Everything You Need to Know About the Right to Data Portability Under GDPR

Content

We meet again for the continuation of our series of articles dedicated to data subjects' rights with the right to data portability. This article follows our 1-minute video to understand everything from Monday, May 24. Follow us on LinkedIn so you don't miss any news!

Settle comfortably on your deckchair and let's go, we'll explain everything in 5 minutes! ☀

What are data subjects' rights?

The GDPR addresses data subjects' rights in Chapter 3 of the GDPR. Not all rights systematically apply to all processing operations; their application depends in particular on the legal basis of the processing.

With our previous articles and those to come, we explain the following rights:

• Right of access,
• Right to rectification,
• Right to object (and right to withdraw consent),
• Right to erasure,
• Right to data portability.

Understanding everything about the right to data portability

The right to data portability is addressed in Article 20 of the GDPR. It is a new right, enshrined in the GDPR. It gives the data subject the possibility of having the personal data they provided to the controller transmitted to them. The data must be transmitted in a commonly used and machine-readable format. The data subject can then choose to transmit this data to another controller or request that the initial controller transmit the data directly to another controller.

The difference between the right to data portability and the right of access lies in the objective pursued by the data subject. By exercising their right to data portability, the data subject obtains their data for the purpose of providing it to another controller. The right to data portability aims to give data subjects more power over the management of their data. This right facilitates the transmission of data between controllers, under the direction of the data subject.

This new right is likely to encourage the interoperability of data formats used by service providers and thus give data subjects the possibility of easily changing providers. To illustrate, a data subject can ask a platform such as Deezer to communicate their data in order to then transfer it to Spotify.

Recital 68 of the GDPR encourages controllers to implement mechanisms so that the right to data portability is processed automatically, between controllers, at the request of the data subject.

Where data processing is subcontracted, the contract concluded between the parties must provide for technical and organizational measures to respond to requests for exercising rights. This requires the processor to cooperate with the controller to respond to requests, including the exercise of the right to data portability.

Finally, it should be noted that exercising the right to data portability does not automatically imply the deletion of data. If the data subject wants their data deleted from the initial controller's information system, they must make another request such as the erasure of their data.

Conditions for exercising the right to data portability

The right to data portability applies subject to meeting the following conditions:

1^st condition of application: The legal basis of the processing

To exercise the right to data portability, the processing must be based on the consent of the data subject or the performance of a contract.

2^nd condition of application: The processing

The right to data portability only applies to automated data processing.

3^rd condition of application: The data concerned

The right to data portability applies only to personal data that has been provided directly by the data subject. Pseudonymised data falls within the scope of the right to data portability. Indeed, this process is reversible and the data can be linked to the person. However, this is not the case for anonymised data.

Data "provided by the data subject" includes, on the one hand, data that they enter, for example in a collection form (such as when creating a customer or user account), such as surname, first name, email address, etc. But on the other hand, it also includes information that results from their activity. In other words, this is data that the person generates by using the controller's service. In this sense, a search history or a listening list on a streaming application falls within the scope of the right to data portability, as this data is considered to be directly provided by the person.

This is not the case for data that is inferred or derived; this data is created by the controller based on data provided by the person. This data is generated by the controller, without being directly provided by the data subject. This can be, for example, suggestions provided by a music streaming application: the platform infers a profile based on the user's listening habits.4th condition of application: the data format

It should be noted that data transmitted in the exercise of this right must be in a structured, commonly used, easily machine-readable format. Supervisory authorities encourage controllers to choose data formats adapted to the type of data concerned, preferably using open and interoperable formats.

Limitations on the right to data portability

The exercise of the right to data portability must not adversely affect the rights and freedoms of third parties. This means not only not transmitting a third party's data, but also respecting intellectual property and trade secrets.

Third party data may be transferred in certain cases, without their consent. This is the case, for example, when a person exercises their right to data portability with a telephone operator. In this context, they may obtain communication of their contact directory. The controller must transfer the data contained in this directory so that the right to data portability is respected. However, this directory contains the personal data of persons who have not consented to their data being transferred to another controller. The data may be transferred to the new controller provided that the latter does not use it in their own interest. This transfer must simply serve the interest of the person exercising their right, who uses the data for the same purposes, for personal use and under their own responsibility. The new controller cannot, for example, reuse this data for commercial prospecting purposes.

Data Comply One (formerly Mission RGPD) and the right to data portability

Don't have time? Are you lost? Are you struggling to manage your compliance and more specifically data subjects' rights?

Data Comply One (formerly Mission RGPD) allows you to create a rights exercise form. On the Data Comply One (formerly Mission RGPD) platform, you have a unique link to make available to individuals (on the showcase website, in various emails, etc.). When the person wants to exercise a right, they fill out this online form directly. Once the form is completed, the rights exercise request is automatically entered into the Data Comply One (formerly Mission RGPD) platform, and all you have to do is respond using our templates!

Manage your compliance with complete simplicity and peace of mind!