Data Portability

Legal Framework

The right to data portability is established in Article 20 GDPR, which grants data subjects two distinct entitlements: receiving their personal data in a structured, commonly used, and machine-readable format, and transmitting that data to another controller without hindrance. The right is conditional and applies only where processing meets both prongs of Article 20(1): the processing must be based on consent under Article 6(1)(a) or Article 9(2)(a), or on a contract under Article 6(1)(b), and the processing must be carried out by automated means.

"The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided"
— GDPR Art. 20(1)

Article 20(2) adds a direct transmission right between controllers "where technically feasible," while Article 20(3) clarifies that portability does not prejudice the right to erasure under Article 17 and excludes processing carried out in the public interest. Article 20(4) imposes a proportionality check: the right must not adversely affect the rights and freedoms of others. Controllers must also inform data subjects of this right at the time of collection, as required by Article 13(2)(b) and Article 14(2)(c).

Key Developments

The scope of "machine-readable format" has been addressed beyond the GDPR context. In Gesamtverband Autoteile-Handel e.V. v Scania CV AB, the Court of Justice considered the concept under EU type-approval legislation, drawing on the open data directive's definition:

"A document should be considered to be in a machine-readable format if it is in a file format that is structured in such a way that software applications can easily identify, recognise and extract specific data from it. …"
— Gesamtverband v Scania ¶15

This interpretive benchmark — ease of identification, recognition, and extraction by software — provides a practical threshold for GDPR portability compliance as well. The EDPB's connected vehicles guidelines reinforce that where raw data is provided by the data subject and processed on the basis of Article 6(1)(b), portability applies, and controllers should clearly distinguish which data falls under portability versus access rights.

Enforcement has followed. The Hungarian DPA (NAIH) imposed a €2,000,000 fine on an online store for, among other violations, failing to properly facilitate data subject rights including portability. The Italian Garante fined a health authority €20,000 for publishing personal data without adequate safeguards, illustrating that portability and transparency obligations are actively policed across sectors.

Status of the Debate

The right to data portability is contested in practice, particularly around two unresolved questions: what constitutes data "provided by" the data subject (covering observed and inferred data remains disputed), and what "technically feasible" means for direct controller-to-controller transmission under Article 20(2). Courts have not yet produced a definitive split on these boundaries, but the interpretive lens from Gesamtverband v Scania on machine-readability is being applied by analogy. A referral to the Court of Justice on the scope of "provided by the data subject" — particularly whether inferred or derived data falls within portability — would resolve the most significant open question. Until then, DPAs are setting expectations through enforcement and guidelines rather than settled jurisprudence.

Practical Guidance

• Map processing activities against the Article 20(1) triggers. Portability applies only to processing based on consent or contract and carried out by automated means. Processing under legitimate interests, public interest, or legal obligation falls outside the right — but access under Article 15 may still apply.

• Distinguish "provided" data from inferred or observed data. Only personal data the data subject has provided — whether actively (form inputs) or passively (usage data like telemetry) — falls within portability. Inferred profiles or derived analytics are generally excluded, though this boundary remains under debate.

• Implement export in a structured, commonly used, machine-readable format. Use established formats (CSV, JSON, XML) that allow software to easily identify, recognise, and extract specific data, consistent with the standard articulated in Gesamtverband v Scania.

• Assess technical feasibility for direct transmission. Article 20(2) requires direct controller-to-controller transfer only where technically feasible. Document the feasibility assessment and maintain an API or equivalent mechanism where viable, particularly for high-volume or recurring portability requests.

• Inform data subjects of the right at collection time. Both Article 13(2)(b) and Article 14(2)(c) require proactive disclosure of the portability right. Privacy notices should clearly explain what data is portable and how to exercise the right.