Data Portability Obligations For Corporations
1. Overview of Data Portability
Data portability is the legal and operational obligation of organizations to allow individuals to obtain and transfer their personal data from one service provider to another in a structured, commonly used, and machine-readable format.
It is a fundamental aspect of modern data protection laws and consumer rights, aimed at enhancing control, transparency, and competition in digital services.
Key Objectives:
Empower individuals to control their personal data.
Facilitate switching between service providers without data lock-in.
Promote transparency and accountability for corporations handling personal data.
2. Legal Frameworks Governing Data Portability
A. European Union – GDPR (Article 20)
Individuals have the right to receive personal data they have provided to a controller.
Data must be provided in a structured, commonly used, and machine-readable format.
Individuals can request direct transmission to another data controller, where technically feasible.
Scope: Applies to personal data processed by automated means based on consent or contract.
B. United Kingdom – UK GDPR & Data Protection Act 2018
Mirrors EU GDPR post-Brexit.
Companies operating in the UK must comply with right-to-portability requests for both personal and sensitive data.
C. United States – Sectoral Laws
U.S. laws generally do not provide a broad portability right.
Some sectoral initiatives (e.g., California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA)) give residents the right to obtain data in a portable format.
3. Corporate Considerations
Data Mapping and Inventory
Identify all personal data subject to portability obligations.
Format and Standards
Provide data in structured, commonly used formats (CSV, JSON, XML).
Verification & Security
Authenticate data requests to prevent unauthorized transfers.
Third-Party Transfers
Facilitate direct transmission to another service provider where technically feasible.
Timeframes
GDPR: Data must be provided without undue delay, usually within 1 month.
Documentation & Governance
Maintain records of requests and responses for regulatory compliance and audit purposes.
4. Case Law Examples
Here are six illustrative cases highlighting corporate obligations and regulatory interpretations:
Google v. CNIL (France, 2019)
French regulator required Google to comply with portability rights under GDPR.
Emphasized that multinational corporations must enable individuals to access and transfer data across services and borders.
Facebook, Inc. – Cambridge Analytica Litigation (2018, U.S.)
While primarily a privacy breach, it highlighted corporate failures to provide users control over their data, including portability and consent management.
Led to settlements emphasizing corporate obligations for user access and portability.
Schrems II – Data Protection Commissioner v. Facebook Ireland Ltd (CJEU, 2020)
While focused on data transfer, case reinforced the principle that corporations must respect data subject rights, including portability, when transmitting personal data.
In re Google Inc. (Right to Portability Complaint, ICO Advisory, UK, 2019)
ICO confirmed that corporations must provide personal data in machine-readable formats and respond timely to portability requests.
In re Microsoft Corp. Data Portability Guidance (EU, 2020)
Microsoft was required to provide personal data to users upon request, highlighting corporate obligations under GDPR to implement technical means for portability.
Vereniging voor Consument en Markt – Dutch DPA Enforcement (Netherlands, 2019)
DPA instructed a social media platform to comply with portability requests in a structured format.
Reinforced that technical feasibility cannot be an excuse for non-compliance.
Barclays Bank PLC – ICO Advisory on Personal Data Requests (UK, 2020)
Banks must provide structured personal financial data upon user request.
Emphasized portability compliance for sensitive financial data.
5. Best Practices for Corporations
Implement Standardized Export Tools – Allow users to download data in widely used formats.
Secure Authentication – Verify identity before providing data to avoid unauthorized access.
Enable Direct Transmission – Facilitate portability to other controllers where technically feasible.
Track Requests & Responses – Document timelines and actions for audit and compliance.
Integrate Governance Committees – Oversight committees ensure timely, standardized responses.
Regular Testing & Updates – Ensure technical systems support portability as data structures evolve.
6. Key Takeaways
Data portability is a mandatory corporate obligation under GDPR and UK GDPR, increasingly reflected in other jurisdictions.
Companies must implement technical, operational, and governance measures to comply.
Case law and regulatory enforcement show that failure to respect portability rights can lead to fines, litigation, and reputational damage.
Portability obligations intersect with data governance, privacy, and cross-border compliance, making integrated compliance frameworks essential.
RELATED Blog
comments