Re-using public-sector data: open data and high-value datasets

The legal framework

Three texts govern the re-use of public-sector data:

• the Open Data Directive, Directive (EU) 2019/1024 of 20 June 2019, in force since 16 July 2019. Member States had to transpose it by 17 July 2021 (Article 17), and it replaced the 2003 directive on public sector information from that date (Article 19). As a directive it works through national law, so your rights against a given body come from the transposing law of its country;
• Commission Implementing Regulation (EU) 2023/138 on high-value datasets, in force since 9 February 2023 and applicable since 9 June 2024 (Article 6);
• Chapter II of the Data Governance Act, Regulation (EU) 2022/868, applicable since 24 September 2023, for public data that is protected.

Who and what is covered

The directive covers existing documents held by public sector bodies: the State, regional and local authorities and bodies governed by public law. It also covers certain public undertakings (utilities, public transport operators, and air and sea carriers with public service obligations) and publicly funded research data (Article 1). "Document" means any content, whatever the medium (Article 2).

Article 1(2) excludes a long list. The main ones for business: documents outside the body's public task, documents in which third parties hold intellectual property rights, documents excluded from access for security or statistical or commercial confidentiality, documents restricted for personal data protection, logos and crests, and documents of broadcasters, most educational establishments and cultural establishments other than libraries, museums and archives. A public body may not use its database right to block or restrict re-use (Article 1(6)).

The core duties

• Re-use is the rule. Documents within scope must be re-usable for commercial or non-commercial purposes (Article 3). For public undertakings and for documents in which libraries, museums and archives hold IP rights, the rules apply only where re-use is allowed.
• Requests. Where no other time limits apply, a body answers within 20 working days, extendable by 20 more for extensive or complex requests. A refusal must give reasons and the means of redress, including review by an impartial body (Article 4).
• Formats. Documents are made available, where possible, in open, machine-readable formats with metadata. There is no duty to create or adapt documents where that is disproportionate, or to keep producing a type of document for re-users. Dynamic data must be made available right after collection, via APIs and where relevant as a bulk download (Article 5).
• Charges. Re-use is free, though marginal costs of reproduction, provision, dissemination, anonymisation and protecting confidential information may be recovered. Bodies that must generate revenue, libraries, museums, archives and public undertakings may charge more, capped at cost plus a reasonable return on investment (Article 6). That return is at most 5 percentage points above the ECB's fixed interest rate (Article 2(16)). Standard charges must be published in advance (Article 7).
• Conditions and licences. Conditions must be objective, proportionate, non-discriminatory and justified by a public interest objective, and may not be used to restrict competition (Article 8). They must be the same for comparable re-use, including cross-border, and a body that uses its own data commercially must apply the same terms to itself (Article 11).
• No exclusivity. Contracts may not grant exclusive rights. The exception, for a service in the public interest, is reviewed at least every three years and must be published online two months before it takes effect (Article 12).
• Research data that is publicly funded and already published in a repository is re-usable, including commercially (Article 10), and free (Article 6(6)).

High-value datasets

Annex I to the directive lists six thematic categories: geospatial, earth observation and environment, meteorological, statistics, companies and company ownership, and mobility (Article 13). The specific datasets must be free, machine-readable, provided via APIs and, where relevant, as a bulk download (Article 14). Member States could exempt revenue-dependent bodies from the free-of-charge rule for at most two years after the implementing act entered into force (Article 14(5)).

The implementing regulation fills in the details for datasets held by public sector bodies. Bodies must offer the datasets via APIs that match re-users' reasonable needs, publish API terms of use and quality-of-service criteria, document the API, name a point of contact and label the datasets as high-value in their metadata (Article 3). The licence is CC0 or CC BY 4.0, or an equivalent or less restrictive open licence, and attribution may be required. The rules also cover machine-readable datasets created before 9 June 2024, and any exemption must be published online (Article 4).

The Annex lists the datasets per category. For companies, for example, it covers basic company information (name, status, registration date, registered office, legal form, registration number, Member State and activity) and company documents and accounts, under CC BY 4.0 or a less restrictive licence, with extra conditions on personal data where relevant.

Protected data: Chapter II of the DGA

Data that the directive excludes because of commercial or statistical confidentiality, third-party IP or personal data can sometimes still be re-used under the DGA (Article 3). Nothing obliges the body to allow it (Article 1(2)). Where it does:

• exclusive arrangements are banned, except for a general-interest service and then for at most 12 months (Article 4);
• the body may require anonymisation or modification first, or access only in a secure processing environment, and may check results and block those that endanger third parties' rights. Re-users must keep the information confidential, may not re-identify anyone, and must announce any plan to transfer non-personal data to a third country (Article 5);
• fees are cost-based, with discounts or free access possible for SMEs, start-ups, civil society and education (Article 6);
• each Member State runs a single information point with a searchable asset list (Article 8);
• a decision follows within two months, extendable by 30 days, with a right of redress (Article 9).

In practice

A Belgian proptech start-up wants to show parcel boundaries and building footprints in its valuation app. Cadastral parcels and buildings are geospatial high-value datasets. It finds them through the metadata label, reads the API terms and quality-of-service criteria, and checks the licence. The Annex sets CC BY 4.0 or a less restrictive licence for these datasets; under CC BY 4.0 it must credit the source in the app. It writes the attribution and the API's availability limits into its own customer terms, so it does not promise more than the source delivers.

A compliance start-up builds a supplier-screening tool on company register data. The basic company information is a high-value dataset, but as soon as the tool also shows directors or shareholders who are individuals, it handles personal data. The Annex allows extra conditions on personal data, and the GDPR applies in full, so the start-up documents its legal basis and retention before it scales.

A mobility app asks a public transport operator for real-time vehicle positions. The operator is a public undertaking: it is not obliged to allow re-use, and if it does, it may charge above marginal cost. The app's best argument is non-discrimination: if the operator already gives the feed to one app, it must offer comparable terms to others.

A municipality offers a start-up exclusive access to its parking sensor data. Under Article 12 the municipality cannot grant that unless the exclusivity is necessary for a service in the public interest, and even then it must publish the deal online two months in advance. A non-exclusive licence is the safer deal.

A research spin-off needs detailed data a regional agency holds under statistical confidentiality. The route is a DGA request via the single information point. It should expect a secure processing environment and checks on its results, and plan its project timeline around the two-month decision period.

Frequently asked questions

Can a public body charge us for data?

For most data, only marginal costs. Bodies that must earn revenue, libraries, museums, archives and public undertakings may charge up to cost plus a reasonable return. High-value datasets and published research data are free.

Can we use open data to train an AI model?

Usually, if the licence allows unrestricted re-use, as CC0 and CC BY 4.0 do. Personal data still needs a GDPR basis, and third-party IP is outside the directive. See data for AI.

Must a body create a dataset for us?

No. There is no duty to create or adapt documents where that is disproportionate, or to keep producing them (Article 5(3) and (4)).

What if our request is refused?

The refusal must give reasons and name the means of redress, which includes review by an impartial body (Article 4(3) and (4)). Ask whether the DGA route applies if the data is protected.

How this connects

Public data often ends up inside a commercial product, so the open licence, the API terms and your own customer contracts have to fit together. We help through data licensing and sharing and data and database rights protection. We draft your customer terms in our Document Studio, and test a body's re-use licence or a data partner's terms clause by clause with Contract Review.

At a glance

Provisions cited

• Directive (EU) 2019/1024: Articles 1 to 8, 10 to 14, 17 and 19, Annex I
• Implementing Regulation (EU) 2023/138: Articles 3, 4 and 6, Annex
• Regulation (EU) 2022/868: Articles 1, 3 to 6, 8 and 9

Key dates

• 16-07-2019: Open Data Directive in force
• 17-07-2021: transposition deadline
• 09-02-2023: high-value datasets regulation in force
• 24-09-2023: DGA applies
• 09-06-2024: high-value datasets regulation applies

In this series

• The Data Governance Act: data intermediaries and data altruism
• Data for AI: data spaces and licensing training data

Related reading

• The EU Data Act
• Database rights and trade secrets