Report on the IMKR Lecture “The New Right to Digital Data Portability” by Dr. Steinrötter

On July 11, 2018, Dr. Björn Steinrötter, assistant professor (Akademischer Rat a. Z.) at Leibniz University Hannover, spoke at the IMKR about the new right to digital data portability under Article 20 of the EU General Data Protection Regulation (GDPR). To illustrate his topic, Dr. Steinrötter raised the following questions: Should the right to data portability actually make it possible to transfer all data from one provider to another, e.g., from Facebook to Google+? Would such a “data migration” entail the deletion of the data from the first provider? Would the data transfer be limited to user data, or could it even extend to content – such as music on Spotify or TV shows and movies on Netflix?

The right to data portability is intended to provide greater control over personal data (Recital 68 of the GDPR). However, a general increase in the level of data protection – achieved by promoting competition through effective data protection technologies or by making it easier to switch providers, thereby limiting the market power of individual companies – also played a role. Article 20 of the GDPR is therefore not merely a data protection provision but also a competition law provision.

With regard to Article 20 of the GDPR, the most important question concerns the data covered by the provision: In addition to the personal nature of the data, which already follows from the scope of application of the GDPR, the data must have been “provided” by the data subject themselves – a term that is certainly open to interpretation. This certainly applies to direct data that the data subject has transmitted directly to the controller. So-called observational data, which the controller generates through the data subject’s active use – e.g., health or activity data from fitness trackers – also falls under this provision. Analytical data, however, which the controller generates through user categorization or analysis – such as creditworthiness – is no longer covered by Article 20 of the GDPR. With regard to this data, however, the data subject is in any case entitled to the right of access under Article 15 of the GDPR. The requirements that Article 20 of the GDPR imposes on the processing of such data are already evident from the wording: It must be based on the data subject’s consent or on a contract, must be automated, and, pursuant to Article 20(3), second sentence, of the GDPR, may not be carried out for the performance of public tasks.

As a legal consequence, the data subject may request two things: to receive their data in a structured, commonly used, and machine-readable format pursuant to Article 20(1), alternative 1 of the GDPR, as well as the (direct) transfer of the data from one controller to another pursuant to Article 20(1), alternative 2, in conjunction with paragraph 2 of the GDPR. However, the exercise of both rights must not infringe upon the (fundamental) freedoms and (fundamental) rights of others (Art. 20(4) GDPR). The reference solely to paragraph 1 is generally considered to be a drafting error.

The right to receive data under Article 20(1), first alternative, of the GDPR entails the right to receive a copy of the data and not merely read access. It is formulated more precisely than the mere right of access under Article 15 of the GDPR. The criterion of interoperability, which was still included in Recital 68, was not incorporated into the final version of the regulation due to a lack of technical feasibility. For this reason, the official heading (“Right to Data Portability”) is also conceptually unfortunate. A more appropriate term would be “right to data transfer.” The right to data transfer under Article 20(1), second alternative, in conjunction with paragraph 2 of the GDPR does not necessarily entail the erasure of data by the original controller, as is evident from Article 20(3), first sentence, of the GDPR. This right is therefore not merely a “right to data relocation.” Rather, Article 20 of the GDPR permits not only a change of provider but also an expansion of providers in the sense of parallel use of the data. Consequently, a request for data portability does not necessarily entail termination of the contract, as is sometimes argued. Rather, the data subject’s declaration must be interpreted on a case-by-case basis in accordance with §§ 133 and 157 of the German Civil Code (BGB).

In conclusion, Dr. Steinrötter emphasized that the primary use case originally envisaged in the legislative process – social media – plays a rather minor role due to Article 20(4) of the GDPR. However, Article 20 of the GDPR could become relevant. This does not concern the transfer of content such as music tracks, movies, or emails as such, but rather, for example, individually created playlists or contact addresses from a webmail account. Although the interoperability of data sets is not (yet) mandatory, providers and trade associations must make a concerted effort to develop common standards and formats. Even against the backdrop of draconian fines (see Art. 83(5)(b) GDPR), implementing the regulatory requirements as effectively as possible is in their very best interest.

The ensuing discussion focused primarily on the question of how the right to receive data and the right to data portability could be situated within the broader context of the emergence of a distinct “data economy law” that must be distinguished from data protection law. It was pointed out that Article 20 of the GDPR is well-suited to promoting the establishment of personal data as a commercializable asset. The right to receive data under Article 20(1), alternative 1, of the GDPR could offer individuals added value by granting them a right of use over their own data in the sense of “data ownership.” However, there are also strong arguments for interpreting Article 20 of the GDPR as an access-based solution. Furthermore, the right to data portability under Article 20(2) of the GDPR could strengthen the user’s bargaining position vis-à-vis companies by removing barriers to switching providers.

Note: Following the presentation, it was reported that the major IT companies have agreed on a joint project aimed at facilitating data portability (Data Transfer Project), see Süddeutsche Zeitung (in German).