The right to data portability in practice: exploring the implications of the technologically neutral GDPR

Abstract

... The introduction of the General Data Protection Regulation (GDPR)1 has been called ‘the most significant data privacy reform process in history’.2 This new law reinforces existing data subject rights in an attempt to rebalance power between citizens and the increasingly sizeable and international companies that are collecting and exploiting data from them. As the GDPR only came into effect recently on the 25 May 2018, it is timely to study how this Regulation works in practice. In this article, we examine the new data subject right introduced under the GDPR, Article 20’s right to data portability (RtDP). Described by the European Data Protection Supervisor (EDPS) as ‘the gateway in the digital environment to the user control which individuals are now realising they lack’,3 the RtDP provides the right for data subjects to receive personal data concerning him or her and the right to transmit those data from one data controller to another. The RtDP is interesting to study as it operates under a framework that aims to be technologically neutral to maintain reasonable longevity of the law. In section ‘GDPR Article 20—the right to data portability’, we explore the historical background, current developments, and existing research on how data portability sits within the GDPR. Traditionally grounded in competition and consumer law, the RtDP is also the first of its kind to be included in data protection law. As a new right, it is yet to be seen whether data portability can be used as a means for protecting the processing of data subjects’ personal data. However, given that data portability requires specific technologies for implementation, little guidance has been provided to data controllers with regards to compliance. To see how the RtDP works in practice, we then conduct 230 data portability requests to a broad range of data controllers and discuss the successes and failures of making these requests as data subjects. With the responses received, we assess the types of data formats used, and the completeness and appropriateness of the RtDP requests. We show some of the potential impediments that data subjects and data controllers may face in exercising and complying with the RtDP, respectively. Then, we revisit the definitions of data portability terminology based on the legal implications identified from the GDPR’s technological neutral framework in application to the RtDP. Finally, we discuss future areas for work in section ‘Future work’, where different stakeholders could help to further clarify the RtDP and suggest ways to overcome these obstacles.