Data portability under the GDPR
Produced in partnership with Alex Brown of Simmons & Simmons
Data portability under the GDPR

The following Financial Services guidance note Produced in partnership with Alex Brown of Simmons & Simmons provides comprehensive and up to date legal information covering:

  • Data portability under the GDPR
  • Right to data portability
  • Time period for complying with the request
  • Meaning of ‘right to receive’
  • Meaning of ‘provided to a controller’
  • Meaning of ‘structured, commonly used and machine-readable format’
  • Meaning of ‘where technically feasible’
  • Meaning of ‘without hindrance from the controller’
  • Interaction with the ‘right to be forgotten’
  • Effect on the rights and freedoms of others
  • more

The General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR), includes a right to data portability. This right allows individuals to obtain from a controller a copy of their personal data in a structured, machine-readable format. In addition, in some circumstances individuals have the right to have that data transferred directly by the controller to another controller.

The right to data portability is designed to both support and enable the free flow of personal data within the EU, and to encourage healthy competition between controllers, by not only facilitating consumers switching between various service providers, but also by encouraging the development of related software, systems and services. Above all, the right to data portability aligns with the EU’s ‘digital single market strategy’ by empowering individuals to more easily control and make use of their own personal data.

The right is intended to benefit individuals by allowing them to obtain a copy of data held about them and to store and use it for their own purposes across different services. The right may allow, for instance, an individual to retrieve their contact list from a webmail application to build a wedding list, to store their data in a personal data store, to transfer their social network-related data from one provider to another, or to transfer their built-up shopping history from one loyalty card provider