Regulation and data
Right to data portability
Portability is the right to receive the personal data one has provided to a controller in a structured, commonly used, machine-readable format, and to pass them to another controller, directly where feasible. It applies where processing is automated and based on consent or a contract (art. 20 of the GDPR).
Also known asdata portability · portability right · derecho a la portabilidad
How it differs from access
Both give the person their data, but not the same data nor for the same purpose: the right of access is for knowing; portability is for taking the data away and using them elsewhere. In a centre it is uncommon, but it can happen: someone moving to another residence may ask for their data in a format the new system can read.
| Access (art. 15) | Portability (art. 20) | |
|---|---|---|
| Which data | Everything the controller processes about the person | What the person themselves provided to the controller |
| On what basis | Any | Consent or contract, with automated processing (art. 20.1) |
| Format | A copy; electronic and commonly used if requested that way (art. 15.3) | Structured, commonly used and machine-readable |
| Also | Information on purposes, recipients and periods | Direct transmission to another controller where technically feasible (art. 20.2) |
Worth knowing
It does not cover everything. It does not apply to processing carried out in the public interest or in the exercise of official authority (art. 20.3), and it cannot adversely affect others (art. 20.4): a resident's conversations may contain other people's data. Nor does exercising it delete anything on its own; if the person also wants the data erased, that is the right to erasure, which remains unaffected (art. 20.3).
Sources
Related terms
- Right to erasureThe right to erasure, or right to be forgotten, lets a person have the controller delete their personal data without undue delay if they are no longer needed, if the consent they rested on is withdrawn, if the person objects to the processing or if they were processed unlawfully. Art. 17 of the GDPR governs it.
- Right of accessThe right of access lets anyone find out whether a controller processes data about them and, if so, obtain a copy and information on what they are used for, what kind they are, who receives them, how long they are kept and where they came from. Art. 15 of the GDPR governs it, and there is one month to reply.