Data portability : Definition, issues and explanations

Data portability is a right stemming from the General Data Protection Regulation (GDPR) that came into force in 2018. It consists of allowing any individual to retrieve the personal data they have provided to a data controller in a structured, commonly used and machine-readable format.

This right aims to offer individuals more control over their data, allowing them to easily transfer it from one service to another without technical hindrance.

Portability only applies to personal data provided directly by the user and processed automatically. It does not concern data deduced or calculated by services.

The main benefit of data portability is to empower users by giving them more control over their personal information. It also facilitates the free flow of data between different services and fosters competition in the digital marketplace.

Having the ability to obtain one's data makes it possible, in particular, to change providers or platforms without losing information, which improves transparency and reduces user lock-in.

For companies, respecting this right is a guarantee of compliance and trust with their customers, while meeting the legal obligations imposed by the RGPD.

Concretely, when a user exercises his or her right to portability, the organization must provide the personal data concerned in a standardized format that facilitates its reuse and transfer.

The most commonly used formats for portability are files in JSON, CSV or XML format, which are machine-readable and widely recognized.

The organization can provide the data directly to the individual or, with his or her consent, transfer the data to another service chosen by the user within a reasonable period of time, usually one month.

Data portability has several notable advantages. It gives individuals more control over their data, facilitates its transfer between different services and encourages healthy competition between providers.

In terms of disadvantages, implementing portability can be technically complex and costly for companies, especially in terms of harmonizing formats and ensuring the security of transfers.

In addition, there are risks related to the confidentiality and protection of data during transfers, which requires strict measures to prevent leaks or unauthorized uses.

A common example is social networks, where a user can request to retrieve all their data (photos, messages, contacts) for transfer to another platform.

In banking, portability facilitates bank switching by allowing customers to obtain their financial data automatically for simplified account reopening.

The healthcare sector also uses portability to allow patients to transfer their digital medical records from one facility to another, ensuring continuity of care.

• The CNIL: The portability of personal data
• Official text of the RGPD - Article 20
• Information Commissioner's Office (ICO) - Data Portability
• MDN Web Docs - Data Transfer API