July 2019 Data Portability: What is at stake? In its inaugural research report, Datum Future, the ability to manage and transfer their personal data Preface an independent think-tank focused on current and for their own benefit. emerging data-driven technologies, explored the ways in which personal data is revolutionising the ways people This means individuals should be easily able to transfer live, work and interact. The report identified five major data from one service provider to another. They do not opportunity sets – Powerful Me, Healthier World, think about data portability per se but seek mobility and In its inaugural research report, Protected Lives, Smart Cities and Brighter Economies continuity of service. For example, users might see value – and also concluded that these opportunities would in asking Deezer to provide Spotify with access to their Datum Future, an independent think- only be fully realised by enabling the mobility and favourite playlists. A seamless data portability process interoperability1 of data between all stakeholders is probably preferable from a user experience (UX) (for example, individuals, businesses, governments, perspective: users would not necessarily need or want tank focused on current and emerging regulators, scientists and technologists, academic to know all the mechanics but need to be able to rely institutions and non-governmental organisations). on a transparent and trustworthy process allowing data data-driven technologies, explored sharing while protecting their privacy. Now in this, the first of a planned series of Bright Papers the ways in which personal data is designed to initiate further discussion and research into For businesses, portability should offer a more fluid the opportunities and challenges identified in that inaugural market experience and stimulate growth as business revolutionising the ways people live, research, Datum Future examines an emerging concept, benefits from more dynamic markets. For Financial enshrined in some new laws around the world but yet to Technology companies (FinTechs), for example, portability be fully delivered and tested: data portability. offers access to a huge pool of historic data to which work and interact. they can apply new and specific models, giving insight We are doing so because we believe data portability, into customers and services and enabling them to if fully realised, holds the key to unlocking benefits for provide better and cheaper services at a lower cost. all stakeholders and to addressing some of the difficult Portable data, at a global scale, with clear governance, questions and imbalances around data collection and ownership and framework, could have beneficial effects on sharing. Once individuals are able safely to port their competition and markets in the long run. The advantages data between services and organisations, the concepts arising from portability do not stop with FinTechs. Global of control and ownership of personal data become more organisations with wider reach could also reap the benefits meaningful. This should be welcomed, and facilitated, – for example it could assist in efforts to build transparency by every data-driven organisation. and ensure an ethical approach to their users and customers which in turn translates into trust—the brand This new Bright Paper, therefore, is addressed to ingredient to which all companies aspire. every such business and organisation and to anyone interested in challenges raised by data portability. It The introduction of the right to data portability through should be considered by readers as a starting point Article 20 of the EU General Data Protection Regulation for deeper investigation, including round tables, events (GDPR) seeks to ensure individuals gain control over and additional research, together with developing and the data held by data controllers3 (“I can ask for my working through theoretical use cases, to understand, data to be transmitted to someone else.”) But these drive and share evolving best practices around the world aspects of the GDPR have raised concerns among in this area. This paper focuses on the practical and businesses (and more broadly among data controllers) ethical issues raised by the requirement for portability because of the lack of detail as to how this new right and draws on the experience of Datum Future’s seven is supposed to be delivered. The portability principle founding members—Accenture, Experian, BNP Paribas, also involves little clarity on the technical means of Facebook, Mastercard, Microsoft and Publicis Groupe— ensuring interoperability or on competition rules4, the to begin to identify frameworks, best practices and start identification of appropriate contacts at destination the important work of developing common standards. controller entities, the security requirements for data in One of those members, BNP Paribas, worked particularly transit and the potential additional costs to port such closely with Datum Future to develop this paper, tapping data, etc. There are added and more acute challenges for into the learnings of Open Banking, until now the closest companies with business models that rely on personal data approximation in the real world to the right to portability collected from individuals and which consider the handling that has been created under some laws but not yet and structural format of that data to be one of their key realised. commercial assets. Data portability means moving beyond the traditional All of this has implications for, and entails different approach that keeps personal data2 siloed in private challenges to, realising the full potential of the five companies and instead ensuring that individuals have opportunity sets identified by Datum Future: 1. See the Glossary 2. See the Glossary 3. See the Glossary 2 1 4. Further details on competition rules available in Shaping competition policy in the era of digitisation, M. Vestager, 2019 3 • Powerful Me: Data portability, if realised in ways that Separately, new regulatory frameworks mandate data give meaningful control to individuals, helps to reconcile sharing, for example the Payment Services Directive 2 two narratives. One sees individuals “empowered” by (Payment data), the Energy Efficiency Directive (Smart Full Report data-driven technologies to take informed decisions, meter data) and the Software Directive (Interoperability engage in society, create, work and live. Another sees information). Questions arise as to how these domain Contents: portability leaking data that is used, and sometimes specific rules on data sharing, generally put in place to exploited, by others (especially at risk when processing enable markets to function properly and protect a special category of personal data, such as having all consumers, interact with the genuine portability right health data in one place). under the GDPR. Preface P2 • Healthier World: Portability potentially enables patients In this new Bright Paper, Datum Future proposes 1 to centralise all their information in one place (in particular to explore the context and drivers of the portability as wellness and health data is now being generated concept and its likely impact on businesses for the next 2 What are the challenges to on personal devices) or share it easily with a range of five to 10 years; to address portability’s purpose and implementing portability? P6 services and providers. However, individuals may not potential scope; and lastly to emphasise the importance be able to interpret their personal health data or assess of balancing the interests of the data subject6, the initial a. Navigating a new regulatory the risk of porting their data to certain providers. controller and the receiving controller, illustrated with cross-business use cases. landscape P7 • Brighter Economies: Effective data portability should mean more fluid and functional markets and enhanced b. Going beyond regulatory competition, prompting greater innovation. Open Banking is an example of creating a more flexible market with new requirements P8 possibilities to easily share data with service providers, often FinTechs, and create innovative new services. 3 How will portability reshape However, too many players on the market might ultimately lead to less user control given all the third the market? P11 parties users have given their data to. a. Handling the customer To a lesser extent, and because they stem from the previous ones, the following opportunity sets are also experience challenge P12 impacted: b. Exploring and exploiting • Smart cities: Portability would have a limited impact in cases where data used in smart cities is aggregated but new opportunities P12 could be one of the solutions to enforcing transparency between cities and third parties when personal data is c. Addressing new concerns P13 used for security purposes. Concluding thoughts and a • Protected Lives: This last opportunity set is likely to be 4 less affected by portability as it covers prevention and call for contributions and use mitigation of large-scale challenges, from terrorism to cases P15 natural disasters. However, it is possible that a culture of philanthropic data donations will develop, in which people port data for good causes (e.g. cancer foundations, 5 Appendix P18 against violence in cities, etc). Data portability offers stakeholders a new way to move away from passive “consent”5 (ticking “I accept” without reading or understanding privacy policies) to greater individual engagement and genuine empowerment