The Right to Data Portability as a Personal Right

Abstract

The right to the portability of personal data guarantees the interested party the right to receive personal data that concern themselves. Specifically, data which a person has provided to a ‘data collector’ in a structured format can currently be transmitted to another ‘data collector’ without any legal consequences as long as the original ‘collector’ has received consent either derived via a contract or other means. This data transaction from one ‘collector’ to another is often carried out by automated means; it is easily technically possible and is therefore considered to not negatively affect the rights and freedoms of others. This right to data transfer is guaranteed when it comes to data collected in the public interest or in the exercise of public powers conferred on the ‘collector’. The main precedent to the right to data portability is the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, regarding the protection of natural persons with respect to the processing of personal data and their free circulation, which repeals Directive 95/46/EC (General Data Protection Regulation). In Article 20, this regulation discusses the right to data portability, establishing the basic guidelines for this right. Thus, a new personal right is guaranteed, given the context of the general protection of data. In order to strengthen control over their own data, a natural person must also be allowed to receive data in the same structured way.

1. Introduction

The right to the portability of personal data guarantees the interested party the right to receive personal data that concern themselves. Specifically, data which a person has provided to a ‘data collector’ in a structured format can currently be transmitted to another ‘data collector’ without any legal consequences as long as the original ‘collector’ has received consent either derived via a contract or other means and as long as it is used for what is defined as a ‘common use’. There is currently no legal means for the originator of the data to prevent this data transfer from happening. This data transaction from one ‘collector’ to another is often carried out by automated means; it is easily technically possible and is therefore considered to not negatively affect the rights and freedoms of others or the freedom of the individual the data originated from.

This right to data transfer is guaranteed when it comes to data collected in the public interest or in the exercise of public powers conferred on the ‘collector’. The main precedent to the right to data portability is the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, regarding the protection of natural persons with respect to the processing of personal data and their free circulation, which repeals Directive 95/46/EC (General Data Protection Regulation). In Art. 20, this regulation discusses the right to data portability, establishing the basic guidelines for this right.

This article addresses the subject of the right to data portability as a personal right focusing on an exploration of the Argentine framework with insights into how data portability may develop in countries outside the EU.

2. The European Regulation

The EU Regulation 2016/679 is part of the European Union (EU) data protection reform. It resides within the data protection law enforcement directive and Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by all EU institutions, such as offices and agencies.

The GDPR protects individuals whose data are being processed by the private and public sector. It strengthens existing rights, giving individuals more control over their personal data. Thus, the GDPR allows individuals to better control their personal data. It further modernizes and unifies existing rules and regulations, allowing businesses to reduce red tape and to benefit from greater consumer trust. The GDPR establishes a system of completely independent supervisory authorities in charge of monitoring and enforcing compliance with the EU regulation.

For many reasons, the right to data portability is the proper tool to foster individual rights. Among other things, it helps people access their own data in a simple and comprehensible manner. It also makes it easier to transfer personal data to different platforms. More importantly, it makes the right to be forgotten more real. Likewise, it makes the right to know when the right to personal data has been violated more credible.

The UE RGPD requires companies to appoint a person responsible for data compliance, with a single state authority supervising. The same rules apply to companies outside the UE if they are providing services to individuals in the EU. Companies must also permanently assess the impact of processing personal data (EUR-Lex 2022).

The Commission submitted a report on the evaluation and review of the regulation in June 2020. The next evaluation is due in 2024.

In the United States, the right to privacy and the right to data portability have a different approach. Of course, US laws address data security and the importance of private records. However, US regulations generally allow for businesses to establish their own set of privacy rules with their customers.

The California Consumer Privacy Act is the closest US equivalent to the GDPR. It includes new privacy rights for California consumers, such as the following: the right to know about the personal information a business collects about them and how it is used and shared; the right to delete personal information collected from them (with some exceptions); the right to opt out of the sale or sharing of their personal information; the right to non-discrimination for exercising their rights; the right to correct inaccurate personal information that a business has about them; and the right to limit the use and disclosure of sensitive personal information collected about them.

The European legal doctrine points out that “The right to data portability is no doubt a key concern for online users as well as for companies that wish to have a level playing field … as GDPR might not deliver the intended results due to its ambiguity and due to the inherent limitations contained therein such as the rights and freedoms of other data subjects. In order to have effective data portability within the EU that covers all stakeholders, including users and businesses, the implementation of the GDPR must be in harmony with competition law and other relevant legislation such as consumer protection laws. This will require cooperation between the relevant competition authorities, the European Data Protection Supervisor, national data protection agencies and sector-specific regulatory authorities where necessary” (Diker Vanberg and Ünver 2017).

Simon Geiregat argues that “exercising that right can entail infringements of third-party copyright, depending on the circumstances, and that IP may often undermine the very regulatory concept and objectives of this ‘portability right’, particularly when cocreated content is involved” and adds that “traders should not be allowed to reject portability requests by waiving their own IP rights, as this would hamper the effectiveness of the consumer’s remedy” (Geirega 2022).

With these regulations, a new personal right arises, within the context of the general protection of data, as part of the right to privacy. This development certainly also has to be seen as a manifestation of the right to personality. This regulation establishes that in order to further strengthen control over one’s own data, specifically when the processing of these personal data is carried out by automated means, individuals that have provided personal data to a ‘data collector’ are natural persons that must also be allowed to receive these data in a structured format.

This legislation incentivizes data collectors dealing with personal information to establish interoperable formats to facilitate data portability. Consequently, individuals should exercise this right when they have consented to provide their personal data or when such data processing is essential for contractual fulfillment. On the other hand, the law should not be applied when the processing of data has a legal basis other than consent or contract. For instance, this law should not apply to ‘data collectors’ processing personal data as part of their public duties. Hence, it should not be invoked when the processing of personal data is indispensable for fulfilling a legal obligation imposed on the data controller (the entity responsible for managing the data), for carrying out tasks in the public interest, or exercising public authority delegated to the data controller. In the context of a governmental agency, for example, the data controller could be the government agency itself. Therefore, if a government agency collects personal data for the purpose of issuing official documents, such as passports or drivers’ licenses, the agency would be the data controller responsible for managing those data. If processing personal data is necessary for fulfilling legal obligations or carrying out public tasks assigned to the agency, the right to data portability might not apply in such situations.

3. One Scenario: Medical Records

The obligation of the data controller to facilitate the transmission or receipt of personal data pertaining to the individual should not necessitate the adoption or maintenance of technically compatible processing systems. Let us consider a scenario where an individual wants to transfer their medical records from one healthcare provider to another. In this case, the individual has the right to transmit their medical data from the original healthcare provider to the new one. However, it is not practical to expect every healthcare provider to adopt or maintain the same technical systems for data processing. Instead, it is crucial that the data controller (the original healthcare provider) ensures that they can provide the individual’s medical records in a commonly used format that allows for easy transmission and reception. This could be a standardized file format like PDF or XML, which can be easily opened and interpreted by most healthcare systems. Thus, the obligation is not for the new healthcare provider to adjust their systems to be compatible with those of the original provider. Instead, the focus is on ensuring that the data are provided in a format that facilitates smooth transmission and reception, without imposing undue burdens on either party.

When personal data pertain to multiple individuals, the right to receive such data should be interpreted in a manner that respects the rights and freedoms of all parties involved, as outlined in this regulation. Continuing with the example of medical records, imagine a scenario where a patient’s medical history includes information about family members or other individuals. In such cases, the patient has the right to access their own medical records without infringing upon the privacy rights of the other individuals mentioned in the records. For instance, if a patient’s medical history includes genetic information that also pertains to their relatives, the patient’s right to receive their medical records should be upheld. However, the healthcare provider must ensure that any information related to third parties is appropriately redacted or anonymized to protect the privacy of those individuals. This ensures that while the patient’s right to access their data is respected, it is carried out without compromising the privacy rights of the others involved.

However, this right should not compromise the interested party’s right to request the deletion of personal data, nor should it infringe upon the limitations of that right as specified in this regulation. Furthermore, this right does not entail the deletion of personal data related to the interested party if said data were provided for the execution or fulfillment of a contract, as long as such data remain necessary for the completion of said contract. Continuing with the medical records example, if a patient decides to switch healthcare providers, they have the right to request that their medical records be transferred directly from their current provider to the new one. However, this right does not imply that the patient’s medical records will be erased from the original provider’s system immediately upon transfer. Instead, if the medical records are still necessary for ongoing treatment or other contractual obligations, such as insurance claims or legal requirements, the original healthcare provider may retain the data for the duration specified in the relevant regulations. This ensures that the patient’s right to data portability is upheld while also considering the legitimate interests and obligations of the healthcare providers involved.

David Fåhraeus, Jane Reichel, and Santa Slokenberga in their article “The European Health Data Space: Challenges and Opportunities” explain the European regulation implications for patients, medical practitioners, private firms, and public administrations. They consider that the EU generally seeks to balance personal rights and the integrity of the single market as it regulates the generation, storage, transfer, and use of personal data. It has now trained its sights on health data, and its stated objective is to give citizens greater control over their personal data and facilitate secure sharing. The authors conclude that while the legal framework could help transform healthcare and catalyze health-related innovation and research in Europe well, there remain major questions that need to be considered and addressed (Fåhraeus et al. 2024).

4. The Right to Data Portability as a Personal Right in Argentina

The right to personal data portability does not yet have specific regulations that guarantee it in the context of the Argentine legal system. This right is not yet included in Law No. 25,326. However, within the framework of the right to privacy, data protection, and digital rights that every person possesses in order to exercise and enjoy their right to the development of their own personality and freedom of expression, it makes it possible to argue that data portability is also protected as a very personal right and thus could be considered a fundamental right.

Article 1 of Law No. 27,078, known as Argentina Digital, declares the development of information and communications technologies, telecommunications, and their associated resources to be of public interest. This article also establishes the neutrality of networks and proposes the objective to enable the access of all the inhabitants of the Republic of Argentina to information and communication services in equitable, social, and geographical conditions applying the highest quality parameters (Ente Nacional de Comunicaciones 2017).

Under Law No. 27,078, the objective of ensuring equitable access to information and communication services extends to healthcare as well. For instance, telemedicine services could be utilized to bridge the gap between urban and rural areas, allowing patients in remote regions to access medical consultations and specialist care without the need for extensive travel. Continuing with the above healthcare scenario, geographical conditions may refer to the geographical spread of healthcare facilities and the availability of essential medical services in different regions of Argentina. This law involves ensuring that individuals living in remote or underserved areas have access to the same quality of healthcare services as those residing in urban centers. To achieve this, the government may invest in improving telecommunications infrastructure and implementing telehealth initiatives to provide medical consultations, diagnoses, and treatment options remotely. By applying the same high-quality parameters, healthcare providers can deliver effective telemedicine services that meet the same standards of care as traditional in-person consultations. This ensures that individuals, regardless of their geographical location, receive timely and quality healthcare services, thereby promoting equitable access to healthcare across Argentina.

In addition, through Article 18 of this law, the Argentine state guarantees the universality of information and communication technology services, ensuring access under conditions of quality, affordability, and at fair and reasonable prices, regardless of geographic location.

As a background, Argentina has resolutions that regulate ‘number portability’ for cell phones since it was regulated in the year 2000 and more recently also for fixed telephony (Ministerio de Modernización 2013). Telephone users can change their provider when it is convenient for them and conserve their telephone number to enable portability for mobile communication service providers (MCS) who must enter into national automatic roaming agreements or other alternative technical solutions for infrastructure sharing, for the provision of their services (Boletín Oficial 2019).

The formation of the doctrine of personal rights or very personal rights counts as a pillar in Argentina according to the thought of Santos Cifuentes, who solidly justified the doctrine of very personal rights as early as in the 1970s. Furthermore, Guillermo Borda considered the same doctrine but included honor, freedom, and physical integrity as part of the human personality. Borda states that these attributes are not separable from the subject or the individual and therefore become subject to the very same right to privacy with respect to data portability (Borda 1991).

Bueres disagrees with this criterion because he considers that if the object of these rights becomes palpable by injuring, it exposes the economic content they lack. It would be equivalent to considering it as a Subjective Patrimonial Right and not a very personal Subjective Right. Bueres distinguishes this right, whose object is the internal good of the person, from that whose efficient cause is the illegality arising from the damage caused to said property. This last prerogative, of purely obligatory roots, is nothing other than the power that assists the victim in compensation for the damage. In short, such a credit right is different and subsequent—chronologically speaking—to the way the very personal extra-patrimonial Subjective Right may be affected.

Bueres also argues that the existence of the very personal Subjective Right is evident when the person can carry out acts of disposal of those assets, which are the basis of the Subjective Right.

“It is the case when an individual donates blood, or authorizes a surgery, decides to participate in risky activities, donates organs, reveals private information or authorizes the disclosure of their images, etc.)” (Laje 2014).

Finally, the same author says that every denial of Subjective Law means, ultimately, the direct path towards the denial of the individual in its ethical integrity, guaranteed with the certainty of the Law manifested in the recognition of Subjective Law, where the norm becomes concrete through the will of the agent who acts on the claim (Bueres 1992).

These ideas and concepts are manifested in the Argentine Civil and Commercial Code of 2015 and regulate the Personal Rights System in various areas. In Article 51, it is established that human rights are inviolable, and under any circumstance, it is a fundamental human right to be recognized and respected for one’s dignity. This complements the concept outlined in Article 52, which stipulates that any individual harmed in their personal or familial privacy, honor, reputation, image, or identity, or whose personal dignity is in any way undermined, has the right to seek prevention and full reparation for the damages suffered. It is worth noting that the normative essence of Article 1737 stipulates that damage occurs when an individual’s rights or interests, not prohibited by the legal system, are infringed upon. These rights or interests typically pertain to individuals, their assets, or collective rights. Comprehensive compensation encompasses various aspects, such as the depletion of or reduction in the victim’s assets, the loss of anticipated earnings based on the objective likelihood of attaining them, and missed opportunities. Furthermore, it extends to the repercussions of violating the victim’s deeply personal rights, including their physical and mental well-being, their legitimate emotional connections, and any disturbances to their life plans.

Under the European GDPR, a person is entitled to file a data breach claim and data breach compensation regarding personal data that have been leaked, disclosed, lost, mis-used, hacked, or corrupted, even if there was no economic loss, but the breach was deliberate or negligent.

Personal data, as elucidated by Bueres, constitute an intrinsic asset of individuals, intricately tied to their existence. Not only do these data serve as identifiers, but they also play a pivotal role in enabling individuals to exercise their rights and fulfill their obligations. The absence of data that uniquely identify individuals renders the formation of a society that upholds fundamental rights, such as identity, freedom, privacy, image, honor, property, and the exercise of civil and political rights, materially unattainable (Masciotra 2019).

A fundamental and indispensable connection exists between personal data and the individual. Personal identity finds expression through such data, forming the cornerstone of the establishment of legal protections safeguarding individual rights. The objectification of personality occurs through the representation of personal data; it is only through this means that the legal framework protecting subjective rights can be established. Consequently, the portability of data inherently facilitates the exercise of specific rights, and any infringement thereof would warrant the protections outlined in the relevant provisions of the Civil and Commercial Code, particularly concerning violations of human dignity.

5. Human Dignity as a Legal Term Linked to the Concept of Data Portability

While legal texts frequently reference the concept of dignity, further elaboration is necessary to establish a direct correlation between the legal principles of human dignity and data portability. This connection warrants additional exploration, especially when considering its application to the emerging manifestations of the right to personality. To establish the link between human dignity and data portability, it is imperative to distill the concept of human dignity to its most fundamental and secure form. Human dignity is a foundational value inherent to both individuals and humanity as a whole. It is imperative to emphasize that simply negating its infringement is insufficient; rather, it entails acknowledging every individual as a subject of the law with the capacity to exercise their rights, especially through the recognition of rights to personality. Human dignity is not merely an abstract quality inherent to individual humans; rather, it emerges within the context of interpersonal relationships, characterizing the interaction between individuals deemed worthy and esteemed. In essence, human dignity denotes a mode of human existence, rather than a mere attribute of being human. Dependent on the recognition of others, one must be able to give and receive dignity.

An indispensable point of reference when explaining what dignified treatment between humans consists of is Article 2 of the German Fundamental Law that enshrines as early as the middle of the last century the right to develop one’s own personality. Subsequently, various legal systems began to formulate the doctrine of personal rights. Currently, these legal systems encompass a broad spectrum of rights under the umbrella of the right to personality. These include the right to honor, privacy (interpreted differently across countries), integrity, identity, personal data protection, and more recently recognized, the right to data portability. Additionally, rights such as the right to image, health, and the fundamental right to shape one’s life ‘project’ are also integral components of the right to personality. This list is not exhaustive; new rights of personality continue to emerge in accordance with evolving notions of dignity that society seeks to uphold.

To formulate a comprehensive theory on Personality Rights, extensive attention and analysis were required in the evolution of legal doctrine and jurisprudence, spanning over a large body of research. The latest and most recent development is the contribution of the School of Solidarity in Law, established and championed by Marcos M. Cordoba (Tulio 2023). This school posits that the principle of solidarity embodies a moral imperative within society, stemming from its social and legal evolution, as well as its customs, ways of life, and accumulated knowledge. The ethos of solidarity, mandated by law in a balanced and systematic manner, emerges as the sole avenue for dignified interactions among individuals. Solidarity is delineated as the reciprocal interplay between the collective and its constituents. No problem or issue exists solely within the domain of an individual, thus dismissing the notion that consciousness initially exists in isolation before engaging with others. Instead, self-awareness, both as an individual and as a member of society, is inherently contextualized within the broader framework of the collective existence. The principle of solidarity distinguishes itself further from mere aggregation seen in social dynamics. A solidarity-based society, for example, surpasses mere coexistence, epitomizing a profound unity and mutual support. In such a society, dignified treatment among and between people is not merely a notion but a tangible reality, characterized by members uniting across a society based on the quality of their engagement within the group. This differentiation sets such a society apart from societies that are structured around the pursuit of individual happiness or the collective utility of such individual pursuits (Scheler 2008).

The cornerstone of the concept of Personality Rights, and indeed the regulation of all rights, resides in safeguarding the dignity of the individual. This dignity serves as a foundational value, a measure of individual worth, and a reflection of humanity that should not only inform but also be actively recognized in practical terms, particularly in the way the law governs interpersonal relations with respect to solidarity. It is precisely through data portability that the exercise of these deeply personal rights becomes feasible in practice.

However, it is worth noting that the portability and interoperability of data decrease the transaction costs of switching from one service provider to another and consequently lifts the lock-in phenomenon, where the customer remains ‘trapped’ despite the presence of better opportunities on the market. It is worth noting that even though this right is constructed as a personal right, it has significant economic implications and stands at the intersection of many areas of law such as competition, antitrust, and consumer protection law.

6. Conclusions

In conclusion, the exploration of data portability within the framework of Argentina’s legal system unveils a complex landscape where individual rights intersect with technological advancements and evolving legal doctrines. While specific regulations governing data portability may currently be lacking, foundational principles rooted in human dignity, privacy rights, and the emerging doctrine of personal rights provide a solid foundation for understanding and advocating for the right to data portability.

The integration of data portability into Argentina’s legal framework presents both opportunities and challenges. On the one hand, it empowers individuals to assert greater control over their personal data, fostering transparency, accountability, and autonomy in an increasingly data-driven society. On the other hand, it necessitates a careful consideration of privacy concerns, technological feasibility, and legal obligations to ensure that data portability enhances rather than compromises individual rights and societal interests.

As Argentina continues to navigate the complexities of data protection and digital rights, policymakers, legal experts, and civil society stakeholders must collaborate to develop robust regulatory frameworks that uphold fundamental rights while fostering innovation and economic growth. By embracing the principles of transparency, accountability, and human dignity, Argentina can pave the way for a future where data portability serves as a catalyst for empowering individuals, promoting social justice, and advancing the common good in the digital age.