3 ms·

That needs to be read in conjunction with A.12(3): > The controller shall provide information on action taken on a request under Articles 15 to 22 to the data

That needs to be read in conjunction with A.12(3): > The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. Whilst you may be able to require that Facebook send the data to a competing service, I would not read A.12(3) as requiring it to be done immediately -- Facebook could (somewhat reasonably) claim that gathering all information about an account takes some time. This limits its usefulness. Further, A.20(1) specifies the "right to receive the personal data concerning him or her", which I would read as making a request under A.20 returns all data relating to you, and does not oblige the controller to return only specifically requested and/or new data. You have have to be comfortable with the entirety of that data being send to the third-party, and they must be set up to process the deluge of information. Not only that, but A.12(5) provides that: > Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or refuse to act on the request. Repeated requests to facilitate sending posts to a third-party could quickly been seen as excessive, in which case Facebook could refuse to process the request, and I doubt that the courts would treat such requests as being within the spirit of the rights granted under A.20 (it is a right that enables moving to a new controller, rather than being intended to synchronise data between controllers on an ongoing basis).

dane-pgp 9y ago
Thank you for that detailed analysis. Perhaps I should have emphasised that the scenario I am suggesting is one where there are already multiple open social networks that are communicating with each other using "industry standard" W3C social network specifications. If technology were in widespread use for allowing instant automated publishing of social media posts to friends on other networks, then I don't see how Facebook could legitimately claim that they can only implement a process that takes weeks (or deluges their competitors with unwanted information). A court should see this as malicious compliance and demand a more "reasonable" effort from them instead. This article: http://ejlt.org/article/view/546/726 http://ejlt.org/article/view/546/726 makes a strong case (in section 3.2) that the GDPR's data portability right should be considered in terms of EU competition law generally: "In light of the above, it can be argued that a refusal of a dominant firm to enable data portability might be seen as a form of exclusionary abuse as it might drive its competitors out of a specific relevant market and increase market concentration."

dane-pgp 9y ago

Thank you for that detailed analysis. Perhaps I should have emphasised that the scenario I am suggesting is one where there are already multiple open social networks that are communicating with each other using "industry standard" W3C social network specifications. If technology were in widespread use for allowing instant automated publishing of social media posts to friends on other networks, then I don't see how Facebook could legitimately claim that they can only implement a process that takes weeks (or deluges their competitors with unwanted information). A court should see this as malicious compliance and demand a more "reasonable" effort from them instead. This article: http://ejlt.org/article/view/546/726 http://ejlt.org/article/view/546/726 makes a strong case (in section 3.2) that the GDPR's data portability right should be considered in terms of EU competition law generally: "In light of the above, it can be argued that a refusal of a dominant firm to enable data portability might be seen as a form of exclusionary abuse as it might drive its competitors out of a specific relevant market and increase market concentration."