A much debated element of the EU Personal Data Protection reform package is the proposal to introduce a right to data portability, as put forth in Article 18 of the
draft Regulation.
Art. 8(2) of the EU Charter of Fundamental Rights states that” everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.” Pursuant to Article 12 of the currently applicable Data Protection Directive, individuals already have the right to access their personal data, and in particular to obtain from the data controller communication “in an intelligible form of the data undergoing processing,” but the form of the communication is not specified, and the way in which that right can be exercised varies considerably from country to country within the EU, and access has become particularly challenging especially in connection with the online environment.
Pursuant to the proposed Art.18 of the Regulation, data subjects could, first, obtain a copy of their personal data “processed by electronic means and in a structured and commonly used format.” The copy itself must be “an electronic and structured format which is commonly used and allows for further use by the data subject.” Further, individuals would be granted the explicit right to transfer “personal data and any other information provided by the data subject and retained by an automated processing system” into another automated processing system “where the data subject has provided the personal data and the processing is based on consent or on a contract.” The transfer should be “without hindrance by the controller”, and data should be “in an electronic format which is commonly used.”Article 18(3) gives the Commission the power to specify the electronic format and the "technical standards, modalities and procedures for the transmission of personal data.”
Art. 18 should be read against the background of Article 15 of the draft Regulation, that provides for the “general” right of access for the data subject. Article 15 states that the data subject has the right to obtain from the controller communication of the personal data undergoing processing, but the main difference is that Article 18 specifically deals with the condition for reuse of the data, by the data subject herself and/or by another automated processing system.
As seen above, Art. 18(2) introduces the right to export personal data and other information provided by data subject to another service “without hindrance” by the controller. It is not clear, however, if this would involve an affirmative obligation on the controller to transfer data directly to another service, i.e. to provide for some degree of interoperability between electronic processing systems. The data that the individual has the right to trasfer should be in electronic form. As mentioned before, the Regulation would give the Commission the power to specify the electronic format and the further technical requirements for allowing the transmission of personal data.
The contours of the data portability right as foreseen by Article 18 of the draft Regulation are not totally clear, though, in particular because most of the critical “technicalities” (i.e. electronic format and the technical standards, modalities and procedures for the transmission of personal data) are left to later clarifications by the Commission. In this highly sensitive area, however, negative implications on innovation processes should be carefully avoided by abstaining from imposing microregulation on technological solutions to ensure data portability. Moreover, in the rather remote event that the language of Article 18 remains largely unaffected by the various negotiation phases the reform package is currently going through, the effectiveness of the new right will critically depend on the interpretation of rather vague legal concepts like “without hindrance.”
Even more uncertainty could be the result of the negotiations surrounding the reform package, though. A good example of this is the amendment proposal put forth by the rapporteur for the European Parliament's Civil Liberties, Justice and Home Affairs Committee (“
Albrecht Draft Report"). According to the proposal, Article 18 should be merged with Article 15. The Albrecht draft, however, blurrs the legal contours of the right to export personal data and other information to another service even further, in so far as it foresees that the right should be exercised “where technically feasible and appropriate”. The critical change in the text would appear to be at least partially in line with the
amendments suggested by the U.S. Chamber of Commerce, and already contained in the
Draft Opinion of the Committee on Industry, Research and Energy for the Committee on Civil Liberties, Justice and Home Affairs.
PaidContent, 