment leaves you vulnerable to legal claims from commercial parties who know their rights.
• Are you a data recipient (innovator)? You may still be paying high licence fees to intermediaries or public bodies for datasets that, under European law, you are entitled to claim free of charge and via open APIs.
• Are you a public authority? Then you will have to get to work helping the semi-public sector with all of this. Not only will assistance be needed in actually making the data available, but arrangements will also have to be made as to where an administrative-law objection can be lodged against a refusal.

Would you like to know whether your organisation is obliged to make data available, or do you want, as an innovator, to enforce your right to free data? Contact me for strategic advice and to sharpen the legal definition of your data position.