The Right to Data Portability in the GDPR: What Lessons Can Be Learned from the EU Experience?

The EU General Data Protection Regulation (GDPR) was published in the Official Journal of the European Union on May 4, 2016. It will become applicable on May 25, 2018. The GDPR provides a new right to data portability for individuals, which requires data controllers to ensure that they can hand over the personal data that has been provided by the data subject himself/herself, in a structured, commonly used and machine readable format, preferably through direct transfer between data controllers. Following an open public consultation that continued until the end of January 2017, on April 5, 2017, the Article 29 Working Party approved a revised and substantive guidance clarifying some of the ambiguities with regards to the right to data portability. This article examines the development of the right to data portability in the European Union and seeks to draw lessons from the European experience with a view to make suggestions particularly for the United States and other jurisdictions. It concludes that the GDPR, both as legislation and as an agile legislative process, will offer valuable insights to other jurisdictions once they recognize the need for individual data portability rights. Further research particularly into enforcement issues as well as the economics of the right to data portability is suggested, as well as research into what the European Union can learn from the United States