Data Portability and Data Control: Lessons for an Emerging Concept in EU Law

• Published in: German law journal Vol. 19; no. 6; pp. 1359 - 1398
• Main Authors: Graef, Inge, Husovec, Martin, Purtova, Nadezhda
• Format: Journal Article
• Language: English
• Published: Toronto Cambridge University Press 01.11.2018
• Subjects: Aspiration; Closely held corporations; Competition policy; Consumer protection; Copyright; Data integrity; General Data Protection Regulation; Incentives; Innovations; Intellectual property; Property rights; Reconciliation; Reuse; Secrets; Single market
• ISSN: 2071-8322; 2071-8322
• DOI: 10.1017/S2071832200023075

The right to data portability (RtDP) introduced by Article 20 of the General Data Protection Regulation (GDPR) forms a regulatory innovation within EU law. The RtDP provides data subjects with the possibility to transfer personal data among data controllers, but has an impact beyond data protection. In particular, the RtDP facilitates the reuse of personal data that private companies hold by establishing a general-purpose control mechanism of horizontal application. Article 20 of the GDPR is agnostic about the type of use that follows from the ported data and its further diffusion. We argue that the RtDP does not fit well with the fundamental rights nature of data protection law, and should instead be seen as a new regulatory tool in EU law that aims to stimulate competition and innovation in data-driven markets. What remains unclear is the extent to which the RtDP will be limited in its aspirations where intellectual property rights of current data holders—such as copyright, trade secrets and sui generis database rights—cause the regimes to clash. In such cases, a reconciliation of the interests might particularly confine the follow-on use of ported data again to specific set of socially justifiable purposes, possibly with schemes of fair remuneration. Despite these uncertainties, the RtDP is already being replicated in other fields, namely consumer protection law and the regulation of non-personal data. Competition law can also facilitate portability of data, but only for purpose-specific goals with the aim of addressing anticompetitive behavior. We conclude that to the extent that other regimes will try to replicate the RtDP, they should closely consider the nature of the resulting control and its breadth and impact on incentives to innovate. In any case, the creation of data portability regimes should not become an end in itself. With an increasing number of instruments, orchestrating the consistency of legal regimes within the Digital Single Market and their mutual interplay should become an equally important concern.