The right to the Portability of the data is the right of the interested party to receive from the Person Responsible for the Treatment the personal data that concern him, provided that the processing of the same is carried out by automated means and is based on his consent or execution of a contract. Portability allows the direct transmission of the Responsible for the Treatment to the interested party, or to another Responsible designated by it.
The AEPD RECENTLY ISSUED A RESOLUTION ON THE RIGHT TO PORTABILITY, DERIVING FROM A CLAIM TO A TELECOMMUNICATION COMPANY, IN WHICH IT IS CLOSED WHAT CATEGORIES OF DATA SHOULD BE TRANSMITTED BY THE RESPONSIBLE FOR THE PROCESSING IN THIS YEAR.
The resolution (R / 00552/2019) issued as a result of the appeal filed by the user, whose initial claim was inadmissible for processing by the AEPD itself, lays the foundations regarding the data to be provided by the Responsible.
Portability, allows the direct transmission of personal data of a Responsible for the Treatment to the interested party, or to another Responsible, in a structured format, of common use and mechanical reading.
It is an important tool that supports the free movement of personal data in the EU and promotes competition among the Data Controllers. It facilitates the change between different service providers, promoting the development of new services in the context of the strategy for the digital single market.
The resolution of the AEPD that is the object of this analysis, specifies what categories of data are considered to be provided by the user, and therefore, are likely to be transmitted.
What is considered as “data provided” by the interested party?
In this regard, following the guidelines of the Working Group of Article 29 (current European Data Protection Committee) on portability, the following categories can be classified as data provided by the interested party:
- Data provided actively and consciously by the interested party, such as postal and electronic address, name and surname, username, age, ID, bank details, etc.
- Data from the observation of the interested party by virtue of the use of the service or device, such as traffic data that the entity retains as necessary for billing purposes and interconnection payments until they are canceled due to the expiration of the legally established term , excluding those kept for the purpose of detection, investigation and prosecution of serious crimes).
- Traffic data that is used, with your consent, for commercial purposes or for the provision of value-added services, including where appropriate, the location data.
What does not include the expression “data provided” by the interested party?
The following are not included in the category of data provided by the user, and therefore will not be subject to portability:
- Those inferred and deducted by the Data Controller based on the data provided by the interested party. For example, the result of an evaluation of a user’s health or the profile created in the context of risk management and financial regulations.
- All personal data that has been created by the Responsible as part of the data processing, through a process of personalization, recommendation or categorization of the user.
- The data referred to web visits.
- Traffic data retained for the purposes of Law 25/2007 of October 18, on the preservation of data relating to electronic communications and public communications networks, (ie those kept for the purpose of detection, investigation and prosecution of serious crimes).
Thus, the expression “provided by” includes personal data that is related to the activity of the interested party, or that is derived from the observation of a person’s behavior, but not the data that results from the subsequent analysis performed by the Responsible.