7 ms·

What are consumers intuitively expecting compliance with this law to look like? Data from one service may be in an entirely different schema than the service y

What are consumers intuitively expecting compliance with this law to look like? Data from one service may be in an entirely different schema than the service you want to import it too - let alone format. Service A may summarize your data and throw away the granular stuff, but service B runs on the granular data. Are consumers going to implement ETL pipelines to achieve portability? Are they expecting to hook up streaming mechanisms for enormous swathes of data? Just as an example, if I wanted to get a list of every song I liked on Spotify and import it into Apple Music, how would that even work? The songId of Spotify is undoubtedly different than the one Apple uses. Are Apple and Spotify supposed to agree on a common file format? I agree with the intent of the law but I'm not surprised most services do not offer an automated way to take out data. It's a rare case, often a heavy workload, and there's really no way to guarantee the data you receive is actually portable.

dsr_ 5y ago
There are incentives for, say, Mastodon to be able to ingest your tweeting history, or for Linked-In to eat your Facebook social graph. There's no incentive other than the law for Twitter or Facebook to make that data exportable.
- deleted 5y ago
  [deleted]
- StopHammoTime 5y ago
  That’s why laws exist. There’s generally no incentive to not kill someone except going to jail.
  - deleted 5y ago
    [deleted]
  - brokenmachine 5y ago
    >There’s generally no incentive to not kill someone except going to jail. I'd let some of you survive.
  - anshorei 5y ago
    Ostracization by peers, revenge by members of the victim's family or tribe. Humans generally had reasons not to go out and kill one another long before laws.
    - selfhoster11 5y ago
      That's literally just a form of law being practiced without being formally codified.
  - account42 5y ago
    > That’s why laws exist. And we are discussing the law that fixes the lack of incentive of Twitter and Facebook to export the data in this very thread!
capableweb 5y ago
> Just as an example, if I wanted to get a list of every song I liked on Spotify and import it into Apple Music, how would that even work? The songId of Spotify is undoubtedly different than the one Apple uses. Are Apple and Spotify supposed to agree on a common file format? Yeah, that'd be great! We didn't get the web as we know it today until bunch of people and companies got together and created standards for everyone to rely on. Why can't we do that same for SaaS businesses? I think the test is something like: If the concept is the same, you should be able to import/export it. For example, you have a SaaS having photo upload + being able to put the photos into a custom gallery. Then you should be able to export that gallery in a format that you can recreate the same gallery in another SaaS that also has photo upload + custom galleries. The article itself is clear that it's not always technically feasible to offer this import/export. For example, it doesn't make sense to be able to export Facebook posts and import them into Twitter, because those are two different formats with different restrictions. This is from the actual article: > In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The full article of "Data Portability" is not that long, you can read it here: https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/
- Helmut10001 5y ago
  I agree, most SaaS concepts are similar and have large overlaps in feature and functionality. Just for Social Media, we've written a common data structure format (lbsn.vgiscience.org) where it is possible to import/export from all services (this one is specifically tailored for visual analytics and exploration of research/privacy questions). When working on the structure, it became clear that most Social Media concepts exist in a similar form on multiple sites. There is very little functionality that is unique to a single SaaS.
  - capableweb 5y ago
    Indeed, common data structures across platforms feels more common than specialized ones, biggest difference seems to mostly sit in the UI/UX layer at this point. Data Transfer project is also trying to define some common data models that companies can use to ensure they export/import agreed data models, although it's still not very extensive: https://github.com/google/data-transfer-project/tree/master/portability-types-transfer/src/main/java/org/datatransferproject/types/transfer/models https://github.com/google/data-transfer-project/tree/master/...
Guillaume86 5y ago
> Just as an example, if I wanted to get a list of every song I liked on Spotify and import it into Apple Music, how would that even work? The songId of Spotify is undoubtedly different than the one Apple uses. Are Apple and Spotify supposed to agree on a common file format? I understand your point but FYI music is a poor example as there is solutions to port metadata in that case. MusicBrainz aims to standardize music metadata and it is pretty commonly used. An example I know is the lastfm service, their APIs accept an optional mbid: https://www.last.fm/api/show/track.updateNowPlaying https://www.last.fm/api/show/track.updateNowPlaying.
- cbm-vic-20 5y ago
  Should music streaming services be compelled to support MusicBrainz to support this GDPR case simply because it is commonly used? Who decides that mbid is the GDPR-accepted track identifier?
  - deleted 5y ago
    [deleted]
  - iatt 5y ago
    In contrast to requiring a particular standard to represent metadata, the better way is to require that the exported data be machine-readable and its contents documented. This gives providers the flexibility to innovate, adding their own identifiers or whatever useful data they want, but avoids legislators forcing everyone to use a common standard that, while useful today, can quickly go out of date. Competitors can then write converters or importers based on this documentation, as could motivated FOSS users.
izacus 5y ago
> Just as an example, if I wanted to get a list of every song I liked on Spotify and import it into Apple Music, how would that even work? The songId of Spotify is undoubtedly different than the one Apple uses. Are Apple and Spotify supposed to agree on a common file format? Why wouldn't it work? Desktop apps had m3u playlist formats which could be read by multiple players - from Winamp on desktop, iTunes on a Mac or even car headunits. It's now kinda wierd to say that rockstar engineers of Apple/Spotify can't find a way to export playlists and liked songs (a global singletons essentially) they got from the SAME publishers and probably ingest from the SAME content owner data sources.
- sethhochberg 5y ago
  m3u (or really anything that relies on file names to reference media assets) would be a potential disaster... all kinds of weird stuff makes it into your parser when you're dealing with a large enough catalog. I used to work in streaming media, including with some m3u-based legacy systems, and dealt with a pile of edge cases a mile high. But thankfully, the industry solved this problem themselves: ISRC (International Standard Recording Code) is already used all over the royalty reporting side of the industry because it specifically solves the problem of referencing an individual recording of a work. DDEX is a content delivery manifest format the industry also uses for this kind of purpose (sharing complex metadata about recordings in a standardized way), but its an 800lb gorilla of a format and not super consumer-friendly. These are things that are all over the back offices of your favorite streaming service, but mostly transparent to the consumer.
  - capableweb 5y ago
    This is a great comment, thanks for adding to the conversation. This further gives proof that it is technically feasible for Spotify and Apple Music to be able to import/export playlists across both their services. Looking forward to seeing it happen in reality.
- redwall_hp 5y ago
  I was thinking the other day about that, sort of. Apple in the early 2000s was really into things like CalDAV and WebDAV. Safari had integrated RSS reading at one point. They embraced standardization and interoperability for many things, at least where important user data was concerned. Then something happened after the iPhone took off and iCloud became a thing, and they became all about vendor lock-in. I assume it comes from being a market leader instead of only having a relatively unpopular computing platform.
908B64B197 5y ago
> Just as an example, if I wanted to get a list of every song I liked on Spotify and import it into Apple Music, how would that even work? The songId of Spotify is undoubtedly different than the one Apple uses. Are Apple and Spotify supposed to agree on a common file format? If I was Spotify I would export that as an SQLite DB. Maybe the metadata catalog as a standalone DB too. Apple Music has an API[0] so it's already mostly possible to import a list of songs in it. > I agree with the intent of the law but I'm not surprised most services do not offer an automated way to take out data. It's a rare case, often a heavy workload, and there's really no way to guarantee the data you receive is actually portable. "Data Portability" is so vaguely defined that I can't help but see it as yet another law that EU bureaucrats will use to fleece (American) "Evil Tech Giants". [0] https://developer.apple.com/documentation/applemusicapi https://developer.apple.com/documentation/applemusicapi
- anticristi 5y ago
  "Data portability" is vague so that the law is stable and flexible. As a comparison, "drivers need to adapt driving speed to weather conditions" is equally vague. It would simply be infeasible to publish an hourly speed limit chart based on rain, fog, snow, etc. It is the responsibility of driving instructors to raise awareness on reasons to adapt the speed. Drivers need to then interpret that clause to their situation. Similarly, it is up to industry -- either via standardization bodies or courts -- to clarify what exactly is "data portability".
  - FigmentEngine 5y ago
    the phrase maybe, but the gdpr article itself provides more "Article 20 Right to data portability 1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:" https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2753-1-1 https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2753-1-1
  - 908B64B197 5y ago
anticristi 5y ago
I agree. I could develop my own ETL and wasn't sure what to do with this right. Where would I import my Klarna Checkout history and for what purpose? I guess this law is there to ensure your images can be transferred from Dropbox to Google Drive to Apple Cloud, without any of them being tempted to pull the plug.
- deleted 5y ago
  [deleted]
kelnos 5y ago
> Just as an example, if I wanted to get a list of every song I liked on Spotify and import it into Apple Music, how would that even work? The songId of Spotify is undoubtedly different than the one Apple uses. Artist + Song Title (+ Album and track number, if it's from an album) should be enough to disambiguate in enough cases for someone to consider this "portable". Beyond that, we have music fingerprint IDs that a service could output in the data dump along with their own service-specific ID. > Are Apple and Spotify supposed to agree on a common file format? For something as simple as this, yes, absolutely they should. It's bonkers that they don't and wouldn't, aside from garbage anti-competitive lock-in reasons.
mulmen 5y ago
This is so sad. That we have already forgotten how easy this is. And that we do not see that data integration is an obvious case for open standards and development. Back in the "bad" (aka glorious) days of p2p file sharing we had no problems keeping things straight. Even Windows XP natively knows how media libraries work. Any service that makes this hard will be at a disadvantage to ones that make it easy, and maybe get roasted in court on GDPR grounds. The only reason services do not offer you data export in an easily digestible format is that they want you to stay in the app.
hnick 5y ago
> Are consumers going to implement ETL pipelines to achieve portability? Are they expecting to hook up streaming mechanisms for enormous swathes of data? As a dev I hate the fact that something like Zapier apparently has to exist in this messy world, but non-technical people like my wife tend to find it intuitive and relatively easy to use so that's one option. Though for your example I'd argue that the ingester (Apple) has a vested interest in allowing import from many formats to poach customers. Much like how Apple went to the effort of creating the Move to iOS app on android. I wonder whether having the data exported with just a song id would be sufficient under the law, because you could just normalise all useful data away and export a list of IDs to the customer which seems clearly against the purpose of the law. Showing just IDs is not my data which would mean the actual songs I like.
account42 5y ago
The emportant part that this law should achieve is to get the data out of the service. This at least allows competing services to provide importers, which is in their interest.

dsr_ 5y ago

There are incentives for, say, Mastodon to be able to ingest your tweeting history, or for Linked-In to eat your Facebook social graph. There's no incentive other than the law for Twitter or Facebook to make that data exportable.

deleted 5y ago
[deleted]
StopHammoTime 5y ago
That’s why laws exist. There’s generally no incentive to not kill someone except going to jail.
- deleted 5y ago
  [deleted]
- brokenmachine 5y ago
  >There’s generally no incentive to not kill someone except going to jail. I'd let some of you survive.
- anshorei 5y ago
  Ostracization by peers, revenge by members of the victim's family or tribe. Humans generally had reasons not to go out and kill one another long before laws.
  - selfhoster11 5y ago
    That's literally just a form of law being practiced without being formally codified.
- account42 5y ago
  > That’s why laws exist. And we are discussing the law that fixes the lack of incentive of Twitter and Facebook to export the data in this very thread!

capableweb 5y ago

> Just as an example, if I wanted to get a list of every song I liked on Spotify and import it into Apple Music, how would that even work? The songId of Spotify is undoubtedly different than the one Apple uses. Are Apple and Spotify supposed to agree on a common file format? Yeah, that'd be great! We didn't get the web as we know it today until bunch of people and companies got together and created standards for everyone to rely on. Why can't we do that same for SaaS businesses? I think the test is something like: If the concept is the same, you should be able to import/export it. For example, you have a SaaS having photo upload + being able to put the photos into a custom gallery. Then you should be able to export that gallery in a format that you can recreate the same gallery in another SaaS that also has photo upload + custom galleries. The article itself is clear that it's not always technically feasible to offer this import/export. For example, it doesn't make sense to be able to export Facebook posts and import them into Twitter, because those are two different formats with different restrictions. This is from the actual article: > In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The full article of "Data Portability" is not that long, you can read it here: https://gdpr-info.eu/art-20-gdpr/ https://gdpr-info.eu/art-20-gdpr/

Helmut10001 5y ago
I agree, most SaaS concepts are similar and have large overlaps in feature and functionality. Just for Social Media, we've written a common data structure format (lbsn.vgiscience.org) where it is possible to import/export from all services (this one is specifically tailored for visual analytics and exploration of research/privacy questions). When working on the structure, it became clear that most Social Media concepts exist in a similar form on multiple sites. There is very little functionality that is unique to a single SaaS.
- capableweb 5y ago
  Indeed, common data structures across platforms feels more common than specialized ones, biggest difference seems to mostly sit in the UI/UX layer at this point. Data Transfer project is also trying to define some common data models that companies can use to ensure they export/import agreed data models, although it's still not very extensive: https://github.com/google/data-transfer-project/tree/master/portability-types-transfer/src/main/java/org/datatransferproject/types/transfer/models https://github.com/google/data-transfer-project/tree/master/...

Guillaume86 5y ago

cbm-vic-20 5y ago
Should music streaming services be compelled to support MusicBrainz to support this GDPR case simply because it is commonly used? Who decides that mbid is the GDPR-accepted track identifier?
- deleted 5y ago
  [deleted]
- iatt 5y ago
  In contrast to requiring a particular standard to represent metadata, the better way is to require that the exported data be machine-readable and its contents documented. This gives providers the flexibility to innovate, adding their own identifiers or whatever useful data they want, but avoids legislators forcing everyone to use a common standard that, while useful today, can quickly go out of date. Competitors can then write converters or importers based on this documentation, as could motivated FOSS users.

izacus 5y ago

sethhochberg 5y ago
m3u (or really anything that relies on file names to reference media assets) would be a potential disaster... all kinds of weird stuff makes it into your parser when you're dealing with a large enough catalog. I used to work in streaming media, including with some m3u-based legacy systems, and dealt with a pile of edge cases a mile high. But thankfully, the industry solved this problem themselves: ISRC (International Standard Recording Code) is already used all over the royalty reporting side of the industry because it specifically solves the problem of referencing an individual recording of a work. DDEX is a content delivery manifest format the industry also uses for this kind of purpose (sharing complex metadata about recordings in a standardized way), but its an 800lb gorilla of a format and not super consumer-friendly. These are things that are all over the back offices of your favorite streaming service, but mostly transparent to the consumer.
- capableweb 5y ago
  This is a great comment, thanks for adding to the conversation. This further gives proof that it is technically feasible for Spotify and Apple Music to be able to import/export playlists across both their services. Looking forward to seeing it happen in reality.
redwall_hp 5y ago
I was thinking the other day about that, sort of. Apple in the early 2000s was really into things like CalDAV and WebDAV. Safari had integrated RSS reading at one point. They embraced standardization and interoperability for many things, at least where important user data was concerned. Then something happened after the iPhone took off and iCloud became a thing, and they became all about vendor lock-in. I assume it comes from being a market leader instead of only having a relatively unpopular computing platform.

908B64B197 5y ago

anticristi 5y ago
"Data portability" is vague so that the law is stable and flexible. As a comparison, "drivers need to adapt driving speed to weather conditions" is equally vague. It would simply be infeasible to publish an hourly speed limit chart based on rain, fog, snow, etc. It is the responsibility of driving instructors to raise awareness on reasons to adapt the speed. Drivers need to then interpret that clause to their situation. Similarly, it is up to industry -- either via standardization bodies or courts -- to clarify what exactly is "data portability".
- FigmentEngine 5y ago
  the phrase maybe, but the gdpr article itself provides more "Article 20 Right to data portability 1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:" https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2753-1-1 https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2753-1-1
- 908B64B197 5y ago

anticristi 5y ago

I agree. I could develop my own ETL and wasn't sure what to do with this right. Where would I import my Klarna Checkout history and for what purpose? I guess this law is there to ensure your images can be transferred from Dropbox to Google Drive to Apple Cloud, without any of them being tempted to pull the plug.

deleted 5y ago
[deleted]

kelnos 5y ago

> Just as an example, if I wanted to get a list of every song I liked on Spotify and import it into Apple Music, how would that even work? The songId of Spotify is undoubtedly different than the one Apple uses. Artist + Song Title (+ Album and track number, if it's from an album) should be enough to disambiguate in enough cases for someone to consider this "portable". Beyond that, we have music fingerprint IDs that a service could output in the data dump along with their own service-specific ID. > Are Apple and Spotify supposed to agree on a common file format? For something as simple as this, yes, absolutely they should. It's bonkers that they don't and wouldn't, aside from garbage anti-competitive lock-in reasons.

mulmen 5y ago

This is so sad. That we have already forgotten how easy this is. And that we do not see that data integration is an obvious case for open standards and development. Back in the "bad" (aka glorious) days of p2p file sharing we had no problems keeping things straight. Even Windows XP natively knows how media libraries work. Any service that makes this hard will be at a disadvantage to ones that make it easy, and maybe get roasted in court on GDPR grounds. The only reason services do not offer you data export in an easily digestible format is that they want you to stay in the app.

hnick 5y ago

> Are consumers going to implement ETL pipelines to achieve portability? Are they expecting to hook up streaming mechanisms for enormous swathes of data? As a dev I hate the fact that something like Zapier apparently has to exist in this messy world, but non-technical people like my wife tend to find it intuitive and relatively easy to use so that's one option. Though for your example I'd argue that the ingester (Apple) has a vested interest in allowing import from many formats to poach customers. Much like how Apple went to the effort of creating the Move to iOS app on android. I wonder whether having the data exported with just a song id would be sufficient under the law, because you could just normalise all useful data away and export a list of IDs to the customer which seems clearly against the purpose of the law. Showing just IDs is not my data which would mean the actual songs I like.

account42 5y ago

The emportant part that this law should achieve is to get the data out of the service. This at least allows competing services to provide importers, which is in their interest.