Data Portability - A Tale of Two Concepts

Art. 20 of the General Data Protection Regulation (GDPR) introduces a new concept to European data protection law – the right to data portability. The rule seeks to empower the consumer, to foster the inter-operability of data, and to prevent lock-in effects on closed platforms. Upon request, data controllers are required to provide personal data to the data subject in a structured, commonly used and machine-readable format, which enables the data subject to transfer their personal data between controllers. However, Art. 20 GDPR leaves much room for interpretation, in particular with respect to the data covered, the scope of the exceptions and the requirement of inter-operability. The proposed Directive on certain aspects concerning contracts for the supply of digital content (DCD-proposal) takes matters a step further. Under the DCD-proposal, the supplier of digital content shall provide the consumer with technical means to retrieve all content provided by the consumer (not only personal data) and any other data produced or generated through the consumer’s use of the digital content. At the same time, the proposed provisions are stricter than Art. 20 GDPR: The data portability right under Art. 20 GDPR may be exercised at any point in time, whereas the right to content portability under the DCD-proposal only arises after the contract has been terminated following a rule in said directive. The paper highlights other circumstances which warrant a right to content portability and laments the lack of an exception to safeguard the rights and interest of third parties. Three case studies are included to illustrate how the portability rules in the GDPR and the proposed Digital Content Directive might work in practice. The paper closes with a synopsis showing the commonalities and differences of Art. 20 GDPR and the portability rules in the proposed Digital Content Directive