11

Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, images, etc...

Most other companies (such as Insurance, Banks, etc) only allow exporting your data if you email/phone them with the request, not providing a way to do that through their website.

For social network websites to comply with GDPR, is there anything that says that they must provide a button to export user data, or is it enough to accept requests through emailing and the staff will securely send a PDF with the export?

Improve this question
2
  • 3
    Facebook has billions of users. Even if a really tiny percentage of users request their data, that would still be an overwhelming large amount of requests to manually handle.
    – NotThatGuy
    May 16, 2020 at 20:36
  • Yup! I thought that would be the reason, but wanted to confirm :)
    – Nuno
    May 18, 2020 at 8:16

2 Answers 2

Reset to default
12

In short, no.

Article 20 of the GDPR covers the “Right to data portability”, which essentially says two main things:

  1. The data subject had the right to an exported copy of their personal data in a common format

And

  1. The data subject has the right to have this data transmitted directly from one controller to another where technically feasible.

Neither of these rights as stated in the GDPR require the data controller to provide a button to initiate either a data export or a transfer to another controller.

Improve this answer
1
  • 3
    The data controller isn't even required to run a website or email :)
    – Hagen von Eitzen
    May 17, 2020 at 14:02
1

It's definitely enough to respond to requests the controller is sent - note this could be by any means, e.g. email, twitter if you operate an account, etc. The controller would still need to do appropriate identity checks.

However a PDF isn't a suitable response to a data portability request. The format must be commonly-used, machine-readable and interoperable. Something like CSV, JSON, XML. A PDF, that would at a minimum require scraping to extract the data in a reusable form, would not meet the requirements.

Improve this answer
2
  • 2
    The GDPR doesn't say that the format used must be "interoperable" or enable "interoperability" - the exact phrase used is: "a structured, commonly used and machine-readable format". PDF can be, (while not perfect for interoperability), structured, commonly used and machine readable. PDF, while not fulfilling the intent of the portability spirit, could fulfil Article 20 just fine.
    – user28517
    May 17, 2020 at 21:29
  • @Moo "Interoperable" is in the pre-amble (see recital 68). There are also some guidelines issued by the Commission before GDPR came into effect here that explicitly suggest CSV, JSON and XML if there's nothing more specific available for the given industry. The EU glossary, also explicitly defines terms like machine-readable. On a practical level, I've got my own national regulator (the ICO in the UK) to enforce the use of something other than PDF :-)
    – GS - Apologise to Monica
    May 18, 2020 at 6:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .