The right to data portability is enshrined in the GDPR, the General Data Protection Regulation, which came into force in 2018 and made many headlines. Only it was mainly about the right of access to or the right to delete data. The aspect of data portability largely fell by the wayside.
Thanks to the right to data portability, consumers should now be able to transfer their data between different providers. For example, someone who uses a fitness app and stores their running times there could take the stored data with them if they decide to use a different app. So much for the theory – what the right to data portability looks like in practice is the subject of an interdisciplinary project funded by bidt.
At the moment, it requires a certain amount of initiative to use the right to data portability. This prevents many from doing so.
Prof. Dr. Susanne Mayr To the profile
Initial results indicate that only a few consumers have heard of it, and companies are not making it easy for them, either. “Currently, it requires a certain amount of initiative to use the right to data portability. This prevents many from doing so,” says psychology professor Susanne Mayr. While many internet platforms offer the possibility to export personal data partially, they do not openly communicate about it.
“Data portability consists of two independent processes: First, the data has to be extracted on the first platform, then it has to be imported on the second platform. Of course, this could happen in one process, and the vision of the GDPR is certainly that this could be done relatively easily and in a user-friendly way. But so far, we have not found any evidence for this process, which should happen in one go, so to speak,” says Jens Großklags, professor of cyber trust.
Those who switch from one professional network to another can, at best, take their self-generated data with them, not their social connections.
Prof. Dr. Johann Kranz To the profile
In addition, the law in the GDPR may be narrower than users would like. “The GDPR only stipulates that transferring personal data that the user has entered himself is possible. This means that all data that has been observed be it movement data or interactions, does not fall under this. The same applies to data derived from user behaviour and predicted data, since the platform operator himself created these,” says economics professor Johann Kranz. And even in the case of personal data, there could still be a discrepancy between wish and reality: “Whoever switches from one professional network to another, for example, can at best take their self-generated data with them and use it on another platform, but not the social connections.”
The bidt project will, therefore also develop recommendations for action on how the possibilities of implementing the right to data portability could be improved: This starts with awareness of the right and goes all the way to pointing out technical options or alternatives.
bidt glossary: Data Portability
The right to data portability is enshrined in the General Data Protection Regulation (GDPR): consumers have the right to transfer their data between different providers. To do this, exporting the data on one platform and importing it on another must be possible. For example, someone who uses a fitness app and stores their running times could take this data to another provider. However, the right does not apply to social connections established on social networks, for example, nor to data on user behaviour observed by the provider.
Research project at bidt
The project is led on an interdisciplinary basis by Professor Jens Großklags (TUM, Chair of Cyber Trust), Professor Johann Kranz (Chair of Internet Business and Internet Services at LMU) and Professor Susanne Mayr (Chair of Psychology with a focus on Human-Machine Interaction at the University of Passau). The research team is investigating awareness and possibilities for implementing the right to data portability. In addition, solutions are being developed on how the concept can strengthen competition in the internet economy and data-driven innovations.
