What is the right to data portability?

What it is

Portability covers data the person provided, including data observed from their use of a service, such as activity logs, but not inferences you created. It must not adversely affect other people's rights.

When it applies

• The lawful basis is consent or contract, and the processing is automated. UK GDPR Art 20(1)

When it does not

• Processing on any other lawful basis, paper records, or data you derived or inferred.
• Processing for a public task. Art 20(3)

Who is responsible

The controller holding the data. The receiving controller becomes responsible for what it receives.

What it involves

1. Check the basis and scope.
2. Extract the data in a machine-readable format such as CSV or JSON.
3. Transmit directly if asked and feasible.
4. Respond within one month.

Timing

One month, extendable by two.

If it goes wrong

Regulatory

Failing to respond properly breaches Arts 12 to 22. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change. Most cases start with a complaint to the regulator, which can order compliance.

Criminal

No offence.

Civil

The person can apply to court for a compliance order (DPA 2018 s.167) and claim compensation for damage or distress (Art 82; s.168).