Legally compliant IoT data usage
with the bee1 data license
IoT data will soon belong to the user - are you ready?
Among the wide variety of data sources that exist today, the data generated by the use of technical devices, so-called IoT devices, will play a special role from September 12, 2025. According to the EU law that comes into force in September, users of technical devices that are connected to the internet will be entitled to the data produced when using these devices. The owners of this data will then be the users of these IoT devices. In particular, this relates to Article 4 of the EU Data Act. This states that the user is entitled to the raw data produced. This results in a legal claim situation. Manufacturers of these devices face fines of up to 4% of their annual turnover if they violate this right. But how do you get hold of this data? Our ePaper gives you a quick overview of the EU Data Act.
Would you like to know more?
Complex legal system
The EU Data Act (Regulation 2023/2854) comes into force on September 12, 2025 and creates legal rights to IoT data for the first time. Users of IoT devices will receive free, immediate access to “readily available data” from their networked devices. Violations can cost companies up to 20 million euros or 4% of their global annual turnover.
The data owner or data holder on the manufacturer’s side may only use available data, which is non-personal data, on the basis of a contract with the user. Data holders can place the data output under a license. This is where a so-called FRAND license comes into play, i.e. it must be fair, reasonable and non-discriminatory. This licensing can be agreed with a third party.
3-party system
The Data Act thus establishes a tripartite legal relationship between the data holder (the producer), the data user (the user) and the data recipient (third party).
Data Act – Tripartite legal relationship
A data user uses an IoT device from a data holder to whose data they are entitled. The data user can now approach a third party – such as an IT service provider – so that the latter can request the IoT data produced on behalf of the data user. The IT service provider can request, evaluate and aggregate this data in one go so that it can provide the data to the data user in a curated and analyzable form. A FRAND license is required for the relationship between the data holder and the third party.
The EU model clauses
Together with the EU Data Act, the EU provides model clauses – the so-called EU Model Contract Terms, or MCT for short – for a FRAND-compliant design of such a license. However, the EU model clauses are subject to fundamental criticism. Industry associations criticize the difficulty in dealing with them. The MCTs present themselves as a confusing modular system. They have:
- a 182-page volume
- Missing data protection aspects
- and are technically hardly usable.
In total, the agreement consists of 182 pages with 4 annexes and, according to the industry association Bitkom, requires around 87 hours of legal work per individual license agreement, as it can hardly be adapted without specialist knowledge. Industry associations in particular criticize the lack of legal localization for the German market. There are also conflicts with the GDPR when dealing with mixed data.
Ultra-compact solution:
bee1 IoT Data License from beebucket
It’s easier:
with the bee1 license as an ultra-compact solution. The bee1 IoT data license developed by beebucket – co-developed by Professor Boris Paal, lawyer and university lecturer at the Technical University of Munich – offers an alternative on just 3 pages.
The license includes full localization for the German market, BGB conformity, GDPR compliance and is ready for immediate use – without any legal effort. bee1 is provided under Creative Common License 4.0
- Radically simplified and shortened to 3 pages
- Developed together with Prof. Boris Paal from the TU Munich
- Full GDPR compliance
- Creates legal certainty for German companies
- Provided by beebucket under Creative Commons License 4.0
