Enforcing Art.20 GDPR: Data Portability is the new take-away

The new General Data Protection Regulation[1](GDPR) of April 2016, in order “to further strengthen consumer control over his or her own data”[2], introduces the so called right to data portability.

In particular, according to Art. 20 of the Regulation, “the data subject shall have the right to receive the personal data concerning him or her which he or she has provided to a controller, in a structured commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the data have been provided”.

 The right is granted for two principal reasons.

On one side,  the policy objective pursued consists in the” promotion of the individual’s control of their personal data and of their trust in the digital environment” On the other, as clarified by Joaquin Alumnia in his 2012 speech[3]“in a competitive market (…) portability of data is important for those markets where effective competition requires that customers can switch by taking their own data with them”[4]

However, as always when coming to intangible assets, it is difficult to understand what is the actual scope of Art. 20 and, more specifically, to provide a concrete definition of what portability of data means.

In fact, although representing extremely valuable pieces of information, personal data are intangible assets, difficult to define and even more difficult to be tracked.

So, what data portability actually  mean?

Imagine data as food. [5]

Personal data constitutes sensitive information So, imagine them as your tasty, awaited Sunday meal.

By allowing the transfer of data to the subject and then to a different controller, data portability is the new take-away.

Put simply, in its first step, this right is structured in the same way of any other delivery service. The client (“data subject”) places an order (“asks to receive his personal data”) and the delivery service  (“data controller”) provides him with his delicious sushi set (“personal data”), served in a lovely and appealing box (“in a structured, commonly used and machine-readable format”).

Nevertheless, the actual release of the above-mentioned sushi box, will be subject to three different conditions.

First: the customer request has to be made by “automatic means” (let’s say through the Deliveroo application); second the process has to be based on consent (yet to establish if yours or your girlfriend’s); third: it does not have to adversely affect the rights and freedoms of others. In particular, in this respect, the Guidelines[6] on the right to Data Portability refer to situations where ” final records include the data concerning multiple people”, requiring a balance to be made between the interests of the different stakeholders.

In other words, make sure not to finish your girlfriend’s sashimi.

What explained, anyway, only constitutes the first bit of the new right to data portability and does not explain its second aspect, consisting in “the right to obtain the transfer of these data to a new controller”.

Thus, forget Deliveroo and your sushi box for a moment (no point of transferring it to someone else) and go back to personal data.

The main novelty of the discipline is that the data subject not only has the right of obtaining his personal data in a structured format but also to transfer them (or to having them transferred) to a different controller[7].

This provision, however,  at least in its first more disruptive[8] draft has been largely criticised [9]by the doctrinein so far as, by imposing the same duties both to “ a start up in a garage and a large software company” it would contradict the basis of antitrust law[10] and, in this way, it would threaten and even reduce consumer welfare.

Nevertheless, it has been pointed out, these critiques do not apply to the final draft of the Article anymore which, due to its more flexible nature[11], easily falls free of any of these issues.

It could be argued, instead, that the new text,  rather than the previous one, by representing a compromise, eventually fails to address its original purpose.[12]

Implementation will take time and it is too early to draw conclusions at the moment. As Alumnia pointed out in his speech[13] “Whether this is a matter for regulation or competition policy, only time will tell”.

Meanwhile, a positive reflection on experiences which are similar [14]to data portability could offer, de iure condendo, the opportunity for the adoption of a more effective implementation of the latter.

In this sense, positive thought and active debate represent the principal tools for this purpose.

In other words, as somebody would say, “stay hungry”.

Always.