European Commission presents strategy for the single market for data.

On 19 November, the European Commission presented a Data Union Strategy as part of the Digital Package. This had already been announced in the political guidelines of Ursula von der Leyen. The aim is to create a simplified, clear and coherent legal framework that enables companies and public administrations to share data smoothly and on a large scale – while complying with high standards of data protection and security.

Background

For the European Union (EU), data has become increasingly central as it faces growing geopolitical competition in which data is regarded as a strategic asset. While global competitors use it for technological and industrial advantage, much data in the EU remains unused, including due to complex regulation. To address these challenges, the strategy identifies three priority areas: increasing the availability of data for the development of artificial intelligence (AI), simplifying EU data rules, and strengthening the EU’s global position on international data flows.

Expanding access to data for AI development

With the rise of generative AI, large language models and AI agents, access to extensive, high-quality and sector-specific datasets has become a decisive factor for global competitiveness. Against this background, the strategy foresees on the one hand making high-quality datasets available to a greater extent. On the other hand, the availability of the computing infrastructure required to process these datasets must be ensured. The strategy therefore provides for data labs (Q4 2025), which act as data service providers and link the Common European Data Spaces with the AI ecosystem. They are intended to offer companies and researchers secure and practical access to high-quality datasets, support compliance with EU rules, and provide tools, guidance and trusted environments for data pooling, curation, labelling as well as pseudonymisation and anonymisation.

In addition, horizontal instruments are intended to strengthen the entire data economy, for example through legal certainty for data pooling and standards for data quality, as well as through investment in capacities for synthetic data. High-value datasets under the Open Data Directive are to be expanded (Q4 2026). Furthermore, the Cloud and AI Development Act (Q1 2026) aims to ensure sustainable data centre infrastructure and sovereign cloud and AI services for companies and public administrations.

Streamlining EU data rules

Building on the European strategy for data of 2020 – the basis for the Common European Data Spaces – the EU has adopted both horizontal and sector-specific legislation. According to the European Commission, however, the complex interaction of this legislation and uneven implementation in the Member States have led to a fragmented legal framework and legal uncertainty – including for public authorities. The Digital Omnibus, published alongside the strategy, is intended to counter this by repealing, among others, the Free Flow of Non-Personal Data Regulation and the Data Governance Act. Essential elements are to be integrated into the Data Act, including provisions on public sector data sharing, currently split between the Data Governance Act and the Open Data Directive. Implementation of the Data Act will be supported through guidelines (Q1 2026), model contractual terms for data access and use, standard contractual clauses for cloud computing contracts, and a Data Act legal helpdesk (Q4 2025).

Beyond simplifying rules, the EU is investing in technologies to automate compliance. Through Horizon Europe and the Digital Europe Programme, it supports common data models, interoperability frameworks and automated analysis to enable real-time compliance checks in future (“one-click compliance”, from Q4 2025). The proposed European Business Wallet (EBW) may play an important role in this, as it will allow verifiable credentials – including compliance certificates – to be stored, managed and shared. At the same time, public authorities will receive secure and immediate access to validated information.

Strengthening the EU’s global position

Access to high-quality data is a strategic advantage, and worldwide data access, localisation and control are increasingly used as instruments of power. According to the strategy, the EU must therefore treat data as a central strategic resource and invest in secure, high-quality and interoperable datasets. European data sovereignty requires openness towards trusted partners, including cross-border data exchange, but under fair, secure and values based conditions. In view of growing geopolitical tensions and increasing digital protectionism, the EU must protect its assets and help shape global rules so that data can flow safely and in a trusted way into and out of the EU. To this end, the European Commission plans guidelines to assess fair treatment of EU data abroad (Q2 2026) and the development of a toolbox to counter unjustified localisation, exclusion and data leakage, as well as measures to protect sensitive non-personal data (Q2 2026).

Relevance for social security

In future, more administrative and health data will become available through Common European Data Spaces. This could enable social security institutions to access high-quality, anonymised data more easily, for example for research, prevention or more efficient administrative processes. The consolidation of public sector data sharing rules in the Data Act will also provide greater legal certainty when social security data is used for specific purposes. The planned data labs will furthermore enable the secure use of sensitive data without reducing protection levels. Overall, the strategy creates opportunities for improved analytics and more modern services, while requiring strict data protection and security standards.