Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Art. 20

Abstract

Data portability regulation has promised that individuals will be easily able to transfer their personal data between online service providers. Yet, after more than two years of an active privacy regulation regime in the European Union, this promise is far from being fulfilled. Given the lack of a functioning infrastructure for direct data portability between multiple providers, we investigate in our study how easily an individual could currently make use of an indirect data transfer between providers. We define such porting as a two-step transfer: firstly, requesting a data export from one provider, followed secondly by the import of the obtained data to another provider. To answer this question, we examine the data export practices of 182 online services, including the top one hundred visited websites in Germany according to the Alexa ranking, as well as their data import capabilities. Our main results show that high-ranking services, which primarily represent incumbents of key online markets, provide significantly larger data export scope and increased import possibilities than their lower-ranking competitors. Moreover, they establish more thorough authentication of individuals before export. These first empirical results challenge the theoretical literature on data portability, according to which, it would be expected that incumbents only complied with the minimal possible export scope in order to not lose exclusive consumer data to market competitors free-of-charge. We attribute the practices of incumbents observed in our study to the absence of an infrastructure realizing direct data portability.

Data Portability as a Tool for Audit

“…Unfortunately the latter data controller, Nike Run Club, interpreted the incoming transmission as an Article 17 (erasure) request and asked for confirmation that the data subject wished to have all of their data erased. This reiterates the findings of others [19,20] that Article 20(2) is not widely understood.…”

“…Wong and Henderson make portability requests to 230 controllers and find variation in their ability to conform with the right's requirements [21]. Syrmoudis et al [19] look at 182 controllers to specifically study the ability to exercise Article 20(2) -the right to port data from one controller to another. In a smaller-scale study, Li compares a set of portability requests with another right, the right to erasure [13].…”

Revisiting Identification Issues in GDPR ‘Right Of Access’ Policies: A Technical and Longitudinal Analysis

“…a list of the most popular websites currently available), but also lists 28% of these organizations not being responsive. However, [8] only lists 7% as unresponsive from a set of 55 organizations in the Alexa top, reinforcing the argument that smaller or less popular organizations (ranked lower in the Alexa top) are often insufficiently equipped with the necessary legal and technical knowledge to correctly handle SARs [20] and may therefore be more susceptible to such attacks. Although not listed in Table 1, Cagnazzo et al [4] partially send out SARs by postal mail, observing even less safe authentication methods when compared to sending it by email.…”

A Multi-Region Investigation of the Perceptions and Use of Smart Home Devices

“…In future work, it would be useful to investigate perceived regulatory protection at a finer granularity by examining specific regulatory measures in the context of Smart Home Devices. For example, it would be interesting to explore whether users of Smart Home Device in the EU recognize their rights related to data erasure [46] or portability [56] under the GDPR and whether those in other regions would appreciate equivalent regulatory protection.…”

“…For instance, the data that Smart Home Devices deal with may be explicitly provided, sensed, inferred, or predicted. GDPR arguably does not cover all of these types of data [17,56]. As a result, for handling the privacy and security aspects of their Smart Home Devices, users may need to rely on good faith self-regulation from the manufacturers of the devices.…”