The right to data portability gives the individual the ability to:
- receive his or her personal data, which the individual provided to the controller, in a structure, commonly used and machine-readable format
- transmit that personal data to another controller without hindrance
where:
- the processing is based on consent or on a contract, and
- the processing is carried out by automated means
The individual has the right to have the personal data transmitted directly from one controller to another where technically feasible.
The right to data portability is not in lieu of the right to erasure.
Exceptions to the right of data portability are processing:
- necessary for the performance of a task carried out in the public interest, or
- in the exercise of official authority vested in the controller
- that adversely affects the rights and freedoms of others.
This blog is the ninth in a series of blogs that describes and explains the eight individual rights set forth in the GDPR. If you don’t want to wait until the next blog to learn more about the GDPR and the individual rights in the GDPR, take a look at GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, that can help SMEs implement the GDPR and demonstrate their implementation.
Next blog: What is the right to object?