Data Portability Between Online Services: an Empirical Analysis on the Effectiveness of GDPR Art
Total Page:16
File Type:pdf, Size:1020Kb
Proceedings on Privacy Enhancing Technologies ; 2021 (3):351–372 Emmanuel Syrmoudis*, Stefan Mager, Sophie Kuebler-Wachendorff, Paul Pizzinini, Jens Grossklags, and Johann Kranz Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Art. 20 Abstract: Data portability regulation has promised that individuals will be easily able to transfer their personal 1 Introduction data between online service providers. Yet, after more Personal data is a nonrival good and thus in theory can than two years of an active privacy regulation regime in be consumed indefinitely [1]. Yet, in contrast to con- the European Union, this promise is far from being ful- sumption, the collection of data in many key online ser- filled. Given the lack of a functioning infrastructure for vices such as social networks, map or fitness applica- direct data portability between multiple providers, we tions is performed in a rival manner [2]. Individuals will investigate in our study how easily an individual could preferably only use one map or fitness application for currently make use of an indirect data transfer between informational support in their everyday life. providers. We define such porting as a two-step trans- As data has emerged to be a critical competitive re- fer: firstly, requesting a data export from one provider, source in the early 21st century [3, 4], this rivalry in data followed secondly by the import of the obtained data collection provides strong incentives for dominant plat- to another provider. To answer this question, we ex- forms that offer key online services to lock in consumer amine the data export practices of 182 online services, data and to deny individuals and competitors alike ac- including the top one hundred visited websites in Ger- cess to this data as a knowledge-building resource [1]. many according to the Alexa ranking, as well as their This corporate behavior of data siloing results in two data import capabilities. Our main results show that main societal challenges [5, 6]: one of concentrated epis- high-ranking services, which primarily represent incum- temological power, i.e., who has the right to know the bents of key online markets, provide significantly larger most and control accumulated information about a per- data export scope and increased import possibilities son [7], and another challenge of concentrated economic than their lower-ranking competitors. Moreover, they power, i.e. who can process the accumulated informa- establish more thorough authentication of individuals tion about a large number of individuals in order to before export. These first empirical results challenge the best know their needs and innovate [1]. theoretical literature on data portability, according to Data portability regulation inherently promises to which, it would be expected that incumbents only com- function as one possible remedy against the concentra- plied with the minimal possible export scope in order to tion of both kinds of power in too few hands [8]. If ap- not lose exclusive consumer data to market competitors plied in an appropriate way, it will enable individuals free-of-charge. We attribute the practices of incumbents to gain greater informational self-determination on the observed in our study to the absence of an infrastructure one hand, and act as a continuous impulse for competi- realizing direct data portability. tion in digital markets on the other [9]. However, while Keywords: Data portability, Privacy regulation, Compe- tition between online services, General Data Protection Regulation (GDPR), Data economy, Consumer rights, Stefan Mager: Ludwig-Maximilians-University of Munich, Switching costs, Data controller E-mail: [email protected] Sophie Kuebler-Wachendorff: Ludwig-Maximilians- DOI 10.2478/popets-2021-0051 University of Munich, E-mail: kuebler-wachendorff@bwl.lmu.de Received 2020-11-30; revised 2021-03-15; accepted 2021-03-16. Paul Pizzinini: Ludwig-Maximilians-University of Munich, E-mail: [email protected] Jens Grossklags: Technical University of Munich, E-mail: [email protected] *Corresponding Author: Emmanuel Syrmoudis: Johann Kranz: Ludwig-Maximilians-University of Munich, Technical University of Munich, E-mail: E-mail: [email protected] [email protected] Data Portability between Online Services 352 previous studies have empirically analyzed compliance the NACE Rev. 2 industry classification, which is the of- with the General Data Protection Regulation (GDPR) ficial industry classification of the European Union [13]. [10], or have even started to investigate the data ex- Within this empirical study, we find evidence that port execution of the GDPR’s Right to Data Portability popular services with higher Alexa ranks complied sig- (Art. 20) [11], thus far, we have been unable to locate nificantly more often with GDPR Art. 20, when re- any empirical study analyzing actual data transfer be- sponding to a data portability request. Contrary to tween providers. We thus pose the research question: what we expected from the theoretical literature on data How well does data portability regulation cur- portability and the economics of data, popular services rently deliver on its promise to allow individuals with higher Alexa ranks also provided a higher data to transfer data from one provider to another? scope than their competitors with lower ranks. Lastly, This main research question of our study will be ex- competitors to those market leading services offer con- amined through a series of subquestions: firstly, in the sumers significantly fewer data import possibilities and absence of a functioning and comprehensive infrastruc- thus have not yet started to leverage the opportunity of ture for direct data transfer between data controlling lowered switching costs through data portability regula- services1[12], we examine the question of whether on- tion for themselves, which potentially could help them line services provide individuals with an option to easily to win consumers by means of indirect data portability. export data and furthermore with the possibility to im- Our study has several implications for policy mak- port data. If yes, which options do they offer? Secondly, ers. Although the introduction of data portability reg- we investigate what scope of personal data online ser- ulation was designed to be a step towards maintaining vices provide via data exports by building on the data a level playing field in online markets, we cannot find taxonomy of De Hert et al. [9]. Drawing on Wohlfarth significant evidence for these intended effects regard- [4], we would expect that current market-leading ser- ing direct (GDPR Art. 20 (2)) or indirect data porta- vices would have an incentive to provide data subjects bility (Art. 20 (1)). In order for privacy regulations to only with the minimum scope possible in order to main- generate more economic implications for online services, tain their advantage in the rivalry of data collection over regulators should make entrepreneurs and small service new entrants or smaller competitors. Thirdly, we exam- providers more aware of the possibilities privacy reg- ine how quickly, securely, and to what level of compli- ulations offer them in winning new users. To achieve ancy with GDPR Art. 20, personal data is transmitted this, projects that enable the direct transfer of personal to individuals upon request. In this way, we can observe data between providers, such as the DTP [14], should be whether there has been any improvement in comparison promoted. Additionally, penalties for inadequate han- to prior work of Wong and Henderson [11] regarding the dling of data portability legislation should be enforced ease of data transfer. so that corporations are pressurized to act and partic- We examine the personal data export and import ipate in projects that aim to establish the direct and capabilities of 182 online services, among which are the secure transfer of personal data between providers. 100 most visited websites in Germany according to the The remainder of this paper is structured as follows: Alexa ranking of September 2020. Using the Alexa rank in Section 2, we provide a review of both theoretical as proxy for the popularity of a service, we conduct a work and empirical investigations in the academic liter- regression analysis to investigate whether it plays a deci- ature, as well as recent legislative developments on data sive role in how well data controllers implement their le- portability. In Section 3, we describe in detail how we gal requirement to provide data portability to individu- collected our dataset and analyzed the export and im- als. Based on our sample, our study further investigates port capabilities of the most important online services in whether certain industry sectors enable a more effective Germany. In Section 4, we display the summary statis- portability of data between providers when compared tics and describe the results of our regression analyses, with other industry sectors. Our categorization relies on before we proceed to discuss their implications for re- search and policy in Section 5. We close our study by mapping out avenues for future research on data porta- bility in Section 6 and end with a brief summary of the major contributions and limitations of our research in 1 The Data Transfer Project (DTP) is perhaps the most ad- vanced project to provide a direct data portability infrastructure the conclusion section. between online services. However, as of 2020 it is still in beta mode and has a low number of participating services. Data Portability between Online Services 353 highest potential economic implications only if it is ap- 2 Background plied correctly [9]. However, determining (and verifying) the proper 2.1 Data portability in privacy legislation implementation of the RtDP is a task that legislators and in practice have left to consumers, data protection organizations, and data controllers. After a preliminary tug-of-war be- In May 2018, the European Union introduced a Right tween EU policy makers and lobbyists of online services to Data Portability (RtDP) for personal data enshrined during the enactment of the GDPR [23], its implemen- for the first time in a legislative framework [15].