Privacy
Your right to portability
The right to portability: obtain and reuse a copy of your data
The right to portability gives you the ability to retrieve some of your data in a machine-readable format. You are free to store this portable data elsewhere or easily transfer it from one system to another, for reuse for other purposes.
What's the point?
With the right to data portability, you can request to retrieve the data you have provided to a platform, for personal use or to pass it on to a third party of your choice. This new right aims to strengthen control over your personal data and allow you to harness its power too!
How to do it concretely?
1. Rendez-vous sur la plateforme de l’organisme
Sur votre espace client ou sur des pages d’information concernant vos droits et la politique d’usage des données, vous devez trouver des informations pratiques et concrètes vous permettant d’exercer votre droit à la portabilité.
Par exemple, après l’authentification sur votre compte client, vous accédez à un bouton de téléchargement ou à un dispositif vous permettant de choisir les données que vous souhaitez recevoir (par exemple, une API).
2. Download the copy of your portable data
Which data? Only data collected with your consent or within the framework of a contract are concerned! The right to portability concerns, for example, information that you have declared (e.g. contact details, like, …) but also data taken from your activity (purchase history, data recorded by a connected watch …).
Conversely, video surveillance images, your tax return, your badge data are not concerned by the right to portability. The same applies to data derived, calculated or inferred from the information you have provided. For example, your rating on an online shopping site by other users, your categorization in marketing segments, your loan simulation or your credit risk analysis result.
In what format? This data must be provided in a “structured, commonly used and machine-readable” format. This means that the organization must offer you data formats adapted to the type of data concerned, giving preference to open, interoperable formats.
For example, your contact data or address books can be provided in “vCard” (or VCF) format, or your location data in .JSON format. More generically, open formats such as CSV or JSON will in many cases be suitable for portability. On the other hand, data provided in a format that is difficult to process (e.g., an image or a PDF) or a proprietary format that requires software or a paid license to use will not be suitable formats.
3. Use them as you wish!
You may use this data :
- for strictly personal use, for example to store your information on a personal storage space;
- to transmit it to another online service that can enrich it and offer you new services;
- to change platforms while keeping your “history”.
In both of these cases, you can ask organization A to transfer your data directly to organization B without your intervention, provided that this transfer is technically possible. If the organization processing your data refuses to do so, it must explain to you why this direct transfer is technically impossible.
What should I do if I get a refusal or no response?
- Identify the organization and then go to the information page reserved for the exercise of your rights on the organization’s website (“confidentiality policy”, “privacy policy”, “legal notice”, etc.).
- Ask for clarification on whether or not there is a facility to exercise your right to portability
- In case of refusal or lack of a satisfactory answer, you can submit a complaint to the regulatory authority, remembering to attach proof of your approach to the organization (screenshots, response e-mail, etc.).
What are the limits of the law?
The right to portability is distinct from the right of access. Where the right of access gives you the ability to exercise your curiosity about the data held by an organization and request its correction or deletion, the right to portability is more about control over your data: it allows you to dispose of and manipulate “portable” data and transmit it to other platforms.
Remember that while some data is not portable, and therefore not reusable, it is still likely to be delivered to you in a “human-readable” format as part of the right of access. For example, your bank will need to be able to show you your credit risk analysis as part of a right of access request, even if it does not have to provide that data to you in a format that meets the requirements of the right to portability (e.g., by sending it to you in a written document, as a pdf or in web format).
It only applies if your data is processed in an automated way (paper files are therefore not concerned) and on the basis of your prior consent or the execution of a contract concluded with you.
The exercise of the right to portability must not infringe on the rights and freedoms of third parties, whose data would be included in the data transmitted following a portability request. For example, your telephone operator may send you a list of your contacts, which naturally includes the data of your interlocutors. On the other hand, the new operator to whom you transmit this list will not be able to use the data of your contacts to make prospecting.
Privacy Center
Data Protection Officer
Source : CNIL
Commission Nationale de l’Informatique et des Libertés
To protect personal data, support innovation, preserve individual liberties