Show simple item record

Files in this item


Item metadata

dc.contributor.authorWong, Janis
dc.contributor.authorHenderson, Tristan
dc.identifier.citationWong , J & Henderson , T 2019 , ' The Right to Data Portability in practice : Exploring the implications of the technologically neutral GDPR ' , International Data Privacy Law , vol. Advance article .
dc.identifier.otherPURE: 259035782
dc.identifier.otherPURE UUID: 00768b95-311a-4b77-9fa8-bdbdb47d686a
dc.identifier.otherBibtex: urn:fed197505e673f8f4cd89b0f7e02ed5e
dc.identifier.otherORCID: /0000-0003-1015-3345/work/59464959
dc.identifier.otherScopus: 85076794659
dc.identifier.otherWOS: 000510391400004
dc.description.abstractKey Points The European General Data Protection Regulation (GDPR) introduces one new data subject right, Article 20’s right to data portability (RtDP). The RtDP aims to allow data subjects to obtain and reuse their personal data for their own purposes across different services. We investigate the RtDP by making 230 real-world data portability requests across a wide range of data controllers. The RtDP is interesting to study as it operates under a framework that aims to be technologically neutral while requiring specific technologies for implementation. Our objective is to assess the ease of the RtDP process from the perspective of the data subject and to examine the file formats returned by data controllers. From our results, including responses indicating that no personal data were stored, only 172 (74.8 per cent) of RtDP requests were successfully completed. However, compliance with the GDPR varied where not all file formats meet the GDPR requirements. There was also confusion amongst data controllers about data subject rights more generally. Based on our observations, we revisit the current guidance for data portability. We suggest new technical definitions to clarify how data should be made portable and determine the appropriateness of certain file formats for different data types. We suggest recommendations and future work for various stakeholders to address the legal implications derived from our study. This includes discussing possibilities for new data portability standards and codes, conducting further empirical research, and building technological solutions to ensure that the RtDP can be better understood in theory and exercised in practice.
dc.relation.ispartofInternational Data Privacy Lawen
dc.rights© 2019, the Author(s). Published by Oxford University Press. This work has been made available online in accordance with the publisher's policies. This is the author created accepted version manuscript following peer review and as such may differ slightly from the final published version. The final published version of this work is available at
dc.subjectData portabilityen
dc.subjectData subject rightsen
dc.subjectGeneral Data Protection Regulationen
dc.subjectTechnological neutralityen
dc.subjectQA75 Electronic computers. Computer scienceen
dc.titleThe Right to Data Portability in practice : Exploring the implications of the technologically neutral GDPRen
dc.typeJournal articleen
dc.contributor.institutionUniversity of St Andrews.School of Computer Scienceen
dc.contributor.institutionUniversity of St Andrews.Centre for Research into Equality, Diversity & Inclusionen
dc.description.statusPeer revieweden

This item appears in the following Collection(s)

Show simple item record