Legal and Governance Issues in the Implementation of the High-Value Data Regulation (EU) 2023/138: An Analysis of the Spanish Model

ABSTRACT Commission Implementing Regulation (EU) 2023/138, which implements Directive (EU) 2019/1024 on open data, marks a regulatory turning point for European public administrations. The Regulation not only requires the publication of certain categories of information but also imposes technical modalities (primarily access via Application Programming Interfaces (APIs)) that compel a conceptual shift: from a passive role as information publishers to an active role as providers of dynamic data services. Accordingly, the Regulation establishes a framework for publishing high-value datasets (HVDs) in order to maximise reuse and generate socioeconomic value. However, its implementation within decentralised administrative structures such as Spain’s reveals significant legal and governance frictions. This article analyses the problems arising from the clash between Spain’s traditional hierarchical model of public data management, derived from the INSPIRE Directive 2007/2/EC and transposed through Law 14/2010 of 5 July on spatial data infrastructures and services in Spain (LISIGE), and the new European Regulation’s requirements for decentralised, immediate, API-based access. Taking Spain as a case study, this article examines (i) the uncertainty as to which body is legally required to expose and maintain the mandatory APIs, (ii) the interoperability and standardisation gaps between administrative levels, (iii) the capacity asymmetries that may undermine uniform compliance, and (iv) the interaction between open licences and the States non-contractual liability for defective or outdated data. Drawing on doctrinal analysis and comparative lessons from other Member States, the article argues that effective compliance requires a federated governance architecture, a clearer allocation of responsibilities, enforceable coordination mechanisms and specific support for under-resourced entities.

KEYWORDS High-value datasets - Open data - API - Federated governance - Interoperability - Liability - Subsidiarity - Spain

TABLE OF CONTENTS 1. Introduction. – 1.1. Context and Purpose. – 1.2. Methodology and Scope. – 2. European Regulatory Framework for High-Value Data. – 2.1. From Open Data to High-Value Datasets. – 2.2. Links with the Data Governance Act and the Data Act. – 3. The Tiered Data Architecture in Spain. – 3.1. Domestic Legal Foundations. – 3.2. Operational Limitations of the Aggregation Chain. – 3.3. Doctrinal Framework: Inter-Administrative Cooperation and Digital Infrastructures. – 3.3.1. Subsidiarity as an Operational Allocation Criterion. – 4. Emerging Legal Issues in the Implementation of HVDs. – 4.1. Uncertainty as to Which Body Is Obliged to Publish the API. – 4.2. Fragmentation of Standards and Weak Interoperability. – 4.3. Capacity Gap and the Risk of a ‘Two-Speed Europe’. – 4.4. State Liability and Open Licences. – 4.5. Lack of a Sanctioning Regime and New Cybersecurity Risks. – 4.6. The Clash of Models: Tiered vs. Federated (Comparative Experiences). – 4.7. Proposed Table of Roles and Responsibilities in a Federated Governance Model. – 5. Proposed Normative and Governance Improvements. – 5.1. Normative Reforms. – 5.1.1. Explicit Designation of the Competent Authority by HVD Category. – 5.1.2. Sanctioning Regime and Effective Compliance Mechanisms. – 5.2. Implementation Toolkit. – 5.2.1. Federated, ‘Publish-at-Source’ Model with Synchronised Catalogues. – 5.2.2. Funding Programmes and Technical Support for Local Entities. – 5.2.3. Security-by-Design Clauses and Periodic API Audits. – 5.2.4. Multilevel Coordination and Training of the Actors Involved. – 5.2.5. Unified Inventory and Improved Metadata Management. – 5.2.6. Planned Transition for Datasets Currently Subject to Fees or Restrictions. – 5.2.7. Assisted Implementation of APIs and Bulk Downloads. – 6. Conclusions.