As part of the European Commission's broader data strategy, the Data Governance Act (“DGA”) introduces a new regulatory regime for data intermediaries, which, inter alia, pursues the objective of increasing the competitiveness of the European data economy by bolstering trust in data-sharing mechanisms. Against this backdrop, we introduce data intermediaries and critically examine the DGA's related legal regime by testing its underlying assumptions and highlighting its intrinsic weaknesses and limitations as part of the broader EU data law puzzle. As a result, the paper brings to the fore certain contradictions between DGA's means and ends. Indeed, due to various questionable assumptions, the DGA imposes requirements that not all data intermediaries can satisfy and entrenches a specific techno-organisational form for data intermediation services that may turn out to be economically non-viable. Consequently, one must wonder whether the DGA's rules on data intermediaries are necessary and proportionate in light of the freedom to conduct a business. We furthermore uncover inconsistencies and loopholes between the DGA, the GDPR, the draft Data Act, and the Digital Markets Act. Overall, while the DGA's underlying efforts are laudable, its precise postulations may hinder the achievement of its underlying objectives due to two main factors. First its own internal limitations and incoherences, and, second, uncertainties and tensions resulting from its interplay with the broader EU data law framework.

Article 5(1)(c) of the European Union's General Data Protection Regulation (GDPR) requires that "personal data shall be [...] adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (`data minimisation')". To date, the legal and computational definitions of 'purpose limitation' and 'data minimization' remain largely unclear. In particular, the interpretation of these principles is an open issue for information access systems that optimize for user experience through personalization and do not strictly require personal data collection for the delivery of basic service.