Right to data portability (art. 20 GDPR)

GDPR for HR | 23.04.2020

This is a right that can be exercised only in the event the personal data have been transmitted on the basis of consent and only if the treatment is carried out on an electronic basis.

This is the right to receive personal data from a data controller in a commonly used format with the consequent right to transmit such data to another data controller, without impediments.

The data must be provided “without undue delay and, in any case, at the latest within one month of receiving the request” (art. 12.3 GDPR). In this way people can move from one service provider to another, thus preventing the formation of phenomena of possible blockage within a service.

Furthermore, the interested party has the right to obtain the transmission of personal data from one data controller to another “without obstacles”, if it is technically possible.

The three minimum requirements are:

– the structured format;
– the common use ;
– readability by automatic device.

The data controller can comply with the standard either by providing a tool for data download, or by guaranteeing the direct transmission of data to another supplier. It is obvious that the data controller, which uses a suitable software can more easily and safely fulfill these requirements. But not only. In the absence of a personal area of the candidate, it will be up to the data controller himself to carry out all the procedures manually, as well as to ask the relative consent to the interested party, at the expense of time and energy.

The data that may be subject to the right to portability are the data that have been provided by the interested party. The interested party has the right to receive, free of charge (except for reimbursement of expenses), the data in a structured and readable form by a data processor (therefore absolutely not in paper format), in a commonly used format. Although there are no specific indications regarding the format to be used, it is obvious that the format must be editable.

The data controller receiving the data is also subject to specific obligations, in particular it becomes the new data controller and therefore must ensure that the data are not excessive in relation to the service it provides.

Another objective that the regulation sets itself is to encourage the free flow of data, thus stimulating the digital economy.

Ensuring the transfer of your personal data from one online service to another promotes competition between companies and innovation and the development of new services. In this way, in fact, the interested party can easily move a service contract to another data controller, without having to supply all his data again but simply asking the old data controller to transport the data to the new data controller.

The data controller must inform the interested parties of the existence of this right, while explaining which data is subject to portability.

Obviously the exercise of this right must not infringe the rights and freedoms of others, such as if the supply infringes the owner’s intellectual property rights or exposes trade secrets.