The EU General Data Protection Regulation (GDPR) has now been in effect for over a year and must be implemented accordingly, however, there is still a lack of clarity with regard to some of its details.
The objectives of strengthening the rights of data subjects and transparency in the processing of personal data require further development and practice-related elaboration in a range of aspects.
With regard to the rights of data subjects pursuant to Arts. 12 to 22 of the GDPR, the right to data portability, in particular, was considered an absolute innovation. In times where data-intensive internet platforms and portals are used, it seems to be exceedingly user-friendly if it is possible to transfer all data when switching from one provider to another. For example, it could be particularly beneficial to users with numerous contacts on Facebook and who extensively share information. All data which is currently available could simply be installed onto a new platform and would continue to be used and shared.
In a professional setting, the question is whether an employee would also have an interest in taking their data with them when changing to another employer and having it imported into the new employer’s EDP systems.
The following article considers the relevance of the data subject’s new right of data portability, with a focus on its application in an HR context.
1. Data Portability – Requirements and Concepts
Article 20 of the GDPR provides an overview of the issue of data portability. With regard to the basic principles of data protection, it regulates the right to data portability if processing is based
- on consent pursuant to point (a) of Art. 6(1) of the GDPR or
- on consent pursuant to point (a) of Art. 9(2) of the GDPR (consent for particularly sensitive data) or
- on a contract pursuant to point (b) of Art. 6(1) of the GDPR
Furthermore, Art. 20 of the GDPR regulates the right to data portability as follows: “The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided...”
The requirements of a format which is structured, commonly used and machine-readable shall be aligned with current market practises. At the same time, recital 68 on the GDPR states, on the other hand, that it must be an interoperable format which allows for continued use. For example, a large social platform allows information to be downloaded either in HTML or JSOM format.
However, this does not apply for all processing but, according to Art. 20 of the GDPR, only if processing is carried out by automated means. Therefore, it does not apply to documents in a paper form. The right to data portability has two versions:
- the right to receive personal data (para. 1)
- the right to direct transfer to another controller named by the data subject (para. 2).
With regard to transfer to another controller, Art. 20(2) of the GDPR includes the provisons that if this is not technically feasible, there is also the alternative option of making the data available to the data subject themselves.
The content of the right to data portability refers to personal data which
- concerns the data subject and
- was provided to the controller by the data subject
and does not exclude the right to data portability. According to Art. 29 Working Party, the data provided could also include data gained from “observing” data subjects (cf. WP 242 of Art. 29 Working Partyi). However, the assumption must be made that in principle, particularly data which was knowingly and actively made available by the data subject is meant (cf. also recital 68 on the GDPR).
2. Distinction from the Right to Access/Right to a Copy of the Data
The purpose of the right to access pursuant to Article 15 of the GDPR including the right to receive a copy of the data serves the implementation of sufficient transparency for the data subject. The legislator, thus, gives the data subject a right to control the processing of their entire personal data by the controller. The copy does not have to be, but can be, in an electronic format. In any case, the request for information must be made in a form which can be understood by the data subject (cf. Art. 12 of the GDPR). Data portability pursuant to Art. 20 of the GDPR should return to the data subject discretionary power over the data which had been made available to the controller by them. The data subject should be able to transmit it to another controller for their further use, thus, making it easier to change (provider). Ultimately, the machine-readable format distinguishes the data included in the right to data portability from the right to a copy of the data; the ability of a human to understand it is not required. The right to data portability constitutes a full, individual right, whereas the right to a copy of the data is only a characteristic of the right to access.
3. The Data Protection Basis for the Transfer to Another Controller
Should the relevant data now be transmitted to another controller (cf. Art. 20(2) of the GDPR), it may be asked on what data protection basis this transfer is permissible. In principle, when exercising the right of transfer to another controller, the express declaration of intent by the data subject can be assumed, and thus their consent. At the same time, it can also be assumed that the legal obligation to transfer following from the GDPR has been fulfilled, as has ultimately the legitimate interest of the data subject. The legal bases for the transfer under data protection law are thus sufficient.
4. Data Portability in Employment Relations
a) Requirement: Employment Agreement as a contract pursuant to point (b) of Art. 6(1) of the GDPR
As a matter of principle, the processing of personal data within an employment relationship follows on the basis of Section 26 of the BDSG [German Federal Data Protection Act] (processing in order to initiate, perform and terminate an employment relationship). At the same time, an employment relationship is also subject to a contract, the performance of which requires personal data to be stored. Therefore, on the one hand consulting Section 26 of the BDSG as a basis for processing under data protection law could negate the right to data portability. On the other hand, if the employment contract is considered to be the legal basis under data protection law, the requirement for the right to data portability would be given. Although this right has been conceived in particular for a change of service providers, at the same time nothing stands in the way of granting it to employees as well (cf. Gola/Heckmann/Gola 13th edition 2019, BDSG Section 26, recital 108).
Even Article 29 Working Party states in its “Guidelines on the right to data portability"1: “When it comes to employees’ data, the right to data portability typically applies only if the processing is based on a contract to which the data subject is a party.” In the guidelines, the employment contract between data subject and employer is classified as a contract pursuant to point (b) of Art. 6(1) of the GDPR; Art. 20 of the GDPR is thus applicable and the required transferability of personal data must also be implemented within an employment relationship.
b) Requirement: Consent pursuant to point (a) of Art. 6(1) or point (a) of Art. 9(2) of the GDPR
The second option for processing on the basis of data protection law under which data portability must be guaranteed is the existence of consent. According to the specification of Art. 7 of the GDPR, consent must be voluntary. The voluntary nature of this consent is often doubted in the employee-employer relationship. Due to the imbalance of power between the employer and employees, there can be no voluntary and thus no effective consent within an employment relationship. Irrespective of the clarification of the issue of the voluntariness of consent within the employment relationship, the right of data portability should always be applied if consent was obtained from employees as the basis of data processing. One example for the use of data within an employment relationship on the basis of consent is the publication of employee photos in the internet which may only occur if the respective employee has granted his or her consent.
c) Processing on the basis of company agreements
The right to data portability shall not be applied if data processing is based on a company agreement. The conclusion of company agreements also sets out a basis for the processing of employee data (Art. 80 of the GDPR in connection with Section 26 of the BDSG). Company agreements are collective agreements which cannot, however, be compared with (individual) consent. If they are concluded in relation to data processing, then they are often a means to limit the potential analysis of employee data resulting from the use of IT systems.
d) Requirement: electronic processing, data provided by the employee
Traditionally, an electronic personnel file is subject to the right of data portability insofar as the data was provided by the data subject themselves. The data entered by applicants in an electronic application portal is also affected by the right to data portability. Similarly, data from professional development courses and seminars which were attended are subject to the right of data portability, insofar as it is available in electronic form. However, if personnel files are still kept on paper, and applications are only made on paper, then they are not subject to the right of data portability.
As they are not provided by the data subject, all data created in the production of payslips by the company are not subject to a right to access either. Performance evaluations of the employee conducted by the employer are not subject to the right of data portability either. Interestingly, it is precisely these that are an explicit means of contact between employer and employee, however, the right to receive the assessments in a "commonly used electronic format” does not exist because the data was not provided by the employee himself or herself.
Summary
The right to data portability in the GDPR is envisaged as a factor to support the free movement of personal data in the EU and aims to promote competition between controllers. These factors are only of subordinate relevance with regard to the processing of personal data in the personnel sphere. Data portability is of no clear benefit to employees. Data which was,for example, provided by the employee at the start of an employment relationship would no longer be up-to-date for a new application. The employee’s change to a new employer is determined by a few factors, however, hardly by the fact that the new employer will be provided with data in a machine-readable format.
In the view of the author, it can be assumed that employees will not make extensive use of their right to data portability. This is demonstrated by the number of enquiries by employees in relation to this question since May 2018. Due to the small number of enquiries, it is also important from an economic point of view to ensure that the expense of implementing the guarantee of data portability within the company remains reasonable.
Nevertheless, the right to data portability as described in this article must also be implemented within HR.
Practical tips
Data portability in employment relationships applies to personal data which
- was provided by the employee themselves and
- is in an electronic format
Payroll data and paper documents are not subject to the right to data portability
ARTICLE 29 WORKING PARTY WP 242 rev. 01 - 16/EN - Guidelines on the right to data portability