How Portable is Portable?

Abstract

The new European General Data Protection Regulation has introduced several new rights designed to empower users and regulate imbalances of power between those who collect and control data and those to whom the data refer. In this paper we focus on one particular right, the right to data portability, and examine how it is being implemented. We discuss the responses to 230 real-world data portability requests, and examine the file formats returned and difficulties in making and interpreting requests. We find variation in file formats, not all of which meet the GDPR requirements, and confusion amongst data controllers about the various GDPR rights.

The exercisability of the right to data portability in the emerging Internet of Things (IoT) environment

“…Together, both studies expose that the RtDP does not function across the examined IoT systems, adding not only to the existing work by scholars, such as Urquhart et al (2018) and Wong and Henderson (2018, 2019), but also pointing out fundamental challenges that both industry and regulators have to address. Authors such as Li (2018) and De Hert et al (2018) have already identified practical roadblocks to the RtDP’s implementation, with our findings offering an empirical analysis of the practical challenges data portability faces in the consumer IoT market.…”

“…Following on from the work of Wong and Henderson (2018, 2019), who performed data portability requests via a standardised email template, the researchers expected that: (a) given the wording of Article 20(1), it would be possible to receive all relevant personal data in a structured, commonly used, machine-readable format, but not to use that data to transmit to a second data controller and (b) given the wording of Article 20(2), it would not be possible to fulfil the direct transmission of data from one data controller to another. The data controllers contacted were made aware during the experimental process that a study was taking place.…”

“…Since the GDPR became operational, only a selected number of studies have inspected the RtDP, with even fewer publications offering empirical examinations. For example, Wong and Henderson (2018) exercised their RtDP against 230 data controllers across various sectors, including social media platforms. Li (2018) explored the conflict between the RtDP and the right to be forgotten (Article 17) and Urquhart et al (2018) investigated the theoretical application of data portability to the Internet of Things (IoT).…”

What HCI Can Do for (Data Protection) Law—Beyond Design

“…Relatively few studies so far have explicitly targeted the implementation of provisions and data subject rights provided by the GDPR. The data subject rights in GDPR are currently being researched, such as the right to data portability [21,93]. Closely related to the right to access data, transparency-enhancing tools have been proposed-mostly following a dashboard approach.…”

Reviewable Automated Decision-Making

“…This will generally require the collation and aggregation of information recorded in previous stages, ensuring that it is presented appropriately to support critical understanding by the forum. Note that, in practice, many organisations appear ill-prepared for meeting their disclosure obligations [65,76] Records about disclosures themselves can also be relevant -both of the processes for disclosure as well as what was actually released, how information was compiled, how it was delivered, in what format, to whom, and when. The basis for disclosure is also relevantwas it legally required, e.g.…”