Data portability is one of the new provisions that have been introduced with the General Data Protection Regulation (GDPR) in May 2018. Given certain limitations, the data subject can request a digital copy of her own personal data. Practical guidelines describe how to handle such data portability requests, but do not support in identifying which data has to be handed out. We apply a rigorous method to extract the necessary information properties to fulfill data portability requests. We then use these properties to define an abstract service for data portability. This service is evaluated in seven expert interviews.

A Service Definition for Data Portability

The General Data Protection Regulation introduces a brand new right to data portability that should enable the data subject "to transmit those data to another controller without hindrance from the controller to which the data have been provided" This brief paper enucleates the legal and technical limitations to this new right: without standards which lead to interoperability the right to data portability is destined to remain more a declaration of principle than a real and effective tool for individual self-determination in the digital environment

Lucio Scudiero

Papers

Bringing Your Data Everywhere in the Internet of (Every) Thing: A Legal Reading of the New Right to Portability