Answer to request

Group 3: Stakeholders at the Member State Level

Background & Role

1. Can you start by introducing your institution and your role in it?

2. Can you describe your institution's and your role in implementing or overseeing the

Data Governance Act at the national level? e.g., Transposing relevant aspects into

national procedures, supervising compliance, providing guidance, or coordinating with

EU bodies.

3. How does your institution coordinate with other national authorities and/or with EU

institutions regarding the DGA?

- If so, are there established channels for information-sharing, joint decision-

making, or consultation with stakeholders? How effective are they?

Legislative Intent

4. From your institution’s perspective, what are the main goals the DGA aims to achieve

in the national context?

5. Looking at the first years of DGA implementation, to what extent does your institution

think these goals have been met at the national level?

6. Does your institution believe that there are areas where the objectives are being met

more successfully, and others where progress is slower? If so, which ones?

Implementation Insights

7. Did your member state face any difficulties or challenges in implementing the DGA?

If so, which?

8. Did your member state face any specific conditions that facilitated the implementation

of the DGA in your country?

- E.g., pre-existing national laws, regulatory frameworks, technical

infrastructure, or in-house expertise.

Gathering Feedback from Stakeholders

9. How has your institution gathered feedback from stakeholders during the

implementation of the DGA? If so, which ones and through what means? (e.g., data

intermediaries, industry, civil society, public bodies), and (e.g., consultations,

workshops, surveys)?

10. Based on this feedback, are there notable differences in awareness or understanding of

the DGA between these groups?

11. Did your institution use stakeholder feedback to shape implementation strategies or

develop guidance materials? If so, what adjustments or improvements were made?

Future Directions

12. Based on your experience so far, are there any changes or clarifications to the DGA? If

so, which ones and why?

PERSONAL DATA - INFORMED CONSENT FORM

1

You are asked to participate in scientific research. Please take your time to decide whether you want to participate. You can stop your participation at any time (in writing or verbally), without giving a reason. You will find more information about the research below. Moreover, the researcher should have already provided you, either in an oral or written form, further details about the research and the specific focus of this semi-structured interview. Do not hesitate to ask questions to the researcher(s) or the supervisor if something is not clear. 1. Description of the research

• Title: From Theory to Practice: A Critical Review of The Data Governance Act Three Years On

• Researcher(s): Bárbara da Rosa Lazarotto

• Supervisor: Sophie Stalla-Bourdillon

• Research group or department: Law, Science, Technology and Society (LSTS)

• Purpose of the research: This research assesses the implementation and impact of Regulation (EU) 2022/868, the Data Governance Act (DGA), three years after its adoption. It examines the extent to which the DGA’s mechanisms have been effective in achieving their objectives, identifies the main barriers to their practical implementation, and considers the broader implications for the EU’s data governance framework.

• Practical conduct: The researcher carries out empirical research using both classical and innovative research methods used in social sciences and humanities’ research, and notably qualitative and digital methods such as documentary analysis, semi-structured interviews, or critical making. More specifically, this Informed Consent Form concerns the conduct of semi- structured interviews with experts. Altogether, we expect to carry out a maximum of ten interviews, each lasting approximately 60 minutes. Note that this research focuses on professional protocols and practices, not personal information about the professionals observed.

2. Responsible data controller VUB (Vrije Universiteit Brussel), Pleinlaan 2, 1050 Brussels, company number 449.012.406.

3. Description of risks and benefits Your participation will not involve any risks.

Your participation will involve the following benefits: - You will have the occasion to further reflect about the practices to which their work

partakes, and about the wider socio-political, legal and technical dynamics at play; - You will provide precious input to fundamental research, which is expected to be

beneficial to the advancement of research and knowledge across various scholarly

PERSONAL DATA - INFORMED CONSENT FORM

2

communities and potentially also to society and policy-makers (by casting a light on important and complex developments in European security politics).

4. Confidentiality We will keep the collected data confidential and respect the privacy legislation, including the European General Data Protection Regulation (GDPR).

5. Data – Purpose – Retention Time – Transfer

For this research, we will collect the following personal data: your name, your email address or other contact details that you provide us for the purpose of organizing the interview and/or receiving a copy of the transcript, as well as your expertise (e.g. education or specific training) and professional position, your perspective on the topics touched upon during the interview. As we are expected to keep a digital copy of this Informed Consent Form, we will also collect your personal data included in this document. We will only process your data for the purpose of scientific research. We will store your data for ten years after the end of the research. Your data may be re-used for the purposes of scientific research in the general interest, under the condition that protection measures are taken. Otherwise, your data will not be transferred to any third parties, unless with your explicit consent or due to a legal obligation.

6. Citations Without your express consent, you will not be cited in any publications. We may quote passages from the transcript of the interview in the context of our scientific activities (e.g. a publication or a presentation), but even in this case we will not cite you directly by name, but refer to you in a pseudonymized form.

7. Security The storage of your data will offer a high degree of protection, in accordance with the guidelines of VUB (VUB Charter of the Researcher, ICT Security policy). Your data will not be stored on a personal computer, an external hard disk or a USB stick, unless encrypted. We will pseudonymize your data as soon as possible. This means that we will replace data that can directly identify you, such as your name and e-mail address, by codes. A "translation key" will be necessary to convert the codes back to the original data. Only the researcher(s) and the supervisor have access to this key.

8. Your rights

You have the right to access, correct and erase your data, request information on the way we handle your data, request a copy of your data, limit the way we handle your data and ask us to transfer your data to third parties.

You are entitled to withdraw the consent to process your data at any time, without having to justify your request.

PERSONAL DATA - INFORMED CONSENT FORM

3

9. Contact

If you have questions or if you wish to exercise your rights, you can contact Bárbara da Rosa Lazarotto ([email protected]) or the data protection officer of VUB ([email protected]).

10. Complaints If you wish to complain about the way we handle your data, you can contact the researchers, the supervisor or the DPO (cf. above). Or you can file a complaint with the data protection authority:

Drukpersstraat 35, 1000 Brussel Tel. +32 2 274 48 00 email: [email protected] website: www.dataprotectionauthority.be

You also have the right to file suit at the competent court.

11. Declaration of the researchers The undersigned researchers confirm that the participant has received a copy of the present document and that they have answered all its questions.

Name: Bárbara da Rosa Lazarotto

Date: 04/09/2025

Signature:

12. Consent of the participant

O I have had the opportunity to ask questions and agree to participate in the research.

O I understand that my participation in this research is voluntary and that I can stop my

participation at any time, without having to give a reason.

O I agree with the collection of the following data for the research: name, email address or other contact details that I provided or may provide for the purpose of organizing the interview and/or receiving a copy of the transcript, information about my expertise (e.g. education or specific training) and my professional position/role, my perspective on the topics touched upon during the interview, and all personal data included in the Informed Consent Form.

Please note that your acceptance to the collection of all the above-mentioned data is essential. If you do not agree, you will not be able to participate in the research.

O I consent to the disclosure of the research results, for example by quoting passages of the interview or a paraphrasis, in a publication, conference or otherwise, without revealing my name. However, I can specify, during the interview, that some exchanges are to be considered off-the-record.

Please note that your consent to disclosing research results in a publication, conference or otherwise is essential. If you do not agree, you will not be able to participate in the research. Note that you are always entitled to signal, during the interview, that some exchanges are off-the-record. If the interview

PERSONAL DATA - INFORMED CONSENT FORM

4

is being tape-recorded, the audio-recording will be stopped during the duration of those exchanges. Note also that we will not cite your name but rather refer to you in a pseudonymized way. Concrete suggestions about how we will refer to you will be included in the copy of the interview transcription shared with you, or in a follow-up messages if the interview is not tape-recorded.

O I agree that audio recordings will be made. The recordings will be converted to transcriptions and kept on file in a secure environment for the same duration of the transcriptions. The researcher(s) will provide me with a copy of the transcription to allow me to check for factual mistakes within a reasonable timeframe.

O I do not agree with making audio recordings. I agree that the researcher will take notes during the interview.

Name: []

Date: []

Signature: []

Group 3: Stakeholders at the Member State Level

Background & Role

1. Can you start by introducing your institution and your role in it?

2. Can you describe your institution's and your role in implementing or overseeing the

Data Governance Act at the national level? e.g., Transposing relevant aspects into

national procedures, supervising compliance, providing guidance, or coordinating with

EU bodies.

3. How does your institution coordinate with other national authorities and/or with EU

institutions regarding the DGA?

- If so, are there established channels for information-sharing, joint decision-

making, or consultation with stakeholders? How effective are they?

Legislative Intent

4. From your institution’s perspective, what are the main goals the DGA aims to achieve

in the national context?

5. Looking at the first years of DGA implementation, to what extent does your institution

think these goals have been met at the national level?

6. Does your institution believe that there are areas where the objectives are being met

more successfully, and others where progress is slower? If so, which ones?

Implementation Insights

7. Did your member state face any difficulties or challenges in implementing the DGA?

If so, which?

8. Did your member state face any specific conditions that facilitated the implementation

of the DGA in your country?

- E.g., pre-existing national laws, regulatory frameworks, technical

infrastructure, or in-house expertise.

Gathering Feedback from Stakeholders

9. How has your institution gathered feedback from stakeholders during the

implementation of the DGA? If so, which ones and through what means? (e.g., data

intermediaries, industry, civil society, public bodies), and (e.g., consultations,

workshops, surveys)?

10. Based on this feedback, are there notable differences in awareness or understanding of

the DGA between these groups?

11. Did your institution use stakeholder feedback to shape implementation strategies or

develop guidance materials? If so, what adjustments or improvements were made?

Future Directions

12. Based on your experience so far, are there any changes or clarifications to the DGA? If

so, which ones and why?

PERSONAL DATA - INFORMED CONSENT FORM

1

You are asked to participate in scientific research. Please take your time to decide whether you want to participate. You can stop your participation at any time (in writing or verbally), without giving a reason. You will find more information about the research below. Moreover, the researcher should have already provided you, either in an oral or written form, further details about the research and the specific focus of this semi-structured interview. Do not hesitate to ask questions to the researcher(s) or the supervisor if something is not clear. 1. Description of the research

• Title: From Theory to Practice: A Critical Review of The Data Governance Act Three Years On

• Researcher(s): Bárbara da Rosa Lazarotto

• Supervisor: Sophie Stalla-Bourdillon

• Research group or department: Law, Science, Technology and Society (LSTS)

• Purpose of the research: This research assesses the implementation and impact of Regulation (EU) 2022/868, the Data Governance Act (DGA), three years after its adoption. It examines the extent to which the DGA’s mechanisms have been effective in achieving their objectives, identifies the main barriers to their practical implementation, and considers the broader implications for the EU’s data governance framework.

• Practical conduct: The researcher carries out empirical research using both classical and innovative research methods used in social sciences and humanities’ research, and notably qualitative and digital methods such as documentary analysis, semi-structured interviews, or critical making. More specifically, this Informed Consent Form concerns the conduct of semi- structured interviews with experts. Altogether, we expect to carry out a maximum of ten interviews, each lasting approximately 60 minutes. Note that this research focuses on professional protocols and practices, not personal information about the professionals observed.

2. Responsible data controller VUB (Vrije Universiteit Brussel), Pleinlaan 2, 1050 Brussels, company number 449.012.406.

3. Description of risks and benefits Your participation will not involve any risks.

Your participation will involve the following benefits: - You will have the occasion to further reflect about the practices to which their work

partakes, and about the wider socio-political, legal and technical dynamics at play; - You will provide precious input to fundamental research, which is expected to be

beneficial to the advancement of research and knowledge across various scholarly

PERSONAL DATA - INFORMED CONSENT FORM

2

communities and potentially also to society and policy-makers (by casting a light on important and complex developments in European security politics).

4. Confidentiality We will keep the collected data confidential and respect the privacy legislation, including the European General Data Protection Regulation (GDPR).

5. Data – Purpose – Retention Time – Transfer

For this research, we will collect the following personal data: your name, your email address or other contact details that you provide us for the purpose of organizing the interview and/or receiving a copy of the transcript, as well as your expertise (e.g. education or specific training) and professional position, your perspective on the topics touched upon during the interview. As we are expected to keep a digital copy of this Informed Consent Form, we will also collect your personal data included in this document. We will only process your data for the purpose of scientific research. We will store your data for ten years after the end of the research. Your data may be re-used for the purposes of scientific research in the general interest, under the condition that protection measures are taken. Otherwise, your data will not be transferred to any third parties, unless with your explicit consent or due to a legal obligation.

6. Citations Without your express consent, you will not be cited in any publications. We may quote passages from the transcript of the interview in the context of our scientific activities (e.g. a publication or a presentation), but even in this case we will not cite you directly by name, but refer to you in a pseudonymized form.

7. Security The storage of your data will offer a high degree of protection, in accordance with the guidelines of VUB (VUB Charter of the Researcher, ICT Security policy). Your data will not be stored on a personal computer, an external hard disk or a USB stick, unless encrypted. We will pseudonymize your data as soon as possible. This means that we will replace data that can directly identify you, such as your name and e-mail address, by codes. A "translation key" will be necessary to convert the codes back to the original data. Only the researcher(s) and the supervisor have access to this key.

8. Your rights

You have the right to access, correct and erase your data, request information on the way we handle your data, request a copy of your data, limit the way we handle your data and ask us to transfer your data to third parties.

You are entitled to withdraw the consent to process your data at any time, without having to justify your request.

PERSONAL DATA - INFORMED CONSENT FORM

3

9. Contact

If you have questions or if you wish to exercise your rights, you can contact Bárbara da Rosa Lazarotto ([email protected]) or the data protection officer of VUB ([email protected]).

10. Complaints If you wish to complain about the way we handle your data, you can contact the researchers, the supervisor or the DPO (cf. above). Or you can file a complaint with the data protection authority:

Drukpersstraat 35, 1000 Brussel Tel. +32 2 274 48 00 email: [email protected] website: www.dataprotectionauthority.be

You also have the right to file suit at the competent court.

11. Declaration of the researchers The undersigned researchers confirm that the participant has received a copy of the present document and that they have answered all its questions.

Name: Bárbara da Rosa Lazarotto

Date: 04/09/2025

Signature:

12. Consent of the participant

O I have had the opportunity to ask questions and agree to participate in the research.

O I understand that my participation in this research is voluntary and that I can stop my

participation at any time, without having to give a reason.

O I agree with the collection of the following data for the research: name, email address or other contact details that I provided or may provide for the purpose of organizing the interview and/or receiving a copy of the transcript, information about my expertise (e.g. education or specific training) and my professional position/role, my perspective on the topics touched upon during the interview, and all personal data included in the Informed Consent Form.

Please note that your acceptance to the collection of all the above-mentioned data is essential. If you do not agree, you will not be able to participate in the research.

O I consent to the disclosure of the research results, for example by quoting passages of the interview or a paraphrasis, in a publication, conference or otherwise, without revealing my name. However, I can specify, during the interview, that some exchanges are to be considered off-the-record.

Please note that your consent to disclosing research results in a publication, conference or otherwise is essential. If you do not agree, you will not be able to participate in the research. Note that you are always entitled to signal, during the interview, that some exchanges are off-the-record. If the interview

PERSONAL DATA - INFORMED CONSENT FORM

4

is being tape-recorded, the audio-recording will be stopped during the duration of those exchanges. Note also that we will not cite your name but rather refer to you in a pseudonymized way. Concrete suggestions about how we will refer to you will be included in the copy of the interview transcription shared with you, or in a follow-up messages if the interview is not tape-recorded.

O I agree that audio recordings will be made. The recordings will be converted to transcriptions and kept on file in a secure environment for the same duration of the transcriptions. The researcher(s) will provide me with a copy of the transcription to allow me to check for factual mistakes within a reasonable timeframe.

O I do not agree with making audio recordings. I agree that the researcher will take notes during the interview.

Name: []

Date: []

Signature: []