In June 2023, the interdisciplinary research project on the right to data portability under GDPR was concluded at bidt. Upon the project’s completion, the three project leaders, Professor Susanne Mayr, Professor Jens Großklags, and Professor Johann Kranz, discussed the expectations linked with the establishment of the right, misconceptions that currently exist among the public, and the potential for data-driven innovations.
Data portability is a very unwieldy term. What does it mean?
In principle, the right to data portability is based on the idea that consumers should be able to change an online service if they are dissatisfied with it.Prof. Dr. Jens Großklags To the profile
Jens Großklags: Until now, it was not easy to change a sales platform, a mail service provider or a music streaming service. Before the new legal regulation, you could neither take your data to a new service nor delete your data from an old service. The right to data portability now makes it possible to receive data in a machine-readable, compact format and then process it yourself. This data can then be uploaded to another provider if this option is made available. The devil is in the detail: too few providers have such import functions, and it is unclear to what extent data must be provided.
What kind of data are we talking about?
Großklags: Roughly speaking, data can be divided into three categories: First, there is data that users have communicated directly in the platform, such as contact data, uploaded photos or documents. Secondly, some data has been collected about the user, for example, through their browsing behaviour; and thirdly, data that has been created by the service – based on the two previous data tracks – such as profiles according to their preferences or music interests. The latter category is usually considered not to be part of the regulation. However, for the other two categories, there is some debate among lawyers whether the right to data portability includes only the user-contributed or also the observed data. In practice, we have seen companies understand the right to data portability in very different ways: Some share only the data contributed, while others provide the entire data set for download.
How is the right to data portability technically implemented concretely – and what are the pitfalls?
Großklags: The bottom line is that there are two problem areas. Many companies do not yet offer a machine-readable format for downloading. Data is sent as a PDF file, copied into an email, or even sent as a paper letter. This makes it difficult to make the data usable. Secondly, even when data is made available in a machine-readable format, it is not done in a standardised way.
The enshrinement of the right to data portability in the GDPR was associated with many hopes: more control over one’s data for users, breaking up data silos, and avoiding lock-in effects. Have these hopes been fulfilled?
Johann Kranz: I don’t really think the regulation is effective because it lacks clarity and specificity. It’s important to define which data can be transferred, such as reputation on sales platforms or images on social media. Additionally, the process of transferring data should be user-friendly. Only with clear regulations and a legal right to data portability can progress be made. Currently, the rules on data portability are too lenient, which benefits big digital platforms. However, it is still a positive development that data portability is an option, but it may only be accessible to knowledgeable and technically skilled users.
Based on your results, it appears that the right to data portability is the least familiar among the GDPR rights. Approximately 25% of the respondents are aware of this right. Can you provide your insights on why this particular topic is not widely known?
Susanne Mayr: The results of our population-representative study did not surprise us. One reason for this is that the concept of data portability is relatively new and can be difficult to understand compared to other rights, such as the right to data erasure. Additionally, most services do not advertise data portability as much as they should, often mentioning it only in the fine print as a potential option. As a result, clear instructions on how to transfer one’s data are hard to come by.
Are there socio-demographic differences, i.e. groups of people who know less about the law than others?
Mayr: Yes, there are big differences here. We have noticed that people who describe themselves as tech-savvy are often more sensitive to the issue of data protection – and more willing to use appropriate solutions. However, due to the aforementioned barriers, these groups have usually not yet made a successful switch. In our study, less tech-savvy people frequently expressed clear wishes to switch, but they have difficulties understanding. Sometimes the spontaneous reaction to the keyword data portability was: “I don’t want my data to be passed on.” There is still a lot of educational work to be done here.
What chances do platforms have if they communicate the right to data portability more openly and make the switch technically easier?
Mayr: Through our experimental study, we discovered that customers are more willing to pay when a service provides the option of data portability. We conducted an exemplary study with an email service provider to prove this. However, prior to the study, we thoroughly informed the participants about the details of their right to data portability.
Are there other advantages of data portability for platform operators?
Start-ups with data-driven business models can benefit from data portability. It allows them to gather a significant amount of data quickly, which is essential for running their models effectively and efficiently. This opens up new opportunities for these start-ups to grow and succeed.Prof. Dr. Susanne Mayr To the profile
Mayr: Regrettably, many start-ups view GDPR as an annoying obstacle to be disregarded in favour of concentrating on the core business concept. They fail to recognise or comprehend the potential of data and data portability.
Data portability can also be useful on platforms with complementary products, such as a combination of sales platforms and payment service providers. Have you also done research on this?
Großklags: Our team conducted a study involving several hundred students to explore the potential of complementary scenarios. On the basis of around 30 services, we asked participants to identify intersections that could be beneficial. Some were viewed as useful by many, e.g. those in gaming, streaming, and payment services; there were also creative ideas for more obscure intersections. We discovered that there are exciting opportunities for developing an innovative value chain based on existing data. However, we also noted that the interfaces are not yet standardised, and it requires significant effort and risk to ensure compatibility between exports and imports.
What has to happen at the political level so that the right to data portability may be fully exercised in the future?
Kranz: For data portability to work well, there needs to be some level of technical standardisation. This would eliminate any confusion for companies about which types of data they need to provide, and it would be more convenient for customers. However, for companies to come to an agreement on a standard, politicians must create a sense of urgency by saying something like, “If you don’t comply, we will establish the standard ourselves!”
Without threat potential, the major digital companies will not take action. It is important to select a standard that is open, practical, and secure for all parties involved.Prof. Dr. Johann Kranz To the profile
Großklags: It is essential to keep practical usability in mind when implementing new legislation, while also creating excitement for the potential benefits it brings. One idea is for the data protection authority to recognise and reward German internet companies with the best import functionality each year, divided into categories for large, medium, and small companies. This would generate positive publicity and enthusiasm within the industry.
The implementation of the law was aimed at providing new and innovative companies with better opportunities to establish themselves, resulting in increased competition. Some academics express concerns that the right to data portability may be too costly for smaller companies to invest in.
Kranz: There is such a fear, but I belong to the other camp. There are standard solutions for data transfer – interfaces that are used by programmers all over the world. Implementing the right to data transfer should not be a hindrance for start-ups.
Looking back on the project period, what were the main challenges in the interdisciplinary work with the three different disciplines?
Mayr: The pandemic! We had to change our plans for the first study. Originally, we already had arranged for catering for the participants but ended up moving the study online. Although it was not the same as meeting in person, we still managed to work well together despite coming from different disciplines. Surprisingly, we found that we had more in common than we had expected. At times, I thought that having a legal perspective would have been helpful, but overall the interdisciplinary approach proved to be very beneficial for studying complex topics.
Thank you very much for the interview!
The interview was conducted by Anja Reiter.