Right to data portability Flashcards
(20 cards)
Right to data portability
Art. 20 GDPR
Right to data portability consists of two aspects
A) THE RIGHT TO EXPORT DATA
B) THE RIGHT TO DIRECTLY TRANSFER DATA
Right to data portability
A) THE RIGHT TO EXPORT DATA
- The right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format
- The right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided
Right to data portability
B) THE RIGHT TO DIRECTLY TRANSFER DATA
In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
Right to data portability
CONDITIONS
IF
- The processing involves personal data concerning the data subject, which he or she has provided to a controller
- the processing is based
* on consent pursuant
to point (a) of Article 6 (1)
or point(a) of Article 9(2)
* or on a contract pursuant
to point (b) of Article 6 (1);
AND
- the processing is carried out by automated means.
Right to data portability
ART. 20 GDPR
3.The exercise of the right referred to in paragraph1 of this Article shall be without prejudice to Article17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4.The right referred to in paragraph1 shall not adversely affect the rights and freedoms of others.
PORTABILITY BEFORE THE GDPR
Telephone number portability in operator switching by users of telephone service - from Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services
Art. 30 - Number Portability
(40) Number portability is a key facilitator of consumer choice and effective competition in a competitive telecommunications environment such that end-users who so request should be able to retain their number(s) on the public telephone network independently of the organisation providing service. The provision of this facility between connections to the public telephone network at fixed and non-fixed locations is not covered by this Directive. However, Member States may apply provisions for porting numbers between networks providing services at a fixed location and mobile networks.
(41) The impact of number portability is considerably strengthened when there is transparent tariff information, both for end-users who port their numbers and also for end-users who call those who have ported their numbers. National regulatory authorities should, where feasible, facilitate appropriate tariff transparency as part of the implementation of number portability.
(42) When ensuring that pricing for interconnection related to the provision of number portability is cost-oriented, national regulatory authorities may also take account of prices available in comparable markets.
PRECEDENTS IN THE REGULATION OF PERSONAL DATA PROTECTION
An evolution of the already well-known right to access (see now Art. 15 GDPR)
Conditions
to be covered by the right to portability data shall
- be personal data clearly referable to the person who invokes the right at issue → anonymous data are not covered
- be processed on the basis of the prior data subject’s consent or of a contract to which the data subject is a party → data processed on other legal basis are not subject to the right to portability
- be processed by automated means → e.g. the right does not apply in the case of data collected in paper registers
- be provided by the data subject (e.g. personal data that has been entered by the data subject in a form)
Data provided by the data subject
- Received Data
- Observed Data
- Inferred Data
- Predicted Data
Data provided by the data subject
- Data directly and knowingly transferred to the data controller
Data directly and knowingly transferred to the data controller are pacifically covered by the right to data portability
(e.g., first name, last name, and address provided to the data controller when purchasing the good)
Data provided by the data subject
- Data provided through the use of a service or tool
Data provided through the use of a service or tool are covered by the right to portability based on a broad reading of the criterion of data “provided to the data subject”- S. the Article 29 Working Party’s Guidelines
(e.g., browser search history; physical activity data collected from a device that the data subject wears, smartwatch)
Data provided by the data subject
- Data further processed by the controller according to business practices
Data further processed by the controller according to business practices (altered or classified according to specific criteria)
– data created by the controller as part of processing, such as by a personalization or recommendation process, by user categorization or profiling are not covered by the right to data portability
Right to data portability
A data subject can
■ Receive and store personal data processed by a controller for further use (for personal purposes too, without necessarily transmitting them to another controller)
■ Transmit personal data from one controller to another data controller, where technically feasible
Data portability and other rights
The exercise of right to data portability does not affect other rights of the data subject recognized by the GDPR:
-Data subject can request from the controller the erasure of personal data concerning him or her according to Article 17.
-the transmission of a data set does neither automatically imply a request of its erasure by the transmitting controller, nor does it entail the termination of the contractual relationship between the data subject and the transmitting controller (nevertheless the obligation could raise from the principle of data minimisation laid down in Art. 5 [1] c GDPR)
The data subject does not lose the right to use the service offered by the controller (the exercise of the right does not imply the termination of the contractual relationship between the data subject and the transmitting controller)
Limitations of data portability
- For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- against controllers processing personal data in the exercise of their public duties
- necessary for compliance with a legal obligation to which the controller is subject
- for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller
- not adversely affect the rights and freedoms of others
- In the case of data transfer from one data controller to another:
— the (new) receiving controller should not process the data relating to third parties for any purposes that would adversely affect those rights
— The controllers (both the sender and the receiver) should technically enable the data subject to select the relevant data and exclude data relating to other data subjects - trade secrets and Intellectual property rights of the controller shall also be protected
- Inferred data does not fall within the scope of application of the right to data portability
Data portability:
Technical specifications
- Data should be transmitted «in a structured, commonly used and machine-readable format»
- principle of technological neutrality
- the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible
Goals of the right to data portability
- Rebalances the relationship between data subjects and data controllers by affirming the right to control data which refer to data subject
Three different perspectives:
a) Data portability as part of the fundamental right to data protection under Art. 8 EU Charter of Fundamental Rights?
b) Data portability as an a property-rights approach (Data subject as the owner of data)?
c) Data portability as a form of control which enables free flow of data among controllers (data sharing and reuse)
- Two benefits for the market:
a) competition strengthening
b) consumer empowerment
- Creating a fair competition between service providers and preventing a ”lock-in” on the market
Further developments of the right to Data Portability
Regulation on a framework for the free flow of non-personal data in the EU
■ Regulation on a framework for the free flow of non-personal data in the EU
(Reg. EU No. 2018/1807)
Article 1 – Subject Matter
Ensure the free flow of data other than personal data within the Union by laying down rules relating to
- data localisation requirements,
- the availability of data to competent authorities
- the porting of data for professional users
Article 6 - Porting of data
- Codes of conduct
a) to contribute to a competitive data economy,
b) based on the principles of transparency and interoperability
c) open standards covering the following aspects:
1 - the switching of service providers
2 - the porting of data
using standard format
Further developments of the right to Data Portability
(Digital Markets Act)
■ Regulation on contestable and fair markets in the digital sector (Digital Markets Act)
Regulation (UE) 2022/1925,
Definitions: Art. 2
- «gatekeeper»:
an undertaking providing core platform services, designated pursuant to Article 3;
- «core platform services»:
any of the following:
a) online intermediation services;
b) online search engines;
c) online social networking services;
d) ideo-sharing platform services;
e) number-independent interpersonal communications services;
f) operating systems;
g) web browser;
h) virtual assistants;
i) cloud computing services;
j) online advertising services.
Art. 3.
An undertaking shall be designated as a gatekeeper if:
a) it has a significant impact on the internal market;
b) it provides a core platform service which is an important gateway for business users to reach end users; and
c) it enjoys an entrenched and durable position, in its operations, or it is foreseeable that it will enjoy such a position in the near future.
Further developments of the right to Data Portability
Difference between End User and business User
End user = any natural or legal person using core platform services other than as a business user;
≠
Business user = any natural or legal person acting in a commercial or professional capacity using core platform services for the purpose of or in the course of providing goods or services to end users;
