What does "structured, commonly used and machine-readable format" look like in practice?

Question

I have made a subject access request, and the result included:

• Statement that their right to process data is from Article 6(1)(b)
• A series of images, that appear to be photographs of a computer monitor, with my data displayed within some unrecognised application (presumably internal and/or proprietary software)

I have requested the data in a structured, commonly used and machine-readable format. They have responded saying screenshots are appropriate and they cannot do otherwise.

I am fairly sure what they provide is not consistent with Article 20(1). I note that article 20(2) includes "where technically feasible" but article 20(1) does not. However I am not at all sure what this would look like in practice. Is there any sources of information where extraction of data from a closed source application and provided to a data subject is further defined? Am I within my rights to insist on this, even if to comply they would have to do some software development? Assuming there is a database underlying the application I would expect it to be a DDL of the database structure, and the relevant insert statements. However this is likely to be very difficult to provide if it is a closed source proprietary application.

Answer 1

Is there any sources of information where extraction of data from a closed source application and provided to a data subject is further defined?

No, the GDPR is based on "general principles" and does not concern itself with implementation details for such matters. It's possible there's EU case law on this, but I can't find any.

Am I within my rights to insist on this, even if to comply they would have to do some software development?

Yes you can demand it, but they don't have to comply with your demand. The information only has to be provided in a "concise, intelligible and easily accessible form, using clear and plain language." and they only have to provide the information electronically where "reasonably practical" to do so, and they only have to take "reasonable steps" to do all this per Section 52 of the Data Protection Act 2018 which implements GDPR into UK law.

You can complain to the Information Commissioner's Office, and they will decide if Section 52 has been complied with or not.

52 Form of provision of information etc

(1) The controller must take reasonable steps to ensure that any information that is required by this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language.

(2) Subject to subsection (3), the information may be provided in any form, including electronic form.

(3) Where information is provided in response to a request by the data subject under [the Right of access by the data subject], the controller must provide the information in the same form as the request where it is practicable to do so.

Answer 2

The GDPR Art 20 right to data portability is distinct from the Art 15 right to access, although there is some overlap.

The right to data portability likely applies here because processing is performed using automated means, but you're only entitled to a machine-readable copy of data that you provided. For example, this would require a social media service to give me a machine-readable copy of my posts and likes, but would not require a credit rating bureau to give me machine-readable data that they received on me from third parties. The used format merely has to be structured and commonly used. Unless there's a standard format in that particular industry, any machine-readable format such as XML, CSV, JSON, or maybe even HTML will do.

The right to access does not entitle you to a machine-readable copy, merely to a copy of the data. Per Art 12, they should respond in a “concise, transparent, intelligible and easily accessible form, using clear and plain language”.

The GDPR allows data subject requests to be rejected only when the request is “manifestly unfounded or excessive”, for which the data controller would have the burden of proof. This is intended to be able to turn down requests that are only intended to harass the data controller, but not to turn down requests that are costly for the data controller to fulfil. Compliance is the data controller's job. However, the data controller could perhaps ask the request to be clarified, e.g. from “give me ALL your data on me” to “give me access to your data on me in your CRM system”.

I think that photographs of a computer monitor fall likely short of being a “intelligible and easily accessible form”, but not necessarily so. High-quality screenshots that are reasonably easy to read might be fine. In itself, the GDPR has no explicit accessibility requirements that e.g. account for people with impaired vision, though national laws might. An image format might also be needed to reliably redact other people's personal data.

But given that this is likely not compliant with GDPR Art 12/Art 15 and that there's a fundamental disagreement between you and the data controller, lodging a complaint with your data protection agency would be a sensible next step. Per Art 15(1)(f) the data controller should have informed you of this right to make a complaint :)