1. European Union

2. Switzerland

3. Requirements for effective data interoperability

4. Rights of data subjects under the European Union's new GDPR
     Data portability in relation to the right of access    Data portability in relation to the right of explanation  

5. See also

6. References

Data portability is a concept to protect users from having their data stored in "silos" or "walled gardens" that are incompatible with one another, i.e. closed platforms, thus subjecting them to vendor lock-in. Data portability requires common technical standards to facilitate the transfer from one data controller to another, thus promoting interoperability.

Data portability applies to personal data. It involves access to the personal data without implying data ownership per se.

At the global level there are proponents seeing the protection of digital data as a human right. Thus in an emerging civil society draft declaration one finds mention of the following concepts and statutes: Right to Privacy on the Internet, Right to Digital Data Protection, Rights to Consumer Protection on the Internet, United Nations Guidelines for Consumer Protection. ^[1]

At the regional level there are at least three main jurisdictions where data rights are seen differently: China/India, the United States and the European Union. In the latter personal data was given special protection under the 2018 General Data Protection Regulation (GDPR).

The GDPR thus became the fifth of the 24 types of legislation listed in Annex 1 Table of existing and proposed European Directives and Regulations in relation to data. ^[2]

Personal data are the basis for behavioral advertising, and early in the 21st century their value began to grow exponentially, at least as measured in the market capitalization of the major platforms holding personal data on their respective users. European Union regulators reacted to this perceived power imbalance between platforms and users, although much still hinges on the terms of consent given by users to the platforms. The concept of data portability comprises an attempt to correct the perceived power imbalance by introducing an element of competition allowing users to choose among platforms.

European Union

The right to data portability was laid down in the European Union's General Data Protection Regulation (GDPR) passed in April 2016. The regulation will apply to data processors, whether inside or outside the EU, if they process data on individuals who are physically located within an EU member state.

Earlier the European Data Protection Supervisor had stated that data portability could "let individuals benefit from the value created by the use of their personal data".^[5]

The European-level Article 29 Data Protection Working Party held a consultation on this in English lasting until the end of January 2017.

Their guidelines and FAQ on the right to data portability contain this call for action:

In April 2017, new guidelines were published on the Article 29 Working Party website.^[6]

The French national data supervisor CNIL hosted a discussion in French. Current participants offer opinions on how the legislation provides few benefits for companies, but many for users.^[7]

Although the United Kingdom voted to withdraw from the EU, it intends to incorporate much of the GDPR in its own legislation, which will include data portability, as "...the GDPR itself contains some noteworthy innovations – for instance… the introduction of a new right to data portability".^[8]

Switzerland

Likewise, in Switzerland, a nation-state that is related to the EU only on a bilateral basis and as an EFTA member state, there has been a trend moving in the same direction. The Swiss view was officially published in March 2018 (as a document in PDF). ^[9]

A cooperative proposed to have a right to data portability anchored in the constitution of the Swiss Confederation. After being seriously considered in the parliament, however, the proposal was not included in the newest draft dated 21 December 2016.^[10] The cooperative is called MIDATA.coop; besides proposing legislation, it will offer users a place to store their data.^[11]

Over the longer term, the Swiss may have to consider that data portability is in the GDPR. Given that the GDPR will raise compliance costs for EU-based companies, it is unlikely that the EU would tolerate a situation with third-party countries in which Swiss companies would not be held to the same standard in order to keep competition fair. The legal terms involved are adequacy and reciprocity ^[12]

Requirements for effective data interoperability

It is always tricky for legislators to regulate at the right level of precision, as everyone understands technology will evolve faster than the law. So far, only the European Union has formalized the expectations around data portability, requiring the data "in a structured, commonly used, machine-readable and interoperable format".

This touches on at least two distinct technical requirements for effective interoperability:

• the need to use file standards that allow for easy reuse (for instance CSV or JSON instead of PDF or even printed paper), encompassed by a "structured, commonly used, machine-readable" format.
• the need (hinging on "interoperable") to not only consider an individual's data release on its own, but also in conjunction with other systems and other individuals' data releases from the same company. This hints at requirements regarding data schemas, versioning and specification of those schemas in case of frequent changes, and generally the absence of efforts on the part of the source data controller to complicate the effective interoperability downstream.

Rights of data subjects under the European Union's new GDPR

The list of these rights has grown.^[13]

Data portability in relation to the right of access

The data portability right is slightly different from the Right of access to personal data; see GDPR and the seventh item in the list cited immediately above. The right of access only mandates that the data subject gets to see their personal data. The old EU Data Protection Directive used to require explicitly in such cases for the data to be provided in "intelligible" form, which has been interpreted so far as "human readable". This requirement is still somewhat present in the EU's General Data Protection Regulation, but only implicitly in conjunction with Recital_(law). Since the right to portability is mostly concerned with reuse by other services (i.e. most likely automated), it could be that both "human readable" and "raw format" would be inappropriate for effective data portability. Some intermediate level might need to be sought.

In addition, the GDPR limits the scope of data portability to cases where the processing is made on the basis of either consent of the data subject, or the performance of a contract.

Data portability in relation to the right of explanation

The data portability right is related to the "right to explanation", i.e. when automated decisions are made that have legal effect or significant impact on individual data subjects. How to display an algorithm? One way is through a decision tree. This right, however, was found to be not very useful in an empirical study.^[14]

The right to explanation is related to the "Right to not be evaluated on the basis of automated processing" shown as the last item in the list shown in Gabel / Hickman.^[15] This includes decisions based on profiling. Such a right was included in the EU Data Protection Directive of 1995, but not much enforcement followed. An article in Wired emphasised the poignancy of the discussion.^[16] The issue has been discussed by Bygrave,^[17] and by Hildebrandt,^[18] who claimed this to be one of the most important transparency rights in the era of machine learning and big data. Contrary to Hildebrandt's high expectations in 2012, four years later, after many revisions to the GDPR, when the text has been finalized, three other well-known authors contest whether a right to explanation still exists in the GDPR (see below).

In the United States there was a description of related developments in a seminal book by law professor Frank Pasquale;^[19] the relevant passages were reviewed by the Electronic Privacy Information Center (EPIC).^[20] Even the U.S. Defense Advanced Research Projects Agency DARPA has an Explainable AI (XAI) program^[21]

cited critically by blogger Artur Kiulian^[22]

Several papers have been published on these topics in 2016, the first of which, by Goodman / Flaxman, outlines the development of the right to explanation.^[23] Pasquale does not think the approach goes far enough, as he has stated in a blog entry at the London School of Economics (LSE).^[24] In fact at LSE there is a whole series on Algorithmic Accountability of which that was one entry in Feb. of 2016, and other notable ones were by Joshua Kroll and Mireille Hildebrandt.^[25]

Another 2016 paper, this one published by Katarinou et al., includes remarks on a right of appeal such that "individuals would have a right to appeal to a machine against a decision made by a human."^[26]

A third 2016 paper, one co-authored by Mittelstadt et al., maps the literature and relates it to the GDPR on its pages 13–14.^[27]

A fourth paper, one co-authored by Wachter, Mittelstadt and Floridi, refutes the idea that such a right might be included in the GDPR, proposes a limited ‘right to be informed’ instead and calls for the creation of an agency to implement the transparency requirement.^[28] A further paper by Edwards and Veale claims such a right is unlikely to apply in the cases of the 'algorithmic harms' attracting recent media attention, and that insufficient attention has been paid to both the computer science literature on explanation and how other GDPR provisions, such as data protection impact assessments and data portability, might help.^[29] Almost two years later a paper appeared that challenges earlier papers, especially Wachter / Mittelstadt / Floridi.^[30]

On both sides of the Atlantic there has been recent activity pertaining to this ongoing debate. Early in 2016 experts on artificial intelligence and UK government officials met during a number of meetings,^[31] and developed a Data Science Ethical Framework.^[32] On November 7, 2016 an event was held in Brussels, organized by MEP Marietje Schaake in the European Parliament and described by danah Boyd.^[33] Only eleven days later at New York University there was a conference on "Fairness, Accountability, and Transparency in Machine Learning " where Principles for Accountable Algorithms and a Social Impact Statement for Algorithms were articulated and placed online for discussion.^[34] By mid-December the IEEE came out with a document whose editing was backed up by public comments that were invited by March 2017 on "Ethically Aligned Design".^[35]

Later in 2017 data portability was analysed by professors of data protection as a central innovation of the new GDPR.^[36]

See also

• Ethics of artificial intelligence
• Data Transfer Project

References

• 402 area code
• 402 Chloe
• (402) Chloe
• (402) Chloë
• 402 MXW
• 402nd Field Artillery Brigade (United States)
• 402nd Field Artillery Brigade (US)
• 402nd Maintenance Wing
• 402 (New Jersey bus)
• 402 (number)
• 402 Payment Required
• 402 Squadron
• 402 Squadron Navigation School Squadron
• 4030
• 4030s
• (40314) 1999 KR16
• 4031 Mueller
• 40320 (number)
• 4034 Vishnu
• (4035) 1986 WD
• 4037 Ikeya
• 403b
• (403) Cyane
• 403d Wing
• 403 error