GDPR Article 20 — Right to Data Portability
ID: gdpr-article-20
{
"@context" : [ "http://www.w3.org/ns/odrl.jsonld", {
"dpv" : "https://w3id.org/dpv#",
"eu-gdpr" : "https://w3id.org/dpv/legal/eu/gdpr#",
"tech" : "https://w3id.org/dpv/tech#",
"dct" : "http://purl.org/dc/terms/",
"xsd" : "http://www.w3.org/2001/XMLSchema#",
"dcat" : "http://www.w3.org/ns/dcat#",
"ex" : "https://example.com/extensions/accomplish#"
} ],
"@type" : "Policy",
"uid" : "https://accomplish.org/policies/gdpr-policies/gdpr-article_20",
"profile" : "https://accomplish.org/gdpr#",
"dct:title" : "GDPR Article 20 — Right to Data Portability",
"dct:description" : "ACCOMPLISH - Policy model for GDPR Article 20 establishing the data subject's right to receive personal data in a structured, commonly used machine-readable format for transmission to another controller.",
"dpv:hasLegalBasis" : "eu-gdpr:A20",
"permission" : [ {
"@type" : "Permission",
"action" : "dpv:Obtain",
"regulationReferences" : [ "gdpr-article-20#article-20-1" ],
"assignee" : {
"@id" : "https://example.com/datasubject",
"@type" : "dpv:DataSubject"
},
"target" : {
"@id" : "https://example.com/data/personaldata",
"@type" : "dpv:PersonalData"
},
"constraint" : [ {
"leftOperand" : "dpv:hasDataSource",
"operator" : "eq",
"regulationReferences" : [ "gdpr-article-20#article-20-1" ],
"rightOperand" : "dpv:DataSubjectDataSource"
}, {
"leftOperand" : "dpv:hasLegalBasis",
"operator" : "isAnyOf",
"regulationReferences" : [ "gdpr-article-20#article-20-1-a" ],
"rightOperand" : [ "eu-gdpr:A6-1-a", "eu-gdpr:A6-1-b" ]
}, {
"leftOperand" : "dpv:hasLegalBasis",
"operator" : "neq",
"rightOperand" : "eu-gdpr:A6-1-e"
} ],
"duty" : [ {
"@type" : "Duty",
"action" : "dpv:MakeAvailable",
"regulationReferences" : [ "gdpr-article-20#article-20-1" ],
"assignee" : {
"@id" : "https://example.com/controller/datacontroller",
"@type" : "dpv:DataController"
},
"target" : {
"@id" : "https://example.com/data/distribution",
"@type" : "dcat:Distribution"
},
"constraint" : [ {
"leftOperand" : "dcat:mediaType",
"operator" : "isAnyOf",
"regulationReferences" : [ "gdpr-article-20#article-20-1" ],
"rightOperand" : [ "application/json", "text/csv", "application/xml" ]
}, {
"leftOperand" : "dpv:hasTechnicalMeasure",
"operator" : "isAllOf",
"rightOperand" : [ "dpv:AccessControlMethod", "dpv:Encryption", "dpv:ActivityMonitoring", "dpv:AuthorisationProtocols", "dpv:SecurityMethod", "tech:API" ]
}, {
"leftOperand" : "dpv:hasTechnicalOrganisationalMeasure",
"operator" : "eq",
"rightOperand" : "eu-gdpr:DataTransferTool"
} ],
"consequence" : [ {
"@type" : "Duty",
"action" : "compensate",
"target" : {
"@id" : "https://example.com/controller/datasubject",
"@type" : "dpv:DataSubject"
},
"assignee" : {
"@id" : "https://example.com/controller/datacontroller",
"@type" : "dpv:DataController"
},
"constraint" : [ {
"leftOperand" : "payAmount",
"operator" : "lteq",
"rightOperand" : {
"@value" : "20000000.00",
"@type" : "xsd:decimal"
},
"unit" : "EUR"
} ]
} ]
}, {
"@type" : "Duty",
"action" : "ex:review",
"dct:description" : "Evaluation of scope and limitations of requested data",
"assignee" : {
"@id" : "https://example.com/controller/datacontroller",
"@type" : "dpv:DataController"
}
}, {
"@type" : "Duty",
"action" : "ex:notify",
"dct:description" : "Communication of reasons if request is denied or delayed",
"assignee" : {
"@id" : "https://example.com/controller/datacontroller",
"@type" : "dpv:DataController"
},
"constraint" : [ {
"leftOperand" : "dqv:hasJustification",
"operator" : "isAnyOf",
"rightOperand" : [ "dpv:DelayJustification", "dpv:NonFulfilmentJustification" ]
} ]
} ]
}, {
"@type" : "Permission",
"action" : "dpv:Transfer",
"regulationReferences" : [ "gdpr-article-20#article-20-2" ],
"assigner" : {
"@id" : "https://example.com/controller/datasubject",
"@type" : "dpv:DataSubject"
},
"assignee" : {
"@id" : "https://example.com/controller/jointdatacontrollers",
"@type" : "dpv:JointDataControllers"
},
"target" : {
"@id" : "https://example.com/data/personaldata",
"@type" : "dpv:PersonalData"
},
"constraint" : [ {
"leftOperand" : "dpv:hasDataSource",
"operator" : "eq",
"regulationReferences" : [ "gdpr-article-20#article-20-1" ],
"rightOperand" : "dpv:DataSubjectDataSource"
}, {
"leftOperand" : "dpv:hasLegalBasis",
"operator" : "isAnyOf",
"regulationReferences" : [ "gdpr-article-20#article-20-1-a" ],
"rightOperand" : [ "eu-gdpr:A6-1-a", "eu-gdpr:A6-1-b" ]
}, {
"leftOperand" : "dpv:hasLegalBasis",
"operator" : "neq",
"rightOperand" : "eu-gdpr:A6-1-e"
}, {
"leftOperand" : "dpv:hasLegalBasis",
"operator" : "eq",
"regulationReferences" : [ "gdpr-article-20#article-20-1-a" ],
"rightOperand" : "dpv:JointDataControllersAgreement"
}, {
"leftOperand" : "dpv:hasDataController",
"operator" : "in",
"regulationReferences" : [ "gdpr-article-20#article-20-2" ],
"rightOperand" : [ {
"@id" : "https://example.com/controller/datacontroller",
"@type" : "dpv:DataController"
}, {
"@id" : "https://example.com/controller/destinationdatacontroller",
"@type" : "dpv:DataController"
} ]
} ],
"duty" : [ {
"@type" : "Duty",
"action" : "dpv:Transfer",
"regulationReferences" : [ "gdpr-article-20#article-20-2" ],
"assignee" : {
"@id" : "https://example.com/controller/datacontroller",
"@type" : "dpv:DataController"
},
"target" : {
"@id" : "https://example.com/data/distribution",
"@type" : "dcat:Distribution"
},
"constraint" : [ {
"leftOperand" : "dcat:mediaType",
"operator" : "isAnyOf",
"regulationReferences" : [ "gdpr-article-20#article-20-1" ],
"rightOperand" : [ "application/json", "text/csv", "application/xml" ]
}, {
"leftOperand" : "dpv:hasTechnicalMeasure",
"operator" : "isAllOf",
"rightOperand" : [ "dpv:AccessControlMethod", "dpv:Encryption", "dpv:ActivityMonitoring", "dpv:AuthorisationProtocols", "dpv:SecurityMethod", "tech:API" ]
}, {
"leftOperand" : "dpv:hasTechnicalOrganisationalMeasure",
"operator" : "eq",
"rightOperand" : "eu-gdpr:DataTransferTool"
} ],
"consequence" : [ {
"@type" : "Duty",
"action" : "compensate",
"assigner" : {
"@id" : "https://example.com/controller/datasubject",
"@type" : "dpv:DataSubject"
},
"assignee" : {
"@id" : "https://example.com/controller/datacontroller",
"@type" : "dpv:DataController"
},
"constraint" : [ {
"leftOperand" : "payAmount",
"operator" : "lteq",
"rightOperand" : {
"@value" : "20000000.00",
"@type" : "xsd:decimal"
},
"unit" : "EUR"
} ]
} ]
}, {
"@type" : "Duty",
"action" : "ex:review",
"dct:description" : "Evaluation of scope and limitations of requested data",
"assignee" : {
"@id" : "https://example.com/controller/datacontroller",
"@type" : "dpv:DataController"
}
}, {
"@type" : "Duty",
"action" : "ex:review",
"dct:description" : "Review technical feasibility of direct transmission between controllers",
"assignee" : {
"@id" : "https://example.com/controller/datacontroller",
"@type" : "dpv:DataController"
}
}, {
"@type" : "Duty",
"action" : "ex:notify",
"dct:description" : "Communication of reasons if request is denied or delayed",
"assignee" : {
"@id" : "https://example.com/controller/datacontroller",
"@type" : "dpv:DataController"
}
} ]
} ],
"prohibition" : [ {
"@type" : "Prohibition",
"action" : "dpv:MakeAvailable",
"regulationReferences" : [ "gdpr-article-20#article-20-4" ],
"constraint" : [ {
"leftOperand" : "ex:hasImpactOnDataSubjectOrDataSubjectGroup",
"operator" : "eq",
"regulationReferences" : [ "gdpr-article-20#article-20-4" ],
"rightOperand" : "ex:ImpactHarmful"
} ]
}, {
"@type" : "Prohibition",
"action" : "dpv:Transfer",
"regulationReferences" : [ "gdpr-article-20#article-20-4" ],
"constraint" : [ {
"leftOperand" : "ex:hasImpactOnDataSubjectOrDataSubjectGroup",
"operator" : "eq",
"regulationReferences" : [ "gdpr-article-20#article-20-4" ],
"rightOperand" : "ex:ImpactHarmful"
} ]
} ]
}