4 ms·

I really wish that GDPR had gone a step further and imposed some requirements over the shape of the data that companies are required to expose. For domains like

I really wish that GDPR had gone a step further and imposed some requirements over the shape of the data that companies are required to expose. For domains like ecommerce, or banking, or social media, companies should be required to export their GDPR data in the same format as each other. Bonus points if companies are also required to allow users to import data in those formats. That would make it easier to avoid being locked into a specific platform: export your data from the old one, import it into the new one. Before you say that this is impractical -- Google requires that other companies submit data to it in very specific formats (eg, product listings), so I don't see why governments can't impose similar requirements on companies, too. It probably wouldn't be applicable for companies with highly-specific data models, though.

pranavjoneja 5y ago
GDPR is about privacy and security, not interoperability. It was (and still is) a very controversial set of regulations, so shoehorning in more requirements would have made it even more unpopular.
- lucb1e 5y ago
  Please check article 20 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e2753-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
  - jeffchien 5y ago
    It only concerns file format right? I interpreted the preceding conversation as talking about format in the sense of data having the same schema and maybe being interoperable, and not just file format. Nothing I read seems to indicate that seamless interoperability is a requirement [0] [1]. Interoperability seems a little difficult to enforce, like brokers that don't support fractional shares might need to start supporting them to import data from other brokers. Edit: I guess this example is poor but I just wanted to point out that schema/interop also involves data domain, validation, etc. [0] https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/dealing-citizens/can-individuals-ask-have-their-data-transferred-another-organisation_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... [1] https://www2.deloitte.com/ch/en/pages/risk/articles/gdpr-data-portability.html https://www2.deloitte.com/ch/en/pages/risk/articles/gdpr-dat...
- blibble 5y ago
  > GDPR is about privacy and security, not interoperability. Article 20 [RIGHT TO DATA PORTABILITY] 1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: ...
  - rcstank 5y ago
    Right, and Amazon is providing the data in a commonly used format.
    - blibble 5y ago
      yes, I'm sure the dump of Amazon's 120 column table (with no details on what those columns are) can be easily imported into other firms software
      - isbvhodnvemrwvn 5y ago
        There is no requirement in that law for a specific format, it just has to be something common like csv and not a random EDI file or binary blob with no schema.
- notpachet 5y ago
  It's about data protection, and giving users some means of control over how their data is used online. Privacy and security just happen to be the two very salient dimensions of that. If you read the GDPR wording, you'll see the phrase "data subject empowerment" pop up in various places, which is exactly what I'm after: more empowerment over what we can do with our data. GDPR has its warts, absolutely. But I don't think that's a reason not to strive for even greater data protection measures for citizens going forward, especially if we amend the existing regulations to fix some of its unintended consequences. [edit: typo]
lucb1e 5y ago
Reading the first paragraph I was wondering if the data portability right (part of GDPR) might be helpful, and then you went on to say "Bonus points if companies are also required to allow users to import data in those formats". Dude, that is exactly what GDPR requires! You are describing article 20 literally :). I'm not sure about ecommerce, no idea why I'd want to import invoices into another web shop, but > Article 20 \n Right to data portability \n 1. The data subject [you] shall have the right to receive the personal data concerning him or her, which he or she has provided to [the company], in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e2753-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
- notpachet 5y ago
  Right, but for the average user, it's not really feasible for them to receive a megabytes-large CSV of data in whatever format Amazon decides to provide, and then transform that into the necessary format for import into <Etsy/Ebay/Shopify>. We could make tools to do so, but then Amazon could just change what format they use for export, so we'd need to update the tools... Regarding importing: you as a user have the right to provide your downloaded data to a different party, but there's nothing in GDPR that says that party must offer the necessary import capability.
  - lucb1e 5y ago
    > it's not really feasible for them to receive a megabytes-large CSV of data in whatever format Amazon decides to provide, and then transform that into the necessary format okay yeah you're still describing Article 20: > the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible

pranavjoneja 5y ago

GDPR is about privacy and security, not interoperability. It was (and still is) a very controversial set of regulations, so shoehorning in more requirements would have made it even more unpopular.

lucb1e 5y ago
Please check article 20 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e2753-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
- jeffchien 5y ago
  It only concerns file format right? I interpreted the preceding conversation as talking about format in the sense of data having the same schema and maybe being interoperable, and not just file format. Nothing I read seems to indicate that seamless interoperability is a requirement [0] [1]. Interoperability seems a little difficult to enforce, like brokers that don't support fractional shares might need to start supporting them to import data from other brokers. Edit: I guess this example is poor but I just wanted to point out that schema/interop also involves data domain, validation, etc. [0] https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/dealing-citizens/can-individuals-ask-have-their-data-transferred-another-organisation_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... [1] https://www2.deloitte.com/ch/en/pages/risk/articles/gdpr-data-portability.html https://www2.deloitte.com/ch/en/pages/risk/articles/gdpr-dat...
blibble 5y ago
> GDPR is about privacy and security, not interoperability. Article 20 [RIGHT TO DATA PORTABILITY] 1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: ...
- rcstank 5y ago
  Right, and Amazon is providing the data in a commonly used format.
  - blibble 5y ago
    yes, I'm sure the dump of Amazon's 120 column table (with no details on what those columns are) can be easily imported into other firms software
    - isbvhodnvemrwvn 5y ago
      There is no requirement in that law for a specific format, it just has to be something common like csv and not a random EDI file or binary blob with no schema.
notpachet 5y ago
It's about data protection, and giving users some means of control over how their data is used online. Privacy and security just happen to be the two very salient dimensions of that. If you read the GDPR wording, you'll see the phrase "data subject empowerment" pop up in various places, which is exactly what I'm after: more empowerment over what we can do with our data. GDPR has its warts, absolutely. But I don't think that's a reason not to strive for even greater data protection measures for citizens going forward, especially if we amend the existing regulations to fix some of its unintended consequences. [edit: typo]

lucb1e 5y ago

Reading the first paragraph I was wondering if the data portability right (part of GDPR) might be helpful, and then you went on to say "Bonus points if companies are also required to allow users to import data in those formats". Dude, that is exactly what GDPR requires! You are describing article 20 literally :). I'm not sure about ecommerce, no idea why I'd want to import invoices into another web shop, but > Article 20 \n Right to data portability \n 1. The data subject [you] shall have the right to receive the personal data concerning him or her, which he or she has provided to [the company], in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e2753-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

notpachet 5y ago
Right, but for the average user, it's not really feasible for them to receive a megabytes-large CSV of data in whatever format Amazon decides to provide, and then transform that into the necessary format for import into <Etsy/Ebay/Shopify>. We could make tools to do so, but then Amazon could just change what format they use for export, so we'd need to update the tools... Regarding importing: you as a user have the right to provide your downloaded data to a different party, but there's nothing in GDPR that says that party must offer the necessary import capability.
- lucb1e 5y ago
  > it's not really feasible for them to receive a megabytes-large CSV of data in whatever format Amazon decides to provide, and then transform that into the necessary format okay yeah you're still describing Article 20: > the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible