1. Summary

This building block encompasses key decision-making points for the effective establishment and operation of a data space, namely the determination of an organisation's form and the establishment of a data space, the creation of a governance authority and the creation of a data space governance framework. Organisational form (or legal form) refers to the type of legal entity a data space may assume. A data space governance framework is a set of internal rules and policies applicable to all data space participants. A governance authority refers to bodies of a data space that are composed of and by data space participants responsible for developing and maintaining as well as operating and enforcing the internal rules.

The building block describes the options of creating a data space as an unincorporated (i.e. without legal personhood) and incorporated (i.e. as a legal person) entity and discusses most important consequences of these choices in a comparative way. The choice of legal of form of a data space has implications for the type and role of a governance authority, the ability of a data space to develop, implement and enforce its internal rules and, ultimately, data space’s overall development and sustainability.

The role of a governance authority may entail various functions, such as setting internal rules and policies, ensuring compliance with internal and external rules, and resolving conflicts that may arise. A governance authority also creates mechanisms for continuous improvement of the data space, identity management, access controls and risk mitigation to build trust and quality within the data space. Overall, the governance authority maintains and operationalises the internal rules for the successful operation of the data space.

Determining the organisational form and establishing the governance authority should be completed before the data space enters the operational phase. At least in the most essential parts, a data space governance framework should be created in parallel to support the functioning of the new data space. The organisational form, type of governance authority and its role may evolve over time due to the scaling up of the data space or the assumption of new functions.

2. Purpose of the building block

This building block aims to help the members of a data space initiative understand their options for its legal formalisation. A data space's business model and technical arrangements require legal formalisation to fully unfold their functionalities, ensure legal rights and business interests, and minimise risks for all data space participants. This building block provides basic information regarding creating a data space as a legal form or collaboration based solely on contracts.

3. Elements and their key functions

3.1 Determining an organisational form and establishing a data space

A data space usually starts when several organisations have data sharing needs (i.e., a data space initiative). As one of the first steps, the members of a data space initiative need to reach several basic agreements such as that they all want to work towards establishing a data space, what sector or sectors of the economy they want to target and how they would work together to achieve it. These agreements do not need to be formalised but can be a simple understanding or informal agreement between the committed members of a data space initiative.

The committed members then continue working together on the business model of the future data space Business ModelPreview. While developing the business model, they also consider the following non-exhaustive list of questions that are decisive for the organisational form of the future data space:

• Should the future data space be a permanent or temporary (even if multiyear) establishment?

• Should the future data space have a legal personality?

• Does the future data space aim to generate profits for its members (i.e. the legal entities that create it)?

• What country will be the primary place of establishment (i.e. headquarters) of the future data space?

• What level of involvement do the members of the data space initiative want to have in managing and operating the future data space?

The answers to these questions should help the committed members of a data space initiative shape the space's business model and decide on appropriate legal arrangements (Figure 1, also see Establish Organisational Form in the Co-Creation Method).

Open

Figure 1. Decision tree including some of the core design choices for organisational form

3.1.1 Data space without legal personality (unincorporated data space)

If there is uncertainty about the permanent establishment or disagreement about the legal form at the beginning of a data space initiative, the committed members of a data space initiative can use various contractual arrangements to give structure to the data space as a multiyear project. For instance, some European Union Member States allow the creation of joint ventures that are not separate legal forms (i.e. participants of a joint venture simply share resources and knowledge). It is also possible to sign other types of cooperation/ collaboration agreements, such as strategic alliance agreements or consortium agreements. For simplicity, all such agreements are called founding agreements and the parties to the founding agreements are called data space members in the text below. By signing the founding agreements, data space members created special obligations towards each other with regard to achieving the goals of their cooperation.

These founding agreements are governed by national civil law that may have specific requirements for their content and form (e.g. simple written form or notarised). Such agreements typically describe the goal of the common project and outline the roles and responsibilities of different members, profit sharing and compensation arrangements, remedies for failure to deliver, applicable law and dispute resolution rules and termination provisions. It is important to underscore that unincorporated joint venture, consortium and other similar cooperation are temporary arrangements that are created to achieve a certain goal. Therefore, the founding agreement must contain provisions on when the agreement is terminated (e.g. upon reaching the goal, after a certain time, upon occurrence of a certain event). Due to the complexity of the arrangements, a written recording of any such agreements is strongly advisable, but no other actions (e.g. authentication by a notary or registration) are usually necessary.

New members can join unincorporated joint ventures, consortia and other types of cooperation only if all current members agree to it and only after the prospective member signs the founding agreement. In such a case, the founding agreement may need amendment because the new member is likely to assume a new role and responsibilities.

3.1.1.1 Consequences of this organisational option and contractual safeguards

Unincorporated joint ventures, consortia and other types of cooperation do not have their own resources and rely solely on the resources, capacities and capabilities of their members. They are tightly controlled by their members, which sometimes might hamper their activities, especially if one of the members does not fully pull its weight and refuses to be replaced. Therefore, it is advisable to expressly allocate in the contract different roles and tasks to be performed by each of the members. A single description of the overall work by each member minimises the risk of scope gaps and the potential for internal disagreements.

Because data management of third parties is expected, the founding agreement must include clauses addressing data management. In particular, if a data space handles personal data, it is necessary to determine which member within this data space is a data processor as required by the GDPR (for more details see Regulatory Compliance). Even if a data space does not handle personal data, it is still necessary to determine which member(s) is(are) responsible for data security and what their responsibilities are. Due to the importance and likely complexity of data management involved, it is advisable for members to design and sign a separate data management agreement.

Because no legal person is created as a result of this cooperation, legal liabilities and ownership remain by default with the individual members and must be specified in the founding agreements.

In particular, usually all results of the conducted work are owned by the party that generates these results (e.g. if a member X creates software X, this software remains member X’s property). Members can agree in the founding agreements on joint ownership of all or only certain results from the cooperation. In this case, they need to agree how exactly they will dispose of joint property rights, including transferring, licencing and distributing the royalties.

Typically, members are solely liable for their actions towards each other, but in the founding agreement they can limit their liability proportionally to their total share in the cooperation. In relations to third parties (i.e. those who are not a member of the founding agreement), members are solely liable for their actions in fulfilling their responsibilities under the founding agreement, and no limitations by the founding contract is possible. Also, agreements need to be negotiated regarding the liability for the assets commonly used or created (e.g. who is paying for the electricity used by the data space; who will do maintenance; who will pay for the necessary software licences; etc.).

An unincorporated entity must also decide on who represents the data space towards other data space participants such as data transaction participants and providers of enabling services as well as third parties. This is of huge importance because the unincorporated data space itself is not able to conclude any agreements in its name. Instead all agreements must run via individual members, but it is likely that the data space interests should be represented or considered in the agreement negotiation.

Addition of any new members requires the agreement (consent) of all existing members. If a new member joins an unincorporated data space, a change of the founding agreement is necessary to determine the role, rights and obligations of the new member. In connection with this, a substantial re-negotiation of the contractual roles, ownership arrangements, liabilities and other issues among all members is likely because a new member brings new dynamics into the existing cooperation.

3.1.1.1 Creation of Governance Authority

Unincorporated joint venture, consortium and other types of cooperation are completely member-driven, which requires strong governance arrangements to align and coordinate individual activities. These governance arrangements are dedicated to achieving the commonly defined purpose of the cooperation (e.g. by generating all of the intended deliverables). The governance arrangements do not extend to actually managing any of the resources (because these remain at the full disposal of the members) or controlling and managing any of the results (because the ownership of those lies with the members).

Members of an unincorporated data space can set up a governance authority for their cooperation according to their needs and wishes. There are no legal requirements for equal or any other specific representation in decision-making, which may lead to power imbalances between contracting parties. Therefore, it would be important to follow the best practices of corporate governance. The governance authority typically consists of all members of the consortium/ joint venture and is ultimately responsible for decision-making and achieving the goals of the cooperation. It can be called “general assembly”, “steering group”, or else. The decisions by this governance authority are adopted unanimously and are binding on the members of the founding agreement. The members then decide separately and for themselves how they implement these decisions to achieve the goals of the cooperation.

It shall be underscored that any individuals active in the governance authority in any capacity remain employees on the payroll of individual members and are subject to the direction of and supervision by these members.

In sum, founding agreements are relatively easy to change depending on the project's needs and circumstances. They can be prolonged, if the original goal has not been achieved. A conversion to a permanent legal person can be done at a later stage of the data space development cycle (e.g. in the implementation stage) once the business model of the data space matures. At the same time, they are very complex documents that must contain safeguards regarding any eventuality. Unincorporated data space is unlikely to be sustainable over time, develop beyond a certain initial point to become truly stand-alone and develop an own dynamic. For this, a data space should become incorporated.

3.1.2 Data space with legal personality (incorporated data space)

When the decision is reached to establish a data space as a permanent structure, establishing a new legal person or creating a data space based on an existing legal person is necessary. Currently existing data spaces that do not have profit-making as their purpose have frequently established themselves as associations and sometimes as foundations. A limited liability company is the most popular legal form for data spaces with profit-making objectives.

If the committed members of a data space initiative decide on an establishment under national law, they will have great flexibility to choose from dozens of various legal forms across 27 EU Member States. Each of those legal forms has its advantages and disadvantages and needs to be considered in detail depending on the data space business model, use cases and more general considerations related to the business location (e.g. availability of the necessary infrastructure, skilled staff, tax rules, business-friendliness, red tape). At the same time, the choice of the business location and legal form is likely to require adjustments to the business model.

In addition, legal forms created under EU law could be particularly attractive for data space targeting cross-border markets and for Common European Data Spaces. Legal forms under EU law allow a company to operate as a single entity throughout the EU and be subject to harmonised rules. One can choose from:

1. European Digital Infrastructure Consortium (a special legal form created for Common European Data Spaces and special multi-country projects);

2. European Company (a for-profit legal entity, similar to the limited liability company);

3. European Cooperative Society (a non-profit with characteristics of a cooperative and public limited company); and

4. European Economic Interest Grouping (a non-profit legal entity similar to a partnership).

Once the members of a data space initiative agree on the legal form for the intended data space, they need to sign a founding agreement (usually called a statute, articles of incorporation or articles of association). Its form and minimum contents are regulated by the national law of the respective EU Member State or by EU law. They vary slightly depending on the exact legal form in question, but the main elements are name and address of the registered office, purpose and intended activities, method of convening of the general assembly and appointment and dismissal of directors, powers of representation to the third parties, certain monetary obligations between the organisation and its members, admission of new members and what happens to the organisation’s property in the case of dissolution. Natural and legal persons that have signed the founding agreement are called data space members. Data space members are in contract (i.e.  founding agreement) with each other for the purpose of the establishment of a data space and, to this end, have special rights and obligations.

While the choice of legal form and business location for a data space is a serious matter, it can be changed later on. However, such a change is not a trivial task and cannot be done very often. In particular, converting from a for-profit legal form (e.g. limited liability company) to a non-profit (e.g. foundation) is rather difficult due to the change in the applicable taxation rules. Also, a company created under the national law of one EU Member State cannot, in most cases, move its headquarters to another EU Member State without first dissolving and re-establishing itself in the new location under the new national law.

3.1.2.1 Consequences of this organisational option

The execution of this organisational option leads to the creation of a data space as a legal person that is separate from its members. This means that the said data space can own property, enter into contractual relationships with other legal entities, be beneficiary of legal rights, be responsible and liable for its own obligations and employ own staff. Results of any work performed by such data spaces are their own (intellectual) property, of which they can dispose freely. Once the founding agreement is signed, such data spaces can develop their own dynamics, gradually becoming more autonomous from their members.

In relation to their members, such data spaces maintain certain obligations, depending on the exact company form. For example, a for-profit data space may have an obligation to distribute profits to its shareholders. Members have the right to participate in the main governance body – e.g. general assembly – and decide on the most important, strategic questions of the data space development (e.g. admission of new members). However, the control by members over the data space is rarely comprehensive: it is unlikely to extend to all activities of the data space and, even for the most important issues, a majority decision is sufficient. By contrast, third parties may participate in a data space as data providers, service providers, data recipients and have contractual relationship with the data space, but they do not have decision rights.

The process of and requirements to the addition of new members depend on the legal form of the incorporated data space and are defined by law and further specified by the founding agreement. In some cases, the agreement of all existing members is required, while in others it suffices that the new member buys shares of the company. No substantial changes to the founding agreement or re-negotiation of rights and obligations are usually necessary.

3.1.2.2 Creation of governance authority

Incorporated data spaces need bodies to create, maintain, and enforce their internal rules and manage the data spaces’ day-to-day operations. A body is a differentiated structure of an organisation that performs specialised functions. For example, if a data space is created as a non-profit in the legal form of an association, it will have to comply with a legal requirement to have two bodies: a general assembly of members and a management board. The general assembly of members is a representative body consisting of all members and makes the most important decisions regarding the association. All members vote for decisions, although not all decisions must be taken unanimously. The management board is an executive body that puts into practice the decisions of the general assembly of members. The management board is appointed or elected by the general assembly and is accountable to it for its activities. The management board effectively runs the association on a daily basis. It is not representative and may include staff specifically hired by the data space for their management skills. Data space’s bodies jointly constitute a data space governance authority; however, data spaces may choose a different name for such an institution. A data space governance authority's form, composition and competencies are determined jointly by the founding members (i.e. legal and natural persons that established the data space). In addition, a data space governance authority is strongly impacted by the business model and legal form of the data space.

Figure 2 provides a visual illustration of the governance authority of an incorporated data space.

Open

Figure 2. Governance authority of an incorporated data space

The members of a data space can decide on the size and composition of the data space governance authority within the limits set by law and depending on the size and needs of the data space. For small data spaces, the executive body may consist of a few people or even one person. Common European Data Spaces in the form of a European Digital Infrastructure Consortium will be large entities requiring a lot of management work and, therefore, need many personnel. They are also more likely to need additional specialised bodies (e.g. working groups or committees) for specific tasks. For instance, due to the high number of participants in a Common European Data Space, there might be a need for a separate committee on participation management.

The legal and natural persons that established a data space (i.e. data space members) can determine the competences of the data space governance authority within the limits of the law (e.g. rules on competencies of the executive body, rules on the representation of the data space in dealings with third parties, rules on the creation of working groups and committees).

If a data space is created based on an already existing legal person and this person runs different business operations besides a data space, it is advisable to create a separate body solely for managing the data space. However, this decision would be within the remit of such a legal person, depending on its business model and the data space size.

To summarise the discussion of unincorporated and incorporated data spaces, Table 1 below provides a concise comparative overview of their main features.

3.2. Creation of the data space governance framework

A complex set of rules governs each data space. Some of these rules are external to the data space, meaning they come from the government, and an individual data space must comply with them. These are legal and regulatory rules (see Regulatory CompliancePreview). Other rules are internal in the sense that they are determined by the members of the data space within the limits and following the requirements of the applicable laws and regulations. These internal rules can consist of founding agreements, contractual framework to join the data space as a participant (see Contractual framework), internal policies, governance procedures, technical specifications for the use of data space and other frameworks. The said internal rules build the body of the rulebook, which serves as an operationalisation of a data space governance framework (see the template for the development of a rulebook by Sitra as an inspiration for what types of internal rules can be included).

As described above, the founding agreement contains the fundamental rules related to the internal organisation and decision-making of a data space. In some cases, much of the content of founding agreements is prescribed by law.

Within the framework of the founding agreement and applicable laws, each data space can and should draw up terms and conditions of use of the data space, internal regulations and policies that govern its day-to-day affairs and operations, and various governance procedures (e.g. dispute resolution, adding or changing technical specifications and others). All of them should be part of the agreement that every data space participant must sign before joining the data space and starting conducting data transactions.

Technical specifications for the data space (e.g. API definitions, semantic models in use, requirements to provenance and traceability and others as described in Technical Building Blocks) also constitutes part of internal rules of a data space. By joining a data space and entering into the respective agreement, each data space participant commits to following the specified technical requirements.

All of the mentioned documents should be prepared and discussed by the executive body of the data space governance authority or by specially created working groups within the governance authority. More technical documents that require specialised expertise can be adopted by the executive body. However, documents of a more general nature (e.g. internal policies for the use of the data space and its internal procedures) should be approved or voted on by the decision-making body of a data space representing all members (with the right to vote). Such an approach not only follows the principles of good corporate governance of representation and inclusivity, but also allows for more flexibility in the operation of a data space.

Each data space tailors the contents of the rulebook to its own needs so that, if necessary, other frameworks can be included in it (e.g. model contracts for data transactions, requirements to data licensing) (see the IDSA Rule Book for a specific example of an existing rulebook of a data space). Once adopted, all data space internal rules are documented in a data space rulebook for operational use. The rulebook must be expressed in a human-readable format and, if possible, a machine-readable format.

4. Co-creation questions

5. Links to other building blocks

• This building block depends strongly on the business model (see Business ModelPreview ). Several business decisions taken by the members of the data space initiative will determine the choice of the legal form (e.g. whether it is a temporary or permanent establishment; in which country or countries it shall be active; whether the purpose is to make profits for the members or to support business activities of the members). At the same time, some of the limitations of applicable legal frameworks may require members of the data space initiative to adjust their business model.

• The building block Participation Management (see Participation ManagementPreview ) depends on this building block. The chosen organisational form will trigger certain legal obligations that will steer processes regarding the admission of new members, their participation in the data space governance authority and their roles, rights and obligations towards the data space more generally.

• The building block Contractual Framework (see Contractual FrameworkPreview depends on this building block. Contractual arrangements will define the rights and obligations of the data space members towards each other and towards the data space. At the same time, contracts concluded (e.g. who are the contracting parties, what are their liabilities) depend on the organisational form chosen for the data space.

6. Future topics

Planned additions:

• Further alignment of the section on the governance framework with the SITRA Rulebook if necessary;

• If necessary, text on federated data spaces can be added.

7. Further reading

• European Commission, European Digital Infrastructure Consortium User Guide, 2023.

• European Commission, Setting up a European Company (SE).

• Many countries and organisations publish model cooperation/ collaboration agreements that can be used by data space members and adjusted to the needs of their data space initiative. Some of the most renowned model agreements are the DESCA Model Consortium Agreement, the International Chamber of Commerce Model Joint Venture Agreement, and the UN ITC contractual joint venture model agreements.

• European Corporate Governance Institute publishes corporate governance codes for various European countries. While these codes are oriented primarily at for-profit listed companies, principles and recommendations are best practices and can be followed by other legal entities as well.

• IDSA, IDSA Rule Book, 2021.

• Sitra, Sitra Rulebook, 2022.

8. Glossary