GDPR Art. 20 EN

Right to data portability

Data Portability Data Portability

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:¶

Data Portability Data Portability Personal Data 10
1. a)
  the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and ¶
  Consent
2. b)
  the processing is carried out by automated means. ¶
2.

In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.¶

Data Portability Data Portability Personal Data 20
3.

The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.¶

Controllers 4
4.

The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.¶

4

Enforcement

Cited in 9 fines totalling €1.2M

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (5) · median fine €59,600 · see all enforcement for Art. 20 →

Connections by provision

20(1) 8 Case Law 2 Guidance .md

Case Law 8

Judgment of the General Court (Ninth Chamber, Extended Composition) of 5 October 2020 (Extracts).#Les Mousquetaires and ITM Entreprises v European Commission.#Competition – Agreements, decisions and concerted practices – Administrative procedure – Decisions ordering an inspection – Plea of illegality against Article 20 of Regulation (EC) No 1/2003 – Right to an effective remedy – Obligation to state reasons – Right to inviolability of the home – Sufficiently strong evidence – Proportionality – A GC - T-318/24 CJEU - C-205/21 - Ministerstvo na vatreshnite raboti Judgment of the Court (Fifth Chamber) of 26 January 2023.#Criminal proceedings against V.S.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Principles relating to processing of personal data – Purpose limitation – Data minimisation – Article 6(a) – Clear distinction between personal data of different categ Judgment of the Court (Fifth Chamber) of 10 March 2016.#Safe Interenvios, SA v Liberbank, SA and Others.#Request for a preliminary ruling from the Audiencia Provincial de Barcelona.#Reference for a preliminary ruling — Prevention of the use of the financial system for the purpose of money laundering and terrorist financing — Directive 2005/60/EC — Customer due diligence measures — Directive 2007/64/EC — Payment services in the internal market.#Case C-235/14. ¶26 CJEU - C-205/21 - Ministerstvo na vatreshnite raboti ¶26 Judgment of the Court (Fifth Chamber) of 26 January 2023.#Criminal proceedings against V.S.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Principles relating to processing of personal data – Purpose limitation – Data minimisation – Article 6(a) – Clear distinction between personal data of different categ ¶30 Judgment of the Court (Fifth Chamber) of 10 March 2016.#Safe Interenvios, SA v Liberbank, SA and Others.#Request for a preliminary ruling from the Audiencia Provincial de Barcelona.#Reference for a preliminary ruling — Prevention of the use of the financial system for the purpose of money laundering and terrorist financing — Directive 2005/60/EC — Customer due diligence measures — Directive 2007/64/EC — Payment services in the internal market.#Case C-235/14.

Guidance 2

Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

20(1)(b) 1 Case Law .md

Case Law 1

20(2) 20 Case Law .md

Case Law 20

Judgment of the General Court (Ninth Chamber, Extended Composition) of 5 October 2020 (Extracts).#Les Mousquetaires and ITM Entreprises v European Commission.#Competition – Agreements, decisions and concerted practices – Administrative procedure – Decisions ordering an inspection – Plea of illegality against Article 20 of Regulation (EC) No 1/2003 – Right to an effective remedy – Obligation to state reasons – Right to inviolability of the home – Sufficiently strong evidence – Proportionality – A Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers Judgment of the Court (Grand Chamber), 16 October 2012.#European Commission v Republic of Austria.#Failure of a Member State to fulfil obligations – Directive 95/46/EC – Processing of personal data and free movement of such data – Protection of natural persons – Article 28(1) – National supervisory authority – Independence – Supervisory authority and the Federal Chancellery – Personal and organisational links.#Case C‑614/10. CJEU - C-614/10 - Commission v. Austria Judgment of the Court (Fifth Chamber) of 8 December 2022.#VS v Inspektor v Inspektorata kam Visshia sadeben savet.#Request for a preliminary ruling from the Administrativen sad - Blagoevgrad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Articles 2, 4 and 6 – Applicability of Regulation 2016/679 – Concept of ‘legitimate interest’ – Concept of ‘task carried out in the public interest or in the exercis Judgment of the Court (Grand Chamber) of 21 March 2024.#RL v Landeshauptstadt Wiesbaden.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Regulation (EU) 2019/1157 – Strengthening the security of identity cards of EU citizens – Validity – Legal basis – Article 21(2) TFEU – Article 77(3) TFEU – Regulation (EU) 2019/1157 – Article 3(5) – Obligation for Member States to include two fingerprints in interoperable digital formats in the stora ¶64 Judgment of the Court (Grand Chamber), 16 October 2012.#European Commission v Republic of Austria.#Failure of a Member State to fulfil obligations – Directive 95/46/EC – Processing of personal data and free movement of such data – Protection of natural persons – Article 28(1) – National supervisory authority – Independence – Supervisory authority and the Federal Chancellery – Personal and organisational links.#Case C‑614/10. ¶62 Judgment of the Court (Grand Chamber), 16 October 2012.#European Commission v Republic of Austria.#Failure of a Member State to fulfil obligations – Directive 95/46/EC – Processing of personal data and free movement of such data – Protection of natural persons – Article 28(1) – National supervisory authority – Independence – Supervisory authority and the Federal Chancellery – Personal and organisational links.#Case C‑614/10. +12 more

20(3) 4 Guidance .md

Guidance 4

EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶149 EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) ¶191 EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act)

20(4) 3 Guidance 1 Literature .md

Guidance 3

EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria ¶51 Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria

Literature 1

General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?

Related across sources

Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement Guidance Guidelines 01/2022 on data subject rights - Right of access Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures News Irish Data Protection Commissioner Fines Instagram EUR 405M for Children Privacy Violations