The right to portability comes into force in Canada on September 22, 2024, through Québec Act 25, amending the Québec Act respecting the protection of personal information in the private sector (Québec Act). The right remains on the horizon at the federal level through Bill C-27 including amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA) mainly through the proposed Consumer Privacy Protection Act (CPPA), still before the House of Commons Standing Committee on Industry and Technology.

As organizations gear up to comply with their obligations under this new privacy right in Canada, we examine how the right to data portability has been interpreted in Europe under the General Data Protection Regulation (GDPR) since Canadian commissioners, starting with the Commission d’accès à l’information du Québec, are likely to follow that lead to enforce the right to data portability in Canada.  

We compare the legislative texts in Europe and in Canada and describe the recognized scope of the right to data portability under the GDPR and as well as the interpretation of both the sending and the receiving organization’s obligations.

1. A comparative look at the legislative texts

The first legislative text to come into force in Canada to create the right to data portability, in September 2024, is new section 27 of the Québec Act framing it as an obligation of the organization: 

“ […] Unless doing so raises serious practical difficulties, computerized personal information collected from the applicant, and not created or inferred using personal information concerning him, must, at his request, be communicated to him in a structured, commonly used technological format. The information must also be communicated, at the applicant’s request, to any person or body authorized by law to collect such information.”

In comparison, Article 20 of the GDPR, upon which the Québec Act is modelled, frames portability as a right of the individual:

1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
   1. the processing is based on consent […] or [is necessary to a contract] and
   2. the processing is carried out by automated means.
2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
3. The exercise of the right [to data portability] shall be without prejudice to [the exercise of the right to be forgotten]. […]
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

The proposed CPPA, under “Mobility of Personal Information,” leaves the details to regulations and would create for organizations, at section 72, the obligation to:

[…] as soon as feasible disclose the personal information that it has collected from the individual to an organization designated by the individual, if both organizations are subject to a data mobility framework.

Leaving aside the laconic CPPA, the following distinctions and similarities appear between the Québec and the European legislative texts creating the right to data portability:

• Both limit the right to
• Computerized data;
• Provided by the individual, rather than created or inferred by the organization about the individual;
• With limitations; and
• Subject to a delay of 30 days, applicable to all individual rights. 
• Limitations are worded differently in the Québec Act and in the GDPR: The Québec Act creates an exception where “doing so raises serious practical difficulties” while the GDPR restricts it to “where technically feasible,” and the Québec Act expressly excludes “created or inferred” data while the GDPR excludes the broader category of requests that would “adversely affect the rights and freedoms of others.”
• Both ensure interoperability by requiring organizations to transfer the data in “structured, commonly used technological format” (Québec Act) or “commonly used and machine-readable format” (GDPR).
• Organizations’ obligations are stated differently: While the Québec Act simply creates the obligation to transfer the data upon request, the GDPR adds, “without hindrance.”

Several applications of the right to portability under the GDPR point to its potential scope of application in Canada.

2. Scope of the right to portability

Canadian regulators may turn to the Guidelines on the Right to Data Portability from the European Data Protection Board (EDPB Guidelines) to define the scope of the right to portability in Canada. The Guidelines affirm its objective to empower data subjects regarding their own personal data and to maintain competition through open data, to avoid “vendor lock-in.”

Still, the right to portability has limitations. The EDPB Guidelines underscore such limitations by describing it as a right of the data subject to receive a “subset” of one’s personal data an organization processes.  

2.1 Limitation to data “about the individual”

The requirement that the personal information be about the individual arises in relation to anonymous data, pseudonymous data and data about third parties provided by the individual:

• Anonymous data are not about an individual, and therefore not subject to portability.
• Pseudonymous data, however, since they can still be linked to an individual through a secondary source, remains personal information and are subject to portability.
• Third-party data provided by the individual may be subject to portability. The EDPB Guidelines give the examples of “telephone, interpersonal messaging or VoIP records” included in an individual’s subscriber’s account history.

2.2 Limitation to data “provided by the individual”

A key concept to clarify in defining the scope of the right to portability is the notion of data “provided by” the individual. The EDPB Guidelines and Data Protection Authority (DPA) decisions provide examples of data excluded from that notion and therefore from the right to portability:

• Insurability: In Decision 45/2023, the Belgian DPA clarifies that, because insurability of an individual results from an analysis by the organization, through its own criteria, of various data provided by the individual, it does not constitute data provided by the individual.  
• Profile: Finnish DPA guidance makes clear data created by the organization, such a profiling, are not subject to portability.
• AML and other crime prevention data: Crime prevention data such as to prevent fraud or detect money laundering and other financial crimes or related to criminal investigations are not covered by the right to portability.
• Assessments: Health assessment of a user, risk management data, financial profile or credit score emanates from the organization, not the individual and are not portable data.
• Public records: Portability also excludes public records such as tax returns or real-estate registration.

The following, however, have been included:   

• Use data: Data generated through use, such as website visit history, traffic and location data or purchase history are deemed “indirectly provided” by the individual and subject to portability. EDPB Guidelines, as well as guidance from the Dutch, Estonian, French, Slovenian DPA and Spanish DPA provide concrete examples. “Indirectly provided data,” subject to data portability, include:
• Activity logs;
• Search history;
• Location data;
• Raw data, such as a person’s heart rate recorded via a fitness tracker;
• Smart meter data;
• Internet of things data;
• Titles of books purchased on an online store;
• Songs listened to on a streaming service;
• Financial transactions data; and
• Metadata such as time of message, sender or addressee.
• Data created by the individual: A directory created by the individual of contacts whether friends, relatives or other individuals, is portable.
• Certain third-party data: Incoming and outgoing calls as well as messages and payments have been included in the right to portability. 

The underlying principle is that the notion of “data provided by the individual” should be applied broadly to all personal data about the individual not created by the organization.

2.3 Limitation relating to intellectual property

The Québec Act expressly excludes “created or inferred” data, presumably, without stating it, to protect intellectual property rights resulting from invention or creation. The same limitation is read into Article 20(4) of the GDPR ensuring the protection of “the rights and freedoms of others.” The EDPB Guidelines explain that this can be understood as “including trade secrets or intellectual property and in particular the copyright protecting the software.” The EDPB goes on to offer considerations in reconciliating intellectual property rights and portability rights:

• Intellectual property rights should not result in denying portability of all information of the individual;
• The right to data portability cannot be used to violate intellectual property rights; and
• A potential business risk cannot, in and of itself, serve as the basis to deny a portability request.

The case of Ola Cabs (Rb. Amsterdam - C/13/689705/HA RK 20-258) before the Court of Amsterdam, opposing Ola cab drivers to Ola, including with respect to their right to portability, clarifies the limitation in Article 20(4) of the GDPR. It interprets the limitation to “the rights and freedoms of others” as including the protection of the rights of the organization. 

The bottom line is that the right to portability exists on a sliding scale of competing rights to privacy and intellectual property: depending upon the level of transformation applied to personal data they are portable, with no competing rights to intellectual property, or not portable, where the level of transformation is such that intellectual property rights prevail. 

3. Organizations’ obligations

European DPA have issued decisions and guidance that define the respective obligations of the organization sending the data under the right to portability and the organization receiving it.

3.1 All organizations

European DPA, such as the French Commission Nationale de l'Information et Libertés (CNIL),  insist on clear and comprehensive descriptions of the right to portability, in an easily accessible privacy policy. The Irish Data Protection Commission calls upon organizations to ensure there is no confusion between the right to access, being the right to access one’s data, whether provided by the individual or created by the organization, and the right to portability, which does not extend to data created by the organization.

The European Data Protection Supervisor (EDPS) also highlights the obligation to develop technical measures to allow the realization of the right to portability. That being said, the EDPB Guidelines quote Recital 68 of the GDPR to clarify that the right to portability “should not create an obligation for the controllers to adopt or maintain processing systems which are technically compatible,” insisting that “portability aims to produce interoperable systems, not compatible systems.” 

3.2 Obligations of the sending organization

The EDPB Guidelines serve to delimit organizations’ obligations when they receive a data portability request. They include the obligations for the data sending organization to: 

• Transfer “without hindrance,” which prohibits measures such as charging a fee, unless the request is manifestly unfounded and excessive, although the overall cost cannot in itself justify denial of portability, using a complicated format, or requiring a specific format to request a data transfer, without justification, or mandatory signatures.
• Verify request, to ensure the request is well understood, particularly as to what data the individual wants transferred.
• Transfer securely, including ensuring the data are not accessed by an unauthorized person through the transfer.
• Justify refusal, as the case may be, within one month of receiving the request and inform the individual of the right to lodge a complaint with the DPA.

It does not include :

• Verifying the receiving organization’s compliance with applicable regulations.
• Providing the data in a specific format, as long as it is structured, commonly used and machine-readable.
• Verifying quality of the data, beyond their general obligations to keep personal information accurate and up to date.
• Retaining personal information for the sole purpose of portability.

The guiding principle is that the right to portability cannot undermine the legal rights of the organization.

3.3 Obligations of the receiving organization

From the same guidance documents, the obligations of the receiving organizations are defined. They include:

• Consistent Use: The transferred information can only be used for the same purposes as the original organization did. 
• Minimization: No more data may be transferred or retained than is necessary to the new processing. Data that are not necessary for the new purposes should not be stored or processed but rather returned or deleted.
• Protection: The receiving organization assumes full responsibility for the protection of the data including:
• Announcing the purpose of the new processing clearly and directly before the transfer request is made to the sending organization, whether the request is made by the individual or by the receiving organization; and
• Ensuring lawfulness of processing, purpose limitation, data minimization, accuracy, integrity and confidentiality, storage limitation and accountability.

They do not include:

• Accepting personal data transmitted through a portability request.

 3.4 Data portability and service providers

The GDPR requires that processors (service providers) be held to assist data controllers (the organization responsible for the data) in responding to individual rights requests. Similarly, both the Québec Act and PIPEDA hold an organization responsible for compliance with the rights and obligations attached to the personal information whether it “keeps the information itself or through the agency of a third person” (section 1 of the Québec Act), or “including information that has been transferred to a third party for processing.” (clause 4.1.3 of Schedule 1 PIPEDA).

According to the EDPB Guidelines on portability, organizations must implement specific procedures on cooperation from service providers to answer data portability requests. The accountability principle in Canada would lead to the same conclusion.

4. More lessons from Europe

Interestingly, when the International Association of Privacy Professionals (IAPP) surveyed expert lawyers on data portability in 2022, they said that data portability “rarely ever seems to be used by data subjects,” in stark contrast with the right to access. While this observation may bring some form of comfort, compliance with the Québec Act and the eventual adoption of the CPPA maintain the pressure to develop, now, the processes that will allow compliance with portability in Canada. The EDPB suggests some concrete operational measures to consider, as applicable:

• Update privacy notices to inform individuals of their right to portability, distinct from other individual rights.
• Inform individuals of their right to portability when they close an account.
• Adopt response mechanisms dedicated to requests for portability including authentication of the individual, which may already exist in relation to other rights.
• Seek confirmation of the request from the individual before transmitting the personal information. 
• Identify alternative means to transfer data to respond to varying requests.  
• Consider tools to facilitate portability such as download tools or direct transmission tools, Application Programming Interfaces, automatic extraction tools of relevant data, secure messaging, or enabling individuals ‘access to a “personal data store” or other personal information management systems.
• Adopt data security tools such as suspending or freezing transmission in the case of a suspicious data transfer.
• Develop interoperable formats.
• Adopt a receiving mechanism to ensure ported data is limited to what is necessary for the new purpose as well as returning or deleting mechanisms for unnecessary data.

For more information on this topic, please contact a member of the Privacy and Cybersecurity group in Canada.