Module 5 · Data portability (Article 20)
Data portability (Article 20) extends the right of access: the data subject can receive their data in a structured, commonly used, machine-readable format and transmit it to another controller. It is triggered only when processing is based on consent OR contract AND is carried out by automated means - it does NOT apply to legitimate interests, legal obligation or public-task processing.
Data portability (Article 20) lets a person receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller, with interoperability as the goal. It is an extension of the right of access but is far narrower in scope.
Only triggered when processing is based on consent OR contract AND is carried out by automated means. It does NOT apply to legitimate interests, legal obligation or public-task processing.
| # | Condition | Key point |
|---|---|---|
| 1 | Lawful basis | Processed by automated means on the basis of consent or contract (not legitimate interest, legal obligation or public task) |
| 2 | Source of data | Data must be provided by the data subject - given or observed, NOT derived or inferred |
| 3 | Third parties | Exercising it must not adversely affect others' rights and freedoms |