Data portability rights between service providers

Introduction

Data portability refers to the right or ability of an individual to obtain personal data held by one service provider and transfer it to another service provider in a structured, commonly used, and machine-readable format. It promotes individual control over personal information, reduces dependence on a particular service provider, and encourages competition in digital markets.

In biotechnology and healthcare, data portability is particularly important because individuals may need to transfer medical histories, genetic test results, laboratory reports, clinical records, and genomic information between hospitals, diagnostic laboratories, research institutions, and digital health platforms.

For example, a patient who changes hospitals should be able to obtain relevant medical records and share them with the new healthcare provider, subject to applicable privacy and confidentiality requirements.

Meaning and importance of data portability

Data portability allows individuals to access and reuse their personal information across different service providers. It can also support direct transfer between providers where technically and legally permitted.

Its main objectives include:

Individual control: Individuals can exercise greater control over their personal information.

Competition: Customers can change service providers without losing access to important records.

Continuity of healthcare: Medical information can be transferred to support diagnosis and treatment.

Transparency: Service providers become more accountable for how they maintain personal information.

Innovation: Standardized data formats encourage interoperability between digital healthcare systems.

In biotechnology, portability must be handled carefully because genetic information may reveal information about biological relatives as well as the individual concerned.

Legal framework in India

The Digital Personal Data Protection Act, 2023 provides a framework for processing digital personal data. However, unlike the European GDPR, it does not establish a general, independent right to data portability for every individual. Consequently, Indian organizations should not assume that the Act creates an unconditional right to transfer all personal data between service providers.

The Information Technology Act, 2000, together with applicable rules, provides a broader framework for electronic records and information security. Its provisions may be relevant when organizations transfer electronic medical and personal records.

The Clinical Establishments (Registration and Regulation) Act, 2010, where applicable, and professional medical ethics requirements are also relevant to the maintenance and handling of patient records. The National Medical Commission's professional conduct framework recognizes the importance of maintaining medical records and providing copies to patients in accordance with applicable requirements.

The Ayushman Bharat Digital Mission (ABDM) promotes interoperable digital health records through standardized systems and consent-based information exchange. Its framework supports the movement of health information between participating healthcare providers, although it should not be confused with a universal statutory data portability right.

International legal framework

The General Data Protection Regulation (GDPR) provides an express right to data portability under Article 20. It allows individuals to receive personal data they have provided to a controller in a structured, commonly used, and machine-readable format. Where technically feasible, individuals may request direct transmission to another controller.

The right generally applies when processing is based on consent or contract and carried out by automated means. It does not apply to every category of personal data or override the rights and freedoms of others.

The OECD Privacy Guidelines also promote individual participation, transparency, and responsible handling of personal information. These principles support the development of interoperable systems and responsible information exchange.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court of India recognized privacy as a fundamental right under Article 21. The judgment emphasized informational privacy and individual control over personal information. Although it did not directly establish a statutory right to data portability, its principles support individuals' interests in accessing and controlling their personal data.

2. K.S. Puttaswamy v. Union of India (Aadhaar case, 2018)

The Supreme Court examined the collection, storage, and use of personal information under the Aadhaar framework. The judgment emphasized proportionality and safeguards against excessive data collection. These principles are relevant when designing secure systems for transferring sensitive health and biometric information.

3. Google Spain SL v. AEPD and Mario Costeja González (2014)

The Court of Justice of the European Union examined individuals' rights concerning personal information processed by search engines. Although the case concerned the right to delisting rather than portability, it demonstrated the importance of individual control over digital information.

4. Orange România SA v. ANSPDCP (2020)

The Court of Justice of the European Union examined the requirements for valid consent under data protection law. The decision is relevant to data portability because transfers of personal information must operate within a valid legal basis and respect individuals' rights.

5. Schrems II (Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems, 2020)

The Court of Justice of the European Union invalidated the EU-US Privacy Shield and emphasized the need for adequate protection when personal data is transferred internationally. Although it was not a portability case, its reasoning is important when transferring healthcare or genetic information between service providers located in different countries.

Challenges in implementing data portability

Data portability between service providers faces several practical and legal challenges:

Interoperability: Different healthcare systems may use incompatible formats and technical standards.

Privacy protection: Genetic and medical information requires strong confidentiality safeguards.

Consent management: Organizations must verify the individual's authority and applicable legal basis for transfer.

Data accuracy: Transferred records must remain complete, authentic, and understandable.

Third-party interests: Genetic information may reveal details about biological relatives, creating additional privacy concerns.

Cybersecurity: Transfers must be protected against unauthorized access, interception, and misuse.

Conclusion

Data portability is an important mechanism for strengthening individual control, improving healthcare continuity, and encouraging competition between service providers. In biotechnology, it enables patients and research participants to access and transfer valuable medical and genetic information while maintaining appropriate privacy safeguards. India currently supports interoperability through initiatives such as the Ayushman Bharat Digital Mission, but its legal framework does not provide a general statutory portability right equivalent to Article 20 of the GDPR. A clear and comprehensive portability framework would improve transparency, patient autonomy, and responsible innovation in biotechnology and digital healthcare.