Motivation: In a broad sense data sharing onboard public transport vehicles is governed by two different business models – interoperable and free of charge access for some data versus data that is restricted to specific uses by commercial contracts and existing legislation. Under the Digital Decade the EU has proposed new legislation with the ambition to promote a single digital market. The question then arises – how will the upcoming regulations affect existing business models for data utilisation?

Method: We have investigated two different cases where existing technology meets upcoming EU legislation. The questions have been framed through dialogue with actors in the industry, to cover topics and questions that are both concrete and current. Using the policy lab methodology, we have investigated the possibility to re-use surveillance film from public transport vehicles for passenger counting. The analysis compares GDPR and the Swedish camera surveillance act with the proposed AI Act, to see what new possibilities or obstacles arise. We have also explored the changes that the Data Act may impose on different actors’ access to data derived from the batteries installed in an electric bus.

Results: The AI Act will not change the business models within the eco-system but facilitate access to more personal data (including personal data where GDPR otherwise would be a barrier), useful for training automated passenger counting. Those responsible for placing the system on the market will still need to ensure that they are compliant with GDPR in terms of processing personal data. In terms of the Data Act the outcome is more disruptive as the owner and user of a vehicle is entitled to all data representing their usage, free of charge, and this will impair existing business models for data access. It is also possible for multiple actors to be users, for instance if the vehicle is owned by a public transport authority and leased by an operator.

Discussion: Our analysis shows that while the impact of the Data Act can resonate with the ambitions behind the regulation in terms of making more data interoperable and available free of charge, it can also have the opposite effect. The latter is specifically the case where altruistic data sharing already is in place and the Data Act imposes standard contracts for and role-based restrictions towards utilisation. Both the AI Act and the Data Act are complex and often difficult to assess. In relation to the Data Act, the recitals were helpful for interpreting the application of articles and definitions. For understanding the relationship between the AI Act and GDPR we combined the legal analysis with prototyping the impacts and relied on sharing insights with other actors. This highlights the need for multiple ways of performing the data collection and analysis as well as the suitability of policy labs as a research method