Jusletter IT

Modern mobility indicates a growing shift towards digitalised transport, which combined with platform business models enables new approaches to efficient and sustainable modes of transportation. Mobility as a service (MaaS) is conceptual characterisation of this shift build upon availability of data collection, processing and communication capabilities that offer a bridge between total dependence on public transport and unsustainable social as well as individual burdens of mass vehicle ownership. The shift to on demand, coordinated, shared and optimised transport service promise to combine benefits of individual mode of transport with efficient use of space, resources and capacities of the transport infrastructure. “The desire to adopt MaaS as a solution is now widely supported, and will depend on the notion that urban mobility must rapidly become fully multifaceted, to minimise the negative impact of increased external costs.”² The growing practical experience with various business models that fit into the concept of MaaS indicate that there are growing opportunities for such element in the modern multi-modal mobility landscape, but also that it needs to be suitably fitted into the particular setting of the given municipal environment and often actively interconnected with the network of public transport to reach full benefits and bring maximal contribution to cost-efficient mobility solutions.

The EU is pursuing innovation and improvement of the mobility landscape on a number of levels, with close link between the modernised transport system and goals of sustainable zero-emission economy envisioned under climate and energy strategies liked to the Commission´s priority known as the European Green Deal.³ There is a number of policy and regulatory initiatives build into the broader shift in approach to transport in EU,⁴ but probably the most relevant are measures pursued under the new European urban mobility framework.⁵ MaaS is closely intertwined with these measures, as suitable development of efficient market environment in transport services that provide e.g. the last mile transport in lower traffic density areas will allow better optimised public transport planning, while achieving the decrease in overall individual traffic and retained mobility options and comfort for the passengers in question. As a data-driven commercial solution, the MaaS business models need to align with the appropriate regulatory requirements, in particular concerning the data processing and sharing. “For the digital revolution to be fully exploited, MaaS must be considered as a way of managing the common good – public space – through the creation of another common good; a public data platform.”⁶

In this regard, the whole European regulatory landscape is currently undergoing a major change that will set the foundation of future digitalised economy. This is linked to another of the strategic priorities of the European Commission, in this case known under the title A Europe fit for the digital age.⁷ This digital strategy is set to strengthen digital sovereignty of the EU and set world-leading standards for data processing, sharing and re-use. It is aimed at the development of a data-agile economy and covers a number of new regulatory initiatives.

In our contribution, we aim to focus on four areas in particular:

(1) the establishing of a cross-sectoral governance framework for data access and use, represented by the new Data Governance Act (DGA) ⁸ provisions on data-sharing as well as the development of the Common European Mobility Data Space for sectoral data sharing and data pooling; ⁹

(2) the new framework aimed at empowering individuals to control their data within the new data-sharing architecture and governance mechanisms, as foreseen in the proposed Data Act (DA); ¹⁰

(3) transformation of competition and liability rules reflecting the shift in the digital economy landscape and ensuring fair competition of all companies, as set in the Digital Markets Act (DMA) ¹¹ and Digital Services Act (DSA) ¹²; and

(4) new cybersecurity rules and requirements applicable to broader spectrum of sectors including the MaaS and digitalised mobility solutions, as set in particular in the proposal of NIS 2 Directive. ¹³

We will highlight the relevance of these new regulatory frameworks for the MaaS concept and discuss the opportunities and limitations for realisation of MaaS solutions in light of these new provisions.

The EU recognises the transformation of the economy driven by digital technologies and that data is at the core of this development. Further development should therefore be based on data that may contribute, among other things, to new possibilities in mobility. European Commission therefore proposed the establishment of common European data spaces for data sharing and data pooling. These common European data spaces should also cover the area of mobility.¹⁴

The Data Governance Act (DGA), which was adopted on 30 May 2022 and shall apply from 24 September 2023, lays down conditions for the re-use of certain categories of data¹⁵ held by public sector bodies.¹⁶ For the purposes of DGA “re-use” is defined as the use by natural or legal persons of data held by public sector bodies, for commercial or non-commercial purposes other than the initial purpose within the public task for which the data were produced.

It is necessary to mention that DGA does not create obligation of public sector bodies to allow the re-use of data. However, DGA prohibits agreements or other practises pertaining to the re-use of specified data which lead to exclusive rights to data or to a restriction of availability of such data for re-use by other entities. The only exception is in situations where without an exclusive right to re-use data the provision of a service or the supply of a product in the general interest would not otherwise be possible.¹⁷

Although DGA does not explicitly regulate the area of MaaS and data generated by MaaS, it will impact MaaS in the area of re-use of such data. While public sector data holders will not be obliged to allow the re-use of data under DGA, on the other hand, they are, with the exceptions mentioned above, prohibited from establishing exclusive agreements and using other practices that would restrict the re-use of data by other entities. If a public sector holder of data generated by the operation of MaaS were to impose any conditions on the re-use of that data, those conditions must be non-discriminatory, transparent, proportionate and objectively justified with regard to the MaaS data. At the same time, these conditions must not be used to restrict business competition.

Another objective of DGA is to support so-called data altruism. This term introduced by DGA means the voluntary sharing of data on the basis of the consent of data subjects to process personal data pertaining to them, or permissions of data holders to allow the use of their non-personal data. The idea behind it is that such data subjects or data holders will share their personal or non-personal data without seeking or receiving a reward¹⁸ for objectives of general interest, improving the provision of public services, public policy making or scientific research purposes. As one of these areas DGA specifically mentions is the improvement of mobility.¹⁹ It is possible to imagine that some MaaS users will be willing to voluntarily share their data generated by using MaaS through data altruism organisations.

We believe that re-use of data generated by vehicles used for private or public transportation could foster innovation and further development of MaaS. Such data may also contribute to data driven planning policies, urban planning and zoning.²⁰ It is therefore crucial to provide conditions for a broad re-use of data generated by intelligent transport systems and vehicles. On the other hand, it is also necessary to maintain the security of data and the rights of data subjects or data holders. In this context, it is necessary to take into account that the DGA is only a general regulation²¹ and its implications for MaaS are likely to be modified by sector-specific regulation. DGA directly foresees this by stating that “[s]ector-specific Union law can develop, adapt and propose new and complementary elements, depending on the specificities of the sector, such as the Union law envisaged on the European health data space and on access to vehicle data.”²² DGA therefore lays down only general rules for the re-use of data which includes data generated by vehicles and other devices used for MaaS and promotes such re-use in general. Thus, in further considerations of re-use of data generated by MaaS, it is necessary to take into account other relevant European legislation, in particular in the field of data protection,²³ cyber security or forthcoming sector-specific regulation.

The Data Act (DA) was proposed by the European Commission in February 2022 and is currently undergoing standard legislative procedure, with no definite timeframe of adoption.²⁴ Nevertheless, it is a crucial piece of the new regulatory landscape of European digital economy. While DGA creates the processes and structures to facilitate data re-use, DA shall clarify who can create value from data and under which conditions. This makes DA horizontal proposal setting basic rules for all sectors with an impact similar to the adoption of GDPR. It should foster business-to-government data sharing for the public interest and support business-to-business data sharing. It is expected to facilitate access to and use of data by consumers while preserving incentives to invest in ways of generating value through data.

It presents measures to allow users of connected devices to gain access to data generated by them and to share such data with third parties to provide aftermarket or other data-driven innovative services, measures to prevent abuse of contractual imbalances in data sharing contracts and reinforced data portability right. It should lead to fairer and more balanced data sharing contracts of SMEs with dominant companies.

In several aspects offers the DA rather challenging future settings for numerous currently pursued digital economy models, in particular sharing economy concepts. There are several interesting moments in connection to MaaS deployment. Articles 3 and 4 DA of the proposal foresee access of the user to the data (personal as well as non-personal) generated by use of the service. It may be an obligation with a positive impact, opening the data processing in MaaS to greater scrutiny and allowing innovation by accessibility of the data for further use based on Article 5 DA. Nevertheless, not only for MaaS, the interpretation and in particular enforcement of this right will greatly define it resulting effect. The accessibility is conditioned by a set of exceptions and limitations that may rest on protection of personal data, scope of trade secrets, interpretation of link between data generation and use (ie. is data generated by the engine sensors during the usage of the leased car data generated by the user in the meaning of DA?). Additionally, the small and micro enterprises are exempt from these obligations, which may lead to purposeful fragmentation and obfuscated chaining of business entities to avoid these obligations or to take maximal advantage of the possible access to these data generated by other entities on the basis of Article 5 DA. The Council is set to discuss the proposal on 6 December 2022, which may lead to major amendments of the proposal or expose the lack of consensus that may delay the adoption of the act significantly (similar to for example the still not adopted e-Privacy Regulation²⁵).

Beyond regulating the conditions for data holder granting access to generated data to third party and streamlining of rules for unfair terms in such set up, DA further set conditions for mandatory grant of access to public sector bodies based on exceptional need scenarios, as regulated in proposed Articles 14–22 DA. Nevertheless, pursuant to the definition of exceptional need to use data in Article 15 DA, we conclude that MaaS are unlikely to be affected by this obligation. Similarly, the requirements designed for effective switching between providers of data processing services under Article 23–26 DA should not pose particular challenges to MaaS providers, as the data generated by their use are largely bound to the technical specification of the vehicles, but depending on interpretation of the breath of commercial, technical, contractual and organisational obstacles targeted in Article 23 para. 1 DA, the gamification aspects of MaaS may need to be reconceptualized and some of the options for achieving a sustainable business model in MaaS through user pool stability will likely not be viable under DA.

The structured call for systematically pursued interoperability under Articles 28–30 DA may be to great benefit of MaaS, as common data structures, taxonomies, interfaces or even smart contract standards would significantly streamline the current diverse landscape of MaaS initiatives and should allow greater synergies, including functional connection of MaaS to municipal public transport in a cohesive public-private urban transport system.

DA and DGA aim at enhancing data sharing and reuse of data, while safeguarding the privacy and data protection rights of EU citizens, but this goal remains challenging, as it will likely create inconsistencies and clashes between provisions, which will make guidelines and enforcement key in achieving the functional balance. This will also require finding a reliable way to differentiate personal and non-personal data subject to DA and DGA, in order to align the approach to data as a common pool-resource that should be broadly accessed and used with the rights and expectations of data subjects.

The goal to protect the privacy and safety of EU citizens is further challenged when AI is involved in the operation. This area is covered by the AI Act.²⁶ The AI Act imposes obligations on so-called high-risk AI systems. According to the proposed legislation, most AI operating in the road traffic environment is considered to be high-risk. Whether it is a component of a physical product or a stand-alone software. However, motor vehicles are excluded²⁷ from the application of the AI Act.²⁸ AI systems operating in road traffic shall be regulated separately by new legislation. Nevertheless, the new legislation must uphold the level of safety set by the AI Act. On the other hand, AI systems serving as safety components in the management or operation of road traffic are also considered to be high-risk and fall under the scope of the AI Act.

The spread of MaaS is closely linked with the online platforms and apps aggregating multiple transport modes into themselves.²⁹ This provides great convenience for consumers, but it is also a regulatory challenge. Digital Markets Act (DMA) is currently in the process of adoption by the EU, while Digital Services Act (DSA) was already adopted. These frameworks for digital economy focus on regulating the intermediary platforms and technological companies with a broad user base identified as “gatekeepers”.³⁰

There are two layers to this approach. The first one concerns the current state of the MaaS adoption process. There are currently very few international companies providing MaaS services active in the EU.³¹ As such, DMA application on MaaS currently remains largely hypothetical, unless one of the already established big tech companies (eg. Alphabet)³² starts providing MaaS. In this case a plethora of new obligation arises to the platform, such as the ban on treating its own services more favourably in ranking them.³³ This could be the case if own MaaS were recommended or treated advantageously in eg. search or map services. An interesting obligation from the DSA is the need to disclose in the terms and conditions “the main parameters used in their recommender systems, as well as any options for the recipients of the service to modify or influence those main parameters.“³⁴ If provided by a very large online platform, it must also include an option of a service not based on profiling, which may significantly distort the benefits derived from the MaaS in question by the user.³⁵

MaaS platforms are likely to meet all three levels of intermediary services under Article 3 lit g) DSA. This means that current MaaS platforms or apps will need to focus on dealing with the risk of illegal content being uploaded to the platform by users, be it consumers or business users. This is then coupled with the need to disclose in the terms and conditions how monitoring of content uploaded by users is done.³⁶

The final considered area of upcoming EU digital economy regulation that shall be reflected in this contribution concerns cybersecurity, particularly the perspective of proposed NIS 2 Directive.

This revision builds on the original NIS Directive³⁷, which broadly sets out the obligations relevant in our context, in particular for operators of intelligent transport systems³⁸, which are the „systems in which information and communication technologies are applied in the field of road transport, including infrastructure, vehicles and users, and in traffic management and mobility management, as well as for interfaces with other modes of transport“³⁹. Such operators can be considered as operators of an essential service, if they fulfil the additional determining criteria set out in Article 5 para. 2 of the NIS Directive (thus, not every operator of intelligent transport systems can be considered as an operator of an essential service, which is then subject to the conditions set out in the NIS Directive).⁴⁰ If operators are considered to be operators of an essential service, they are primarily subject to the obligations set out in Articles 14 and 15 of the NIS Directive. In brief, these include the obligation to prevent and the need to minimise the impact of incidents and attacks, the need to take appropriate technical and organisational measures to manage security risks, to prevent incidents affecting network security and, in the event of a serious impact, to report incidents to the competent authority or CSIRT.

Although the NIS 2 Directive is still undergoing the legislative process, its pre-final wording indicates that the range of obliged entities relevant in the context of MaaS will remain similar.⁴¹ However, under the NIS 2 Directive, the designation of obliged entities and the related obligations are changing. ITS operators are likely to be referred to as essential entities (rather than essential services as they were established under the NIS Directive) and will be considered as any entity listed in Annex I to the NIS 2 Directive. Thus, there will be a move away from the limited designation of obliged entities based on determining criteria, and any ITS provider should be an essential entity under the NIS 2 Directive.⁴²

The NIS 2 Directive clarifies the obligations and impacts for the essential entities compared to the previous legislation and sets new specific obligations for the entities concerned. The main purpose, in addition to increasing the level of security of individual obliged entities and covering a more comprehensive range of obliged entities, is also to strengthen the role of the European Network and Information Security Agency (ENISA) in terms of collecting and circulating relevant information (also by operating a European Vulnerability Register)⁴³ or to introduce cross-border sharing of information on cyber security in general.⁴⁴

Essential entities must specifically develop and adopt more detailed technical and organisational measures to manage security risks, including developing a cybersecurity strategy.⁴⁵ They have more obligations related to the reporting of significant incidents⁴⁶ (this means significantly broader coverage of incidents than in the case of the NIS Directive and the obligations defined here for reporting incidents with a severe impact) and a reduction of the reporting time to 24 hours (however, with the possibility to deviate from this limit upon agreement with the competent authority)⁴⁷. In addition, under the NIS 2 Directive, the supervision and enforcement of the obligations under introduced legal regime, particularly of essential entities, are also intensified compared to the previous regulation.⁴⁸

The NIS 2 Directive then foresees the possibility of using certification schemes⁴⁹ inter alia for MaaS related technologies, according to the basic requirements set out in the Cybersecurity Act.⁵⁰ Still, it should be noted that, to the date, the individual certification schemes have not yet been approved and the specific implications are thus currently unclear. Additionally, ENISA presented guidelines on implementing the NIS Directive towards the issue of "smart" cars,⁵¹ specifically in cybersecurity related to the automated driving environment.⁵² Given the interconnectedness with the MaaS issue, it is then appropriate to reflect such a background, especially in the context of the NIS 2 Directive.

Additionally, the Directive on resilience of critical entities (RCE Directive)⁵³ is a brand-new legislation, and it complements the changes proposed under NIS 2 Directive. The RCE Directive reflects the increasing synergy between the physical and digital world and aims to mitigate the risks that critical entities face. These risks are identified in multiple areas, two of which concern MaaS. Firstly, the RCE Directive identifies the risk in sectors where operators are reliant on each other and disruption affecting one of them can create a cascading effect. Secondly, the RCE Directive mentions unmanned vehicles as one of the challenges to the environment where critical entities operate.⁵⁴ According to Article 5 of the RCE Directive, it is expected that the critical entities under the RCE Directive and the critical infrastructure according to the NIS2 Directive will overlap. Furthermore, unmanned vehicles and other AI systems that are intended to be used as safety components in the management and operation of critical digital infrastructure are considered to be high-risk AI systems according to the AI Act.⁵⁵ Notably, the term critical digital infrastructure shall be interpreted according to the RCE Directive.

In this contribution, our aim was to provide an analysis of the set of recently or currently adopted components of the new EU legislative framework for digital economy, in particular DGA, DA, DMA, DSA and NIS 2 Directive with the focus on likely opportunities and limits ensuing for MaaS. All these legislative acts have potential to impact the approach to MaaS, although none provides a specific and focused regulation of MaaS per se. The limits will mostly concern additional information and data security requirements, even though data access and re-use may also influence the approach to future MaaS. Nevertheless, the new frameworks should be mainly seen as opportunities for better conditions for development and expansion of MaaS, contributing to better interoperability, more resilient and reliant services and better access to data currently out of reach by other data holders. At any rate, MaaS would benefit from further regulatory guidance and service-specific regulation, both bridging the increasingly complex and intertwined regulatory landscape.