Data Act Compliance: The Privacy Challenge
The Data Act, which is set to take effect on September 12, 2025, imposes new obligations on providers of connected devices, mandating that device users must be allowed to access and share data generated by their devices with any party of their choice. This regulation is intended to foster a more open data economy. Data Intermediaries, as defined by the Data Governance Act, play a crucial role in this framework by offering the technical infrastructure necessary for facilitating such data sharing.
Privacy Rules in Data Sharing Scenarios
Although the Data Act promotes data sharing, it does not modify existing privacy regulations. Under the GDPR, each use case for shared data must be explicitly explained, and data subjects must consent to each specific activity individually. Additionally, the process for withdrawing consent must be as straightforward as granting it, ensuring that individuals retain full control over their data.
The Cost of Centralized Consent Management
One of the significant challenges that companies face is managing consent at scale, especially when dealing with vast amounts of data owners and recipients. In centralized consent management systems, intermediaries handle consent for each data transaction. This approach becomes prohibitively expensive as the number of participants increases. For instance, if managing a single consent costs €1, a system with 1 million data owners and 10 data recipients would incur a staggering cost of €10 million.
To address this issue, decentralizing consent management is a viable solution. In a decentralized system, data owners interact directly with recipients without the need for intermediaries. This approach significantly reduces costs, as expenses are primarily tied to the number of data owners, potentially lowering costs from €10 million to €1 million in the previous example.
Ecosteer’s Revolutionary Technology: Decentralizing Data Visibility Control
Ecosteer, a pioneering technology company, offers an innovative solution to decentralize consent management through its Data Visibility Control Overlay (DVCO). This technology empowers data owners with unilateral control over data visibility, enabling a decentralized consent management system. The DVCO leverages Ecosteer’s globally patented multicast encryption scheme to allow data owners to manage the visibility of data streams generated by their devices and applications.
Technical Implementation: Data Visibility Control Overlay
The DVCO operates within Multicast architectures, which use publish/subscribe data broker protocols such as MQTT, NATS, and Kafka. In these architectures, the device generating the data stream acts as a Publisher, while the applications receiving the data are Subscribers. The Data Owner is the legal owner of the data generated by the Publishing devices, and Data Recipients own the Subscriber applications.
In current centralized implementations, consent management and data governance are controlled by the Data Intermediary. The intermediary manages both access to the data broker and visibility over the data streams exchanged between the Data Owner and Data Recipient. In other words, Data Recipients with access to the Broker can also view the data they receive.
Ecosteer DVCO changes this by decoupling control over data broker access from data visibility. While the Data Intermediary continues to control broker access, the Data Owner exclusively manages data visibility. As a result, access to the Data Broker alone is insufficient for data visibility — the Data Owner must also grant visibility.
Multicast Encryption Scheme: Empowering Data Owners
The DVCO is built on Ecosteer’s globally patented Multicast Encryption Scheme for Data Ownership Platforms[1]. Installed on the Data Origin — the device or application generating the data stream — the DVCO encrypts the data stream before sending it to the Data Broker. The broker then distributes the encrypted data to all subscribing applications (Data Sinks). However, only Data Recipients with the necessary cryptographic tools, provided by the Data Owner, can decrypt the data stream.
For the Data Owner, granting consent involves simply clicking a ‘grant’ button, which triggers the exchange of cryptographic keys. This process does not require intervention from the Data Intermediary. Conversely, by clicking a ‘revoke’ button, the Data Owner can halt the sharing of cryptographic tools, effectively stopping the Data Recipient from decrypting the data as the cryptographic tools change at configurable intervals.
Smart Contracts: Further Decentralization
Ecosteer DVCO establishes a direct, disintermediated relationship between Data Owners and Data Recipients. This decentralized consent management can be further enhanced with the use of smart contracts. These contracts formalize the relationship between data owners and users, detailing the purpose of data usage and consent status. Additionally, smart contracts facilitate the tokenization of data, enabling the quantification of data’s value. Tokens can serve as rewards for data sharing, functioning similarly to loyalty points, where Data Owners receive tokens from Data Recipients and use them to purchase products and services.
Ecosteer DVCO and Data Spaces
Ecosteer DVCO (Data Visibility Control Overlay) introduces a transformative capability to Data Spaces by enabling real-time sharing of data streams under the Data Provider’s control. This enhances the flexibility and responsiveness of data ecosystems while incorporating robust data governance. The DVCO empowers corporations and individuals alike, granting full control over data-sharing processes via pub/sub data brokers.
Notably, the pub/sub data broker does not have to be centralized; it can be integrated within the Data Provider’s connector, enabling a distributed approach where each Connector functions as its own data broker. This supports secure, seamless sharing while reducing reliance on centralized infrastructure and addressing diverse stakeholder needs.
Architecturally, the DVCO aligns with the Data Spaces Reference Architecture by maintaining the separation of data transmission and control planes while extending it with a decentralized layer of data visibility control. This enhances transparency and accountability in data usage, addressing governance and privacy concerns in modern ecosystems.
Data Sharing: A New Business Frontier
Compliance with the Data Act opens up new business opportunities, particularly in the development of data exchanges. Companies can create exchanges using either their own infrastructure or services provided by Data Intermediaries, allowing customers to share and potentially monetize their data. Ecosteer DVCO facilitates scalable data exchanges by assigning data visibility control to data owners, thereby eliminating costs and legal liabilities related to consent management.
Ecosteer DVCO Flexibility
The DVCO is designed for versatility, and as such it is capable of being installed as a software upgrade on various devices — such as smart meters, wearables, industrial equipment, and appliances — as well as applications, including voice assistants, payment apps, self-scanning apps, and web browsers. This flexibility ensures that every kind of data stream, ranging from video to sensor data points, can be shared in a Data Act and GDPR-compliant manner.
Example Applications of Ecosteer DVCO
Ecosteer’s Data Visibility Control Overlay (DVCO) is a versatile technology that can be integrated into any device or application, making it applicable across a wide range of sectors, from consumer markets to industrial scenarios. Below are a few examples that highlight the diverse potential of DVCO.
Integrated Mobility Data Exchange: Project with AMT, Genova Public Transport Company
In this project, Ecosteer DVCO is implemented as a web application that empowers citizens to unilaterally control which data recipients can access their position data generated by their smartphones. As the project scales, users will be able to manage the visibility of a broader set of mobility data, such as position, means of transport, direction, and e-charging. Data recipients can reward citizens for sharing their data visibility through tokens, functioning similarly to loyalty points. These tokens can then be redeemed for products and services offered by the data recipients.
Healthcare Data Exchange
In this healthcare-focused project, Ecosteer DVCO is installed on an air quality sensor’s microcontroller and a smartphone app that receives data streams from a Bluetooth smartwatch. The data streams are encrypted at the source and can only be decrypted by authorized data recipients with the explicit consent of the data owners. This consent can be revoked at any time, ensuring continuous control over data sharing. Additional devices can be integrated into the exchange as needed. The high-quality, personal data generated through this system is invaluable to healthcare stakeholders such as doctors, caregivers, research centers, pharmaceutical companies, and insurance providers, all while ensuring full compliance with privacy regulations.
Neutral Data Intermediary
The Start 4.0 Competence Center in Genova has selected Ecosteer DVCO to become Italy’s first Neutral Data Intermediary. The center’s primary focus is to provide data intermediation services to its industrial partners, ensuring compliance with both the Data Act and GDPR without requiring investment in new infrastructure. Manufacturers and service providers will leverage Start 4.0’s services to exchange critical data, supporting supply chains and distributed asset maintenance, with the assurance of maintaining full, unilateral control over their data.
Data Sovereignty
Ecosteer DVCO also plays a pivotal role in advancing data sovereignty. When implemented on a web browser, it provides users with complete control over the sharing of their navigation data, making it an essential tool for Web 3.0, the next generation of the internet. Additionally, when integrated with an eSIM, DVCO could grant smartphone users unilateral control over the data generated by their devices, bypassing mobile operating systems.
Next Steps
In the next article of this series, we will explore Ecosteer’s latest innovation focused on decentralizing control over data records stored by companies, such as Electronic Health Records (EHRs) maintained by clinics.
[1] US10771243B1 — Multicast encryption scheme for data-ownership platform — Google Patents
