Data access

The EU experience

In July 2025, the EU Court of Justice ruled on the case of Lisa Ballmann v. European¹ Data Protection Board (EDPB). Ballmann requested the EDPB to provide documents from² its investigation into Meta, which was the data processor for the plaintiff on Facebook. The EDPB refused, arguing that Ballmann was not a party to the investigation and could not request access to the investigation materials.

However, the EU Court recognized that it is not necessary to be a party to the proceedings in order to have the right to access investigation³ materials. According to Article 77 of the GDPR, every user has the right to lodge a complaint with a supervisory authority regarding a breach of the Regulation and to be informed about the progress of the complaint, including the investigation materials. The EU Court gave a broad interpretation of the rule: the data subject has the right to access information not only about the processing of their own data, but also about the data processor's activities in general.

Also in July 2025, the European Commission approved rules on free access for researchers to data from very large platforms. Back in 2022, the EU adopted the Digital⁴ Services Act (DSA), which imposed obligations on such platforms to provide researchers with public access to their data on systemic risks related to the design, architecture, functioning of⁵ platforms and their algorithmic systems. Now, the EU is creating a special portal for the exchange of such data, where researchers will be able to submit requests for specific platform data. Access to data will be granted only to organizations whose research is independent of commercial interests and whose findings will be made publicly available. Researchers' requests are not addressed directly to the platforms , but to national digital services coordinators (bodies authorized to implement the DSA), which review the requests and formulate technical requirements for platforms to provide access to the requested data.

The experience of Italy

In July 2025, public consultations concluded on business practices that force users to choose between agreeing to data collection through tracking technologies (“ok option”) or paying for resources or services (“pay⁶ option”). In other words, either surrender your data or pay to use the content or platform – what is commonly referred to as the “consent wall” scheme. This scheme deprives users of freedom of choice: users should have the right to decide to pay or not, but the “pay or ok” scheme forces them to pay either with money or with data. It violates the rule of specific consent: under current regulations, users provide data for a specific purpose of processing, whereas access to content is not the purpose of data processing, but in fact a service in exchange for data. It may also be unclear to users who and why is collecting their data, how their data will be used, and when their processing will cease. If, following consultations, the practice is found to be unlawful, the government will be able to prohibit platforms from using the “pay or ok” scheme, which will restrict platforms' unlawful access to users' behavioral data.

The US and EU experience

In July 2025, the US and the EU announced the conclusion of a Trade⁷ Cooperation Agreement, including the removal of barriers to digital trade. The countries agreed to maintain zero customs duties on electronic data transmissions (e.g., audiovisual content). Thus, the parties agreed not to complicate the conditions for digital trade, which is important for European companies amid the tightening of US trade policy (increased customs import duties).

Russia’s experience

Unlike the EU, Russia has little tradition of upholding users' rights to information. For example, under current legislation on personal data, users have only the right to access information about the processing of their personal data, but not about activities of the data controller. Therefore, in Russia, users do not have the right to access information about the outcomes of audits on security measures taken by platforms (as in the EU). Given Russia's national goals for developing the data economy, it is necessary to develop practices for providing researchers with access to data from the largest platforms, including through a separate portal.

From the monitoring issue No. 7 (19), July 2025. Download the full issue (PDF) · issue page at the Gaidar Institute