ABSTRACT
Data portability is one of the most unprecedented and innovative aspects of Europe’s GDPR and California’s CCPA. Widespread adoption of data portability is not slowing down. Privacy bills in Congress submitted by both Democrats and Republicans include data portability as a right. Several proposed state and international privacy laws also call for the right to data portability.
This article examines the right to data portability and the inherent tension between its anti-competitive and privacy/cybersecurity features. While data portability can help foster innovation and competition, it also poses several risks of data getting into the wrong hands.
First, this article will examine the background of data portability. This will explore smaller-scale sectoral examples of data portability and the history of comprehensive data portability. Second, this article will review practical risks of data portability, including which data should be included, whose data should be included, and who can choose to port data. Finally, this article will discuss security risks of data portability. This article will suggest various solutions to mitigate security risks, including portability impact assessments (first proposed by Peter Swire), solutions from the financial industry, and self-regulatory regimes.
Hondagneu-Messner, Sasha, Data Portability: A Guide and a Roadmap (May 21, 2021), 47 Rutgers Computer and Technology Law Journal 240 (2021).
Leave a Reply