The right to data portability in practice: exploring the implications of the technologically neutral GDPR

Abstract

The European General Data Protection Regulation (GDPR) introduces one new data subject right, Article 20's right to data portability (RtDP). The RtDP aims to allow data subjects to obtain and reuse their personal data for their own purposes across different services. • We investigate the RtDP by making 230 real-world data portability requests across a wide range of data controllers. The RtDP is interesting to study as it operates under a framework that aims to be technologically neutral while requiring specific technologies for implementation. Our objective is to assess the ease of the RtDP process from the perspective of the data subject and to examine the file formats returned by data controllers. • From our results, including responses indicating that no personal data were stored, only 172 (74.8%) of RtDP requests were successfully completed. However, compliance with the GDPR varied where not all file formats meet the GDPR requirements. There was also confusion amongst data controllers about data subject rights more generally. • Based on our observations, we revisit the current guidance for data portability. We suggest new technical definitions to clarify how data should be made portable and determine the appropriateness of certain file formats for different data types. • We suggest recommendations and future work for various stakeholders to address the legal implications derived from our study. This includes discussing possibilities for new data portability standards and codes, conducting further empirical research, and building technological solutions to ensure that the RtDP can be better understood in theory and exercised in practice.

How do app vendors respond to subject access requests? A longitudinal privacy study on iOS and Android Apps

“…In line with our findings, previous studies report various anomalies, poor practices, and severe compliance issues on the side of the data controllers, resulting in low rates of satisfying responses to data subject requests [1,10,19,24,34,37]. Besides a widespread unwillingness or inability to provide the requested data in time [2,10,34,37], researchers have observed the use of inappropriate file formats for the transfer of personal data [42], instances of personal information leakage to impostors [7,10], issues concerning the language and clarity of interactions [24], and unsafe procedures to authenticate data subjects [4,25]. In some cases, researchers were not even able to locate the contact details of data controllers, rendering any request submission impossible from the outset [17,24].…”

“…Existing research-based suggestions and recommendations for data controllers need to be compiled into actionable guidelines and distributed in a form that makes them digestible for small-and medium-sized organizations, such as app vendors. This includes, in particular, guidance on how to authenticate data subjects safely [4,7,25], how to transfer personal data [42], and how to facilitate the submission of requests [2,10,17]. It should be a key objective to replace the error-prone manual processing of data subject requests with automated and standardized interfaces for obtaining personal data and other privacy-related information.…”

“…Numerous studies have examined how data controllers react to data subject requests in practice. In these studies, test requests for data access, erasure, and/or portability were either sent to specific types of organizations, such as CCTV operators [34], smartphone app vendors and website owners [10], online tracking companies [37], or to a broad range of public and private sector organizations [1,2,18,19,24,42,43].…”

“…In [24], investigations were carried out in ten different EU member states and, in addition to the quantitative evaluation, a detailed case-by-case assessment is provided for individual data controllers. With the exception of [1], [37] and [42], the above-referenced studies were conducted prior to the GDPR coming into force. Also, in contrast to our study, none of the existing publications offers a multi-year longitudinal evaluation over a constant set of data controllers.…”

“…One crucial ethical aspect of undercover field studies is that resources of the studied subjects are consumed without their consent -namely, in our case, the working time of employees of the examined app vendors. However, as in related studies [1,2,10,24,37,42], the covert approach was necessary to test the behavior of the vendors under realistic conditions and to prevent a research participation effect [20]. It can be assumed that employees of the investigated companies would have put more care and diligence into answering our inquiries if they had known about the nature of our study.…”