Right to data portability

The right to data portability is established by Article 20 of the General Data Protection Regulation (GDPR). This right allows data subjects to obtain a copy of their personal data in a structured, commonly used, and machine-readable format, enabling them to reuse their data in another context or service. The goal of the right to data portability is to strengthen individuals’ control over their personal data and to promote the free flow of information within the European Union.

The right to data portability can be exercised when the processing:

1. Is based on consent or a contract: The processing of data must be based on the data subject’s consent or be necessary for the performance of a contract to which the data subject is a party.
2. Is carried out by automated means: The right applies only to processing carried out by automated means, not to manual or paper-based processing.

When exercising the right to portability, the data subject also has the right to request the direct transmission of personal data from one controller to another, where technically feasible. However, the right to portability must not adversely affect the rights and freedoms of others, for example, when the transfer of data might involve the disclosure of information about third parties.

Practical Examples of the Right to Data Portability

• Switching service providers: A user switching cloud service providers can request that their data be transferred from the old provider to the new one in a machine-readable format.
• Banking services: A customer may request the portability of their financial data to compare different offers or easily transfer information between financial institutions.

Trust Guardian’s approach to the right to data portability

Trust Guardian helps businesses manage the right to data portability by facilitating the collection of data portability requests in a centralized point for managing data subject rights. Through myPrivacy, data subjects can request the portability of their data in a simple and transparent manner, thereby promoting a more responsible and informed management of their personal data.