MBF Knowledge Base
MBF · MBF Knowledge Base Home · EU General Data Protection Regulation Controversial Topics

EU General Data Protection Regulation Controversial Topics

All information here was borrowed from the GDPR website https://eugdpr.org

An overview of controversial topics likely debated during the Trilogue negotiations, including the stance of each EU body from their respective adopted drafts of the GDPR.

Many of the key points of the regulation are clear and documented similarly across the three current drafts, but many details still needed to be hammered out and some points come with enough variability to warrant their own comparison between drafts. Below is an analysis of the topics which are likely to have been the subject of much debate during the Trilogue negotiation process.

Data Portability

The right to data portability has its own article (18) in the commission and council proposal documents, but is part of the right to access article (15) in the parliament text. The relevant quotes from each draft are as follows:

Commission text:

Where the data subject has provided the personal data and the processing is based on consent or on a contract, the data subject shall have the right to transmit those personal data and any other information provided by the data subject and retained by an automated processing system, into another one, in an electronic format which is commonly used, without hindrance from the controller from whom the personal data are withdrawn.

Parliament text:

Where the data subject has provided the personal data where the personal data are processed by electronic means, the data subject shall have the right to obtain from the controller a copy of the provided personal data in an electronic and interoperable format which is commonly used and allows for further use by the data subject without hindrance from the controller from whom the personal data are withdrawn. Where technically feasible and available, the data shall be transferred directly from controller to controller at the request of the data subject.

Council text:

The right [to data portability] shall not apply if disclosing personal data would infringe intellectual property rights in relation to the processing of those personal data. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured and commonly used and machine-readable format.

It is important to note that all texts only apply portability to data provided by the data subject, and the Commission and Council texts only apply to data which is processed based on consent or contract, leaving out personal data processed by other lawful means. The most important differences come in the Parliaments caveat of only requiring direct transfer where technically feasible and available as well as the Councils addition of the need for data to be machine readable and also excluding data that would infringe intellectual property rights if disclosed. The predominant concerns arising from the supporters of data portability see the Parliaments text as a potential drag on overall effectiveness if corporations are simply unwilling to improve their technology in order to comply. On the other hand, critics of the idea worry that forcing data portability with such a broad scope will lead to disproportionate cost and effort in industries with no consumer lock-in.