Right to data portability
The General Data Protection Regulation contains a right to data portability. This means that data subjects must be able to receive personal data, that they have provided themselves, in an electronic, structured format. This data can then be transferred to other services. The data can also be transferred directly from one provider to the next via interfaces without consumers having to download their data.
The right to data portability should enable consumers to switch easily between services and providers. Another aim is to prevent or break up possible monopoly positions. However, it is unclear how data portability can be guaranteed in practice, as many providers have not yet developed technical solutions for this.
According to the Federal Data Protection Act, the right to transferability does not apply in Germany if it hinders archiving purposes in the public interest.
Article 20 GDPR (Right to data portability)
1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
(a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
(b) the processing is carried out by automated means.
2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
Source: Regulation (EU) 2016/679 (see also recital 68)
Section 28(4) BDSG (Data processing for archiving purposes in the public interest)
The rights provided in Article 18 (1) (a), (b) and (d) and in Articles 20 and 21 of Regulation (EU) 2016/679 shall not apply as far as these rights are likely to render impossible or seriously impair the achievement of the archiving purposes in the public interest, and the exceptions are necessary to fulfil those purposes.
