If you are a data subject in the European Union, you will want to know what the right to data portability is and how to port data. You will ask questions like: How do I port my data? These are important questions, and knowing the answer will help you exercise your right to data portability effectively. So how do you exercise this right? Which law created it? And when can you exercise it?
If you are a data controller, you will want to know more about how this right affects you and how to help data subjects exercise it. We can help you comply with your legal obligation to enable data subjects to exercise their right to data portability.
What is the right to Data Portability?
This right entitles you, as the data subject, to move or copy your personal data from one controller to another. Think of it like this:
- You sign a contract with one company for them to provide you with services for a two-year period.
- After the two years you want to move to another company, which can give a better deal.
- Do you now have to start over and create a new profile with the new company you are doing business with, or can you move your profile from the old company for the new company to use it?
Data portability is, in other words, about information or data – personal data – that relates to you transferring from one place to another, for your benefit. The old controller must make sure that the personal data is in a structured, commonly-used and machine-readable format that encourages interoperability, when they provide it to you.
How do I Port my Data?
It is important to keep the following in mind whenever you want to exercise the right:
- You must initiate or start the process of data porting by contacting the old controller and asking them to do it.
- Depending on the contract you have with the new controller, you might be responsible for anything that happens to the data once the old data controller has given it to you or the new controller.
- The old controller must try by all reasonable means to only send your data, and not the data of other data subjects;
- If the old controller sends the data to you, you must make it available for the new controller.
- If the data goes directly to the new controller, they must inform you that they have it and what they will use it for.
Actions you can take
- Understand how to exercise this right effectively by letting us answer your questions.
- Understand your responsibilities, those of the old controller that needs to port your data, and those of the new controller, by asking for our advice.
- Understand what the GDPR and the right to portability mean for you when it comes to the rights of other data subjects, by asking us all your questions.
How do I Port my Data quickly – the duties of Controllers
The old controller must tell you about your right to data portability, how to port data, how long it may take, and what the delays are (if there are any). You are allowed to demand that the old controller speed up the process, and not make you wait for an unreasonable period. Ultimately, it doesn’t matter what the reason is for their delay, the old controller must make sure that they port your data within one month of receiving the request from you. If complying with your request is complicated, they are allowed an additional two months within which to provide the data, but they must inform you about the reasons for the delay within one month after you’d initially made the request for data porting.