Download the PDF
Data trends 2024
Data trends 2024
Chapter 4: New data portability rights: challenges and opportunity
By Richard Bird, Aedan Collins, Theresa Ehlen, Jan Niklas di Fabio, Adam Gillert, Christine Lyon, Giles Pratt and Philipp Roos
IN BRIEF
Data portability rights seek to make it easier for a natural or legal person to transfer their data from one company to another, by giving them the right to request a copy of their data in a structured, commonly used, and machine-readable format, and to transmit their data to another company. Examples might include a consumer seeking to move their content to a different social networking platform, or a company seeking to migrate its business data to a different cloud services provider.
At present, data portability rights (such as those found in privacy laws) generally do not play a major role in practice due to legal and technical limitations. This may soon change with the introduction of new laws in the EU and UK.
Although more US states are adopting data portability rights in the B2C context, new laws in the EU and UK will likely increase the practical impact of data portability well beyond what we are seeing in the US, by expanding data portability rights in B2B as well as B2C contexts.
Christine Lyon
Partner
Existing data privacy-related laws, such as the EU GDPR, UK GDPR, and newer US state consumer data privacy laws like the California Consumer Privacy Act, already provide individuals with various data portability rights for their personal data. In practice, however, the data portability rights under these laws have not always led to the benefits that may have been envisioned by lawmakers. For example, these data portability rights are subject to various restrictions, such as technical feasibility. Consequently, individuals may find it difficult to move their data from one organisation to another given different technical set-ups of the relevant services.
New and pending EU and UK laws regulating the use and control of data have the potential to change the practical relevance of data portability rights, including by giving new data portability rights to organisations and imposing new data portability obligations on providers of certain types of online services.
Philipp Roos
Principal Associate
Under the Digital Markets Act (DMA), so-called ‘gatekeepers’ (ie, companies that provide core platform services, such as online search engines, online marketplaces and social networking services) must provide users with effective portability of data provided by the end user or generated through the activity of the user in the course of using the relevant service.
In particular:
Another recent EU data access right, which could also be used by consumers to move their data from one service provider to another, is included in the Digital Content Directive. This specifically targets the relationship between consumers and organisations that act for purposes relating to their trade, business, craft, or profession in relation to digital content and digital services contracts (traders). In particular, if a B2C contract regarding the supply of digital content or a digital service is terminated, the trader must make available to the consumer any content other than personal data (since that is governed by the EU’s GDPR) that was provided or created by the consumer during the supply of the digital content or digital service. Such content may include user-generated technical or performance data.
Data portability will also play a key role in various upcoming EU proposed laws that are part of the EU Digital Strategy.
The EU’s draft Data Act, aiming to facilitate data sharing between organisations, includes several mechanisms which look to ensure data portability by users, whether the users are consumers or businesses:
The Data Act forms a key piece of the EU data strategy aiming to unlock industrial data and facilitate switching between data processing providers.
Theresa Ehlen
Partner
Closely connected to the Data Act, the European Commission envisages establishing so-called ‘Common European data spaces’ for several key sectors. For the health and finance sector, the European Commission has already published drafts regulating such data spaces. In line with the goal of granting patients and customers of financial institutions further control over their data, the drafts suggest sector-specific data portability rights.
(Source: UK Competition and Markets Authority)
Similarly, UK lawmakers are also considering various government-backed draft laws that seem likely to create new data portability rights and obligations, such as:
Lawmakers in the EU and the UK are currently introducing laws which include new data portability rights going beyond the data portability rights under existing privacy laws.
This is a trend other jurisdictions might follow, just as the EU GDPR led to reforms of data privacy laws in many jurisdictions.
Strengthened data portability rights can, in principle, lead to increased competition and consumer choice, stimulating data-driven innovation. But data portability rights also risk undermining incentives to invest in data-driven businesses, particularly if the scope of data that must be shared includes valuable analytics data.
Giles Pratt
Partner
The practical effects of each data portability right can be quite different, especially given their different scope and the possible limitations under each of the relevant laws.
Organisations should start assessing: