Understanding Data Portability
Article 20 of the GDPR provides individuals with the right to receive personal data concerning them in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance.
When Does the Right Apply?
The right to data portability applies when:
- The processing is based on consent or for the performance of a contract, AND
- The processing is carried out by automated means
This means the right does not apply to processing based on other legal grounds such as legitimate interests, legal obligations, or public interest.
What Data is Covered?
The right covers personal data that:
- The individual has provided to the controller
- This includes data provided knowingly and actively (e.g., completing a form)
- Also includes observed data generated by the individual's activities (e.g., browsing history, location data)
The right does not extend to inferred or derived data created by the organization (e.g., credit scores, customer profiles created through analysis).
How to Provide Portable Data
Organizations must provide data:
- In a structured, commonly used and machine-readable format
- Examples include CSV, JSON, or XML formats
- With clear information about what the data fields mean
- Without undue delay and within one month (extendable by two months)
- Free of charge (unless requests are manifestly unfounded or excessive)
Direct Transmission
Where technically feasible, individuals have the right to have their data transmitted directly from one controller to another. Organizations should facilitate this where possible.
Rights of Others
The right to data portability must not adversely affect the rights and freedoms of others. Organizations should ensure that providing portable data does not disclose information about other individuals.