Apidays London 2024 - The Hidden Power Brokers in the EU Data Act Enforcement by David Vazquez Cortizo, apinity.pdf

APIs: The Hidden Power Brokers in the EU Data Act Enforcement
Dr. David Vazquez Cortizo, Managing Director & CTO - apinity

apidays London 2024 - APIs for Smarter Platforms and Business Processes
September 18 & 19, 2024

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

1. APIs - The hidden power brokers in
the EU Data Act enforcement
David Vazquez Cortizo
Managing Director @apinity.io

2. Agenda
●Intro to EU Data Access regulation
●Implications for the impacted actors
●Technical readiness journey
●Summary

3. 3
EU Broader context of data access regulation

4. 4
EU Data Act due in Sep 2025

The EU Data Act is a regulation on harmonised
rules on fair access to and use of data. Designed
to enhance the EU’s data economy and foster a
competitive data market (in particular for the IoT
industry), it clarifies who can use what data and
under which conditions.

The Data Act gives users of connected products
(businesses or individuals that own, lease or rent
such a product) greater control over the data they
generate, while maintaining incentives for those
who invest in data technologies. It also lays down
general conditions for situations where a business
has a legal obligation to share data with another
business.

5. 5
EU Data Act due in Sep 2025

Chapter II on business-to-business and business-to-consumer data sharing in the context of IoT:
users of IoT objects can access, use and port data that they co-generate through their use of a
connected product.

Chapter III on business-to-business data sharing: this clarifies the data-sharing conditions
wherever a business is obliged by law, including through the Data Act, to share data with another
business.

Chapter V on business-to-government data sharing: public sector bodies will be able to make
more evidence-based decisions in certain situations of exceptional need through measures to
access certain data held by the private sector.
https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained

6. 6
Implications on the affected industries and players

Data holders (e.g. your connected car company) is
obliged to grant users access to generated data
-> includes non personal data

Users are entitled to share their data with third
parties for predefined purposes
-> direct competition purposes excluded

Data holders are obliged to make data accessible to
third parties under “reasonable terms”
-> Reasonable compensation must be agreed upon

Data holders must provide “necessary data” access
to public authorities
-> Free of charge in case of public emergencies

7. 7
Implementing EU Data Act / FIDA technical readiness
Only mandated in FIDA
Not spoken of in the EU Data Act

8. 1.Prepare Your Systems & Data
Identify which core product data needs to be exposed & prepare core system
2.Expose APIs to the outside - securely at scale
APIs must be exposed securely - Authorization is controlled by user consent
Large and very dynamic number of consumers supported
3.Build Customer Dashboards
Expand data model to support customer consent dashboards
Implement customer consent dashboard application(s)
4.Verify and upgrade your IAM
Verify capabilities of your Identity and Access Management (IAM) - OIDC
5.Integrate & Validate
Integration and validation of end2end use cases
Monetize your APIs
API Monetization readiness
EU Data Act / FIDA Readiness in a nutshell

1
5
2
3
4
6

9. 9
Technical readiness for EU Data Act / FIDA as Data Holder
／Identify product data that has to be exposed
#There will be a certain amount of uncertainty that has to be managed
#Amount of uncertainty should not be used as an excuse for inaction
／Evaluate readiness of software architecture to expose data through
secure APIs, including data mapping capabilities
#Your IAM must support OAuth2
#Your APIs must be access controlled using OAuth2

10. 10
Technical readiness for EU Data Act / FIDA as Data Holder

／Redesign/expand the data model of your core system
#To be able to link product, user identifiers and list of Data Users
#(FIDA required) Customer dashboards will be based on this extended data model
／Implement customer dashboard as consent interface
#Explicitly mandated for FIDA only, arguably needed for the EU Data Act case anyway
#For easy management (e.g. revoke access capability) of given consents by users
／Implement new business logic (application, module, microservice)
#To manage new consents
#To revoke consent requests

11. 11
／Ensure your Identity and Access Management (IAM) system

#supports OAuth2 and OIDC (OpenID Connect) -> 3 legged tokens
#serves web pages/iframes so that users can grant access to Data Users (third parties)
#supports fine grained access control -> using OAuth2 scopes / claims in the JWT token
#can generate an audit log to resolve potential litigation issues
(e.g. customer claiming that his data was accessed without his/her consent)
／Identify and support End2end integration scenarios
#User consent management flows
#Data access from third parties (Data Users)
Technical readiness for EU Data Act / FIDA as Data Holder

12. 12
／Address API Monetization
#Externalize the capability by onboarding your APIs on an API Marketplace
#Choose vendor providing API Management solution with metering & billing capabilities
#Develop internally
Technical readiness for EU Data Act / FIDA as Data Holder

13. 13
／Breaking down silos: EU Data Act promotes data sharing across industries
／New business models enabled by cross-sector data access
／Opportunities for SMEs - Fair access to data
／Increased transparency and competition in the market
The EU Data Act as a catalyst for cross-sector innovation:

14. 14
／The EU is using regulation to drive open data markets
#EU Data Act is a transversal law with specific focus on the IoT industry
#FIDA is specific for the financial industry (including P&C insurance)

／Product and User data will be exposed through APIs

／Technical readiness includes
#Identify and expose relevant product data via secure APIs
#Extend data models to support user consent management
#Specific requirements for the Identity and Access Management system
#API Monetization - Consider use of API Marketplaces (public or SaaS)

Summary

15. The API marketplace company
E-Commerce Journey | Gateway agnostic | Regulated Industries
Meet us for a Chat

Thank you