Right to data portability

What it is

The right to data portability is the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, and to transmit it to another controller without hindrance.

In practice: “Give me my data in a format I can take elsewhere and, if possible, send it directly to the new provider yourself”.

The purpose: to foster competition and freedom of choice in the digital market, making it easy to switch provider without losing your data.

When it applies: 3 cumulative conditions

All three must be met.

1. The legal basis of the processing

The processing must be based on:

• consent (Art. 6.1.a or 9.2.a GDPR);
• contract (Art. 6.1.b GDPR).

✕ It does not apply to

• legitimate interest (Art. 6.1.f);
• legal obligation (Art. 6.1.c);
• public interest (Art. 6.1.e);
• vital interest (Art. 6.1.d).

Examples: a Spotify subscription (contract) → portability yes; data held by the tax authorities (legal obligation) → portability no.

2. The type of data

Only data that is:

• actively provided by you: profile details, uploaded photos, posts, emails sent;
• observed from your activity: search history, usage data, logs, location;
• derived or inferred, as long as strictly derived: for example a playlist based on your listening.

✕ Not portable

• data processed with a significant contribution from the controller: proprietary algorithms, assessments, complex credit scores;
• third-party data linked to you: for example emails received from others;
• anonymous data.

Examples

• ✓ Spotify playlist: portable (it is the list of songs you saved).
• ✕ Spotify recommendations: not portable (proprietary algorithm).
• ✓ Facebook photos: portable (you uploaded them).
• ✕ Facial recognition: not portable (complex processing by the platform).

3. Automated processing

The data must be processed by automated means (databases, IT systems). Data kept only in paper archives is not portable.

The data format

The controller must provide a format that is:

• structured: not a plain PDF, but a file with a data structure (tables, fields, relationships);
• commonly used: widespread standards, not proprietary formats;
• machine-readable: it can be processed by software.

Typical formats

• CSV (Comma-Separated Values): universal.
• JSON (JavaScript Object Notation): structured, used on the web.
• XML (eXtensible Markup Language): structured.
• Specific open formats: iCalendar (.ics) for calendars, vCard (.vcf) for contacts.

✕ Not sufficient

• PDF (unstructured);
• scans or images;
• closed proprietary formats.

Direct transmission to the new controller (Art. 20.2)

You have the right to have the data transmitted directly from one controller to another, where technically feasible.

“Technically feasible” means that:

• the systems are compatible or interoperable;
• APIs or standard protocols exist;
• the transfer can take place securely.

It does not mean that:

• the original controller must build new systems for the purpose;
• if interoperability does not exist, it is enough to give the data to you, and you upload it to the new service.

Examples

• Feasible: from Gmail to Outlook.com (standard IMAP/POP3 protocols).
• Not feasible: from Instagram to TikTok (no interoperability) → Instagram gives you the files and you upload them to TikTok manually.