Big Bytes, Tiny Servings: Is the EU’s Circular Economy Strategy Too Optimistic?

No other region has regulated the data economy more actively than the EU. The connection between the circular economy and the digital economy has been highlighted on several occasions. The World Economic Forum has stated that ‘[a]n efficient business ecosystem can only operate if it is fully digitalized’, and that digitalization is important for the ‘realisation of a global circular economy’. While data sharing has the potential to drive sustainable circularity, the challenges it presents might hinder it from bearing full fruit.

This blog post will dive into two specific problems hindering the circular economy from advancing, considering the EU’s Data Act (2023), which becomes applicable in September 2025. The focus will be on how the EU’s data sharing obligations (i) potentially hinder competition and (ii) increase cybersecurity risks, thus negatively affecting the circular economy.

As opposed to the linear economy, the circular economy focuses on the use and reuse of an item, making data an ideal ‘product’, because once it is collected, the same data can be used and reused for multiple purposes. In 2025 the EU’s data economy will be worth €829 billion, according to the European Commission, and by 2030 €140 billion can be captured in the Nordics.

Sustainability as an accordion & data as the new oil

Perhaps sustainability is best described as an intellectual accordion, due to its ever changing, widening and narrowing definitions. The data economy is not sustainable as of today, some of it is due to the untapped market, which the Commission has estimated that around 80 per cent of industrial data is ‘never used’ and data sharing can reduce this number.

Due to its range, data has been dubbed ‘the new oil’. Data, like oil, is not worth much in its raw form – it must be processed. As opposed to oil, the same data can be processed several times for different purposes.

In the data economy, data sharing can be a useful tool for achieving sustainability faster. Data sharing is the act of making data available to various entities. These can be as big as organizations, and as small as individual internet users. Lately the focus has been on involuntary acts of data sharing between companies.

Thierry Breton, former Commissioner for Internal Market, introduced the Data Act as ‘an important step in unlocking a wealth of industrial data in Europe’, because it provides rules on how this data can be used and by whom. In other words, 'who can create value from data'.  The proposed effects of the Data Act were optimistic, the European Commission estimated that the Data Act would ‘create €270 billion of additional GDP by 2028’, simply by making more data available for reuse. Despite the European Commission’s optimism, the market was not as impressed to receive the Data Act, as the EU was to present it.

Data sharing – a handout to your competition?

The Data Act obliges providers of data processing services, i.e. Acelerar Technologies and Virtalent, to ‘take all reasonable measures in their power to facilitate’ a customer who switches from one provider to another, to achieve the same ‘functional equivalence’. This has garnered reactions. Parliament Member, Adam Bielan, expressed his concerns on functional equivalence ‘as it places obligations on the source providers that are impossible to comply with, unless they have access to the infrastructure of the provider of destination’ cloud services (definition: specific services provided online by cloud companies).

The U.S. Chamber of Commerce labelled the Act proposal ‘A Misguided Policy’ for hindering competition by forcing data sharing and undermining innovation. They even went as far as to state that the ‘Data Act’s negative impact on U.S. cloud companies appears to be intentional’. Center for European Reform agreed that the forced sharing of data might be looked upon as a hindrance for competition, because they are ‘unnecessary rules on firms that want to use technologies’. SAP and Siemens, both software providers, explained that the ‘[Data Act] risks undermining European competitiveness by mandating data sharing-including core know-how and design data-with (…) also third parties’.

Data sharing – invitation to cyberthreats?

Cybersecurity risks are another challenge with data sharing. Specifically, the loss of control over data is highly emphasized. Data sharing leads to the expansion of points of access, meaning the more entities one shares their data with - the larger the attack surface becomes. Potentially, hackers gain more ground and various points of access to the same data that, prior to the data sharing, could have stayed within one’s territory, thus increasing the chances of successful Evil Twin or Man-in-the-Middle attacks. This can lead to data misuse, intellectual property theft and industrial digital espionage.

For data sharing to become the tool the EU wants it to be, the challenges with interoperability must be addressed in the sense of a cross-border uniform approach. Interoperability refers to the ‘ability of computers to connect and exchange information with each other’. While the lack of interoperability poses challenges, so does interconnectedness. Without secure cybersecurity systems, companies do not want to share their data, but these types of securities are costly. Both data and other digital assets are protected by rigid cybersecurity. However, with the emergence of the Internet of Things, everything is increasingly connected. This also makes the circular economy more interconnected. An attack on one part of the chain makes it easier to attack other parts of the chain.

Marathon, not a sprint

Although the EU has made significant efforts to regulate the data economy, there is still some balancing left to do – because after all, is sustainability achievable in the absence of free competition and security? In situations like these, the EU should divert its focus from how to tap into the data market and instead concentrate on reassuring companies that their data is safe and used appropriately. Voluntary coercion only goes so far, but safeguards and reassurance might just get the EU to the finish line.