2. Introduction¶
2.1 Document purpose¶
The purpose of the document is to specify Data Exchange Services, including high level architecture and key requirements for data value, trust and compliance.
Enabling digital transformation as well as developing innovative services requires the right data at the right time, aggregating from multiple sources to produce valuable insightful information.
However, within most organizations, data sharing is too often stalled by stakeholder resistance, data governance policies, lack of tools, and inability to address regulatory constraints.
Overcoming these resistances requires to establish reliable trust mechanisms throughout the data sharing process. The Gaia-X Data Product concept and its operational model, together with the Gaia-X Data Exchange Services, provide such mechanisms. In addition, they provide mechanisms to facilitate and demonstrate compliance with the European regulations regarding data (GDPR, Data Act, Data Governance Act and Trusted Data Transactions).
2.2 Document structure¶
This document opens with a presentation of the Gaia-X Data Product conceptual model and Data Transactions. It then describes the core Data Exchange Services that enable trustworthy data sharing across participants.
Subsequently, it provides an overview of the Data Products Catalogue and introduces initial considerations related to Data Access Logging.
Next, it explores the Data Usage Agreement and Data Access Contracts in depth, as a core concept of the Gaia-X data exhange model.
Finally, it outlines the Policies for data exchange and the use of ODRL, including illustrative examples.
2.3 Related Gaia-X Documents¶
This document is based on and synchronized with the work of Gaia-X Archicture Document and Identity Credentials and Access Management (ICAM) Document. The Gaia-X Data Exchange Services Working Group closely collaborates with the Gaia-X Service Characterisitcs Working Group to specifiy the related Data Exchange ontologies.
Note
Annex 1 specifies the current reference to the Gaia-X Ontology for Data Exchange, while Annex 2 provides a Data Exchange example related to personal finance management.
2.4 Terms and Definiitons¶
| Terms | Definitions | Additional Information | Link to Ontology |
|---|---|---|---|
| Contract Policy | Contract Policies that are interoperable to have a clear and unambiguous basis for a contract between the participants. | Contract policies should be machine and human readable. They have to contain access and usage policies. ODRL is used as a Policy Definition Language for this purpose. | |
| Data | re-interpretable representation of information in a formalized manner suitable for communication, interpretation, or processing | Note 1 to entry: Data can be used for communication, interpretation or processing by humans or automatic means. Note 2 to entry: Communication, interpretation or processing can include the exchange or sharing of data by one or more entities. | |
| Data Access | act or acts of providing access to data. | Note 1: “Data access” can be granted by (i) allowing access to the original data set, or (ii) by giving a copy of the data to the interested entity.Note 2: CEN/CLCC EN 18235-1 calls this activity “data sharing” or “data exchange”. | |
| Data Access Contract (DAC) | A DAC is established between a Data Provider and a Data Consumer. It focuses on service delivery : technical configuration, billing, SLA, termination clauses, etc. | NA | |
| Data Access Ccontract Store | system for storing data access contracts | NA | |
| Data Access Logging | Data Access Logging ensures that data transactions can be logged throughout their lifecycle, providing an audit trail for accountability, compliance and dispute resolution. | NA | |
| Data Access Logging Service | Data Access Logging Services are optional services that provide evidence that data has been (a) actually accessed (i.e. provided and received) and (b) that the Data Usage Agreement was enforced before access. | NA | |
| Data Access Protocols | Data Access Protocols are required to exchange data between Participants and to enable Data Access. | NA | |
| Data Consumer | A participant that receives data in the form of a Data Product. The data is used for query, analysis, reporting or any other data processing. | NA | https://docs.gaia-x.eu/ontology/2511/slots/dataConsumer/ |
| Data Exchange Services | A set of services that provides features enabling a Data Exchange, such as and not limited to: policy negotiation for access control and usage control, exchange traceability, service protocol negotiation, data access, data tiering, access enforcement, usage enforcement. | Data Connector or Data Exchange Platform are two different architecture implementations of potentially similar Data Exchange service features. | |
| Data Licence | Data License defines the usage policies for all data in the data product. Data Licenses contain a set of constraints related to the authorized or forbidden usage of the data in the Data Product. | NA | |
| Data Producer | party, device or any software that generates data | NA | https://docs.gaia-x.eu/ontology/2511/classes/DataLicense/ |
| Data Product | data sharing unit, packaging data and metadata, and any associated licence terms | Note 1 to entry: Data product does not necessarily imply commercial aspects. Note 2 to entry: Data product can be published in a data product catalogue that is searchable by data users. Note 3 to entry: In the context of trusted data transactions, a data product will be assocaited with data licence terms. | https://docs.gaia-x.eu/ontology/2511/classes/DataProduct/ |
| Data Products Catalogue | A Data Products Catalogue is a structured and a standardized registry of data products that is made available within an ecosystem. It allows data providers to publish, describe, and manage their offerings, and enables data consumers to discover, assess, and access data products that meet their needs. | NA | https://docs.gaia-x.eu/ontology/2511/classes/DataProductCatalogue/ |
| Data Product Catalogue Services | Data Product Catalogue Services are mandatory services that provide mechanisms to publish Data Product Descriptions (inc. metadata) and support search. | NA | |
| Data Product Description | Data Product Descriptions contain the Metadata describing the data (scope, format, quality, etc.) using an ontology which is defined by the ecosystem and contains information describing the contractual and operational aspects of the Service Offering (cost and billing, technical means, service level agreement, etc.). | NA | https://docs.gaia-x.eu/ontology/2511/classes/DataProductDescription/ |
| Data Provider | party that has right or duty to make data available to data users through data products | Note 1 to entry: Data Provider carries out several activities, i.e.: (i) non-technical, on behalf of a data rights holder, including the description of the data products, data license terms, the publishing of data products in a data product catalogue, the negotiation with the data users, and the conclusion of contracts. (ii) technical, with the provision of the data products to the data users. | https://docs.gaia-x.eu/ontology/2511/slots/dataProvider/ |
| Data Rights Holder | party that has legal rights or obligations to use, grant access to or share certain data, or transfer such rights to others. | NA | https://docs.gaia-x.eu/ontology/2511/slots/dataRightsHolder/ |
| Data Sharing | access to the same data by more than one authorized entity. | Note 1 to entry: Use of the data can be synchronous or asynchronous. Note 2 to entry: Data can be shared, for example, (i) by following access to the original data set, or (ii) by giving a copy of the data to the interested entity.Note 3 to entry: The way in which data are shared fundamentally influences the available controls and the statements needed in a data sharing agreement. (ISO ISO/IEC DIS 20151 & CEN CLC) | |
| Data Transaction | Result of an agreement between a data provider and a data user with the purpose of exchanging, accessing and using data, in return for monetary or non-monetary compensation. | “Data exchange“ and “data access” terms are used in order to describe different mechanisms, like actual transfer of data or situations where data does not move but where access is provided to different stakeholders.Data transactions do not necessarily imply a commercial relationship.Each data transaction is unique and must be treated independently of other data transactions. | |
| Data Usage Agreement | A DUA is established between a Data Rights Holder and a Data Consumer. It focuses on the usage conditions of the data contained in the Data Product. | NA | https://docs.gaia-x.eu/ontology/2511/classes/DataUsageAgreement/ |
| Data Usage Agreement Services | Data Usage Agreement Services are mandatory services that provide mechanisms to notarize/revoke Data Usage Agreements (DUA), to check their status, their validity (i.e. check that the signatory is really holding rights on the data) and their applicability (i.e. that the Data Access Prerequisites are fulfilled). | NA | |
| Data Usage Contract | Before using a data product, the data consumer negotiates and co-signs a Data Usage Contract (DUC) with the Data Provider. This Data Usage Contract is based on the data product description and includes the service configuration element and mutually agreed and enforceable Terms of Usage, resulting from potential negotiations. | NA | |
| DUA notary | A Data Usage Agreement (DUA) Notary is a specialization of a Notary validating the existence of a legally binding (e.g., signed by both parties, not revoked) Data Usage Agreement (DUA) between a Data Producer and a Data Consumer. | NA | |
| Metadata | Data about other data, documents, or set of data that describes their content, context, structure, data format, provenance, and/or rights attached to them. | NA | |
| Permissible Evidence | Permissible Evidence is a Verifiable Claim template and a set of Accepted Issuers. The accepted issuers shall be part of an Issuers catalogue maintained by the ecosystem, with for each issuer the access method and the list of accepted VC templates are specified. | NA | |
| Permissible Standard | Permissible Standards shall identify standards respectively requirements/controls within such standards, where implementation shall be considered prima facie evidence of conformity with the related Gaia-X criterion. | NA | |
| Runtime Policies | Runtime Policies are derived from the Contract Policies and are used for the execution of the contract policies in the system of the participants. | NA | |
| Signature | The signature can be a digital signature (as for instance an eIDAS signature) or simply an electronic form (as a click on a “I agree” button in a specific screen provided by the DUA Notary). | NA | https://docs.gaia-x.eu/ontology/2511/classes/Signature/ |
| Terms of Usage | A specific instantiation of a data license included in a data product usage contract listing all the constraints associated with a data exchange. | NA | |
| Usage Control | Usage control is an extension to traditional access control. It is about the specification and enforcement of restrictions regulating what must (not) happen to data. | NA |