What is Data Portability?
In May of 2018 the European Union tightened regulations about customer right to data portability as part of theGDPR(General Data Protection Regulation). But what do these changes mean, and how will they impact business operations?
Data portability is the capability to move data from one platform or service to another. It requires that data be stored in a commonly recognized format, and that it maintains a degree of accessibility. With the introduction of the GDPR, data portability has become more critical to the enterprise.
The European Union’sGeneral Data Protection Regulations (GDPR)requires data owned by users to be portable, and that electronic businesses and services must provide to it to owners upon request. This is the “right to data portability.”
The right to data portability ensures that, within 30 days of a request, organizations must transfer individuals’ personally identifiable information (PII) in a safe, secure, and re-usable format.
For modern businesses, this means big changes. Gone are the days when a departing customer’s data could simply be deleted or, more likely, archived for long stretches in the hopes users will return. Under GDPR, organizations must have clear rules for promptly extracting, securing, and transferring private data to its original owners.
For example,Netflix accumulates countless personal detailsabout customers who have long used the subscription service. This can include credit card information, favorite shows, viewing tastes, and more. Prior to GDPR, when a customer left Netflix, all that data stayed with the company. Now services like Netflix must provide this detailed information so that customers can use it for another, potentially competing service. Because it facilitates the exchange of personal data between data controllers, under the control of the data subjects, the right to data portability liberates the flow of personal data between companies, and therefore fosters the development of new innovative digital services.
Failure to deliver data portability not only negatively impacts the establishment of trustworthy personalized services with data subjects, but it can come with big costs, including fines totalling up to four percent of global revenues. Indeed, this makes a strong incentive for reaching compliance.
Tostay compliant with GDPR, organizations are tasked with developing plans and procedures for securely transferring owner data in a “structured, commonly used, machine-readable format.” Developing a data portability plan and training internal IT staff on how to remain compliant with requirements will be a mandatory management practice for organizations moving forward. Asstated by the regulator, “data controllers should develop the means that will contribute to answer data portability requests, such as download tools and Application Programming Interfaces”.
Once plans are made for extracting portable data, organizations must be trained on the security requirements for delivering it to its destination. This can be one of three endpoints:
Note also that a stipulation of the right to data portability declares the owner’s right to request data even when he or she is not leaving a service. Should a user want a report on information like shows views, hours spent listening, or other details, companies must be able to promptly provide it to remain compliant with this aspect of GDPR.
The European Union’s adoption of GDPR standards stress the right to data portability, but also includes a provision for the right to data access.
