If you are a data subject, you will want to know what the right to data portability is. You may also want to know how to actually port your data and exercise your right.
If you are a data controller (or responsible party), you will want to know more about how this right affects you and how to help data subjects exercise their right. We can help you comply with your legal obligation to enable data subjects to exercise their right to data portability.
What is the right to data portability?
This right entitles you, as the data subject, to move or copy your personal data from one controller to another. Think of it like this:
- You sign a contract with one company for them to provide you with services for a two-year period.
- After two years you want to move to another company, which can give you a better deal.
- Do you now have to start over with the new company you are doing business with, or can you move your profile from the old company for the new company to use it? With the right to data portability, you don’t have to start from scratch.
Data portability is about personal data that relates to you being transferred from one place to another. The old controller must make sure that the personal data is in a structured, commonly used and machine-readable format that encourages interoperability when they provide it to you.
How do I port my data?
It is important to keep the following in mind whenever you want to exercise this right:
- You must start the process of data porting by contacting the old controller and asking them to do it.
- Depending on the contract you have with the new controller, you might be responsible for anything that happens to the data once the old data controller has given it to you or the new controller.
- The old controller must try by all reasonable means to only send your data, and not the data of other data subjects.
- If the old controller sends the data to you, you must make it available for the new controller.
- If the data goes directly to the new controller, they must inform you that they have it and what they will use it for.
Actions you can take
- Understand how to exercise this right effectively by letting us answer your questions.
- Understand your responsibilities as a data subject, those of the old controller that needs to port your data, and those of the new controller, by asking for our advice.
- Understand what the right to portability means for you when it comes to the rights of other data subjects, by asking us all your questions.
How do I port my Data quickly – the duties of controllers
The old controller must tell you:
- about your right to data portability,
- how to port data,
- how long it may take, and
- what the delays are (if there are any).
You are allowed to demand that the old controller speed up the process, and not make you wait for an unreasonable period. Ultimately, it doesn’t matter what the reason is for their delay. The old controller must make sure that they port your data within one month of receiving the request from you. If complying with your request is complicated, they are allowed an additional two months within which to provide the data. They must inform you about the reasons for the delay. This must be done within one month after you initially made the request for data porting.
