Summary

Next to a number of other changes in the widely discussed General Data Protection Regulation, a completely new data subject right has been established – the right to data portability. The right to data portability, as established in Article 20 of the General Data Protection Regulation, provides data subjects with the right to receive a copy of their personal data, which they have provided to a controller, transmit that data to another controller, or have the personal data transmitted directly from one controller to another, where technically feasible. The objective of the right to data portability is to reinforce the control of the data subject over the personal data pertaining to them.

This article analyses the preconditions that need to be met for data portability, the obligations of the controller in relation to the right to data portability, and views when the controller has the right to decline a data subject’s request for data portability.