Data portability

Data portability is a concept to protect users from having their data stored in "silos" or "walled gardens" that are incompatible with one another, i.e. closed platforms, thus subjecting them to vendor lock-in and making the creation of data backups or moving accounts between services difficult. Data portability requires common technical standards to facilitate the transfer from one data controller to another, such as the ability to export user data into a user-accessible local file, thus promoting interoperability, as well as facilitate searchability with sophisticated tools such as grep . Data portability applies to personal data. It involves access to personal data without implying data ownership per se.

Data portability is a concept to protect users from having their data stored in "silos" or "walled gardens" that are incompatible with one another, i.e. closed platforms, thus subjecting them to vendor lock-in and making the creation of data backups or moving accounts between services difficult. Data portability requires common technical standards to facilitate the transfer from one data controller to another, such as the ability to export user data into a user-accessible local file, thus promoting interoperability, as well as facilitate searchability with sophisticated tools such as grep . Data portability applies to personal data. It involves access to personal data without implying data ownership per se. ===European Union=== The right to data portability was laid down in the European Union's General Data Protection Regulation (GDPR) passed in April 2016. The regulation applies to data processors, whether inside or outside the EU, if they process data on individuals who are physically located within an EU member state. Earlier the European Data Protection Supervisor had stated that data portability could "let individuals benefit from the value created by the use of their personal data". The European-level Article 29 Data Protection Working Party held a consultation on this in English lasting until the end of January 2017. Their guidelines and FAQ on the right to data portability contain this call for action: The French national data supervisor CNIL hosted a discussion in French. Current participants offer opinions on how the legislation provides few benefits for companies, but many for users. In April 2017, new guidelines were published on the Article 29 Working Party website. In late 2019 the Data Governance Act was published by the Commission. In 2021 researchers, many of them French and Finnish, published a 46-page report covering the state-of-the-art. In 2022 the European Commission published the Data Act. Although the United Kingdom voted to withdraw from the EU, it intends to incorporate much of the GDPR in its own legislation, which will include data portability, as "...the GDPR itself contains some noteworthy innovations – for instance… the introduction of a new right to data portability". In November at the Internet Governance Forum 2019 in Berlin panelists reported that Article 20 GDPR is not actionable, neither legally nor technically. In the UK—ironically post-Brexit—researchers are monitoring developments. Germany has called to strengthen the European Union's right to data portability using competition law. A commission was set up for the purpose of proposing improvements. ===Switzerland=== Likewise, in Switzerland, a nation-state that is related to the EU only on a bilateral basis and as an EFTA member state, there has been a trend moving in the same direction. The Swiss view was officially published in March 2018¹ (as a document in PDF). An association proposed to have a right to data portability anchored in the constitution of the Swiss Confederation. A law was passed that includes data portability; as described here in German and here in French. The association partners with a cooperative called MIDATA.coop, which will offer users a place to store their data. A second association has issued its guideline on the topic. Over the longer term, the Swiss may have to consider that data portability is in the GDPR. Given that the GDPR will raise compliance costs for EU-based companies, it is unlikely that the EU would tolerate a situation with third-party countries in which Swiss companies would not be held to the same standard in order to keep competition fair. The legal terms involved are adequacy and reciprocity. ===United States: California=== The State of California has a Consumer Privacy Act (CCPA) of 2018, which introduces data portability to the USA. ===United States: Utah=== The State of Utah is the first state to pass the Digital Choice Act, which, among other provisions, requires social media service providers of any size to provide data portability export (but not import) starting July 2026. ===Canada=== Canada anticipates a law in that it shows Transparency, Portability and Interoperability as Principle No. 4 of its Digital Charter. ===India=== Data portability is included in the Personal Data Protection Bill 2019 about to become law as section 26 in chapter VI. ===Brazil=== Data portability is included in the Privacy law#Brazil as its Article 18. ===Australia=== In Australia, a Consumer Data Right has been proposed. ===Thailand=== Data portability is included in the new law. ===Kenya=== A right to data portability is enshrined in the new data protection law under clause 34. However, the intentions behind the new law, its enforcement and relation to the government's new Identity management system have already been contested. ==Requirements for effective data interoperability== It is always tricky for legislators to regulate at the right level of precision, as everyone understands technology will evolve faster than the law. So far, only the European Union has formalized the expectations around data portability, requiring the data "in a structured, commonly used, machine-readable and interoperable format". This touches on at least two distinct technical requirements for effective interoperability: the need to use file standards that allow for easy reuse (for instance CSV or JSON instead of PDF or even printed paper), encompassed by a "structured, commonly used, machine-readable" format. the need (hinging on "interoperable") to consider not only an individual's data release on its own, but also in conjunction with other systems and other individuals' data releases from the same company. This hints at requirements regarding data schemas, versioning and specification of those schemas in case of frequent changes, and generally the absence of efforts on the part of the source data controller to complicate the effective interoperability downstream. Likewise, European researchers stress that there are both practical and legal gaps that the EU should fill. ==See also== External wiki GDPR Hub maintained by Max Schrems et al. Data Transfer Project Ethics of artificial intelligence General Data Protection Regulation ==Notes== ==References==

Text derived from https://en.wikipedia.org/w/index.php?oldid=1375124063 under CC BY-SA 4.0; modifications have been made.