Key References:

  • GDPR Art. 20
  • Recital 68

Key elements of Art. 20

  • Newly conferred right
  • Portability:
    • Data subject has the right of data portability of their personal data provided to the controller.
    • Data subject can receive the data directly from the controller.
    • Data subject has right to have personal data transferred to another controller without hindrance.
  • Necessary conditions for data portability under Art. 20:
    • The data subject must have provided personal data to the controller, and
    • The personal data must be processed on the basis of either consent or contract, and
    • The personal data must be processed by automated means, and held in a structured, commonly used, machine-readable and interoperable format.
  • Not covered by Art. 20:
    • Personal data that is held by the controller on other lawful bases (e.g. legal obligations, public interest) is not covered by the right of data portability.
    • Personal data that is not processed by automated means, or unstructured is not covered by the right of data portability.
  • Recital 68.2 states that controllers should be encouraged – but not required – to develop interoperable formats that enable data portability.