Should consumers have a right to demand the transfer of their personal information from one online provider to another of their choice? The Privacy Commissioner this week released survey results that showed a majority (56 percent) of New Zealanders consider the ability to transfer personal information between social network or cloud services as important or very important.

These results came from answers to the question:

When you decide to change online service providers (e.g. an online social network or cloud service provider), how important is it for you to be able to transfer personal information that was stored and collected by the old provider to the new one?

This was the same question asked last year of consumers in all 28 countries of the European Union in the Eurobarometer 431 survey which found that two-thirds of the people surveyed (67 percent) found it important to be able to transfer personal data to a new online service provider.

The Eurobarometer survey was part of the European Commission’s process of testing public attitudes to privacy issues.  At that time (February-March 2015) the European Commission’s proposal for a replacement to existing EU data protection law was under consideration by the European Council. The results supported the inclusion of a new ‘Right to Data Portability’ in the EU General Data Protection Regulation (GDPR) agreed in December last year and finally adopted by the European Parliament a few weeks ago. The new law will come into effect in 2018.

The Right to Data Portability in Article 20 of the EU GDPR entitles the individuals concerned to receive the personal information that they have provided to an online business in a “structured, commonly used, machine-readable and interoperable format”, and to transmit the information to a competing business. Where technically feasible, the individuals concerned will also have the right to insist that the first business transmit their personal information directly to the other business.

The new right will strengthen the hand of European individuals in the new digital environment.  Other Eurobarometer 431 survey results are relevant in this respect, for instance:

• More than eight out of ten respondents feel that they do not have complete control over their personal data.
• Over seven out of ten respondents agree that providing personal information is an increasing part of modern life.
• Europeans overwhelmingly believe they should always have the same rights and protections over their personal information regardless of the country in which the public authority or private company offering the service is established.

Interestingly, the Right to Data Portability is now established as a privacy right in Europe rather than as a competition or consumer protection entitlement. While not established in competition law the EU right does owe something to earlier experience with competition issues. Some US academic critics, writing in 2013 in relation to an earlier draft of the right, have suggested that the consumer right although “appealing” would be problematic if viewed through the lens of US antitrust law. On the other hand, a more recent paper by UK academics concluded on an analysis of EU law that “the right to data portability is not incompatible with traditional competition law principles”.

The competition analysis tends to focus on consumers being “locked-in” to a particular service provider because of high “switching costs” if they want to move to another provider.

The experience with competition in mobile networks is probably fairly high in people’s minds when considering both the issues of possible “data lock-in” and “digital data switching costs” and also the regulatory solution of a right to data portability. In the mobile space the Europeans acted to create obligations of “number portability” (and more recently continue to act on roaming costs).

Number portability is a solution that New Zealand has also adopted both in relation to local and mobile number portability. Another context in which switching has been promoted in New Zealand is in relation to electric and gas through the ‘what’s my number’ initiative.

The academic debate may continue for some time as to how competition law might in principle approach the question of consumer rights online. However, in Europe at least the debate is over: with the concurrence of European governments and the European Parliament, the European Union has acted to establish this significant new privacy right.  

The right to data portability is now law (although not in effect for another two years) in the European Union, a region with 508 million individuals. Many of the online companies that provide services to European citizens also serve New Zealanders over here. With New Zealand’s privacy law due for replacement before long we should start discussing whether New Zealand consumers would also benefit from having this new right in our law as well.

Image credit: The first Dataportability logo - via Wikipedia

Europe, data