Data portability: Definition, challenges, and explanations

Data portability is a right under the General Data Protection Regulation (GDPR), which came into force in 2018. It consists of allowing any individual to retrieve the personal data they have provided to a data controller in a structured, commonly used, and machine-readable format.

This right aims to give individuals more control over their data, allowing them to easily transfer it from one service to another without technical barriers.

Portability applies only to personal data provided directly by the user and processed automatically. It does not apply to data inferred or calculated by the services.

The main benefit of data portability is that it empowers users by giving them more control over their personal information. It also facilitates the free movement of data between different services and promotes competition in the digital market.

Being able to obtain your data allows you to switch providers or platforms without losing information, which improves transparency and reduces user lock-in.

For companies, respecting this right is a guarantee of compliance and trust with their customers, while meeting the legal obligations imposed by the GDPR.

In practical terms, when a user exercises their right to portability, the organization must provide the personal data concerned in a standardized format that facilitates its reuse and transfer.

The most commonly used formats for portability are JSON, CSV, or XML files, which are machine-readable and widely recognized.

The organization may provide the data directly to the individual or, with their consent, transfer the data to another service chosen by the user within a reasonable time frame, generally one month.

Data portability offers several notable advantages. It gives individuals more control over their data, facilitates its transfer between different services, and encourages healthy competition between providers.

In terms of disadvantages, implementing portability can be technically complex and costly for companies, especially when it comes to harmonizing formats and ensuring the security of transfers.

In addition, there are risks related to confidentiality and data protection during transfers, which require strict measures to prevent leaks or unauthorized use.

A common example is social networks, where users can request to retrieve all their data (photos, messages, contacts) in order to transfer it to another platform.

In banking, portability makes it easier to switch banks by allowing customers to automatically obtain their financial data for simplified account reopening.

The healthcare sector also uses portability to enable patients to transfer their digital medical records from one institution to another, ensuring continuity of care.

• The CNIL: The portability of personal data
• Official text of the GDPR - Article 20
• Information Commissioner's Office (ICO) - Data Portability
• MDN Web Docs - Data Transfer API