How Portable is Portable?: Exercising the GDPR's Right to Data Portability
Open accessAbstract
The new European General Data Protection Regulation has introduced several new rights designed to empower users and regulate imbalances of power between those who collect and control data and those to whom the data refer. In this paper we focus on one particular right, the right to data portability, and examine how it is being implemented. We discuss the responses to 230 real-world data portability requests, and examine the file formats returned and difficulties in making and interpreting requests. We find variation in file formats, not all of which meet the GDPR requirements, and confusion amongst data controllers about the various GDPR rights.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In practice, many organisations appear ill-prepared for meeting their disclosure obligations.
“Note that, in practice, many organisations appear ill-prepared for meeting their disclosure obligations [65,76]”
From Reviewable Automated Decision-Making: A Framework for Accountable Algorithmic Systems (2021) · cites this paper as [76]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Emmers, E. (2019) · SGEM International Multidisciplinary Scientific Conferences on Social Sciences and Arts · doi:10.5593/sgemsocial2019v/1.1 · Cited by 1,317 · see citing works
ARTICLE 29 Data Protection Working Party
Sotiropoulos, D. M. (2013) · Cited by 434 · see citing works
The right to data portability in the GDPR: Towards user-centric interoperability of digital services
Hert, P. D., Papakonstantinou, V. N., Malgieri, G., Beslay, L., & Sanchez, I. (2017) · Computer law & security review · doi:10.1016/j.clsr.2017.10.003 · Cited by 262 · see citing works
Brown, I., & Marsden, C. T. (2013) · The MIT Press eBooks · doi:10.7551/mitpress/8879.001.0001 · Cited by 131 · see citing works
Realising the right to data portability for the domestic Internet of things
Urquhart, L., Sailaja, N., & McAuley, D. (2017) · Personal and Ubiquitous Computing · doi:10.1007/s00779-017-1069-2 · Cited by 109 · see citing works
Fairness and enforcement: bridging competition, data protection, and consumer law
Graef, I., Clifford, D., & Valcke, P. (2018) · International Data Privacy Law · doi:10.1093/idpl/ipy013 · Cited by 100 · see citing works
Shattering one-way mirrors – data subject access rights in practice
Ausloos, J., & Dewitte, P. (2018) · International Data Privacy Law · doi:10.1093/idpl/ipy001 · Cited by 96 · see citing works
Data portability among online platforms
Engels, B. (2016) · Internet Policy Review · doi:10.14763/2016.2.408 · Cited by 91 · see citing works
Why the Right to Data Portability Likely Reduces Consumer Welfare: Antitrust and Privacy CritiquePreprint
Swire, P., & Lagos, Y. (2012) · SSRN Electronic Journal · doi:10.2139/ssrn.2159157 · Cited by 84 · see citing works
Data Portability and Data Control: Lessons for an Emerging Concept in EU Law
Graef, I., Husovec, M., & Purtova, N. (2018) · German Law Journal · doi:10.1017/s2071832200023075 · Cited by 59 · see citing works
Privacy threat model for data portability in social network applications
Weiss, S. (2009) · International Journal of Information Management · doi:10.1016/j.ijinfomgt.2009.03.007 · Cited by 58 · see citing works
How to attribute the right to data portability in Europe: A comparative analysis of legislations
der Auwermeulen, B. V. (2016) · Computer law & security review · doi:10.1016/j.clsr.2016.11.012 · Cited by 53 · see citing works
Social Networks and Data Portability using Semantic Web technologies
Bojārs, U., Breslin, J. G., & Decker, S. (2008) · ARAN (University of Galway Research Repository) (Ollscoil na Gaillimhe – University of Galway) · doi:10.13025/21400 · Cited by 39 · see citing works
Edwards, L. (2018) · Cited by 36 · see citing works
Unfolding the New-Born Right to Data Portability: Four Gateways to Data Subject Control
Uršič, H. (2018) · SCRIPTed A Journal of Law Technology & Society · doi:10.2966/scrip.150118.42 · Cited by 35 · see citing works
What happens when facebook is gone?
McCown, F., & Nelson, M. L. (2009) · ACM/IEEE Joint Conference on Digital Libraries · doi:10.1145/1555400.1555440 · Cited by 30 · see citing works
Collectively Exercising the Right of Access: Individual Effort, Societal EffectPreprint
Mahieu, R., Asghari, H., & van Eeten, M. J. G. (2018) · SSRN Electronic Journal · doi:10.2139/ssrn.3107292 · Cited by 29 · see citing works
Data Protection: Enter the General Data Protection RegulationPreprint
Edwards, L. (2018) · SSRN Electronic Journal · doi:10.2139/ssrn.3182454 · Cited by 26 · see citing works
The Unaccountable State of Surveillance
Székely, I., & Vissy, B. (2017) · Law, governance and technology series · doi:10.1007/978-3-319-47573-8 · Cited by 19 · see citing works
Data Portability and Data Control: Lessons for an Emerging Concept in EU LawPreprint
Graef, I., Husovec, M., & Purtova, N. (2017) · SSRN Electronic Journal · doi:10.2139/ssrn.3071875 · Cited by 17 · see citing works
Shattering One-Way Mirrors. Data Subject Access Rights in Practice
Ausloos, J., & Dewitte, P. (2019) · Lirias · Cited by 14 · see citing works
Zingales, N. (2015) · SSRN Electronic Journal · doi:10.2139/ssrn.2707570 · Cited by 7 · see citing works
Prosumer law and network platform regulation: the long view towards creating OffData
Marsden, C. T. (2018) · Figshare · Cited by 7 · see citing works
Flagged first, then by citations
Research works printed but not linked: 3
- [10]10. European Union. 2015. 'Decision (EU) 2015/2240 of the European Parliament and of the Council of 25 November 2015 establishing a programme on interoperability solutions and common frameworks for European public administrations, businesses and citizens (ISA2 programme) as a means for modernising the public sector'. Official Journal of the European Union, L318, (4th Nov. 2015), 1-16.
- [11]11. European Union. 1995. 'Directive of the European Parliament and the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data'. Official Journal of the European Union, L281, (23rd Nov. 1995), 1-20.
- [12]12. European Union. 2016. 'Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)'. Official Journal of the European Union, L119, (4th May 2016), 1-88.
Cited by
Sorted by citations
Reviewable Automated Decision-Making: A Framework for Accountable Algorithmic Systems
Cobbe, J., Lee, M. S. A., & Singh, J. (2021) · Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency · doi:10.1145/3442188.3445921 · Cited by 150 · see citing works
“Note that, in practice, many organisations appear ill-prepared for meeting their disclosure obligations [65, 76] Records about disclosures themselves can also be relevant – both of the processes for disclosure as well as what was actually released, how information was compiled, how it was delivered, in what format, to…”
BackgroundOpen Humans: a platform for participant-centered research and personal data exploration
Greshake Tzovaras, B., Angrist, M., Arvai, K., Dulaney, M., Estrada-Galiñanes, V., Gunderson, B., Head, T., Lewis, D., Nov, O., Shaer, O., et al. (2019) · GigaScience · doi:10.1093/gigascience/giz076 · Cited by 56 · see citing works
The Security Implications of Data Subject Rights
Singh, J., & Cobbe, J. (2019) · IEEE Security & Privacy · doi:10.1109/msec.2019.2914614 · Cited by 17 · see citing works
- Authors
- Wong, J., & Henderson, T.
- Affiliations
- University of St Andrews (GB)
- Venue
- Proceedings of the 2018 ACM International Joint Conference and 2018 International Symposium on Pervasive and Ubiquitous Computing and Wearable Computers
- Publisher
- ACM
- Published
- 2018-10-08
- Pages
- 911-920
- OpenAlex
- W2899391355
- Semantic Scholar
- fe3dc12da68ac5fc3e6569cded2c32982625678a
- Cited by
- 27
- References
- 23
- Citations by year
- 2025: 4 · 2024: 2 · 2023: 3 · 2022: 4 · 2021: 6 · 2020: 4 · 2019: 4
- FWCI
- 32.69
- Type
- conference paper
- Language
- en
- Open access
- green
- hdl.handle.net
- Locations
- ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp) (publishedVersion)
- St Andrews Research Repository (St Andrews Research Repository) (submittedVersion)
- Topics
- Social Sciences › Law › Digitalization, Law, and Regulation
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Social Sciences › Safety Research › Ethics and Social Impacts of AI
- Keywords
- data portability, General Data Protection Regulation, GDPR, data protection rights, file formats, data controllers, data subject rights, personal data, data interoperability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
