Technology Governance Wiki - User contributions [en]

Data Portability (USA)

2026-10-08T22:37:29Z

Kayembe Rodrigue:

=== Definition ===

According to the Cambridge Dictionary, [https://dictionary.cambridge.org/dictionary/english/portability portability] refers to “the ability to be used for a different purpose or on a different system”. Data portability (DP) can essentially boil down to an individual’s ability to move personal data from one service to another or to themselves. On top of DP conferring control to individuals over their data and [https://www.eff.org/deeplinks/2018/09/what-we-mean-when-we-say-data-portability depending on the context and platform], it can also nurture competition between service providers by clearing paths for dynamic of choice whilst lowering barriers for new providers.

In this analysis, we will address the way in which DP is regulated in the United States, both at a federal and state level. Subsequently, we will analyse some of the main effects of its regulation (or lack thereof), to finalise with a comparison with its counterparty in the EU.


=== US Overview ===

The extent to which data portability is recognised varies considerably in the US. At one level, the right may simply entitle individuals to receive their data in a format that meets specific requirements, such as a portable and readily usable format. A second level goes a step further by imposing an obligation of direct transfer on the service provider; this obligation has not been comprehensively legislated at federal level in the US.

Instead, the underlying legal framework of DP is a patchwork of state statuses and sector-specific regulations. [https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf Health Insurance Portability and Accountability Act, 1996 (HIPAA)] is an example of the latter. Initially, the [https://www.govinfo.gov/content/pkg/FR-2000-12-28/pdf/00-32678.pdf Privacy Rule 2000] provided only for the access to data with no element of portability attached. The [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act 2009] then augmented HIPPA with a portability aspect: under [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf §13405(e)], and codified at [https://www.law.cornell.edu/uscode/text/42/17935 42 U.S.C. §17935(e)], fulfilling a data request in a given format became a right for the individual and an obligation on the provider. More recently the [https://www.govinfo.gov/content/pkg/PLAW-114publ255/pdf/PLAW-114publ255.pdf Cures Act 2016] introduced an infrastructure-layer requirement to enable true data portability and enforcement avenue with [https://www.law.cornell.edu/uscode/text/42/300jj-52 information blocking ban] aspect.

The finance industry attempted making similar strides by way of [https://www.govinfo.gov/content/pkg/PLAW-111publ203/pdf/PLAW-111publ203.pdf Dodd-Frank Act, Pub. L. 111-203] as codified under [https://www.law.cornell.edu/uscode/text/12/5533 12 U.S.C. §5533]. However, this has been stalled with an [https://infobytes.orrick.com/wp-content/uploads/2025-10-29-Order-Granting-Injunction-1.pdf injunction] due to contention on who exactly this right is conferred to and who should bear the cost. Federally, other sectoral statutes grant individuals a right of access to data held about them. The [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act] is one example: it obliges consumer reporting agencies to disclose [https://www.law.cornell.edu/uscode/text/15/1681g “''all information in the consumer’s file''”], but only “''in writing''” by default, with electronic disclosure made available where a consumer authorises it and the agency [https://www.law.cornell.edu/uscode/text/15/1681h offers] it. It imposes no specific format requirement and grants no right of direct transfer to third parties.

Despite the lack of a comprehensive federal privacy that encompasses DP, [https://privacylawmap.com/blog/how-many-states-have-data-privacy-laws several states] have adopted general data protection and privacy laws, including: California, Virginia, Colorado, Connecticut, Utah. For the purpose of this, we will be focusing on the regulation of California and Utah.

We have chosen California as:

* It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 ''dark horse contender'']” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states; 
* It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the ''‘‘[https://archive.org/details/tradingupconsume0000voge California effect’]’''.

As for Utah, its selection stems from the contrast it presents:

* Its [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022] (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy [https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report] in comparison to California’s leading score of 69/100; 
* Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by “technically feasible” and “practicable”; 
* Yet, through the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025] (DCA), it became the first US state to require social media platforms to provide [https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability] through open protocols.


=== California ===

[http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5 California Consumer Privacy Act (CCPA)] is a regulation that modified California’s Civil Code, incorporating several data protection provisions in the context of consumer relations.

To begin with, section [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.110 § 1798.110(b)] states that “''a business that collects personal information about a consumer shall disclose to the consumer, pursuant to subparagraph (B) of paragraph (3) of subdivision (a) of [https://1.next.westlaw.com/Link/Document/FullText?findType=L&originatingContext=document&transitionType=DocumentItem&pubNum=1000200&refType=SP&originatingDoc=I911c51d0009711f1a766b53df0bebe74&cite=CACIS1798.130 Section 1798.130], the information specified in subdivision (a) upon receipt of a verifiable consumer request from the consumer''”. To comply with this obligation, section [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.130 §1798.130(a)(3)(B)(iii)] adds that the business shall ''“Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumer’s request without hindrance. “Specific pieces of information” do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumer’s personal information from one business to another in the context of switching services''”.

It is worth mentioning that, under the CCPA, data portability is mainly considered as a format requirement of the business obligation if consumers exercise their access rights pursuant to section [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.110 § 1798.110(b)]. This has direct effects for reporting obligations. As stated in Section [https://www.law.cornell.edu/regulations/california/11-CCR-7102 § 7102], businesses that process personal information of 10,000,000 or more consumers in a calendar year shall compile the metrics on the number of “requests to know” that the business received, complied with in whole or in part, and denied.

Thus, while businesses are indeed required to disclose metrics on the amount of access request received during the year, they are not obliged to disclose the format in which these were delivered, nor if the consumer is required to port the data to a different business. Out of several business reports from 2025, we were only able to identify that Cisco voluntarily provided information on data portability, indicating that they received “[https://www.cisco.com/c/en/us/about/legal/ccpa-metrics-report.html 21 extra requests]” (which include types of Port Data, Subprocessor Disclosures, and Restrict Auto Decision). This starkly contrasts with the total of 731 requests to know during the same year, which could signal an underuse of data portability rights.


=== Utah ===

[https://le.utah.gov/~2022/bills/static/SB0227.html UCPA] entered into effect in December, 2023. Consumers are conferred portability rights via [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer’s personal data, that the consumer previously provided to the controller, in a format that: 
(a) to the extent technically feasible, is portable; 
(b) to the extent practicable, is readily usable; and 
(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.

There has not been much effort to further define technologically natural ‘Readily usable’, ‘to the extent practicable’ and ‘without impediment’ under UCPA. Similar to [https://dl.acm.org/doi/epdf/10.1145/3267305.3274152 GDPR] the lack of specificity here results in a wide array of inconsistent results.

Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266] that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code [https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4]).

Utah lead the charge introducing the [https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind] legislation amongst states requiring social media platforms to provide interoperability through open protocols under the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act] (UDCA), enacted in 2025, and whose section [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201] outlines that “''If a consumer requests a copy of the consumer’s personal data under [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html Section 13-61-201], a social media service shall provide the personal data, including the user’s social graph, in a format that:'' 
''(1) is portable, to the extent technically feasible;'' 
''(2) is readily usable, to the extent practicable; and'' 
''(3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.

Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of [https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA] deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy [https://www.transunion.com/ccpa-metrics data] suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.


=== Landscape Impact ===

The World Wide Web movement sought to allow free flow and access to data to all, built on liberalist ideologies. Contrarily, the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users - creating a new power dynamic with data. The Right to Data Portability (RTDP) was established by the GDPR as a solution to empower individuals to attain data sovereignty and regulate competition in the market, ultimately resulting in innovation and platform dependency. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “[https://www.oecd.org/en/publications/mapping-data-portability-initiatives-opportunities-and-challenges_a6edfab2-en.html Privacy-Innovation Paradox]”.

“RTDP stems from technical codification and trust governance rather than legal codification”.

* Dependence and the lack of appropriate infrastructures 
* Need for sector-specific standardisation 
* ever-changing nature of the regulatory subject in a digital world;

makes it hard to implement data portability efficiently.


==== Case study: Vehicle Data Access ====

The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law ([https://en.wikipedia.org/wiki/Motor_Vehicle_Owners%27_Right_to_Repair_Act Right to Repair]) which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access as it could lead to vulnerabilities and possibly hacking (access to the steering and brake systems); with reference to the federal [https://www.dhs.gov/science-and-technology/safety-act Safety Act].


==== Influence of hyperscaler in the United States: ====

When we discuss personal data transfer in a digital space, cloud computing stands as critical infrastructure. The GDPR prescribes for the “free of charge” rules ([https://gdpr-info.eu/art-12-gdpr/ Article 12(5)] for access requests, [https://gdpr-info.eu/art-20-gdpr/ Article 20] for portability) for transfer of personal data. However, its limited application extends to the '''controller''' in relation to the '''data subject, exempting''' cloud vendors. Currently, the US hyperscalers - namely Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares in the cloud computing space and have also well integrated themselves into multiple layers of the AI stack, serving several core functions through their subsidiaries. Due to the scale of investment required and the high barriers of entry, a non-competitive market is created making it hard for meaningful participation and innovations from new entrants.

Data portability is recommended as a solution to break such monopolistic tendencies, however, does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. While some hyperscalers do allow portability services, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of [https://windowsforum.com/news/azure-cloud-exit-fees-are-falling-but-microsoft-licensing-and-portability-still-block-switching.447160/ Microsoft increasing licensing cost] if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 cloud systems].


=== EU Comparison ===

The modern US data portability framework has been influenced, though not determined, by the EU’s GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time.

We have mainly explored data portability via the lens of consumers and personal data. The EU has taken note of this and addressed it via [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]. The US lacks an equivalent to the Data Act’s switching provisions. US businesses have nonetheless benefited indirectly, as AWS, Microsoft and Google waived exit egress fees globally in 2024 ahead of the Data Act’s obligations, exemplifying the Brussels effect.

Finally, Utah has illustrated that there’s scope to go beyond GDPR. By extending portability to the social graph and requiring interoperability through open protocols, the DCA targets the network effects that make switching platforms costly, an issue Article 20 GDPR does not reach.


=== Conclusion ===

Data portability does not tackle code architectural differences, security, or high switching costs. Beyond these technical barriers, company practices and commercial interests play a major role in product design. Together, these factors reinforce the established [https://research-portal.st-andrews.ac.uk/en/publications/how-portable-is-portable-exercising-the-gdprs-right-to-data-porta/ status quo] in which portable data is not, in practice, very portable. This analysis has shown that, although the US defines the right to portability less comprehensively and less broadly than the EU, its use remains minimal on both sides.

Data Portability (USA)

2026-10-08T20:31:03Z

Kayembe Rodrigue: /* Definition */

=== Definition ===

According to the Cambridge Dictionary, [https://dictionary.cambridge.org/dictionary/english/portability portability] refers to “the ability to be used for a different purpose or on a different system”. Data portability (DP) can essentially boil down to an individual’s ability to move personal data from one service to another or to themselves. On top of DP conferring control to individuals over their data and [https://www.eff.org/deeplinks/2018/09/what-we-mean-when-we-say-data-portability depending on the context and platform], it can also nurture competition between service providers by clearing paths for dynamic of choice whilst lowering barriers for new providers.

In this analysis, we will address the way in which DP is regulated in the United States, both at a federal and state level. Subsequently, we will analyze some of the main effects of its regulation (or lack thereof), to finalise with a comparison with its counterparty in the EU.



=== US Overview ===

The extent to which data portability is recognised varies considerably in the US. At one level, the right may simply entitle individuals to receive their data in a format that meets specific requirements, such as a portable and readily usable format. A second level goes a step further by imposing an obligation of direct transfer on the service provider; this obligation has not been comprehensively legislated at federal level in the US.

Instead, the underlying legal framework of DP is a patchwork of state statuses and sector-specific regulations. [https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf Health Insurance Portability and Accountability Act, 1996 (HIPAA)] is an example of the latter. Initially, the [https://www.govinfo.gov/content/pkg/FR-2000-12-28/pdf/00-32678.pdf Privacy Rule 2000] provided only for the access to data with no element of portability attached. The [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act 2009] then augmented HIPPA with a portability aspect: under [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf §13405(e)], and codified at [https://www.law.cornell.edu/uscode/text/42/17935 42 U.S.C. §17935(e)], fulfilling a data request in a given format became a right for the individual and an obligation on the provider. More recently the [https://www.govinfo.gov/content/pkg/PLAW-114publ255/pdf/PLAW-114publ255.pdf Cures Act 2016] introduced an infrastructure-layer requirement to enable true data portability and enforcement avenue with [https://www.law.cornell.edu/uscode/text/42/300jj-52 information blocking ban] aspect.

The finance industry attempted making similar strides by way of [https://www.govinfo.gov/content/pkg/PLAW-111publ203/pdf/PLAW-111publ203.pdf Dodd-Frank Act, Pub. L. 111-203] as codified under [https://www.law.cornell.edu/uscode/text/12/5533 12 U.S.C. §5533]. However, this has been stalled with an [https://infobytes.orrick.com/wp-content/uploads/2025-10-29-Order-Granting-Injunction-1.pdf injunction] due to contention on who exactly this right is conferred to and who should bear the cost. Federally, other sectoral statutes grant individuals a right of access to data held about them. The [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act] is one example: it obliges consumer reporting agencies to disclose [https://www.law.cornell.edu/uscode/text/15/1681g “''all information in the consumer’s file''”], but only “''in writing''” by default, with electronic disclosure made available where a consumer authorises it and the agency [https://www.law.cornell.edu/uscode/text/15/1681h offers] it. It imposes no specific format requirement and grants no right of direct transfer to third parties.

Despite the lack of a comprehensive federal privacy that encompasses DP, [https://privacylawmap.com/blog/how-many-states-have-data-privacy-laws several states] have adopted general data protection and privacy laws, including: California, Virginia, Colorado, Connecticut, Utah. For the purpose of this presentation, we will be focusing on the regulation of California and Utah.

We have chosen California as:

* It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 ''dark horse contender'']” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states; 
* It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the ''‘‘[https://archive.org/details/tradingupconsume0000voge California effect’]’''.

As for Utah, its selection stems from the contrast it presents:

* Its [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022] (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy [https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report] in comparison to California’s leading score of 69/100; 
* Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by “technically feasible” and “practicable”; 
* Yet, through the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025] (DCA), it became the first US state to require social media platforms to provide [https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability] through open protocols.


=== California ===

[http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5 California Consumer Privacy Act (CCPA)] is a regulation that modified California’s Civil Code, incorporating several data protection provisions in the context of consumer relations.

To begin with, section § 1798.110(b) states that “''a business that collects personal information about a consumer shall disclose to the consumer, pursuant to [https://1.next.westlaw.com/Link/Document/FullText?findType=L&originatingContext=document&transitionType=DocumentItem&pubNum=1000200&refType=SP&originatingDoc=I911c51d0009711f1a766b53df0bebe74&cite=CACIS1798.130 subparagraph (B) of paragraph (3) of subdivision (a) of Section 1798.130], the information specified in subdivision (a) upon receipt of a verifiable consumer request from the consumer''”. To comply with this obligation, section §1798.130(a)(3)(B)(iii) adds that the business shall ''“Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumer’s request without hindrance. “Specific pieces of information” do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumer’s personal information from one business to another in the context of switching services''”.

It is worth mentioning that, under the CCPA, data portability is mainly considered as a format requirement of the business obligation if consumers exercise their access rights pursuant to section § 1798.110(b). This has direct effects for reporting obligations. As stated in Section § 7102, businesses that process personal information of 10,000,000 or more consumers in a calendar year shall compile the metrics on the number of “requests to know” that the business received, complied with in whole or in part, and denied. Thus, while businesses are indeed required to disclose metrics on the amount of access request received during the year, they are not obliged to disclose the format in which these were delivered, nor if the consumer is required to port the data to a different business. Out of several business reports from 2025, we were only able to identify that Cisco voluntarily provided information on data portability, indicating that they received “[https://www.cisco.com/c/en/us/about/legal/ccpa-metrics-report.html 21 extra requests]” (which include types of Port Data, Subprocessor Disclosures, and Restrict Auto Decision). This starkly contrasts with the total of 731 requests to know during the same year, which could signal an underuse of data portability rights.


=== Utah ===

[https://le.utah.gov/~2022/bills/static/SB0227.html UCPA] entered into effect in December, 2023. Consumers are conferred portability rights via [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer’s personal data, that the consumer previously provided to the controller, in a format that: 
(a) to the extent technically feasible, is portable; 
(b) to the extent practicable, is readily usable; and 
(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.

There has not been much effort to further define technologically natural ‘Readily usable’, ‘to the extent practicable’ and ‘without impediment’ under UCPA. Similar to [https://dl.acm.org/doi/epdf/10.1145/3267305.3274152 GDPR] the lack of specificity here results in a wide array of inconsistent results.

Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266] that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code [https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4]).

Utah lead the charge introducing the [https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind] legislation amongst states requiring social media platforms to provide interoperability through open protocols under the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act] (UDCA), enacted in 2025, and whose section [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201] outlines that “''If a consumer requests a copy of the consumer’s personal data under Section 13-61-201, a social media service shall provide the personal data, including the user’s social graph, in a format that: (1) is portable, to the extent technically feasible; (2) is readily usable, to the extent practicable; and (3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.

Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of [https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA] deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy [https://www.transunion.com/ccpa-metrics data] suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.


=== Landscape Impact ===

The World Wide Web movement sought to allow free flow and access to data to all, built on liberalist ideologies. Contrarily, the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users - creating a new power dynamic with data. The Right to Data Portability (RTDP) was established by the GDPR as a solution to empower individuals to attain data sovereignty and regulate competition in the market, ultimately resulting in innovation and platform dependency. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox’.[https://doi.org/10.1093/qje/ (2)]

“RTDP stems from technical codification and trust governance rather than legal codification”.

* Dependence and the lack of appropriate infrastructures 
* Need for sector-specific standardisation 
* ever-changing nature of the regulatory subject in a digital world;

makes it hard to implement data portability efficiently.

'''Case study: Vehicle Data Access'''

The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) [https://en.wikipedia.org/wiki/Motor_Vehicle_Owners%27_Right_to_Repair_Act (3)] which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access as it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.[https://www.dhs.gov/science-and-technology/safety-act (4)]

'''Influence of hyperscaler in the United States:'''

When we discuss personal data transfer in a digital space, cloud computing stands as critical infrastructure. The GDPR prescribes for the “free of charge” rules ([https://gdpr-info.eu/art-12-gdpr/ Article 12(5)] for access requests, [https://gdpr-info.eu/art-20-gdpr/ Article 20] for portability) for transfer of personal data. However, its limited application extends to the '''controller''' in relation to the '''data subject, exempting''' cloud vendors. Currently, the US hyperscalers - namely Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares in the cloud computing space and have also well integrated themselves into multiple layers of the AI stack, serving several core functions through their subsidiaries. Due to the scale of investment required and the high barriers of entry, a non-competitive market is created making it hard for meaningful participation and innovations from new entrants.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (5)]

Data portability is recommended as a solution to break such monopolistic tendencies, however, does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. While some hyperscalers do allow portability services, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of [https://windowsforum.com/news/azure-cloud-exit-fees-are-falling-but-microsoft-licensing-and-portability-still-block-switching.447160/ Microsoft increasing licensing cost] if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)]

The US’ reliance on a patchwork of state statuses rather than a comprehensive federal privacy and data protection framework to regulate DP has had mixed results. An alliance of businesses have aligned to [https://itif.org/publications/2022/01/24/looming-cost-patchwork-state-privacy-laws/ report] that this patchwork could likely create duplicate compliance costs exceeding $1 trillion over 10 years, with small businesses bearing around $20–23 billion annually. States such as Utah have legislated with this in mind with revenue requirements. The Right to Data Portability (RTDP) largely depends on the type of data and where the consumer lives. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox’.[https://doi.org/10.1093/qje/ (2)]

Case study: Vehicle Data Access

The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) (3) which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.(4)

'''Influence of hyperscale establishment concentration in the United States:'''

The World Wide Web movement sought to allow free movement and access of data to all, built on liberalist ideologies, but the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users. Utah has led the charge on tackling this with UDCA, however the impact is still unknown at this stage.

“RTDP stems from technical codification and trust governance rather than legal codification”.

* Dependence and the lack of appropriate infrastructures 
* Need for sector-specific standardisation 
* ever-changing nature of the regulatory subject in a digital world;

makes it hard to implement data portability efficiently.

Data portability does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. All these facts feed into the established [https://research-portal.st-andrews.ac.uk/en/publications/how-portable-is-portable-exercising-the-gdprs-right-to-data-porta/ status quo] of portability not being highly portable.

We have mainly explored data portability via the lens of consumers and personal data. A gap that is prevalent for the right of businesses to port from one hyperscaler to another. This is particularly interesting as Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares and subsequently [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 influence] globally. The EU has taken note of this and addressed it via [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]. In doing so hyperscalers have begun enabling portability services globally as a side effect, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of Microsoft increasing licensing cost if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)]


=== EU Comparison ===

The modern US data portability framework has been influenced, though not determined, by the EU’s GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time.

Data Portability (USA)

2026-10-08T20:19:38Z

Kayembe Rodrigue:

=== Definition ===

According to the Cambridge Dictionary, [https://dictionary.cambridge.org/dictionary/english/portability portability] refers to “the ability to be used for a different purpose or on a different system”. Data portability (DP) can essentially boil down to an individual’s ability to move personal data from one service to another or to themselves. On top of DP conferring control to individuals over their data and [https://www.eff.org/deeplinks/2018/09/what-we-mean-when-we-say-data-portability depending on the context and platform], it can also nurture competition between service providers by clearing paths for dynamic of choice whilst lowering barriers for new providers.

In this presentation, we will address the way in which DP is regulated in the United States, both at a federal and state level. Subsequently, we will analyze some of the main effects of its regulation (or lack thereof), to finalize with a comparison with its counterparty in the EU.


=== US Overview ===

The extent to which data portability is recognised varies considerably in the US. At one level, the right may simply entitle individuals to receive their data in a format that meets specific requirements, such as a portable and readily usable format. A second level goes a step further by imposing an obligation of direct transfer on the service provider; this obligation has not been comprehensively legislated at federal level in the US.

Instead, the underlying legal framework of DP is a patchwork of state statuses and sector-specific regulations. [https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf Health Insurance Portability and Accountability Act, 1996 (HIPAA)] is an example of the latter. Initially, the [https://www.govinfo.gov/content/pkg/FR-2000-12-28/pdf/00-32678.pdf Privacy Rule 2000] provided only for the access to data with no element of portability attached. The [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act 2009] then augmented HIPPA with a portability aspect: under [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf §13405(e)], and codified at [https://www.law.cornell.edu/uscode/text/42/17935 42 U.S.C. §17935(e)], fulfilling a data request in a given format became a right for the individual and an obligation on the provider. More recently the [https://www.govinfo.gov/content/pkg/PLAW-114publ255/pdf/PLAW-114publ255.pdf Cures Act 2016] introduced an infrastructure-layer requirement to enable true data portability and enforcement avenue with [https://www.law.cornell.edu/uscode/text/42/300jj-52 information blocking ban] aspect.

The finance industry attempted making similar strides by way of [https://www.govinfo.gov/content/pkg/PLAW-111publ203/pdf/PLAW-111publ203.pdf Dodd-Frank Act, Pub. L. 111-203] as codified under [https://www.law.cornell.edu/uscode/text/12/5533 12 U.S.C. §5533]. However, this has been stalled with an [https://infobytes.orrick.com/wp-content/uploads/2025-10-29-Order-Granting-Injunction-1.pdf injunction] due to contention on who exactly this right is conferred to and who should bear the cost. Federally, other sectoral statutes grant individuals a right of access to data held about them. The [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act] is one example: it obliges consumer reporting agencies to disclose [https://www.law.cornell.edu/uscode/text/15/1681g “''all information in the consumer’s file''”], but only “''in writing''” by default, with electronic disclosure made available where a consumer authorises it and the agency [https://www.law.cornell.edu/uscode/text/15/1681h offers] it. It imposes no specific format requirement and grants no right of direct transfer to third parties.

Despite the lack of a comprehensive federal privacy that encompasses DP, [https://privacylawmap.com/blog/how-many-states-have-data-privacy-laws several states] have adopted general data protection and privacy laws, including: California, Virginia, Colorado, Connecticut, Utah. For the purpose of this presentation, we will be focusing on the regulation of California and Utah.

We have chosen California as:

* It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 ''dark horse contender'']” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states; 
* It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the ''‘‘[https://archive.org/details/tradingupconsume0000voge California effect’]’''.

As for Utah, its selection stems from the contrast it presents:

* Its [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022] (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy [https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report] in comparison to California’s leading score of 69/100; 
* Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by “technically feasible” and “practicable”; 
* Yet, through the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025] (DCA), it became the first US state to require social media platforms to provide [https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability] through open protocols.


=== California ===

[http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5 California Consumer Privacy Act (CCPA)] is a regulation that modified California’s Civil Code, incorporating several data protection provisions in the context of consumer relations.

To begin with, section § 1798.110(b) states that “''a business that collects personal information about a consumer shall disclose to the consumer, pursuant to [https://1.next.westlaw.com/Link/Document/FullText?findType=L&originatingContext=document&transitionType=DocumentItem&pubNum=1000200&refType=SP&originatingDoc=I911c51d0009711f1a766b53df0bebe74&cite=CACIS1798.130 subparagraph (B) of paragraph (3) of subdivision (a) of Section 1798.130], the information specified in subdivision (a) upon receipt of a verifiable consumer request from the consumer''”. To comply with this obligation, section §1798.130(a)(3)(B)(iii) adds that the business shall ''“Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumer’s request without hindrance. “Specific pieces of information” do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumer’s personal information from one business to another in the context of switching services''”.

It is worth mentioning that, under the CCPA, data portability is mainly considered as a format requirement of the business obligation if consumers exercise their access rights pursuant to section § 1798.110(b). This has direct effects for reporting obligations. As stated in Section § 7102, businesses that process personal information of 10,000,000 or more consumers in a calendar year shall compile the metrics on the number of “requests to know” that the business received, complied with in whole or in part, and denied. Thus, while businesses are indeed required to disclose metrics on the amount of access request received during the year, they are not obliged to disclose the format in which these were delivered, nor if the consumer is required to port the data to a different business. Out of several business reports from 2025, we were only able to identify that Cisco voluntarily provided information on data portability, indicating that they received “[https://www.cisco.com/c/en/us/about/legal/ccpa-metrics-report.html 21 extra requests]” (which include types of Port Data, Subprocessor Disclosures, and Restrict Auto Decision). This starkly contrasts with the total of 731 requests to know during the same year, which could signal an underuse of data portability rights.


=== Utah ===

[https://le.utah.gov/~2022/bills/static/SB0227.html UCPA] entered into effect in December, 2023. Consumers are conferred portability rights via [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer’s personal data, that the consumer previously provided to the controller, in a format that: 
(a) to the extent technically feasible, is portable; 
(b) to the extent practicable, is readily usable; and 
(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.

There has not been much effort to further define technologically natural ‘Readily usable’, ‘to the extent practicable’ and ‘without impediment’ under UCPA. Similar to [https://dl.acm.org/doi/epdf/10.1145/3267305.3274152 GDPR] the lack of specificity here results in a wide array of inconsistent results.

Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266] that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code [https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4]).

Utah lead the charge introducing the [https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind] legislation amongst states requiring social media platforms to provide interoperability through open protocols under the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act] (UDCA), enacted in 2025, and whose section [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201] outlines that “''If a consumer requests a copy of the consumer’s personal data under Section 13-61-201, a social media service shall provide the personal data, including the user’s social graph, in a format that: (1) is portable, to the extent technically feasible; (2) is readily usable, to the extent practicable; and (3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.

Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of [https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA] deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy [https://www.transunion.com/ccpa-metrics data] suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.


=== Landscape Impact ===

The World Wide Web movement sought to allow free flow and access to data to all, built on liberalist ideologies. Contrarily, the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users - creating a new power dynamic with data. The Right to Data Portability (RTDP) was established by the GDPR as a solution to empower individuals to attain data sovereignty and regulate competition in the market, ultimately resulting in innovation and platform dependency. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox’.[https://doi.org/10.1093/qje/ (2)]

“RTDP stems from technical codification and trust governance rather than legal codification”.

* Dependence and the lack of appropriate infrastructures 
* Need for sector-specific standardisation 
* ever-changing nature of the regulatory subject in a digital world;

makes it hard to implement data portability efficiently.

'''Case study: Vehicle Data Access'''

The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) [https://en.wikipedia.org/wiki/Motor_Vehicle_Owners%27_Right_to_Repair_Act (3)] which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access as it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.[https://www.dhs.gov/science-and-technology/safety-act (4)]

'''Influence of hyperscaler in the United States:'''

When we discuss personal data transfer in a digital space, cloud computing stands as critical infrastructure. The GDPR prescribes for the “free of charge” rules ([https://gdpr-info.eu/art-12-gdpr/ Article 12(5)] for access requests, [https://gdpr-info.eu/art-20-gdpr/ Article 20] for portability) for transfer of personal data. However, its limited application extends to the '''controller''' in relation to the '''data subject, exempting''' cloud vendors. Currently, the US hyperscalers - namely Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares in the cloud computing space and have also well integrated themselves into multiple layers of the AI stack, serving several core functions through their subsidiaries. Due to the scale of investment required and the high barriers of entry, a non-competitive market is created making it hard for meaningful participation and innovations from new entrants.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (5)]

Data portability is recommended as a solution to break such monopolistic tendencies, however, does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. While some hyperscalers do allow portability services, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of [https://windowsforum.com/news/azure-cloud-exit-fees-are-falling-but-microsoft-licensing-and-portability-still-block-switching.447160/ Microsoft increasing licensing cost] if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)]

The US’ reliance on a patchwork of state statuses rather than a comprehensive federal privacy and data protection framework to regulate DP has had mixed results. An alliance of businesses have aligned to [https://itif.org/publications/2022/01/24/looming-cost-patchwork-state-privacy-laws/ report] that this patchwork could likely create duplicate compliance costs exceeding $1 trillion over 10 years, with small businesses bearing around $20–23 billion annually. States such as Utah have legislated with this in mind with revenue requirements. The Right to Data Portability (RTDP) largely depends on the type of data and where the consumer lives. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox’.[https://doi.org/10.1093/qje/ (2)]

Case study: Vehicle Data Access

The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) (3) which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.(4)

'''Influence of hyperscale establishment concentration in the United States:'''

The World Wide Web movement sought to allow free movement and access of data to all, built on liberalist ideologies, but the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users. Utah has led the charge on tackling this with UDCA, however the impact is still unknown at this stage.

“RTDP stems from technical codification and trust governance rather than legal codification”.

* Dependence and the lack of appropriate infrastructures 
* Need for sector-specific standardisation 
* ever-changing nature of the regulatory subject in a digital world;

makes it hard to implement data portability efficiently.

Data portability does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. All these facts feed into the established [https://research-portal.st-andrews.ac.uk/en/publications/how-portable-is-portable-exercising-the-gdprs-right-to-data-porta/ status quo] of portability not being highly portable.

We have mainly explored data portability via the lens of consumers and personal data. A gap that is prevalent for the right of businesses to port from one hyperscaler to another. This is particularly interesting as Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares and subsequently [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 influence] globally. The EU has taken note of this and addressed it via [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]. In doing so hyperscalers have begun enabling portability services globally as a side effect, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of Microsoft increasing licensing cost if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)]


=== EU Comparison ===

The modern US data portability framework has been influenced, though not determined, by the EU’s GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time.

Data Portability (USA)

2026-10-08T20:09:09Z

Kayembe Rodrigue:

<div>== Definition ==</div><div> </div><div>According to the Cambridge Dictionary, [https://dictionary.cambridge.org/dictionary/english/portability portability] refers to “the ability to be used for a different purpose or on a different system”. Data portability (DP) can essentially boil down to an individual’s ability to move personal data from one service to another or to themselves. On top of DP conferring control to individuals over their data and [https://www.eff.org/deeplinks/2018/09/what-we-mean-when-we-say-data-portability depending on the context and platform], it can also nurture competition between service providers by clearing paths for dynamic of choice whilst lowering barriers for new providers.</div><div> </div><div>In this presentation, we will address the way in which DP is regulated in the United States, both at a federal and state level. Subsequently, we will analyze some of the main effects of its regulation (or lack thereof), to finalize with a comparison with its counterparty in the EU.</div><div> </div><div>== US Overview ==</div><div> </div><div>The extent to which data portability is recognised varies considerably in the US. At one level, the right may simply entitle individuals to receive their data in a format that meets specific requirements, such as a portable and readily usable format. A second level goes a step further by imposing an obligation of direct transfer on the service provider; this obligation has not been comprehensively legislated at federal level in the US.</div><div> </div><div>Instead, the underlying legal framework of DP is a patchwork of state statuses and sector-specific regulations. [https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf Health Insurance Portability and Accountability Act, 1996 (HIPAA)] is an example of the latter. Initially, the [https://www.govinfo.gov/content/pkg/FR-2000-12-28/pdf/00-32678.pdf Privacy Rule 2000] provided only for the access to data with no element of portability attached. The [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act 2009] then augmented HIPPA with a portability aspect: under [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf §13405(e)], and codified at [https://www.law.cornell.edu/uscode/text/42/17935 42 U.S.C. §17935(e)], fulfilling a data request in a given format became a right for the individual and an obligation on the provider. More recently the [https://www.govinfo.gov/content/pkg/PLAW-114publ255/pdf/PLAW-114publ255.pdf Cures Act 2016] introduced an infrastructure-layer requirement to enable true data portability and enforcement avenue with [https://www.law.cornell.edu/uscode/text/42/300jj-52 information blocking ban] aspect.</div><div> </div><div>The finance industry attempted making similar strides by way of [https://www.govinfo.gov/content/pkg/PLAW-111publ203/pdf/PLAW-111publ203.pdf Dodd-Frank Act, Pub. L. 111-203] as codified under [https://www.law.cornell.edu/uscode/text/12/5533 12 U.S.C. §5533]. However, this has been stalled with an [https://infobytes.orrick.com/wp-content/uploads/2025-10-29-Order-Granting-Injunction-1.pdf injunction] due to contention on who exactly this right is conferred to and who should bear the cost. Federally, other sectoral statutes grant individuals a right of access to data held about them. The [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act] is one example: it obliges consumer reporting agencies to disclose [https://www.law.cornell.edu/uscode/text/15/1681g “''all information in the consumer’s file''”], but only “''in writing''” by default, with electronic disclosure made available where a consumer authorises it and the agency [https://www.law.cornell.edu/uscode/text/15/1681h offers] it. It imposes no specific format requirement and grants no right of direct transfer to third parties.</div><div> </div><div>Despite the lack of a comprehensive federal privacy that encompasses DP, [https://privacylawmap.com/blog/how-many-states-have-data-privacy-laws several states] have adopted general data protection and privacy laws, including: California, Virginia, Colorado, Connecticut, Utah. For the purpose of this presentation, we will be focusing on the regulation of California and Utah.</div><div> </div><div>We have chosen California as:</div><div>* It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 ''dark horse contender'']” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states;</div><div>* It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the “[https://archive.org/details/tradingupconsume0000voge ''California effect'']”.</div><div> </div><div>As for Utah, its selection stems from the contrast it presents:</div><div>* Its [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022] (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy [https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report] in comparison to California’s leading score of 69/100;</div><div>* Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by "technically feasible" and "practicable";</div><div>* Yet, through the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025] (DCA), it became the first US state to require social media platforms to provide [https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability] through open protocols.</div><div> </div><div>== California ==</div><div> </div><div>[http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5 California Consumer Privacy Act (CCPA)] is a regulation that modified California’s Civil Code, incorporating several data protection provisions in the context of consumer relations.</div><div> </div><div>To begin with, section § 1798.110(b) states that “''a business that collects personal information about a consumer shall disclose to the consumer, pursuant to [https://1.next.westlaw.com/Link/Document/FullText?findType=L&originatingContext=document&transitionType=DocumentItem&pubNum=1000200&refType=SP&originatingDoc=I911c51d0009711f1a766b53df0bebe74&cite=CACIS1798.130 subparagraph (B) of paragraph (3) of subdivision (a) of Section 1798.130], the information specified in subdivision (a) upon receipt of a verifiable consumer request from the consumer''”. To comply with this obligation, section §1798.130(a)(3)(B)(iii) adds that the business shall “''Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumer’s request without hindrance. “Specific pieces of information” do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumer’s personal information from one business to another in the context of switching services''”.</div><div> </div><div>It is worth mentioning that, under the CCPA, data portability is mainly considered as a format requirement of the business obligation if consumers exercise their access rights pursuant to section § 1798.110(b). This has direct effects for reporting obligations. As stated in Section § 7102, businesses that process personal information of 10,000,000 or more consumers in a calendar year shall compile the metrics on the number of “requests to know” that the business received, complied with in whole or in part, and denied. Thus, while businesses are indeed required to disclose metrics on the amount of access request received during the year, they are not obliged to disclose the format in which these were delivered, nor if the consumer is required to port the data to a different business. Out of several business reports from 2025, we were only able to identify that Cisco voluntarily provided information on data portability, indicating that they received “[https://www.cisco.com/c/en/us/about/legal/ccpa-metrics-report.html 21 extra requests]” (which include types of Port Data, Subprocessor Disclosures, and Restrict Auto Decision). This starkly contrasts with the total of 731 requests to know during the same year, which could signal an underuse of data portability rights.</div><div> </div><div>== Utah ==</div><div> </div><div>[https://le.utah.gov/~2022/bills/static/SB0227.html UCPA] entered into effect in December, 2023. Consumers are conferred portability rights via [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer's personal data, that the consumer previously provided to the controller, in a format that:</div><div>:(a) to the extent technically feasible, is portable;</div><div>:(b) to the extent practicable, is readily usable; and</div><div>:(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.</div><div> </div><div>There has not been much effort to further define technologically natural 'Readily usable', 'to the extent practicable' and 'without impediment' under UCPA. Similar to [https://dl.acm.org/doi/epdf/10.1145/3267305.3274152 GDPR] the lack of specificity here results in a wide array of inconsistent results.</div><div> </div><div>Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266] that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code [https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4)].</div><div> </div><div>Utah lead the charge introducing the [https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind] legislation amongst states requiring social media platforms to provide interoperability through open protocols under the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act] (UDCA), enacted in 2025, and whose section [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201] outlines that “''If a consumer requests a copy of the consumer's personal data under Section 13-61-201, a social media service shall provide the personal data, including the user's social graph, in a format that: (1) is portable, to the extent technically feasible; (2) is readily usable, to the extent practicable; and (3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.</div><div> </div><div>Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of [https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA] deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy [https://www.transunion.com/ccpa-metrics data] suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.</div><div> </div><div>== Landscape Impact ==</div><div> </div><div>The World Wide Web movement sought to allow free flow and access to data to all, built on liberalist ideologies. Contrarily, the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users - creating a new power dynamic with data. The Right to Data Portability (RTDP) was established by the GDPR as a solution to empower individuals to attain data sovereignty and regulate competition in the market, ultimately resulting in innovation and platform dependency. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox”.[https://doi.org/10.1093/qje/ (2)]</div><div> </div><div>“RTDP stems from technical codification and trust governance rather than legal codification”.</div><div>* Dependence and the lack of appropriate infrastructures</div><div>* Need for sector-specific standardisation</div><div>* ever-changing nature of the regulatory subject in a digital world;</div><div>makes it hard to implement data portability efficiently.</div><div> </div><div>=== Case study: Vehicle Data Access ===</div><div> </div><div>The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) [https://en.wikipedia.org/wiki/Motor_Vehicle_Owners%27_Right_to_Repair_Act (3)] which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access as it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.[https://www.dhs.gov/science-and-technology/safety-act (4)]</div><div> </div><div>=== Influence of hyperscaler in the United States ===</div><div> </div><div>When we discuss personal data transfer in a digital space, cloud computing stands as critical infrastructure. The GDPR prescribes for the "free of charge" rules ([https://gdpr-info.eu/art-12-gdpr/ Article 12(5)] for access requests, [https://gdpr-info.eu/art-20-gdpr/ Article 20] for portability) for transfer of personal data. However, its limited application extends to the '''controller''' in relation to the '''data subject, exempting''' cloud vendors. Currently, the US hyperscalers - namely Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares in the cloud computing space and have also well integrated themselves into multiple layers of the AI stack, serving several core functions through their subsidiaries. Due to the scale of investment required and the high barriers of entry, a non-competitive market is created making it hard for meaningful participation and innovations from new entrants.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (5)]</div><div> </div><div>Data portability is recommended as a solution to break such monopolistic tendencies, however, does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. While some hyperscalers do allow portability services, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of [https://windowsforum.com/news/azure-cloud-exit-fees-are-falling-but-microsoft-licensing-and-portability-still-block-switching.447160/ Microsoft increasing licensing cost] if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)]</div><div> </div><div>The US’ reliance on a patchwork of state statuses rather than a comprehensive federal privacy and data protection framework to regulate DP has had mixed results. An alliance of businesses have aligned to [https://itif.org/publications/2022/01/24/looming-cost-patchwork-state-privacy-laws/ report] that this patchwork could likely create duplicate compliance costs exceeding $1 trillion over 10 years, with small businesses bearing around $20–23 billion annually. States such as Utah have legislated with this in mind with revenue requirements. The Right to Data Portability (RTDP) largely depends on the type of data and where the consumer lives. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox”.[https://doi.org/10.1093/qje/ (2)]</div><div> </div><div>=== Case study: Vehicle Data Access ===</div><div> </div><div>The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) (3) which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.(4)</div><div> </div><div>=== Influence of hyperscale establishment concentration in the United States ===</div><div> </div><div>The World Wide Web movement sought to allow free movement and access of data to all, built on liberalist ideologies, but the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users. Utah has led the charge on tackling this with UDCA, however the impact is still unknown at this stage.</div><div> </div><div>“RTDP stems from technical codification and trust governance rather than legal codification”.</div><div>* Dependence and the lack of appropriate infrastructures</div><div>* Need for sector-specific standardisation</div><div>* ever-changing nature of the regulatory subject in a digital world;</div><div>makes it hard to implement data portability efficiently.</div><div> </div><div>Data portability does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. All these facts feed into the established [https://research-portal.st-andrews.ac.uk/en/publications/how-portable-is-portable-exercising-the-gdprs-right-to-data-porta/ status quo] of portability not being highly portable.</div><div> </div><div>We have mainly explored data portability via the lens of consumers and personal data. A gap that is prevalent for the right of businesses to port from one hyperscaler to another. This is particularly interesting as Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares and subsequently [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 influence] globally. The EU has taken note of this and addressed it via [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]. In doing so hyperscalers have begun enabling portability services globally as a side effect, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of Microsoft increasing licensing cost if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)]</div><div> </div><div>== EU Comparison ==</div><div> </div><div>The modern US data portability framework has been influenced, though not determined, by the EU's GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time.</div>

Data Portability (USA)

2026-10-08T20:03:58Z

Kayembe Rodrigue:

<div>'''Data Portability (USA)'''</div><div> </div><div>'''Definition'''</div><div> </div><div>According to the Cambridge Dictionary, [https://dictionary.cambridge.org/dictionary/english/portability portability] refers to “the ability to be used for a different purpose or on a different system”. Data portability (DP) can essentially boil down to an individual’s ability to move personal data from one service to another or to themselves. On top of DP conferring control to individuals over their data and [https://www.eff.org/deeplinks/2018/09/what-we-mean-when-we-say-data-portability depending on the context and platform], it can also nurture competition between service providers by clearing paths for dynamic of choice whilst lowering barriers for new providers.</div><div> </div><div>In this presentation, we will address the way in which DP is regulated in the United States, both at a federal and state level. Subsequently, we will analyze some of the main effects of its regulation (or lack thereof), to finalize with a comparison with its counterparty in the EU.</div><div> </div><div>'''US Overview'''</div><div> </div><div>The extent to which data portability is recognised varies considerably in the US. At one level, the right may simply entitle individuals to receive their data in a format that meets specific requirements, such as a portable and readily usable format. A second level goes a step further by imposing an obligation of direct transfer on the service provider; this obligation has not been comprehensively legislated at federal level in the US.</div><div> </div><div>Instead, the underlying legal framework of DP is a patchwork of state statuses and sector-specific regulations. [https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf Health Insurance Portability and Accountability Act, 1996 (HIPAA)] is an example of the latter. Initially, the [https://www.govinfo.gov/content/pkg/FR-2000-12-28/pdf/00-32678.pdf Privacy Rule 2000] provided only for the access to data with no element of portability attached. The [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act 2009] then augmented HIPPA with a portability aspect: under [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf §13405(e)], and codified at [https://www.law.cornell.edu/uscode/text/42/17935 42 U.S.C. §17935(e)], fulfilling a data request in a given format became a right for the individual and an obligation on the provider. More recently the [https://www.govinfo.gov/content/pkg/PLAW-114publ255/pdf/PLAW-114publ255.pdf Cures Act 2016] introduced an infrastructure-layer requirement to enable true data portability and enforcement avenue with [https://www.law.cornell.edu/uscode/text/42/300jj-52 information blocking ban] aspect.</div><div> </div><div>The finance industry attempted making similar strides by way of [https://www.govinfo.gov/content/pkg/PLAW-111publ203/pdf/PLAW-111publ203.pdf Dodd-Frank Act, Pub. L. 111-203] as codified under [https://www.law.cornell.edu/uscode/text/12/5533 12 U.S.C. §5533]. However, this has been stalled with an [https://infobytes.orrick.com/wp-content/uploads/2025-10-29-Order-Granting-Injunction-1.pdf injunction] due to contention on who exactly this right is conferred to and who should bear the cost. Federally, other sectoral statutes grant individuals a right of access to data held about them. The [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act] is one example: it obliges consumer reporting agencies to disclose [https://www.law.cornell.edu/uscode/text/15/1681g “''all information in the consumer’s file''”], but only “''in writing''” by default, with electronic disclosure made available where a consumer authorises it and the agency [https://www.law.cornell.edu/uscode/text/15/1681h offers] it. It imposes no specific format requirement and grants no right of direct transfer to third parties.</div><div> </div><div>Despite the lack of a comprehensive federal privacy that encompasses DP, [https://privacylawmap.com/blog/how-many-states-have-data-privacy-laws several states] have adopted general data protection and privacy laws, including: California, Virginia, Colorado, Connecticut, Utah. For the purpose of this presentation, we will be focusing on the regulation of California and Utah.</div><div> </div><div>We have chosen California as:</div><div> </div><div>* It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 ''dark horse contender'']” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states;</div><div>* It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the ''‘‘[https://archive.org/details/tradingupconsume0000voge California effect’]’''.</div><div> </div><div>As for Utah, its selection stems from the contrast it presents:</div><div> </div><div>* Its [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022] (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy [https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report] in comparison to California’s leading score of 69/100;</div><div>* Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by "technically feasible" and "practicable";</div><div>* Yet, through the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025] (DCA), it became the first US state to require social media platforms to provide [https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability] through open protocols.</div><div> </div><div>'''California'''</div><div> </div><div>[http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5 California Consumer Privacy Act (CCPA)] is a regulation that modified California’s Civil Code, incorporating several data protection provisions in the context of consumer relations.</div><div> </div><div>To begin with, section § 1798.110(b) states that “''a business that collects personal information about a consumer shall disclose to the consumer, pursuant to'' ''[https://1.next.westlaw.com/Link/Document/FullText?findType=L&originatingContext=document&transitionType=DocumentItem&pubNum=1000200&refType=SP&originatingDoc=I911c51d0009711f1a766b53df0bebe74&cite=CACIS1798.130 subparagraph (B) of paragraph (3) of subdivision (a) of Section 1798.130], the information specified in subdivision (a) upon receipt of a verifiable consumer request from the consumer''”. To comply with this obligation, section §1798.130(a)(3)(B)(iii) adds that the business shall ''“Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumer’s request without hindrance. “Specific pieces of information” do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumer’s personal information from one business to another in the context of switching services''”.</div><div> </div><div>It is worth mentioning that, under the CCPA, data portability is mainly considered as a format requirement of the business obligation if consumers exercise their access rights pursuant to section § 1798.110(b). This has direct effects for reporting obligations. As stated in Section § 7102, businesses that process personal information of 10,000,000 or more consumers in a calendar year shall compile the metrics on the number of “requests to know” that the business received, complied with in whole or in part, and denied. Thus, while businesses are indeed required to disclose metrics on the amount of access request received during the year, they are not obliged to disclose the format in which these were delivered, nor if the consumer is required to port the data to a different business. Out of several business reports from 2025, we were only able to identify that Cisco voluntarily provided information on data portability, indicating that they received “[https://www.cisco.com/c/en/us/about/legal/ccpa-metrics-report.html 21 extra requests]” (which include types of Port Data, Subprocessor Disclosures, and Restrict Auto Decision). This starkly contrasts with the total of 731 requests to know during the same year, which could signal an underuse of data portability rights.</div><div> </div><div></div><div>==== '''Utah''' ====</div><div> </div><div>[https://le.utah.gov/~2022/bills/static/SB0227.html UCPA] entered into effect in December, 2023. Consumers are conferred portability rights via [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer's personal data, that the consumer previously provided to the controller, in a format that:</div><div> </div><div>(a) to the extent technically feasible, is portable;</div><div> </div><div>(b) to the extent practicable, is readily usable; and</div><div> </div><div>(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.</div><div> </div><div>There has not been much effort to further define technologically natural 'Readily usable', 'to the extent practicable' and 'without impediment' under UCPA. Similar to [https://dl.acm.org/doi/epdf/10.1145/3267305.3274152 GDPR] the lack of specificity here results in a wide array of inconsistent results.</div><div> </div><div>Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266] that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code [https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4]).</div><div> </div><div>Utah lead the charge introducing the [https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind] legislation amongst states requiring social media platforms to provide interoperability through open protocols under the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act] (UDCA), enacted in 2025, and whose section [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201] outlines that “''If a consumer requests a copy of the consumer's personal data under Section 13-61-201, a social media service shall provide the personal data, including the user's social graph, in a format that: (1) is portable, to the extent technically feasible; (2) is readily usable, to the extent practicable; and (3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.</div><div> </div><div>Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of [https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA] deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy [https://www.transunion.com/ccpa-metrics data] suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.</div><div> </div><div>'''Landscape Impact'''</div><div> </div><div>The World Wide Web movement sought to allow free flow and access to data to all, built on liberalist ideologies. Contrarily, the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users - creating a new power dynamic with data. The Right to Data Portability (RTDP) was established by the GDPR as a solution to empower individuals to attain data sovereignty and regulate competition in the market, ultimately resulting in innovation and platform dependency. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox’.[https://doi.org/10.1093/qje/ (2)]</div><div> </div><div>“RTDP stems from technical codification and trust governance rather than legal codification”.</div><div> </div><div>* Dependence and the lack of appropriate infrastructures</div><div>* Need for sector-specific standardisation</div><div>* ever-changing nature of the regulatory subject in a digital world;</div><div> </div><div>makes it hard to implement data portability efficiently.</div><div> </div><div>'''Case study: Vehicle Data Access'''</div><div> </div><div>The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) [https://en.wikipedia.org/wiki/Motor_Vehicle_Owners%27_Right_to_Repair_Act (3)] which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access as it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.[https://www.dhs.gov/science-and-technology/safety-act (4)]</div><div> </div><div>'''Influence of hyperscaler in the United States:'''</div><div> </div><div>When we discuss personal data transfer in a digital space, cloud computing stands as critical infrastructure. The GDPR prescribes for the "free of charge" rules ([https://gdpr-info.eu/art-12-gdpr/ Article 12(5)] for access requests, [https://gdpr-info.eu/art-20-gdpr/ Article 20] for portability) for transfer of personal data. However, its limited application extends to the '''controller''' in relation to the '''data subject, exempting''' cloud vendors. Currently, the US hyperscalers - namely Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares in the cloud computing space and have also well integrated themselves into multiple layers of the AI stack, serving several core functions through their subsidiaries. Due to the scale of investment required and the high barriers of entry, a non-competitive market is created making it hard for meaningful participation and innovations from new entrants.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (5)]</div><div> </div><div>Data portability is recommended as a solution to break such monopolistic tendencies, however, does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. While some hyperscalers do allow portability services, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of [https://windowsforum.com/news/azure-cloud-exit-fees-are-falling-but-microsoft-licensing-and-portability-still-block-switching.447160/ Microsoft increasing licensing cost] if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)]</div><div> </div><div>The US’ reliance on a patchwork of state statuses rather than a comprehensive federal privacy and data protection framework to regulate DP has had mixed results. An alliance of businesses have aligned to [https://itif.org/publications/2022/01/24/looming-cost-patchwork-state-privacy-laws/ report] that this patchwork could likely create duplicate compliance costs exceeding $1 trillion over 10 years, with small businesses bearing around $20–23 billion annually. States such as Utah have legislated with this in mind with revenue requirements. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox’.[https://doi.org/10.1093/qje/ (2)]</div><div> </div><div>Case study: Vehicle Data Access</div><div> </div><div>The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) (3) which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.(4)</div><div> </div><div>'''Influence of hyperscale establishment concentration in the United States:'''</div><div> </div><div>The World Wide Web movement sought to allow free movement and access of data to all, built on liberalist ideologies, but the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users. Utah has led the charge on tackling this with UDCA, however the impact is still unknown at this stage.</div><div> </div><div>“RTDP stems from technical codification and trust governance rather than legal codification”.</div><div> </div><div>* Dependence and the lack of appropriate infrastructures</div><div>* Need for sector-specific standardisation</div><div>* ever-changing nature of the regulatory subject in a digital world;</div><div> </div><div>makes it hard to implement data portability efficiently.</div><div> </div><div>Data portability does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. All these facts feed into the established [https://research-portal.st-andrews.ac.uk/en/publications/how-portable-is-portable-exercising-the-gdprs-right-to-data-porta/ status quo] of portability not being highly portable.</div><div> </div><div>We have mainly explored data portability via the lens of consumers and personal data. A gap that is prevalent for the right of businesses to port from one hyperscaler to another. This is particularly interesting as Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares and subsequently [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 influence] globally. The EU has taken note of this and addressed it via [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]. In doing so hyperscalers have begun enabling portability services globally as a side effect, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of Microsoft increasing licensing cost if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)]</div><div> </div><div>'''EU Comparison'''</div><div> </div><div>The modern US data portability framework has been influenced, though not determined, by the EU's GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time.</div>

Data Portability (USA)

2026-10-08T19:52:37Z

Kayembe Rodrigue:

Data Portability (USA)

2026-10-08T19:40:45Z

Kayembe Rodrigue: Blanked the page

Data Portability (USA)

2026-10-08T19:36:53Z

Kayembe Rodrigue:

'''Definition'''According to the Cambridge Dictionary,[https://dictionary.cambridge.org/dictionary/english/portability portability]

refers to “the ability to be used for a different purpose or on a different system”. Data portability (DP) can essentially boil down to an individual’s ability to move personal data from one service to another or to themselves. On top of DP conferring control to individuals over their data and[https://www.eff.org/deeplinks/2018/09/what-we-mean-when-we-say-data-portability depending on the context and platform]

, it can also nurture competition between service providers by clearing paths for dynamic of choice whilst lowering barriers for new providers.In this presentation, we will address the way in which DP is regulated in the United States, both at a federal and state level. Subsequently, we will analyze some of the main effects of its regulation (or lack thereof), to finalize with a comparison with its counterparty in the EU.'''US Overview'''The extent to which data portability is recognised varies considerably in the US. At one level, the right may simply entitle individuals to receive their data in a format that meets specific requirements, such as a portable and readily usable format. A second level goes a step further by imposing an obligation of direct transfer on the service provider; this obligation has not been comprehensively legislated at federal level in the US.Instead, the underlying legal framework of DP is a patchwork of state statuses and sector-specific regulations.[https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf Health Insurance Portability and Accountability Act, 1996 (HIPAA)]

is an example of the latter. Initially, the[https://www.govinfo.gov/content/pkg/FR-2000-12-28/pdf/00-32678.pdf Privacy Rule 2000]

provided only for the access to data with no element of portability attached. The[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act 2009]

then augmented HIPPA with a portability aspect: under[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf §13405(e)]

, and codified at[https://www.law.cornell.edu/uscode/text/42/17935 42 U.S.C. §17935(e)]

, fulfilling a data request in a given format became a right for the individual and an obligation on the provider. More recently the[https://www.govinfo.gov/content/pkg/PLAW-114publ255/pdf/PLAW-114publ255.pdf Cures Act 2016]

introduced an infrastructure-layer requirement to enable true data portability and enforcement avenue with[https://www.law.cornell.edu/uscode/text/42/300jj-52 information blocking ban]

aspect. The finance industry attempted making similar strides by way of[https://www.govinfo.gov/content/pkg/PLAW-111publ203/pdf/PLAW-111publ203.pdf Dodd-Frank Act, Pub. L. 111-203]

as codified under[https://www.law.cornell.edu/uscode/text/12/5533 12 U.S.C. §5533]

. However, this has been stalled with an[https://infobytes.orrick.com/wp-content/uploads/2025-10-29-Order-Granting-Injunction-1.pdf injunction]

due to contention on who exactly this right is conferred to and who should bear the cost. Federally, other sectoral statutes grant individuals a right of access to data held about them. The[https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act]

is one example: it obliges consumer reporting agencies to disclose[https://www.law.cornell.edu/uscode/text/15/1681g “all information in the consumer’s file”]

, but only “''in writing''” by default, with electronic disclosure made available where a consumer authorises it and the agency[https://www.law.cornell.edu/uscode/text/15/1681h offers]

it. It imposes no specific format requirement and grants no right of direct transfer to third parties.Despite the lack of a comprehensive federal privacy that encompasses DP,[https://privacylawmap.com/blog/how-many-states-have-data-privacy-laws several states]

have adopted general data protection and privacy laws, including: California, Virginia, Colorado, Connecticut, Utah. For the purpose of this presentation, we will be focusing on the regulation of California and Utah.  We have chosen California as: 
*It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 dark horse contender]” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states;
*It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the ''‘‘''[https://archive.org/details/tradingupconsume0000voge California effect’]''’''.
As for Utah, its selection stems from the contrast it presents:
*Its[https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022](UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy[https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report]in comparison to California’s leading score of 69/100;
*Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by "technically feasible" and "practicable";
*Yet, through the[https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025](DCA), it became the first US state to require social media platforms to provide[https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability]through open protocols.
'''California'''[http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5 California Consumer Privacy Act (CCPA)]

 is a regulation that modified California’s Civil Code, incorporating several data protection provisions in the context of consumer relations.To begin with, section § 1798.110(b) states that “''a business that collects personal information about a consumer shall disclose to the consumer, pursuant to''[https://1.next.westlaw.com/Link/Document/FullText?findType=L&originatingContext=document&transitionType=DocumentItem&pubNum=1000200&refType=SP&originatingDoc=I911c51d0009711f1a766b53df0bebe74&cite=CACIS1798.130 subparagraph (B) of paragraph (3) of subdivision (a) of Section 1798.130]

'', the information specified in subdivision (a) upon receipt of a verifiable consumer request from the consumer''”. To comply with this obligation, section §1798.130(a)(3)(B)(iii) adds that the business shall ''“Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumer’s request without hindrance. “Specific pieces of information” do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumer’s personal information from one business to another in the context of switching services''”.It is worth mentioning that, under the CCPA, data portability is mainly considered as a format requirement of the business obligation if consumers exercise their access rights pursuant to section § 1798.110(b). This has direct effects for reporting obligations. As stated in Section § 7102, businesses that process personal information of 10,000,000 or more consumers in a calendar year shall compile the metrics on the number of “requests to know” that the business received, complied with in whole or in part, and denied. Thus, while businesses are indeed required to disclose metrics on the amount of access request received during the year, they are not obliged to disclose the format in which these were delivered, nor if the consumer is required to port the data to a different business. Out of several business reports from 2025, we were only able to identify that Cisco voluntarily provided information on data portability, indicating that they received “[https://www.cisco.com/c/en/us/about/legal/ccpa-metrics-report.html 21 extra requests]

” (which include types of Port Data, Subprocessor Disclosures, and Restrict Auto Decision). This starkly contrasts with the total of 731 requests to know during the same year, which could signal an underuse of data portability rights. '''Utah''' [https://le.utah.gov/~2022/bills/static/SB0227.html UCPA]

 entered into effect in December, 2023. Consumers are conferred portability rights via[https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer's personal data, that the consumer previously provided to the controller, in a format that:(a) to the extent technically feasible, is portable;(b) to the extent practicable, is readily usable; and(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means. There has not been much effort to further define technologically natural 'Readily usable', 'to the extent practicable' and 'without impediment' under UCPA. Similar to[https://dl.acm.org/doi/epdf/10.1145/3267305.3274152 GDPR]

the lack of specificity here results in a wide array of inconsistent results. Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per[https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266]

that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code[https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4]

).  Utah lead the charge introducing the[https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind]

legislation amongst states requiring social media platforms to provide interoperability through open protocols under  the[https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act]

(UDCA), enacted in 2025, and whose section[https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201]

outlines that “''If a consumer requests a copy of the consumer's personal data under Section 13-61-201, a social media service shall provide the personal data, including the user's social graph, in a format that: (1) is portable, to the extent technically feasible; (2) is readily usable, to the extent practicable; and (3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of[https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA]

deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy[https://www.transunion.com/ccpa-metrics data]

suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability. '''Landscape Impact '''The World Wide Web movement sought to allow free flow and access to data to all, built on liberalist ideologies. Contrarily, the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]

” gathered from their users - creating a new power dynamic with data. The Right to Data Portability (RTDP) was established by the GDPR as a solution to empower individuals to attain data sovereignty and regulate competition in the market, ultimately resulting in innovation and platform dependency. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox’.[https://doi.org/10.1093/qje/ (2) ] “RTDP stems from technical codification and trust governance rather than legal codification”. 
*Dependence and the lack of appropriate infrastructures 
*Need for sector-specific standardisation 
*ever-changing nature of the regulatory subject in a digital world;
makes it hard to implement data portability efficiently.  '''Case study: Vehicle Data Access''' The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair)[https://en.wikipedia.org/wiki/Motor_Vehicle_Owners%27_Right_to_Repair_Act (3)]

which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access as it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.[https://www.dhs.gov/science-and-technology/safety-act (4)] '''Influence of hyperscaler in the United States: ''' When we discuss personal data transfer in a digital space, cloud computing stands as critical infrastructure. The GDPR prescribes for the "free of charge" rules ([https://gdpr-info.eu/art-12-gdpr/ Article 12(5)]

for access requests,[https://gdpr-info.eu/art-20-gdpr/ Article 20]

for portability) for transfer of personal data. However, its limited application extends to the '''controller '''in relation to the '''data subject, exempting''' cloud vendors. Currently, the US hyperscalers - namely Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares in the cloud computing space and have also well integrated themselves into multiple layers of the AI stack, serving several core functions through their subsidiaries. Due to the scale of investment required and the high barriers of entry, a non-competitive market is created making it hard for meaningful participation and innovations from new entrants.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (5)] Data portability is recommended as a solution to break such monopolistic tendencies, however, does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. While some hyperscalers do allow portability services, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of[https://windowsforum.com/news/azure-cloud-exit-fees-are-falling-but-microsoft-licensing-and-portability-still-block-switching.447160/ Microsoft increasing licensing cost]

if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)] The US’ reliance on a patchwork of state statuses rather than a comprehensive federal privacy and data protection framework to regulate DP has had mixed results. An alliance of businesses  have aligned to[https://itif.org/publications/2022/01/24/looming-cost-patchwork-state-privacy-laws/ report]

that this patchwork could likely create duplicate compliance costs exceeding $1 trillion over 10 years, with small businesses bearing around $20–23 billion annually. States such as Utah have legislated with this in mind with revenue requirements. The Right to Data Portability (RTDP) largely depends on the type of data and where the consumer lives. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox’.[https://doi.org/10.1093/qje/ (2) ]Case study: Vehicle Data AccessThe United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) (3) which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.(4)'''Influence of hyperscale establishment concentration in the United States:'''The World Wide Web movement sought to allow free movement and access of data to all, built on liberalist ideologies, but the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]

” gathered from their users. Utah has led the charge on tackling this with UDCA, however the impact is still unknown at this stage.  “RTDP stems from technical codification and trust governance rather than legal codification”. 
*Dependence and the lack of appropriate infrastructures 
*Need for sector-specific standardisation 
*ever-changing nature of the regulatory subject in a digital world;
makes it hard to implement data portability efficiently. Data portability does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. All these facts feed into the established[https://research-portal.st-andrews.ac.uk/en/publications/how-portable-is-portable-exercising-the-gdprs-right-to-data-porta/ status quo]

of portability not being highly portable.We have mainly explored data portability via the lens of consumers and personal data. A gap that is prevalent for the right of businesses to port from one hyperscaler to another. This is particularly interesting as Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares and subsequently[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 influence]

globally. The EU has taken note of this and addressed it via[https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]

. In doing so hyperscalers have begun enabling portability services globally as a side effect, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of Microsoft increasing licensing cost if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)] '''EU Comparison '''The modern US data portability framework has been influenced, though not determined, by the EU's GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time.

Data: Data Portability

2026-10-08T19:35:17Z

Kayembe Rodrigue: /* United States */

= Data: Data Portability =

According to [https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_20 Article 20] of the General Data Protection Regulation, "[the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided" where processing is based on consent or contract and is carried out by automated means. Additionally, the [https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng Data Act ] foresees that data portability should support interoperability of data processing services, while data portability should also be ensured as part of the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] gatekeeper obligations.
== [[Data:Brazil|Brazil]] ==
in progress

= China - Ceren, Sergey, Juliette =
== 1. Overview ==
The Personal Information Protection Law ([https://en.spp.gov.cn/2021-12/29/c_948419.htm PIPL])  came into effect on 1 November 2021, much later than the General Data Protection Regulation ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504 GDPR]) which came into force on 24 May 2016. PIPL is China’s primary legal framework for personal information protection and has notable parallels with the GDPR, while reflecting distinctly Chinese regulatory priorities.

== 2. Key Terms and Definitions in the PIPL are as follows ==
PIPL Article 2: “The '''personal information of natural persons''' shall be protected by law. No organization or individual may infringe upon natural persons’ rights and interests on their personal information.”
'''Personal information processor''' (Article 73(1)): “any organization or individual that independently determines the purpose and method of processing personal information.” The term personal information processor is functionally equivalent to the GDPR concept of a data controller.
'''Personal information''' (Article 4): “information related to an identified or identifiable natural person, recorded electronically or by other means, excluding anonymized information.”

== 3. The Scope of PIPL ==
PIPL applies to the processing of personal information of natural persons within China (Article 3), while also having explicit extraterritorial reach, applying to processing outside China where:



*the purpose is to provide products or services to persons within China;
*the purpose is to analyze or assess the behavior of persons within China; or
*other circumstances provided by law or administrative regulations [https://www.dlapiperdataprotection.com/index.html?c=CN apply].

== 4. Data Portability under PIPL Article 45 ==
Article 45 of the PIPL sets out China’s primary data-portability terms:
“Individuals have the right to access and copy their personal information from personal information processors, except where laws or administrative regulations provide otherwise. Where an individual requests access to or copying of personal information, the personal information processor shall provide it in a timely manner.
Where an individual requests the transfer of personal information to a personal information processor designated by the individual, where the conditions set by the national cyberspace authority (hereon abbreviated as “CAC”) are met, the personal information processor shall provide a means for such transfer.”
When the scope of Article 45 of the PIPL is reviewed, it is seen that the data portability right:



*- applies to all personal information processors;
*- has no size threshold or gatekeeper designation, whereby a small enterprises to large platforms are, in principle, equally subject to the provision;
*- is limited to personal information;
*- does not encompass non-personal data, including machine-generated, anonymized and IoT data.
*- not confined to processing based on consent or contract (until the DSMR clarified, as elaborated below),
*- not expressly limited to data “provided by” the individual (until the DSMR clarified, as elaborated below)
At first, the PIPL was construed to be vague in terms of this data portability clause, since the data portability conditions were awaited to be announced by CAC. The conditions referred to in PIPL Article 45 have since been elaborated in Article 25 of the Network Data Security Management Regulations ([https://www.gov.cn/zhengce/content/202409/content_6977766.htm DSMR]), (Official English Ministry of Justice [https://en.moj.gov.cn/pdf/RegulationsonNetworkDataSecurityManagement.pdf text]) promulgated by the State Council on 30 September 2024 and effective from 1 January 2025. The Regulations are a State Council administrative regulation, not an instrument issued solely by the CAC. They nonetheless respond to PIPL Art. 45’s reference to conditions set by the CAC and operate within China’s broader CAC-centred data-governance framework.
Article 25 is [https://www.dehenglaw.com/CN/tansuocontent/0008/032097/7.aspx?MID=0902 widely understood] as implementing and further specifying the PIPL’s data-portability right. Nonetheless, the provision does not itself establish a fully mature interoperability regime comparable to the EU framework: further technical standards, procedural guidance, and enforcement practice remain relevant to the right’s practical exercise.
DSMR Article 25 reads as follows:
“For requests for transferring personal information that meets the following conditions, a network data processor shall provide means for other network data processors designated by the individual to access and obtain relevant personal information:
(1) the true identity of the requester can be verified;
(2) the requested transfer involves personal information provided with the individual's consent or collected based on a contract;
(3) the transfer of personal information is technically feasible; and
(4) the transfer of personal information does not harm the legitimate rights and interests of others. Where the number of transfer requests significantly exceeds a reasonable limit, the network data processor may charge necessary fees based on the cost of transferring personal information.”
'''Lack of Direction in Implementation'''
Implementation is lacking, although lawyers’ [https://www.dehenglaw.com/CN/tansuocontent/0008/032097/7.aspx?MID=0902 commentary] describes Article 25 as an “expansion and further specification” of the portability right under PIPL Art. 45. 
Article 25 of the DSMR does not by itself create a fully mature interoperability regime. Further CAC rules, technical standards, transfer formats, authentication procedures, and enforcement practice may still be needed for the right to operate consistently in practice. We distinguish between: (1) the existence of regulatory conditions, which Article 25 of the DSMR supplies; and (2) complete operational implementation, which remains dependent on technical and administrative development.

== 5. Implementation and Case Law ==
We identified no published Chinese judgment directly applying the transfer right in PIPL Art. 45(3). Indeed, Courts have addressed portability indirectly, mainly through unfair competition law. On 28 August 2025 the Supreme People's Court, released their [https://www.court.gov.cn/zixun/xiangqing/474431.html first batch of guiding cases] devoted to data rights. Two of these stand out in terms of data portability, and are discussed below, although the rulings are not based on data portability provisions under the PIPL:
#Guiding Case No. 263: The case concerned a dispute between two recruitment platforms and was decided before the PIPL entered into force, on the basis of Art. 2 of the Anti-Unfair Competition Law. The court held that a platform which, with the user's authorization, transfers data that user obtained on another platform does not engage in unfair competition, provided it does not disrupt market order. The original platform holds protected interests in data it has invested in, but it may not prevent users from transferring data they lawfully hold.
 
#Guiding Case No. [https://www.court.gov.cn/zixun/xiangqing/474431.html 262], states that unauthorized scraping that substantially replaces the original platform's service is unfair competition[https://cms.law/en/chn/legal-updates/china-s-supreme-court-releases-six-guiding-cases-on-data-rights-providing-insights-for-corporate-counsels .]
In a judgment of 8 September 2023, the Guangzhou Internet [https://www.hunton.com/privacy-and-information-security-law/the-first-case-in-china-on-personal-information-protection-in-cross-border-transfer-scenario Court] held that the rights to be informed and to decide are the core personal information rights, whereas the rights of access, copy, portability, correction, supplementation and explanation are instrumental rights. This case pertained to the necessity of the personal information processor’s (in GDPR terms, data controller’s) transfer of data abroad. Albeit not being directly related to data portability, this case classified data portability as a supplementary right.
Overall, there is no evidence yet that the individual transfer right works in practice. Data portability in China has so far been developed by the courts and framed by competition and data-circulation concerns rather than by data protection.
In their [https://doi.org/10.1016/j.clsr.2024.105994 article] “''From brussels effect to gravity assists: Understanding the evolution of the GDPR-inspired personal information protection law in China''”, Wenlong Li and Jiahong Chen have stated that there is much space left for local courts to decide on the nature, scope and impact of data portability rights on a case-by-case basis. It should be noted, as a significant caveat, that there exists a scant corpus of case-law, and the few decisions that are publicly accessible are inadequate to form a coherent pattern.
Despite the interpretative powers granted by the PIPL to the CAC, the authority remains relatively passive in elucidating and detailing the provisions of the PIPL through official guidelines.

== 6. Public and Private Sector ==
PIPL applies to both public and private sector processors.
State organs are specifically addressed in Articles 33 through 38 of the [https://en.spp.gov.cn/2021-12/29/c_948419.htm PIPL] and receive some exemptions, such as the absence of a consent requirement where processing is necessary to perform statutory duties or obligations. PIPL’s Article 45 on data portability does not expressly exclude state organs, but has a very broad general carve-out “except where laws or administrative regulations provide otherwise”. In terms of setting out a broad exception regime, this article may be construed as similar to the exceptions under GDPR Article 23 (this subject as a topic exceeds the scope of this research).

== 7. Related Legislation: Data Security Law (DSL, 2021) ==
The [https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ DSL] classifies data into tiers: general, important, and core national data. It imposes corresponding security obligations. It contains no portability right. Restrictions on cross-border transfers of “important data” may limit the practical exercise of portability. We will not delve into this piece of legislation and its application, as it vastly remains outside the scope of this research.
A related legislative framework is also encountered in Article 9 of the 2022 Anti-Monopoly Law, providing that undertakings must not use data and algorithms, technology, capital advantages, platform rules, or similar means to engage in monopolistic conduct prohibited by the law.

== 8. Comparison of the Chinese Data Portability Regime with the EU Data Portability Regime ==

#''' ''''''The EU'''
The EU portability right [https://ejlt.org/index.php/ejlt/article/view/988 originated] in Article 18(1) of the draft GDPR as a way to facilitate switching between online services, although the final provision narrowed its scope. GDPR’s Article 20 gives individuals more control over personal data and can support data flows within the EU by enabling the provision of a copy of personal data or a direct transfer between controllers.
The scope of the GDPR based data portability right encompasses the [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504 following]:



*personal data processed on the basis of consent or a contract: 
*non-personal data falls outside the scope of the GDPR entirely,
*the right applies to SMEs as well as large technology firms (similar to the Chinese scope).
*the right is free of charge and may be exercised at any time (subject to limits such as deletion/anonymization of the data, interference with a public-interest task, and the rights and freedoms of others).
 
The EU’s [https://ec.europa.eu/newsroom/article29/items/611233 Article 29 Working Party Guidelines on the right to "data portability"] shed light on the application and intent of the data portability right, as quoted below:
“It allows for data subjects to receive the personal data that they have provided to a controller, in a structured, commonly used and machine-readable format, and to transmit those data to another data controller. The purpose of this new right is to empower the data subject and give him/her more control over the personal data concerning him or her. Since it allows the direct transmission of personal data from one data controller to another, the right to data portability is also an important tool that will support the free flow of personal data in the EU and foster competition between controllers. It will facilitate switching between different service providers, and will therefore foster the development of new services in the context of the digital single market strategy.”
 
'''Comparative analysis of GDPR and PIPL:'''Compared with the EU framework, China’s Article 25 is a significant move from a high-level statutory portability clause toward specified regulatory conditions. Yet the availability of concrete technical standards and consistent enforcement remains a central practical question.
As [https://doi.org/10.1016/j.clsr.2024.105994 identified by Wenlong Li and Jiahong Chen]:
“unlike the EU's cherishment of data protection as a freestanding, fundamental right, China's placement of personal information protection as a legally protectable interest in its legal order is further down the legal hierarchy to such an extent that its legal position has significantly affected how personal information protection is balanced against other rights and interests. Particularly relevant rights include the right to conduct a business (not formulated explicitly in China), economic growth, as well as cyber sovereignty. Personal information protection, even combined with the right to privacy, has never been elevated to the highest level of hierarchy as a fundamental or constitutional right in China.”
 “…China navigates through a patchwork of internal considerations, international standards, and strategic choices, ultimately sculpting a data protection regime that has a similar appearance to the GDPR but aligns with its distinct political, cultural and legal landscape.”
“Unlike the US, China is not a major exporter of digital services to the EU, which gives the country a much weaker incentive to align its data privacy law in an attempt to facilitate the free flow of personal data from the EU.”
In light of these valuable considerations, it is concluded that in the EU, data protection is recognized as an autonomous fundamental right. In China, by contrast, personal information protection is treated as a ''legally protected interest'', which places it much lower in the legal hierarchy. This weaker status shapes how it is weighed against competing considerations, such as the freedom to conduct a business, economic development and cyber sovereignty. Neither personal information protection nor the right to privacy, whether taken separately or together, has ever been raised to the rank of a fundamental or constitutional right in China. China's approach results from a combination of domestic priorities, international models and strategic decisions. The outcome is a data protection framework that looks similar to the GDPR on the surface but is adapted to China's own political, cultural and legal context. Unlike the United States, China exports few digital services to the EU. It therefore has much less reason to bring its data protection law into line with EU standards in order to secure the free flow of personal data from Europe[https://doi.org/10.1016/j.clsr.2024.105994 .]
 
#''' '''Portability of Non-personal data
#China has no direct equivalent to the EU Data Act’s internet of things data portability regime.
#National security is at the forefront of considerations playing into information transfers abroad.



*Unlike the EU legislation’s motto of “free flow of data in the internal market”, China is guarding sovereignty concerns when thinking of the transfer of data.
While data transfers outside of China should not be confused with the general right to data portability, the interplay between the two could be considered. A limitation, or a lack in the adoption of the right to data portability results in less flow of data both within China, and outside of China. While data transfers abroad do not form part of this exercise, it should also be noted that the main driving factor of EU’s data protection regime is the free flow of information within the internal market, while China does not take part in such a union and is therefore not incentivized by such a market goal.

== [[Data:India|India]] ==

== [[Data Portability (USA)|United States]] ==
in progress

Data Portability (USA)

2026-10-08T19:34:49Z

Kayembe Rodrigue: Created blank page

Market tipping - Rodrigue

2026-10-07T11:55:04Z

Kayembe Rodrigue: Undid revision 124236 by Kayembe Rodrigue (talk)

===== '''Definition''' =====
Tipping is the process by which a marginal lead in a market grows into lasting dominance, because each additional consumer makes that leading product more attractive to the next (see [https://wiki.ivir.nl/index.php?title=Governance_by_markets#Network_Effects_(Indirect)_-_Sebasti%C3%A1n network effects]). A market in which this has happened is said to have tipped: one producer or standard holds most of the market, and its position is difficult, though not impossible, to overturn. Shapiro and Varian (1999) illustrated this phenomenon by exclaiming that "Positive feedback makes the strong get stronger and the weak get weaker, leading to extreme outcomes." This ‘positive feedback’ comprises ‘network effects in the modern day. This phenomenon is typically evident in digital [https://wiki.ivir.nl/index.php?title=Two_and_Multi-Sided_Markets_Robert multi-sided platforms] (MSPs).

===== '''WhatsApp''' =====
Messaging is a prime illustration of tipping: the value of a messaging application lies almost entirely in who else uses it. In much of Europe, the market tipped to WhatsApp early. Once enough early adopters had joined, others followed because they wanted to communicate where the people they knew already were, and each new user made the application more attractive to the next. Once tipped, the market proved [https://www.techhiveadvisory.africa/insights/the-whatsapp-privacy-policy-update-2021-unpacking-the-chaff-and-what-it-means-for-non-eu-users resilient]: the 2021 privacy-policy backlash drove mass [https://42matters.com/blog?p=how-whatsapps-privacy-updates-impacted-telegram-and-signal downloads] of Signal and Telegram, yet users largely remained.

===== '''Implications''' =====
The main implication of a tipping market is, naturally, its proven ability to create a monopoly without exhibiting all the the characteristics of a classical monopoly. The market can shift from a competitive market to being exclusively dominated 'winner take all'. By amassing a considerable user base WhatsApp became the de facto middleman for businesses looking to reach customers via messaging. To date this can only done through its business platform with associated fees and WhatsApp specific terms. For instance, a [https://developers.facebook.com/documentation/business-messaging/whatsapp/pricing/non-template-messages charge] per customer service initiated outbound messages. WhatsApp can throw its weight in this manner because it knows businesses will consider this just a cost of business as they’re not able to take their customers elsewhere immediately if they disagree.

===== '''Gaps''' =====
Tipping assume narrowly assumes that products in a competing market start on an equal footing. An individual product battles to hold the market where the network effect forms a part of the market as a protocol such as SMTP.

<h6 class="mwt-heading" >Further Information: </h6>
[https://forio.com/simulate/mit/video-game/simulation/login.html Simulation Game]

Market tipping - Rodrigue

2026-10-07T11:53:55Z

Kayembe Rodrigue:

===== '''Definition''' =====Tipping is the process by which a marginal lead in a market grows into lasting dominance, because each additional consumer makes that leading product more attractive to the next (see [https://wiki.ivir.nl/index.php?title=Governance_by_markets#Network_Effects_(Indirect)_-_Sebasti%C3%A1n network effects]). A market in which this has happened is said to have tipped: one producer or standard holds most of the market, and its position is difficult, though not impossible, to overturn. [https://lib.uva.nl/discovery/fulldisplay?docid=alma990013172240205131&context=L&vid=31UKB_UAM1_INST:UVA&lang=en&search_scope=DN_and_CI_and_PURE&adaptor=Local%20Search%20Engine&tab=Everything&query=any,contains,Information%20Rules:%20A%20Strategic%20Guide%20to%20the%20Network%20Economy&offset=0 Shapiro and Varian (1999)] illustrated this phenomenon by exclaiming that "Positive feedback makes the strong get stronger and the weak get weaker, leading to extreme outcomes." This ‘positive feedback’ comprises ‘network effects in the modern day. This phenomenon is typically evident in digital [https://wiki.ivir.nl/index.php?title=Two_and_Multi-Sided_Markets_Robert multi-sided platforms] (MSPs).

===== '''WhatsApp''' =====Messaging is a prime illustration of tipping: the value of a messaging application lies almost entirely in who else uses it. In much of Europe, the market tipped to WhatsApp early. Once enough early adopters had joined, others followed because they wanted to communicate where the people they knew already were, and each new user made the application more attractive to the next. Once tipped, the market proved [https://www.techhiveadvisory.africa/insights/the-whatsapp-privacy-policy-update-2021-unpacking-the-chaff-and-what-it-means-for-non-eu-users resilient]: the 2021 privacy-policy backlash drove mass [https://42matters.com/blog?p=how-whatsapps-privacy-updates-impacted-telegram-and-signal downloads] of Signal and Telegram, yet users largely remained.

===== '''Implications''' =====The main implication of a tipping market is, naturally, its proven ability to create a monopoly without exhibiting all the the characteristics of a classical monopoly. The market can shift from a competitive market to being exclusively dominated 'winner take all'. By amassing a considerable user base WhatsApp became the de facto middleman for businesses looking to reach customers via messaging. To date this can only done through its business platform with associated fees and WhatsApp specific terms. For instance, a [https://developers.facebook.com/documentation/business-messaging/whatsapp/pricing/non-template-messages charge] per customer service initiated outbound messages. WhatsApp can throw its weight in this manner because it knows businesses will consider this just a cost of business as they’re not able to take their customers elsewhere immediately if they disagree.

===== '''Gaps''' =====Tipping assume narrowly assumes that products in a competing market start on an equal footing. An individual product battles to hold the market where the network effect forms a part of the market as a protocol such as SMTP.
====== Further Information: ======
[https://forio.com/simulate/mit/video-game/simulation/login.html Simulation Game]

Market tipping - Rodrigue

2026-10-07T11:52:18Z

Kayembe Rodrigue: /* Implications */

Market tipping - Rodrigue

2026-10-07T11:47:38Z

Kayembe Rodrigue: /* Definition */

===== '''Definition''' =====
Tipping is the process by which a marginal lead in a market grows into lasting dominance, because each additional consumer makes that leading product more attractive to the next (see [https://wiki.ivir.nl/index.php?title=Governance_by_markets#Network_Effects_(Indirect)_-_Sebasti%C3%A1n network effects]). A market in which this has happened is said to have tipped: one producer or standard holds most of the market, and its position is difficult, though not impossible, to overturn. Shapiro and Varian (1999) illustrated this phenomenon by exclaiming that "Positive feedback makes the strong get stronger and the weak get weaker, leading to extreme outcomes." This ‘positive feedback’ comprises ‘network effects in the modern day. This phenomenon is typically evident in digital [https://wiki.ivir.nl/index.php?title=Two_and_Multi-Sided_Markets_Robert multi-sided platforms] (MSPs).

===== '''WhatsApp''' =====
Messaging is a prime illustration of tipping: the value of a messaging application lies almost entirely in who else uses it. In much of Europe, the market tipped to WhatsApp early. Once enough early adopters had joined, others followed because they wanted to communicate where the people they knew already were, and each new user made the application more attractive to the next. Once tipped, the market proved [https://www.techhiveadvisory.africa/insights/the-whatsapp-privacy-policy-update-2021-unpacking-the-chaff-and-what-it-means-for-non-eu-users resilient]: the 2021 privacy-policy backlash drove mass [https://42matters.com/blog?p=how-whatsapps-privacy-updates-impacted-telegram-and-signal downloads] of Signal and Telegram, yet users largely remained.

===== '''Implications''' =====
The main implication of a tipping market is, naturally, its proven ability to create a monopoly without exhibiting all the the characteristics of a classical monopoly. By amassing a considerable user base WhatsApp became the de facto middleman for businesses looking to reach customers via messaging. To date this can only done through its business platform with associated fees and WhatsApp specific terms. For instance, a [https://developers.facebook.com/documentation/business-messaging/whatsapp/pricing/non-template-messages charge] per customer service initiated outbound messages. WhatsApp can throw its weight in this manner because it knows businesses will consider this just a cost of business as they’re not able to take their customers elsewhere immediately if they disagree.

===== '''Gaps''' =====
Tipping assume narrowly assumes that products in a competing market start on an equal footing. An individual product battles to hold the market where the network effect forms a part of the market as a protocol such as SMTP.

<h6 class="mwt-heading" >Further Information: </h6>
[https://forio.com/simulate/mit/video-game/simulation/login.html Simulation Game]

Market tipping - Rodrigue

2026-10-07T11:44:08Z

Kayembe Rodrigue: /* Definition */

===== '''Definition''' =====
Tipping is the process by which a marginal lead in a market grows into lasting dominance, because each additional consumer makes that leading product more attractive to the next (see [https://wiki.ivir.nl/index.php?title=Governance_by_markets#Network_Effects_(Indirect)_-_Sebasti%C3%A1n network effects]). A market in which this has happened is said to have tipped: one producer or standard holds most of the market, and its position is difficult, though not impossible, to overturn. Shapiro and Varian (1999) illustrated this phenomenon by exclaiming that "Positive feedback makes the strong get stronger and the weak get weaker, leading to extreme outcomes." This ‘positive feedback’ comprises ‘network effects in the modern day.

===== '''WhatsApp''' =====
Messaging is a prime illustration of tipping: the value of a messaging application lies almost entirely in who else uses it. In much of Europe, the market tipped to WhatsApp early. Once enough early adopters had joined, others followed because they wanted to communicate where the people they knew already were, and each new user made the application more attractive to the next. Once tipped, the market proved [https://www.techhiveadvisory.africa/insights/the-whatsapp-privacy-policy-update-2021-unpacking-the-chaff-and-what-it-means-for-non-eu-users resilient]: the 2021 privacy-policy backlash drove mass [https://42matters.com/blog?p=how-whatsapps-privacy-updates-impacted-telegram-and-signal downloads] of Signal and Telegram, yet users largely remained.

===== '''Implications''' =====
The main implication of a tipping market is, naturally, its proven ability to create a monopoly without exhibiting all the the characteristics of a classical monopoly. By amassing a considerable user base WhatsApp became the de facto middleman for businesses looking to reach customers via messaging. To date this can only done through its business platform with associated fees and WhatsApp specific terms. For instance, a [https://developers.facebook.com/documentation/business-messaging/whatsapp/pricing/non-template-messages charge] per customer service initiated outbound messages. WhatsApp can throw its weight in this manner because it knows businesses will consider this just a cost of business as they’re not able to take their customers elsewhere immediately if they disagree.

===== '''Gaps''' =====
Tipping assume narrowly assumes that products in a competing market start on an equal footing. An individual product battles to hold the market where the network effect forms a part of the market as a protocol such as SMTP.

<h6 class="mwt-heading" >Further Information: </h6>
[https://forio.com/simulate/mit/video-game/simulation/login.html Simulation Game]

Market tipping - Rodrigue

2026-10-07T11:38:12Z

Kayembe Rodrigue: /* Implications */

===== '''Definition''' =====
Tipping is the process by which a marginal lead in a market grows into lasting dominance, because each additional consumer makes that leading product more attractive to the next. A market in which this has happened is said to have tipped: one producer or standard holds most of the market, and its position is difficult, though not impossible, to overturn. Shapiro and Varian (1999) illustrated this phenomenon by exclaiming that "Positive feedback makes the strong get stronger and the weak get weaker, leading to extreme outcomes." This ‘positive feedback’ comprises ‘network effects in the modern day.

===== '''WhatsApp''' =====
Messaging is a prime illustration of tipping: the value of a messaging application lies almost entirely in who else uses it. In much of Europe, the market tipped to WhatsApp early. Once enough early adopters had joined, others followed because they wanted to communicate where the people they knew already were, and each new user made the application more attractive to the next. Once tipped, the market proved [https://www.techhiveadvisory.africa/insights/the-whatsapp-privacy-policy-update-2021-unpacking-the-chaff-and-what-it-means-for-non-eu-users resilient]: the 2021 privacy-policy backlash drove mass [https://42matters.com/blog?p=how-whatsapps-privacy-updates-impacted-telegram-and-signal downloads] of Signal and Telegram, yet users largely remained.

===== '''Implications''' =====
The main implication of a tipping market is, naturally, its proven ability to create a monopoly without exhibiting all the the characteristics of a classical monopoly. By amassing a considerable user base WhatsApp became the de facto middleman for businesses looking to reach customers via messaging. To date this can only done through its business platform with associated fees and WhatsApp specific terms. For instance, a [https://developers.facebook.com/documentation/business-messaging/whatsapp/pricing/non-template-messages charge] per customer service initiated outbound messages. WhatsApp can throw its weight in this manner because it knows businesses will consider this just a cost of business as they’re not able to take their customers elsewhere immediately if they disagree.

===== '''Gaps''' =====
Tipping assume narrowly assumes that products in a competing market start on an equal footing. An individual product battles to hold the market where the network effect forms a part of the market as a protocol such as SMTP.

<h6 class="mwt-heading" >Further Information: </h6>
[https://forio.com/simulate/mit/video-game/simulation/login.html Simulation Game]

Market tipping - Rodrigue

2026-10-07T07:19:52Z

Kayembe Rodrigue:

===== '''Definition''' =====
Tipping is the process by which a marginal lead in a market grows into lasting dominance, because each additional consumer makes that leading product more attractive to the next. A market in which this has happened is said to have tipped: one producer or standard holds most of the market, and its position is difficult, though not impossible, to overturn. Shapiro and Varian (1999) illustrated this phenomenon by exclaiming that "Positive feedback makes the strong get stronger and the weak get weaker, leading to extreme outcomes." This ‘positive feedback’ comprises ‘network effects in the modern day.

===== '''WhatsApp''' =====
Messaging is a prime illustration of tipping: the value of a messaging application lies almost entirely in who else uses it. In much of Europe, the market tipped to WhatsApp early. Once enough early adopters had joined, others followed because they wanted to communicate where the people they knew already were, and each new user made the application more attractive to the next. Once tipped, the market proved [https://www.techhiveadvisory.africa/insights/the-whatsapp-privacy-policy-update-2021-unpacking-the-chaff-and-what-it-means-for-non-eu-users resilient]: the 2021 privacy-policy backlash drove mass [https://42matters.com/blog?p=how-whatsapps-privacy-updates-impacted-telegram-and-signal downloads] of Signal and Telegram, yet users largely remained.

===== '''Implications''' =====
The main implication of a tipping market is, naturally, its proven ability to create a monopoly. By amassing a considerable user base WhatsApp became the de facto middleman for businesses looking to reach customers via messaging. To date this can only done through its business platform with associated fees and WhatsApp specific terms. For instance, a [https://developers.facebook.com/documentation/business-messaging/whatsapp/pricing/non-template-messages charge] per customer service initiated outbound messages. WhatsApp can throw its weight in this manner because it knows businesses will consider this just a cost of business as they’re not able to take their customers elsewhere immediately if they disagree.

===== '''Gaps''' =====
Tipping assume narrowly assumes that products in a competing market start on an equal footing. An individual product battles to hold the market where the network effect forms a part of the market as a protocol such as SMTP.

<h6 class="mwt-heading" >Further Information: </h6>
[https://forio.com/simulate/mit/video-game/simulation/login.html Simulation Game]

Market tipping - Rodrigue

2026-10-07T00:56:39Z

Kayembe Rodrigue:

===== '''Definition''' =====
Tipping is the process by which a marginal lead in a market grows into lasting dominance, because each additional consumer makes that leading product more attractive to the next. A market in which this has happened is said to have tipped: one producer or standard holds most of the market, and its position is difficult, though not impossible, to overturn. Shapiro and Varian (1999) illustrated this phenomenon by exclaiming that "Positive feedback makes the strong get stronger and the weak get weaker, leading to extreme outcomes." This ‘positive feedback’ comprises ‘network effects in the modern day.

===== '''WhatsApp''' =====
Messaging is a prime illustration of tipping: the value of a messaging application lies almost entirely in who else uses it. In much of Europe, the market tipped to WhatsApp early. Once enough early adopters had joined, others followed because they wanted to communicate where the people they knew already were, and each new user made the application more attractive to the next. Once tipped, the market proved [https://www.techhiveadvisory.africa/insights/the-whatsapp-privacy-policy-update-2021-unpacking-the-chaff-and-what-it-means-for-non-eu-users resilient]: the 2021 privacy-policy backlash drove mass [https://42matters.com/blog?p=how-whatsapps-privacy-updates-impacted-telegram-and-signal downloads] of Signal and Telegram, yet users largely remained.

===== '''Implications''' =====
The main implication of a tipping market is, naturally, its proven ability to create a monopoly. By amassing a considerable user base WhatsApp became the de facto middleman for businesses looking to reach customers via messaging. To date this can only done through its business platform with associated fees and WhatsApp specific terms. For instance, a [https://developers.facebook.com/documentation/business-messaging/whatsapp/pricing/non-template-messages charge] per customer service initiated outbound messages. WhatsApp can throw its weight in this manner because it knows businesses will consider this just a cost of business as they’re not able to take their customers elsewhere immediately if they disagree.

===== '''Gaps''' =====
Tipping assume narrowly assumes that products in a competing market start on an equal footing. An individual product battles to hold the market where the network effect forms a part of the market as a protocol such as SMTP.

Market tipping - Rodrigue

2026-10-07T00:53:11Z

Kayembe Rodrigue: content

Governance by markets

2026-10-05T11:00:58Z

Kayembe Rodrigue:

= Glossary =
= [https://wiki.ivir.nl/index.php?title=Data_as_an_input_to_market_power Data as an input to market power] (Sergey) =In the present digital economy, data has emerged as a valuable economic commodity that entities leverage to gain a competitive edge over their rivals [[https://repository.nls.ac.in/cgi/viewcontent.cgi?article=1478&context=nlsblr 1]]. '''Data''' is an input into production, so businesses that control data can have market power and impede the entry of potential competitors. '''Market power''' refers to a firm's ability to influence the price, output, or other market conditions in its favour, without being constrained by competitive forces [[https://www.tutor2u.net/economics/reference/what-is-meant-by-market-power 2]].'''Data as an input to market power''' means that access to information can help a business limit the competitive pressure it faces. Information about searches, clicks or purchases can improve services and advertising. If competitors cannot obtain comparable information at a reasonable cost, they may struggle to offer an attractive alternative. This can allow a platform to raise prices or worsen quality or privacy protections without losing enough business to make doing so unprofitable. This matters even when a service is free, because competition also concerns advertising charges, personal information and the choices available. Data can be used repeatedly and by several businesses without being used up. However, access can be restricted through contracts and technical controls. Nevertheless, holding a large dataset alone does not establish market power.'''Google Search''' illustrates this mechanism. Google controls over 91% of global search engine traffic [[https://www.statista.com/statistics/1381664/worldwide-all-devices-market-share-of-search-engines/ 3]] and uses information about users’ searches and the results they click to improve the relevance of its rankings. A larger volume of searches gives it more opportunities to learn, including about unusual queries that smaller search engines encounter less often. Better results can attract further use, producing additional information and reinforcing the advantage. A new search engine may therefore struggle to attract users while lacking the information needed to improve its service. Data access can constitute a significant barrier to entry when this type of analytics is necessary to participate in a market, particularly when alternatives are limited. A platform’s control over data access can shape who is able to compete with it. By determining whether, and on what terms, rivals can access that information, a platform can influence the competitive opportunities available to others. This suggests that regulation should examine access to strategically important data alongside prices and market shares. Article 6(11) of the EU Digital Markets Act [[https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng#:~:text=giving%20their%20consent.-,11.%C2%A0,-The%20gatekeeper%20shall 4]] reflects this approach: certain large search providers must, on request, share specified search data with rival search providers on fair and non-discriminatory terms, with relevant personal data anonymised. The aim is to help rivals compete while protecting users. A data advantage does not, by itself, establish unlawful conduct.Would access to equivalent data enable a rival to compete effectively? The concept cannot answer this on its own. Additional data may eventually add little value, become outdated, or have substitutes. Firms also need the skills and computing resources to use it. Google’s default positions in browsers and devices can further restrict rivals’ access to users even if data become available. The unresolved issue is how much competitive advantage comes from data itself and how much comes from these other resources and arrangements. 

= Two Sided Markets (Ceren) =In two-sided markets, two sides of a market interact through an intermediary. These markets typically have some externality,<code class="mwt-code">Carl Shapiro and Hal R Varian, ''Information Rules: A Strategic Guide to the Network Economy'' (Harvard Business School Press 2010), 183.</code> where the decisions of the sides affect the other. The intermediary also has multitudes of effects on both sides, mainly identified in the related literature through its pricing.An example of a two sided market is payment systems, whereby the credit card providing bank is the intermediary between the customers and merchants. In this example, banks provide credit cards to customers to be utilized in their payments, and merchants accept payment via multiple credit card systems to accommodate payments from customers holding credit cards from such providers[https://doi.org/10.1257/jep.23.3.125 .]The main power of the intermediary materializes in their pricing toward the merchant (and the merchant’s bank in interchange fees in case of payment being transferred through different banks). Customers will be expected to be more loyal, holding a few credit cards, whereas merchants accept payment from many banks to accommodate all customers’ payment methods. Banks will provide more subsidies to customers to attract them and compete aggressively on the customer side, making their platform more desirable to work with by merchants, who will in turn be more accepting of the platform’s fees to gain the business of the larger volume of customers. However, dynamic pricing (increasing fees after gaining entry and loyalty) may be a way for these platforms to abuse their power.The concept may be derailed from these logical / analytical systems of operation or expected outcomes when public policy interferes with the market. For example, net neutrality rules regulate what internet service providers (the intermediary) can charge content providers (one side) who aim to reach the consumers (the other side). In this case the above considerations and the concept are halted.

= Switching costs and lock-in (Kate) =
[[File:Untitled Diagram.drawio (1).png|300px|thumb|Goods Matrix]]

= Excludability and rivalrousness (Paul)  =
=== Excludability and Rivalrousness ===The terms excludability and rivalrousness both refer to consumption characteristics that can be assigned to- or identified in goods. '''Excludability''': Goods to which economic actors can technically or legally restrict access are considered to have ‘high excludability’. Conversely, goods to which access cannot be restricted are of ‘low excludability’, or, in absolute terms, ‘non-excludable’.'''Rivalrousness''': Rivalrousness on the other hand refers to the finitude of the good in question. The greater the depletion of the stock, quantity, or amount is on account of one party’s consumption, the more rivalrous a good is. Tabulating the characteristics against one another allows for inference and definition of the type of good an object, service, or resource may constitute (see fig. 1). Excludability and Rivalrousness of goods can therethrough serve as a predictor for certain types of market failures: Goods which are non-excludable or of low excludability, but nonetheless costly to provide, are vulnerable to so-called free rider problem. Goods which are non-excludable, but highly rivalrous (common goods), may lead to the tragedy of the commons, that is over-exploitation. 

=== AI Training and the (non-)excludability of information. ===The unusual nature of excludability and rivalrousness of data further compromises the applicability of the goods classification built thereon. In traditional economics, a non-excludable and non-rivalrous good would be seen as a public good. This does apply insofar as data is vulnerable to corporate exploitation without commensurate indemnification. Data usage may however actually be anti-rival in the sense that increasing aggregate usage increases the value of the data (better labeling, easier access, previously undrawn conclusions, etc.), rather than diminish the ‘stock’ of data. Conversely, data may be rivalrous not in its absolute depletion by consumption, but rather the benefit or competitive advantage usage of that data may confer: If all AI firms are able to train on the exact same data (all available data), the utility of that data may still increase, but the competitive advantage of possessing that data is exhausted.

=== Free-Rider Problems & Public Data ===As any party can benefit from publicly available data at no cost or low cost, the incentive for private market actors to fund its creation is comparatively weak. Consequently, public bodies (and less frequently open-source foundations and non-profits) often assume the responsibility for the provision of this type of data. A classical example is weather data and its creation by national weather agencies.

= Interoperability (Sisi) =

#What is interoperability?[[https://www.ibm.com/think/topics/interoperability 1]]Interoperability is a “standards-based” approach that enables different IT systems to communicate with minimal end-user interaction to exchange data and “share functionality”. Each system also allows the other system to “read, update, modify, and analyze” data with minimal human interaction. [[https://www.oracle.com/nl/interoperability/ 2]]Interoperability works by having different systems share data by employing the same standards for data formats (e.g., Extensible Markup Language or JavaScript Object Notation), exchange, and vocabulary to title data elements. These standards are agreed upon “in advance” by organizations, industry types, and user groups. Then, software developers build the system based on the model agreed upon.

#Concrete example from a digital technology or platformInteroperable systems are vital in healthcare, commerce, and public safety. A notable example includes the integration of Electronic Health Records (HER). This system allows different healthcare providers to securely access and share personal patient information regardless of the specific EHR system used.[[https://data.europa.eu/en/news-events/news/interoperability-solutions-bridging-systems-connected-future 3]] An example of such a system is the GNU Health Hospital Information System, which is a model employed by small private offices and large national public health systems.[[https://interoperable-europe.ec.europa.eu/collection/gnu-health/solution/gnu-health-hospital-information-system 4]]For example, a health care professional may access lab results and patient history data from various platforms to enable them to make a diagnosis.

#One governance implication: what does this concept explain about how platforms exercise power?Interoperability is a powerful tool because it helps provide a “seamless user experience” and optimizes data sharing between separate systems. It helps companies and organizations access data from multiple sources and improve efficiency, such as accelerating workflows and reducing the possibility of errors by pooling data from its sources.Interoperability standards are mandated by law on the technical side to ensure “critical systems” are compatible, especially in public safety and health. [[https://www.ibm.com/think/topics/interoperability 5]]In Europe, interoperability is governed by the European Health Data Space regulation (EHDS); the “first common EU data space dedicated to a specific sector as part of the European strategy for data.”This Regulation aims to benefit EU citizens such as patients, researchers, healthcare professionals, and industry players by establishing a common framework for the exchange of electronic health data within the EU. In addition, it enables certain data to be “reused” for public purpose and innovative scientific research. [[https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en 6]]

#Where does the concept break down or fail to explain somethingWhile the EDHS harmonizes a legal and technical framework for sharing EU data, its shortcoming is its gradual implementation. The EDHS entered into force in 2025; however, most of its obligations will not apply until 2029. This leaves four years for health care companies to use interoperability in a deregulated manner. [[https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en 7]]Furthermore, there are actual barriers to achieving full interoperability in healthcare, including data silos (which isolate data collections and hinder data exchange), lack of standardization (where one system records blood pressure as free text, another system stores it as a structured numeric value), and deficient infrastructure, which requires significant technological upgrading.The burden remains on health companies to decide which standards to adopt and how much to invest in stable technological infrastructure to strengthen their data governance and interoperability. [[https://www.tigahealth.com/how-to-overcome-healthcare-interoperability-challenges/ 8]]

= "Economies of Scale (Jihae)" =
= [[Network Effects (Indirect) - Sebastián]] =
= [[Monopsony - (Atmika)]] =
===== [https://wiki.ivir.nl/index.php?title=Market_tipping_-_Rodrigue Market Tipping - Rodrigue] =====

Market tipping - Rodrigue

2026-10-05T10:59:07Z

Kayembe Rodrigue: Created blank page

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T20:47:17Z

Kayembe Rodrigue: /* IDEMIA Group: */

EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Europol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut ("NEN")''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329]. 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts.



===== '''IDEMIA Group:''' =====

*Public [https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/opportunities/tender-details/4802 tender] contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary. 

<code class="mwt-code">Atmika: Highly informative regarding an interesting niche topic substansiated by instances and national as well as multinational instutitions. Weakness and limitation analysis was original and relevant.  </code>

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T20:46:50Z

Kayembe Rodrigue: /* Stichting Koninklijk Nederlands Normalisatie Instituut ("NEN") */

EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Europol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut ("NEN")''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329]. 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts.



===== '''IDEMIA Group:''' =====

*Public [https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/opportunities/tender-details/4802 tender] contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary 

<code class="mwt-code">Atmika: Highly informative regarding an interesting niche topic substansiated by instances and national as well as multinational instutitions. Weakness and limitation analysis was original and relevant.  </code>

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T20:46:17Z

Kayembe Rodrigue: /* IDEMIA Group: */

EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Europol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut ("NEN")''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts



===== '''IDEMIA Group:''' =====

*Public [https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/opportunities/tender-details/4802 tender] contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary 

<code class="mwt-code">Atmika: Highly informative regarding an interesting niche topic substansiated by instances and national as well as multinational instutitions. Weakness and limitation analysis was original and relevant.  </code>

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T20:45:53Z

Kayembe Rodrigue: /* IDEMIA: */

EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Europol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut ("NEN")''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts



===== '''IDEMIA Group:''' =====

*Public [https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/opportunities/tender-details/4802 tender] contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary,
 

<code class="mwt-code">Atmika: Highly informative regarding an interesting niche topic substansiated by instances and national as well as multinational instutitions. Weakness and limitation analysis was original and relevant.  </code>

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T20:45:08Z

Kayembe Rodrigue: /* IDEMIA: governing midstream, through design and implementation */

EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Europol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut ("NEN")''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts



===== '''IDEMIA:''' =====

*Public [https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/opportunities/tender-details/4802 tender] contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary,
 

<code class="mwt-code">Atmika: Highly informative regarding an interesting niche topic substansiated by instances and national as well as multinational instutitions. Weakness and limitation analysis was original and relevant.  </code>

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T10:07:31Z

Kayembe Rodrigue: /* IDEMIA: governing midstream, through design and implementation */

EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Europol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut ("NEN")''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts



===== '''IDEMIA: governing midstream, through design and implementation''' =====

*Public [https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/opportunities/tender-details/4802 tender] contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary,
 

<code class="mwt-code">Atmika: Highly informative regarding an interesting niche topic substansiated by instances and national as well as multinational instutitions. Weakness and limitation analysis was original and relevant.  </code>

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T09:44:04Z

Kayembe Rodrigue: /* Stichting Koninklijk Nederlands Normalisatie Instituut ("NEN") */

EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Europol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut ("NEN")''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts



===== '''IDEMIA: governing midstream, through design and implementation''' =====

*Public tender contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary,
 

<code class="mwt-code" >Atmika: Highly informative regarding an interesting niche topic substansiated by instances and national as well as multinational instutitions. Weakness and limitation analysis was original and relevant.  </code>

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T09:37:31Z

Kayembe Rodrigue: /* European Data Protection Supervisor (EDPS) */

EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Europol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut ("NEN")''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts\



===== '''IDEMIA: governing midstream, through design and implementation''' =====

*Public tender contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary,
 

<code class="mwt-code" >Atmika: Highly informative regarding an interesting niche topic substansiated by instances and national as well as multinational instutitions. Weakness and limitation analysis was original and relevant.  </code>

Talk:Predicitive Policing - Europol (Atmika)

2026-09-23T07:14:34Z

Kayembe Rodrigue: Created page with "- On Palantir worth adding one liner explaining what they do if possible and weakness might need some more clarification - Adding hyperlinks would be helpful to help quickly jump to regulations "

- On Palantir worth adding one liner explaining what they do if possible and weakness might need some more clarification

- Adding hyperlinks would be helpful to help quickly jump to regulations 

Governance by institutions

2026-09-23T07:08:48Z

Kayembe Rodrigue:

[https://wiki.ivir.nl/index.php?title=Antropic%27s_Fable_5.1_(Kate_Davey) Anthropic's Fable 5.1 (Kate Davey)]

= [[cloud service (Ceren)]] =
* app store
*digital identity system
*online-payment system
*AI model
*public algorithmic system.
[https://wiki.ivir.nl/index.php?title=Decentralized_digital_currency:_BITCOIN_(Sisi) Decentralized Digital Currency: Bitcoin (Sisi)]

[[Submarine Internet Cables  - By Pablo Latorre]]

[[Artificial General Intelligence - By Sebastián Muller]]

[[Predicitive Policing - Europol (Atmika)]]

[[Entry/Exit System (EES) - Rodrigue Kayembe]]

[https://wiki.ivir.nl/index.php?title=Social-Media_Governance_in_the_EU_-_by_Sergey_Abramov Social-Media Governance - by Sergey Abramov]

== [[App Store Governance - Google Play (Paul)]]`` ==
== [[Representative Search Engine and AI Company in China, Baidu - By Jihae Park]] ==

= [[Quantum Computing made in Barcelona: Qilimanjaro - by Mariona Fortuny Jané]] =

<div></div>

Governance by institutions

2026-09-23T07:08:10Z

Kayembe Rodrigue:

[https://wiki.ivir.nl/index.php?title=Antropic%27s_Fable_5.1_(Kate_Davey) Anthropic's Fable 5.1 (Kate Davey)]

= [[cloud service (Ceren)]] =
* app store
*digital identity system
*online-payment system
*AI model
*public algorithmic system.
[https://wiki.ivir.nl/index.php?title=Decentralized_digital_currency:_BITCOIN_(Sisi) Decentralized Digital Currency: Bitcoin (Sisi)]

[[Submarine Internet Cables  - By Pablo Latorre]]

[[Artificial General Intelligence - By Sebastián Muller]]

[https://wiki.ivir.nl/index.php?title=Social-Media_Governance_in_the_EU_-_by_Sergey_Abramov Social-Media Governance - by Sergey Abramov]

== [[App Store Governance - Google Play (Paul)]]`` ==
== [[Representative Search Engine and AI Company in China, Baidu - By Jihae Park]] ==
[[Predicitive Policing - Europol (Atmika)]]
[[Entry/Exit System (EES) - Rodrigue Kayembe]]
= [[Quantum Computing made in Barcelona: Qilimanjaro - by Mariona Fortuny Jané]] =

<div></div>

Governance by institutions

2026-09-23T07:07:12Z

Kayembe Rodrigue:

[https://wiki.ivir.nl/index.php?title=Antropic%27s_Fable_5.1_(Kate_Davey) Anthropic's Fable 5.1 (Kate Davey)]

= [[cloud service (Ceren)]] =
* app store
*digital identity system
*online-payment system
*AI model
*public algorithmic system.
[https://wiki.ivir.nl/index.php?title=Decentralized_digital_currency:_BITCOIN_(Sisi) Decentralized Digital Currency: Bitcoin (Sisi)]

[[Submarine Internet Cables  - By Pablo Latorre]]

[[Artificial General Intelligence - By Sebastián Muller]]

[https://wiki.ivir.nl/index.php?title=Social-Media_Governance_in_the_EU_-_by_Sergey_Abramov Social-Media Governance - by Sergey Abramov]

== [[App Store Governance - Google Play (Paul)]]`` ==
== [[Representative Search Engine and AI Company in China, Baidu - By Jihae Park]] ==
[[Predicitive Policing - Europol (Atmika)]]
= [[Quantum Computing made in Barcelona: Qilimanjaro - by Mariona Fortuny Jané]] =

<div></div>

Governance by institutions

2026-09-23T07:05:34Z

Kayembe Rodrigue:

[https://wiki.ivir.nl/index.php?title=Antropic%27s_Fable_5.1_(Kate_Davey) Anthropic's Fable 5.1 (Kate Davey)]

= [[cloud service (Ceren)]] =
* app store
*digital identity system
*online-payment system
*AI model
*public algorithmic system.
[https://wiki.ivir.nl/index.php?title=Decentralized_digital_currency:_BITCOIN_(Sisi) Decentralized Digital Currency: Bitcoin (Sisi)]

[[Submarine Internet Cables  - By Pablo Latorre]]

[[Artificial General Intelligence - By Sebastián Muller]]

[https://wiki.ivir.nl/index.php?title=Social-Media_Governance_in_the_EU_-_by_Sergey_Abramov Social-Media Governance - by Sergey Abramov]

[[https://wiki.ivir.nl/index.php?title=Predicitive Policing_-_Europol_(Atmika)|Predicitive Policing - Europol (Atmika)]]
== [[App Store Governance - Google Play (Paul)]]`` ==
== [[Representative Search Engine and AI Company in China, Baidu - By Jihae Park]] ==
= [https://wiki.ivir.nl/index.php?title=Revolut_Regulation Revolut Regulation] <div></div>

= [[Quantum Computing made in Barcelona: Qilimanjaro - by Mariona Fortuny Jané]] =

<div></div>

Predicitive Policing - Europol (Atmika)

2026-09-23T07:03:47Z

Kayembe Rodrigue:

= 1. European Police Office (Europol)(1) =
*Europol was established in 1998 through the Europol Convention and is currently regulated by the consolidated Europol Regulation (Regulation (EU) 2016/794)(1).  
*Europol derives it’s authority from Article 88 of Treaty on the Functioning of the European Union (TFEU), prescribing for its body to be governed by a regulation and to be adopted jointly with national parliaments of Member States, in accordance with ordinary legislative procedure.
*Europol strives to protect and prevent organised cross-border crimes against EU citizens to facilitate intelligence cooperation between Member States to ensure internal security.
*Weakness: Role majorily outlined for information consolidation and empowering Member State Parliament.
 
== 2. European Parliament (Member States) & EU market ==

*Granted self-identity and sovereignty through their own national enactments and read with Article 114 TFEU grants authority to Parliaments of Member States and the Council to enact rules and regulations in the interest of internal market harmonisation.
*The EU AI Act (Regulation (EU) 2024/1689) (2), currently the only regulation for AI use and ensuring ethical practices are followed due to the nature of data shared and unreliable training model - profiling system.
*Ensure economic growth while also safeguarding fundamental rights of its citizens while cooperating within the internal market.
*Weakness: Lack of coordination, and implementation standards which can result in different rates and quality of transposition
== 3. Palantir Technologies (Private entity)(3) ==

*Self-determined and incorporated in the United States. Deriving authority from contracts with EU entities to provide AI services.
*Governed by principles laid out in the contract, but supersedingly by United States’ legal framework by way of establishment. 
*Outsourced software building for data, decision and operation - notably in the national security, policing and advisory services for health care and national safety increasingly between EU states.
*Weakness: Unregulated access and processing of national data in light of the United States’ surveillance policy makes for data and infrastructural vulnerability in the EU.
 Notes & references:

 
#Söderholm, S. (2023). Fundamental rights control when implementing predictive policing–a European perspective. Peking University law journal, 11(1), 91-104.
#Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, pp. 53–114).
#Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)
#https://www.politico.eu/article/europe-wants-to-kick-its-palantir-habit/
#Meško, G. (2026). Modern Policing and Technology—European Perspectives—A Brief Reflection. European Journal of Crime, Criminal Law and Criminal Justice, 1(aop), 1-11.

Predicitive Policing - Europol (Atmika)

2026-09-23T07:03:35Z

Kayembe Rodrigue: Created page with "<h1 class="mwt-heading" data-mwt-headingspacesbefore=" " data-mwt-headingspacesafter=" " data-mwt-headingnewlines="0"> </h1> <h2 class="mwt-heading" data-mwt-headingspacesbefore=" " data-mwt-headingspacesafter=" " data-mwt-headingnewlines="1">1. European Police Office (Europol)(1)</h2> <ul> <li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Europol was established in 1998 through the Europol Convention and is currently regulated by the consolidated Europo..."

<h1 class="mwt-heading" data-mwt-headingspacesbefore=" " data-mwt-headingspacesafter=" " data-mwt-headingnewlines="0"> </h1>
<h2 class="mwt-heading" data-mwt-headingspacesbefore=" " data-mwt-headingspacesafter=" " data-mwt-headingnewlines="1">1. European Police Office (Europol)(1)</h2>
<ul>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Europol was established in 1998 through the Europol Convention and is currently regulated by the consolidated Europol Regulation (Regulation (EU) 2016/794)(1). </li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Europol derives it’s authority from Article 88 of Treaty on the Functioning of the European Union (TFEU), prescribing for its body to be governed by a regulation and to be adopted jointly with national parliaments of Member States, in accordance with ordinary legislative procedure.</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Europol strives to protect and prevent organised cross-border crimes against EU citizens to facilitate intelligence cooperation between Member States to ensure internal security.</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Weakness: Role majorily outlined for information consolidation and empowering Member State Parliament.</li>
</ul>
 
<h2 class="mwt-heading" data-mwt-headingspacesbefore=" " data-mwt-headingspacesafter=" " data-mwt-headingnewlines="1">2. European Parliament (Member States) & EU market</h2>
<ul>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Granted self-identity and sovereignty through their own national enactments and read with Article 114 TFEU grants authority to Parliaments of Member States and the Council to enact rules and regulations in the interest of internal market harmonisation.</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">The EU AI Act (Regulation (EU) 2024/1689) (2), currently the only regulation for AI use and ensuring ethical practices are followed due to the nature of data shared and unreliable training model - profiling system.</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Ensure economic growth while also safeguarding fundamental rights of its citizens while cooperating within the internal market.</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Weakness: Lack of coordination, and implementation standards which can result in different rates and quality of transposition</li>
</ul>
<h2 class="mwt-heading" data-mwt-headingspacesbefore=" " data-mwt-headingspacesafter=" " data-mwt-headingnewlines="1">3. Palantir Technologies (Private entity)(3)</h2>
<ul>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Self-determined and incorporated in the United States. Deriving authority from contracts with EU entities to provide AI services.</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Governed by principles laid out in the contract, but supersedingly by United States’ legal framework by way of establishment. </li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Outsourced software building for data, decision and operation - notably in the national security, policing and advisory services for health care and national safety increasingly between EU states.</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Weakness: Unregulated access and processing of national data in light of the United States’ surveillance policy makes for data and infrastructural vulnerability in the EU.</li>
</ul>
 
Notes & references:
 
<ol>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Söderholm, S. (2023). Fundamental rights control when implementing predictive policing–a European perspective. Peking University law journal, 11(1), 91-104.</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, pp. 53–114).</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">https://www.politico.eu/article/europe-wants-to-kick-its-palantir-habit/</li>
<li class="mwt-list" data-mwt-sameline="false" data-mwt-spaces="">Meško, G. (2026). Modern Policing and Technology—European Perspectives—A Brief Reflection. European Journal of Crime, Criminal Law and Criminal Justice, 1(aop), 1-11.</li>
</ol>

Governance by institutions

2026-09-23T07:02:55Z

Kayembe Rodrigue:

[https://wiki.ivir.nl/index.php?title=Antropic%27s_Fable_5.1_(Kate_Davey) Anthropic's Fable 5.1 (Kate Davey)]

= [[cloud service (Ceren)]] =
* app store
*digital identity system
*online-payment system
*AI model
*public algorithmic system.
[https://wiki.ivir.nl/index.php?title=Decentralized_digital_currency:_BITCOIN_(Sisi) Decentralized Digital Currency: Bitcoin (Sisi)]

[[Submarine Internet Cables  - By Pablo Latorre]]

[[Artificial General Intelligence - By Sebastián Muller]]

[https://wiki.ivir.nl/index.php?title=Social-Media_Governance_in_the_EU_-_by_Sergey_Abramov Social-Media Governance - by Sergey Abramov]
== [[App Store Governance - Google Play (Paul)]]`` ==
== [[Representative Search Engine and AI Company in China, Baidu - By Jihae Park]] ==
= [https://wiki.ivir.nl/index.php?title=Revolut_Regulation Revolut Regulation] <div></div>

= [[Quantum Computing made in Barcelona: Qilimanjaro - by Mariona Fortuny Jané]] =

<div></div>

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:47:10Z

Kayembe Rodrigue:

EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut ("NEN")''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts\



===== '''IDEMIA: governing midstream, through design and implementation''' =====

*Public tender contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary,

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:46:31Z

Kayembe Rodrigue: /* Stichting Koninklijk Nederlands Normalisatie Instituut */

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut ("NEN")''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts\



===== '''IDEMIA: governing midstream, through design and implementation''' =====

*Public tender contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary,

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:45:43Z

Kayembe Rodrigue: /* European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) */

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts\

===== '''IDEMIA: governing midstream, through design and implementation''' =====

*Public tender contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary,

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:44:24Z

Kayembe Rodrigue: /* IDEMIA: governing midstream, through design and implementation */

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] of the European Parliament and of the Council and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts\

===== '''IDEMIA: governing midstream, through design and implementation''' =====

*Public tender contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary,

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:44:03Z

Kayembe Rodrigue:

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] of the European Parliament and of the Council and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts\

===== '''IDEMIA: governing midstream, through design and implementation''' =====

*Public tender contract with eu-LISA, plus proprietary technology.
*Govern via design and code.
*Secure identity verification; including, its own commercial interest.
*Algorithms are proprietary,

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:42:50Z

Kayembe Rodrigue: /* Stichting Koninklijk Nederlands Normalisatie Instituut */

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] of the European Parliament and of the Council and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329] 
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements. Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:32:32Z

Kayembe Rodrigue: /* European Data Protection Supervisor (EDPS) */

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] of the European Parliament and of the Council and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329]
*NEN is a private foundation, and ISO is a non-governmental federation of national standards bodies.
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements.  Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts, and participation costs time and money, so civil society and affected travellers are barely represented.

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:32:08Z

Kayembe Rodrigue: /* European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) */

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*It has the powers of investigation, corrective powers and sanctions, and authorisation and advisory powers.
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] of the European Parliament and of the Council and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329]
*NEN is a private foundation, and ISO is a non-governmental federation of national standards bodies.
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements.  Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts, and participation costs time and money, so civil society and affected travellers are barely represented.

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:31:21Z

Kayembe Rodrigue: /* Stichting Koninklijk Nederlands Normalisatie Instituut */

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*It has the powers of investigation, corrective powers and sanctions, and authorisation and advisory powers.
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems;
**financially accountable management of said large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] of the European Parliament and of the Council and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329]
*NEN is a private foundation, and ISO is a non-governmental federation of national standards bodies.
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements.  Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts, and participation costs time and money, so civil society and affected travellers are barely represented.

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:28:22Z

Kayembe Rodrigue: /* Stichting Koninklijk Nederlands Normalisatie Instituut */

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*It has the powers of investigation, corrective powers and sanctions, and authorisation and advisory powers.
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems;
**financially accountable management of said large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] of the European Parliament and of the Council and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329]
*NEN is a private foundation, and ISO is a non-governmental federation of national standards bodies.
*Collaborate with partners, by pooling know-how of the markets and technological developments and translating this into applicable agreements.  Promoting innovation, sustainability, safety, efficiency and international trade. 
*Legitimacy can be challenged''', '''although of the committees are dominated by industry and technical experts, and participation costs time and money, so civil society and affected travellers are barely represented.

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:22:25Z

Kayembe Rodrigue: /* Stichting Koninklijk Nederlands Normalisatie Instituut */

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*It has the powers of investigation, corrective powers and sanctions, and authorisation and advisory powers.
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems;
**financially accountable management of said large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] of the European Parliament and of the Council and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*SO/IEC JTC 1/SC 37 incorporated incorporated into EES as required by [https://eur-lex.europa.eu/eli/dec_impl/2019/329/oj/eng (EU) 2019/329]

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-23T00:10:07Z

Kayembe Rodrigue: /* Stichting Koninklijk Nederlands Normalisatie Instituut */standardising biometric technologies to support interoperability and data exchange between systems.

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*It has the powers of investigation, corrective powers and sanctions, and authorisation and advisory powers.
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems;
**financially accountable management of said large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] of the European Parliament and of the Council and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html notified] as State standardisation body as per [http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].
*Participant member on ISO/IEC JTC 1/SC 37 on the standardising of biometric technologies to support interoperability and exchange of data between systems. 
*

Entry/Exit System (EES) - Rodrigue Kayembe

2026-09-22T23:59:26Z

Kayembe Rodrigue: /* Stichting Koninklijk Nederlands Normalisatie Instituut */

'''Summary'''EES is the European wide automated border management system used for registering Schengen external border crossings for non-EU nationals crossing for short stays.

===== '''European Data Protection Supervisor (EDPS)''' =====
*EU’s independent data protection authority with a mission to monitor and ensure the protection of personal data and privacy. Focussed on when EU Institutions and bodies process any personal of information of an individual. In the instance of EES, it seeks to safeguard the fundamental right to data protection non-EU nationals whose personal data and biometrics the EES collects.
*Regulation [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1725 (EU) 2018/1725] outlines the rules for data protection in the EU institutions.  [http://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3701-39-1 Article 57 of Regulation (EU) 2018/1725] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj#d1e3832-39-1 Article 58 of Regulation (EU) 2018/1725] define the duties and authorities of the EDPS 
*It has the powers of investigation, corrective powers and sanctions, and authorisation and advisory powers.
*Limited enforcement powers by design, has the powers to bind EU bodies but not the EU legislature. Evidenced by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 Eurpol] case where it ordered Europol to delete large datasets on individuals with no established link to crime. The Parliament and Council responded by amending the [https://eur-lex.europa.eu/eli/reg/2022/991/oj Europol Regulation] to permit retroactive authorisation of that type of processing. This decision to amend was challenged, however the Court held that it lacked standing, as its special status "is not intended to limit the powers of the EU legislature" [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TO0578 (Case T-578/22 ''EDPS v Parliament and Council'', 6 September 2023, para 48)].

===== European Union Agency for Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) =====

*Responsible for managing large-scale IT systems in supporting the implementation of asylum, border management, migration, and justice policies in the EU wide.
*eu-LISA mission is to support EU member states and their digitalisation efforts in the EU's Justice and Home Affairs (JHA) domain by ensuring: 
**The efficient development of large scale IT systems;
**financially accountable management of said large scale IT systems; 
**the effective, secure and continuous operation of large-scale IT systems under it's scope;
**a high level of data protection;
**continuity and uninterrupted service
**appropriate level of data and physical security 
*Initially established by Regulation [https://eur-lex.europa.eu/eli/reg/2011/1077/oj/eng (EU) 1077/2011] of the European Parliament and of the Council and later it's mandate was reaffirmed under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1726-20250128 (EU) 2018/1726]. 
*One of eu-LISA weakness is around accountability, as it is essentially controlled by the actors that use it's systems. As per [https://eur-lex.europa.eu/eli/reg/2018/1726/2022-06-21/eng Reg. 2018/1726, art 20(1))] the management Board must comprise of representative of each Member State and two Commission representatives.

===== '''Stichting''' '''Koninklijk''' '''Nederlands''' '''Normalisatie''' '''Instituut''' =====
*Supports the standardisation process in The Netherlands and [https://zoek.officielebekendmakingen.nl/stcrt-2015-39157.html nominated] as State standardisation body as per[http://data.europa.eu/eli/reg/2012/1025/oj/eng Regulation (EU) No 1025/2012 on European standardisation] as [//Regulation%20(EU)%202022/2480%20amending%20Regulation%20(EU)%20No%201025/2012 amended].