7.12.2023

Agreements define data sharing and re-use

‘Data is the new oil’ has been a popular phrase in recent years, but perhaps a more apt comparison would be solar power: a renewable natural resource that can benefit everyone at once, without diminishing. Data is created everywhere in our society. Networking and digitalisation are increasing across industries, and Bengt Holmström, among others, has called for the EU to recognise the value of data. At the same time, as Vili Lehdonvirta notes, data is a highly heterogeneous good with a content-specific value.

The Commission aims for a single market for data

In its 2020 data strategy, the European Commission deemed that data is insufficiently available for re-use and that data sharing is hampered, in part, by companies’ fear of losing their competitive edge. According to the Commission, the strategy aims to make the EU a leader in a data-driven society by creating a single market for data that will allow data ‘to flow freely within the EU and across sectors for the benefit of businesses, researchers and public administrations.’

In February 2022, the Commission published its proposal for the new Data Act (DA). This Act aims to increase data availability and create a regulatory framework for sharing data between different actors in the EU, including rules on who can use and access what data and for which purposes. The Data Act is part of the Commission’s larger proposal package, the so-called Big Five, that also includes the Data Governance Act (DGA), the Digital Markets Act (DMA), the Digital Services Act (DSA) and the Artificial Intelligence Act (AIA). As for the Data Act, the legislative process is well underway, and its goals include rules on who can access and control what data, among other things.

Data protection through agreements

In this connection, it should be noted that data itself is not protected under any special IP rights. Instead, the protection is largely based on agreements between companies and, in some cases, on the protection of trade secrets. Data can also form a database that is protected. In practice, the underlying data set must always be identified so that the related rights and restrictions can be evaluated. Agreeing on how the data can be used is key when data is shared and re-used.

The important thing is to understand the nature of the data and, consequently, what rights may be attached to it. It is equally important to know what the data will be used for, i.e. what rights the user needs to have. This allows for the data user to control the risks associated with third-party rights through agreements. For the party sharing the data, a formal agreement on data sharing provides an opportunity to protect data such as trade secrets, for example by restricting the use of the data to a specific purpose.

Progressing protection procedures

In Finland, the business and industry organisations recognised the need to develop the practices for data sharing agreements early on. The Technology Industries of Finland drafted the model terms for data sharing in 2019. In addition, the IT2022 terms, drafted in cooperation by IT supplier and client organisations, include new special terms and conditions for data use.

Efficient use of data always requires that industry-specific characteristics are taken into account in data sharing agreements so that reaching commercial goals is supported. We have assisted clients in various fields in matters related to data use and data agreements. If you would like to discuss the protection of your company’s data or any of the other topics covered in this blog in more detail, please do not hesitate to contact the authors.

Latest references

We advised UK-based investment company Downing in its acquisition of the entire share capital of Tornionlaakson Voima Oy. Tornionlaakson Voima owns three hydropower plants in the Tengeliönjoki river system – the Portimokoski power plants in Ylitornio, the Jolmankoski power plants in Raanujärvi and the Kaaranneskoski power plants in Sirkkakoski. The power plants produce a total of approx. 45 gigawatt-hours of electricity per year. Tornionlaakson Voima’s daily operations will continue normally, and the transaction will not affect customers. The consummation of the transaction is subject to the approval of the Ministry of Economic Affairs and Employment. Downing has over 35 years’ experience in providing a wide range of investment solutions to the needs of institutional investors, advisers and retail investors. The company manages over £2 billion in assets in both the private and public markets and its current hydro power portfolio includes approx. 50 hydro power plants in the Nordics. 
Case published 27.3.2026
We successfully represented insurance companies LähiTapiola and OP Henkivakuutus in two cases concerning an important point of principle: the right of insurance companies to process health data as part of the insurance application process. The Supreme Administrative Court handed down twin decisions ( one published as precedent ) addressing the matter in light of contrary DPA decisions. Under the Finnish Data Protection Act, insurance companies may, to simplify, process health data concerning “insured persons” (vakuutettu, försäkrad) to determine liability under the insurance. This rule constitutes an exception to Article 9 GDPR. At issue was whether the term “insured person” also covers people in the process of obtaining insurance coverage or only people who are already covered. In more practical terms: can an insurance company rely on the rule when considering whether/how to grant the insurance in the first place? The SAC answered in the affirmative and thus upheld the traditional industry approach over the DPA’s contrary view. The SAC noted that the Data Protection Act did not define the term “insured person” and thus looked at insurance legislation for guidance. As argued by the insurance companies, that legislation also uses the term in the context of describing the insured person’s pre-contractual informational obligations. Thus, and in view of the underlying purpose of the rule at issue, the SAC found that an “insured person” could be someone in the process of obtaining coverage, not just a person already covered. The outcome clarifies the scope of the local rule at the insurance application stage for the Finnish insurance industry.
Case published 22.1.2026
We acted as Finnish counsel to SuperOffice AS, backed by Axcel, in its acquisition of Lyyti Oy from Finnish private equity firm Vaaka Partners and other sellers. Lyyti is a leading event management software company for physical, digital and hybrid events with a strong customer base in Finland, Sweden and France. SuperOffice is a leading provider of customer relationship management (CRM) software for small and medium-sized businesses across Northern Europe. Axcel is a Nordic private equity firm with a focus on technology, business services and industrials, healthcare, and consumer sectors.
Case published 9.12.2025
We advised Lantmännen ek för in its contemplated acquisition of Leipurin from Aspo Plc. Lantmännen is an agricultural cooperative and Northern Europe’s leader in agriculture, machinery, bioenergy and food products. Lantmännen is owned by 17,000 Swedish farmers and has 12,000 employees in over 20 countries. Leipurin is a leading Nordic supplier of bakery ingredients, equipment, and expert services to professional bakeries, confectioneries, and food manufacturers. The company operates across Finland, Sweden, and the Baltic countries with subsidiaries located in the aforementioned countries, providing comprehensive solutions to the baking industry. The closing of the transaction remains subject to regulatory approvals.
Case published 25.8.2025