A perspective on the use of personal data stores in data spaces to support multiparty data access as required by the data Act

Abstract

This perspective article explores the requirements arising from the EU's Data Act for multiparty data access in connected products, a key element of the EU's Data Strategy. We categorize these requirements into six dimensions: Data accessibility for users, Information transparency for users, User rights regarding data, Fair and transparent data sharing, Interoperability, and Protection of legitimate interests. For each category, we provide detailed explanations and propose a conceptual model to address them. Central to this model are technological concepts such as identity management, consent management, data access policies, data usage policies, data catalogues, confidential compute, and linked data. We analyze how these technologies can support the Data Act's requirements and integrate them into a cohesive architecture. To ground these insights, we present an "agentic home" use case, illustrating the deployment of personal data stores in edge environments to enable generative AI applications. This application exemplifies the transformative potential of combining personal data in data spaces with generative AI, showcasing a pathway for the EU to maintain a competitive position in AI while upholding ethical norms and values. We argue that by leveraging the data space paradigm in relation to personal data and within the provisions of the Data Act, the EU can capitalize on generative AI as the "killer app" for data spaces, driving innovation and ethical data practices in the digital economy. (c) 2025 The Author(s). Published by Elsevier Inc. This is an open access article under the CC BY-NC license (http://creativecommons.org/licenses/by-nc/4.0/)