R3Legal
This chapter in shortThe laws that apply, the agreements that put the Rulebook into effect, and how licences work.
Highlight what applies to
R3.1Regulations that apply
Applies toData providersData consumersService & compute providers
In shortEach participant is responsible for its own legal compliance. EMPOWER-X sets rules and tools that make compliance easier, and checks them where it can.
Each participant is responsible for its own legal compliance. EMPOWER-X sets rules and tools that make compliance easier and checks them where it can.
Regulations, triggers and requirements
| Regulation | Triggered when | Requirement in EMPOWER-X |
|---|---|---|
| GDPR | An offer contains or derives from data about an identifiable person (smart meters, charging sessions, households) | Personal-data flag on the offer; lawful basis held by the data holder; compute-to-data or aggregation by default; DPIA where required |
| Data Governance Act | A participant offers data intermediation services, or public-sector data under protection is reused | Neutrality and notification duties for intermediaries; conditions for reuse of protected public data |
| Data Act | A user requests data generated by a connected product (meter, charger, inverter), or a participant provides data processing services | Support for user access and sharing requests; switching and portability; fair contractual terms |
| Electricity Directive (EU) 2019/944 and national transposition | Metering and consumption data, or energy communities, are involved | Respect eligible-party access rules and DSO neutrality |
| NIS2 | A participant is an essential or important entity in the energy sector | Security measures and incident reporting by that participant |
| AI Act | An AI system is offered as a service | Provider classifies the system and supplies the required documentation |
| Open Data Directive and Spanish reuse law | Public-sector bodies publish data | Reuse conditions and licences compatible with public-sector rules |
| Spanish data protection law (LOPDGDD) | Personal data of individuals in Spain | Spanish-specific requirements on top of the GDPR |
R3.2Compliance mechanisms
Applies toEveryone
In shortCompliance is checked at four moments, not once.
Compliance mechanisms
- At onboarding: credential validation and the eligibility check (R1.4).
- At publication: the publication checklist, including licence, personal-data flag and access mode.
- Continuously: credential status checks before each order, and the conformance tests in R5.6.
- Periodically: a quarterly review of the catalogue and a yearly regulatory watch by the Legal and Ethics Advisory Group, which updates the table in R3.1.
R3.3Agreements
Applies toEveryone
In shortThree agreements put the Rulebook into effect.
Three agreements put this Rulebook into effect. The Participation Agreement is public on Downloads; the other templates are available to members.
Participation Agreement
Signed by each participant with the Governance Authority. It binds the participant to this Rulebook and sets the term, termination, liability and fees (when applicable).
Service Provisioning Agreement
Applies to algorithms, compute and other services. It adds a service description, service levels, support and limits of liability. Its standard terms are shown with each service in the service catalogue.
R3.4Licences and data sharing
Applies toData providersData consumers
In shortEvery offer carries a licence the data holder has approved in writing. Without one, the offer is marked "Licence pending".
Data sharing: licence and offer terms
- Every offer carries a licence approved in writing by the data holder. The licence states what the consumer may do with the data, for how long, and whether onward sharing is allowed.
- A privacy policy is not a licence. A link to a privacy policy, or to any document that does not grant usage rights, does not meet this rule.
- The licence link must open publicly from the internet. Internal network addresses and test domains are not accepted.
- Providers should use a standard licence (for example CC BY 4.0, CC0 or ODbL) or the EMPOWER-X standard data licence template. Bespoke licences are allowed if they are complete and approved by the data holder.
- Until the data holder has approved a licence, the offer shows the status "Licence pending" and may be used only by parties already authorised by the data holder (for example pilot partners).
- Ordering an offer is acceptance of its licence and policy, and forms the data sharing agreement between provider and consumer.
Transitional rule
Offers published before this Rulebook applies must pass the publication checklist within 60 days. Until then, offers without an approved licence show "Licence pending" under R3.4.
Machine-readableoffers/offer-profile.shacl.ttl
R3.5Liability, IP and disputes
Applies toEveryone
In shortEach participant answers for its own acts. Publishing an offer transfers no ownership. Disputes go through three steps.
Liability, intellectual property and confidentiality
- Each participant is liable for its own acts and for the accuracy of its credentials and offers.
- The Governance Authority and the operator are liable only for running the shared services with reasonable care, not for the content of offers.
- Publishing an offer transfers no ownership. Results of compute-to-data jobs belong to the consumer unless the licence says otherwise.
- Participants keep confidential any non-public information learned through EMPOWER-X.
Dispute resolution
- Negotiation between the parties for 30 days.
- Mediation by the Governance Authority, or by an independent mediator when the Governance Authority is a party.
- If unresolved, the courts of the registered office of the Governance Authority, under Spanish law, unless mandatory law provides otherwise.
The Governance Authority keeps an anonymised register of disputes and their outcomes, used to improve this Rulebook.