GDPR Article 20 — Right to data portability
Article 20(1) — Portable data
The data subject has the right to receive personal data provided to a controller in a structured, commonly used, and machine-readable format and to transmit those data to another controller without hindrance, where the processing is based on consent or contract and is carried out by automated means.
Article 20(1)(a) — Consent or contract basis
The portability right applies where processing is based on consent under Article 6(1)(a) or Article 9(2)(a), or on a contract under Article 6(1)(b).
Article 20(1)(b) — Automated means
The portability right applies where processing is carried out by automated means.
Article 20(2) — Direct transmission
In exercising the portability right, the data subject has the right to have personal data transmitted directly from one controller to another, where technically feasible.
Article 20(3) — Public-interest exclusion
The portability right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Article 20(4) — Rights and freedoms of others
The portability right shall not adversely affect the rights and freedoms of others.