The right to data portability is designed to facilitate the exercise of the right of access to data for data subjects. The latter simply allows anyone whose data has been collected to retrieve this data in a structured, commonly used and machine-readable format so that they can reuse it subsequently and freely, including in a different technical environment. The aim is to facilitate the free circulation of data.
By way of example, contact data may be provided in a common format such as vCard. On the other hand, formats that require the acquisition of a software licence will not be suitable formats.
The conditions for the right to portability are set out in Article 20 of the GDPR.
The right to data portability may only apply to data processing carried out by :
- automated means,
- in performance of a contract or
- for which the data subject has given his/her prior consent.
The data in question corresponds to information which the data subject has supplied himself to the data controller or which he has himself generated as a result of his activity.
This means that data generated by the data controller from data supplied by the individual are not concerned.
For example, a marketing profile calculated on the basis of a score produced by the organisation is not part of the data that is "portable" because it has not been provided directly or generated by the individual.