Technology Governance Wiki - Recent changes [en]

Data: Data Portability

Plixavra — Wed, 14 Oct 2026 07:21:54 GMT

United States

Show changes

Data:China

Plixavra — Wed, 14 Oct 2026 07:20:39 GMT

Show changes

Data:China

Plixavra — Wed, 14 Oct 2026 07:19:18 GMT

Created page with "text to be added"

New page

text to be added

Data: Data Portability

Plixavra — Wed, 14 Oct 2026 07:19:09 GMT

China

← Older revision		Revision as of 09:19, 14 October 2026
(4 intermediate revisions by the same user not shown)
Line 2:		Line 2:

	According to [https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_20 Article 20] of the General Data Protection Regulation, "[the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided" where processing is based on consent or contract and is carried out by automated means. Additionally, the [https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng Data Act ] foresees that data portability should support interoperability of data processing services, while data portability should also be ensured as part of the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] gatekeeper obligations.		According to [https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_20 Article 20] of the General Data Protection Regulation, "[the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided" where processing is based on consent or contract and is carried out by automated means. Additionally, the [https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng Data Act ] foresees that data portability should support interoperability of data processing services, while data portability should also be ensured as part of the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] gatekeeper obligations.
	== <span dir="ltr" lang="en"><span class="mw-page-title-main">[[Data:Brazil\|Brazil]]</span></span> ==		= <span dir="ltr" lang="en"><span class="mw-page-title-main">[[Data:Brazil\|Brazil]]</span></span> =
	<span dir="ltr" lang="en"><span class="mw-page-title-main">in ~~progress~~</span></span>		<span dir="ltr" lang="en"><span class="mw-page-title-main">Click on the link above to find out more about data portability in Brazil.</span></span>

	= China ~~- Ceren, Sergey, Juliette~~ =		= [[Data:China\|China]] =
	== 1. Overview ==
			= 1. Overview =
	<p>The Personal Information Protection Law ([https://en.spp.gov.cn/2021-12/29/c_948419.htm PIPL])  came into effect on 1 November 2021, much later than the General Data Protection Regulation ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504 GDPR]) which came into force on 24 May 2016. PIPL is China’s primary legal framework for personal information protection and has notable parallels with the GDPR, while reflecting distinctly Chinese regulatory priorities.</p>		<p>The Personal Information Protection Law ([https://en.spp.gov.cn/2021-12/29/c_948419.htm PIPL])  came into effect on 1 November 2021, much later than the General Data Protection Regulation ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504 GDPR]) which came into force on 24 May 2016. PIPL is China’s primary legal framework for personal information protection and has notable parallels with the GDPR, while reflecting distinctly Chinese regulatory priorities.</p>

Line 99:		Line 100:
	<p>While data transfers outside of China should not be confused with the general right to data portability, the interplay between the two could be considered. A limitation, or a lack in the adoption of the right to data portability results in less flow of data both within China, and outside of China. While data transfers abroad do not form part of this exercise, it should also be noted that the main driving factor of EU’s data protection regime is the free flow of information within the internal market, while China does not take part in such a union and is therefore not incentivized by such a market goal.</p>		<p>While data transfers outside of China should not be confused with the general right to data portability, the interplay between the two could be considered. A limitation, or a lack in the adoption of the right to data portability results in less flow of data both within China, and outside of China. While data transfers abroad do not form part of this exercise, it should also be noted that the main driving factor of EU’s data protection regime is the free flow of information within the internal market, while China does not take part in such a union and is therefore not incentivized by such a market goal.</p>

	== <span dir="ltr" lang="en"><span class="mw-page-title-main">[[Data:India\|India]]</span></span> ==		= <span dir="ltr" lang="en"><span class="mw-page-title-main">[[Data:India\|India]]</span></span> =

	== <span dir="ltr" lang="en"><span class="mw-page-title-main">[[Data Portability (USA)\|United States]]</span></span> ==		<span dir="ltr" lang="en"><span class="mw-page-title-main">Click on the link above to find out more about data portability in India.</span></span>
	in ~~progress~~		= <span dir="ltr" lang="en"><span class="mw-page-title-main">[[Data Portability (USA)\|United States]]</span></span> =
			<span dir="ltr" lang="en"><span class="mw-page-title-main">Click on the link above to find out more about data portability in the United States</span></span>

Data:India

Latorre Tallard Pablo — Sat, 10 Oct 2026 22:02:05 GMT

← Older revision		Revision as of 00:02, 11 October 2026
Line 1:		Line 1:
			'''Words: 1911'''
	= Data Portability Rights =		= Data Portability Rights =
	<p style="text-align: justify;">Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).</p>		<p style="text-align: justify;">Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).</p>

Infrastructures:China

Latorre Tallard Pablo — Sat, 10 Oct 2026 21:58:32 GMT

References

Show changes

Infrastructures: Digital Sovereignty

Latorre Tallard Pablo — Sat, 10 Oct 2026 21:56:28 GMT

China

Show changes

Infrastructures:China

Latorre Tallard Pablo — Sat, 10 Oct 2026 21:54:59 GMT

Created page with "<p>'''Words: 2306'''<br></p><div><p><br></p></div><div> == '''Introduction''' == </div><div><p style="text-align: justify;" ><span style="font-size: 14.4px;">“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and..."

New page

<p>'''Words: 2306'''<br></p><div><p><br></p></div><div>
== '''Introduction''' ==
</div><div><p style="text-align: justify;" ><span style="font-size: 14.4px;">“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and network sovereignty in direct relation to digital and technological independence.</span><br></p></div><div style="text-align: justify;" ><p>In the early 2000s, Chinese authorities focused primarily on controlling data flows rather than developing national technological champions. Indeed, at the time Google held around the 40% of the Chinese Internet search market and companies like Yahoo maintained substantial equity participation in Chinese firms like Alibaba, all of which ended in 2009 when the Urumqi riots triggered China’s decision to permanently block platforms like Facebook and YouTube, prompting Google’s withdrawal from the Chinese Internet search market.</p></div><div style="text-align: justify;" ><p>In 2010 “Cyber Sovereignty” was crystallized as an organizing principle of Chinese digital policy following historical concerns about information control and a national determination to resist foreign influence over China. This political and economic landscape cemented the nation’s ambition to achieve full digital sovereignty.</p></div><div><p style="text-align: justify;" >Today Chinese digital sovereignty is incorporated into its legal framework, particularly in the Cybersecurity Law and the Data Security Law (both from 2017). These laws aim for China to develop the autonomy and capacity necessary to exercise full control over its information infrastructure and data.</p></div><div><p><br></p></div><div>
== '''Cybersecurity Law''' ==
</div><div><p style="text-align: justify;" >The Cybersecurity Law is a comprehensive legal framework that regulates cyberspace and information infrastructure security in China, governing information networks build, operation, and use within its territory (see article 2). The law covers a wide range of issues, including critical information infrastructure management, cybersecurity, and data protection.</p></div><div style="text-align: justify;" ><p>In the area of critical information infrastructure management, the law applies to “Critical Information Infrastructures” (CIIs) and “Critical Information Infrastructure Operators” (CIIOs) which include information infrastructure and its operators in sectors such as energy, finance, healthcare, telecommunications, transportation, and governmental services. CIIOs have the obligation to adopt enhanced security measures and protocols to safeguard information infrastructure and their data. Additionally, CIIOs must perform regular security assessments and report their results to State agencies, implement protective measures and protocols, and cooperate with State agencies, among others (see articles 23, 36, 37, 38, and 40).</p></div><div style="text-align: justify;" ><p>In the area of cybersecurity, the law applies to all information infrastructure operators (not only to CIIOs) which have the obligation to adopt comprehensive cybersecurity measures which include monitoring their infrastructure security, safeguarding against data breaches, impeding misuse of their infrastructures for illegal activities, prepare incident response plans, report cybersecurity incidents, and cooperate with State agencies (see articles 23, 27, 30 and 51).</p></div><div style="text-align: justify;" ><p>Finally, in the area of data protection, the law applies to CIIOs in the case of data localization, and to all information infrastructure operators in the case of personal information. CIIOs have the obligation to store within China all critical data and personal information they collect or generate in the country’s territory. Additionally, CIIOs must pass a security evaluation and get State authorization to transfer data abroad (see article 39). Moreover, all information infrastructure operators have the obligation to follow guidelines for collecting, processing, and storing personal information. In that sense, information infrastructure operators must secure user consent for gathering personal information and disclose it, and warrant its protection by implementing measures to guard against unauthorized or illegal access and misuse including breach notification (see article 42).</p></div><div style="text-align: justify;" ><p>Additionally, the law establishes obligations for the State including to balance cybersecurity and information infrastructure development (see article 4), continuously improve the national cybersecurity strategy (see article 5), and deal with cybersecurity risks and threats (see article 6).</p></div><div style="text-align: justify;" ><p>In general, the law provides the State extensive powers to access data held by information infrastructure operators functioning within China, including the authority to require assistance and support in matters of national security or criminal investigations.</p></div><div><p style="text-align: justify;" >Infringing the law can result in sanctions for information infrastructure operators which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a threat to public order or national security, infringements can result in criminal prosecution and career suspension (see articles 61, 63, 64, 65, 66, 68, 69, 71, and 76).</p></div><div><p><br></p></div><div>
== '''Data Security Law''' ==
</div><div><p style="text-align: justify;" ><span style="font-size: 14.4px;">The Data Security Law is a comprehensive legal framework that regulates data management for the purposes of national sovereignty, security, and social and economic development.</span><br></p></div><div style="text-align: justify;" ><p>It establishes the obligation of the State to develop a data classification system based on its importance to social and economic development and the damage its alteration, destruction, leakage, or illicit use would cause to national security, public interest, or people or organizations’ rights and interests. Such classification allows the State to apply varying protection levels depending on the data’s sensitivity and relevance, where “central data of the State” or data deemed important to national security, major public interests, critical economic sectors, or important aspects of people livelihood is given the highest level of protection (see article 21). Other categories of data are “important data” and “general data” which are not defined in the law but in complementary regulations.</p></div><div style="text-align: justify;" ><p>The law applies to data management carried out within China’s territory, and generates legal responsibility for data management outside if it harms national security, public interest, or people or organizations’ rights and interests (see article 2). Data processors of “important data” have the obligation to designate officers responsible for data security, to conduct risk evaluations periodically reporting the results to State authorities, and to report security incidents to users and State authorities, among others (see articles 27, 29 and 30). Moreover, data processors are impeded to transfer data to foreign judicial authorities without authorization (see article 36).</p></div><div style="text-align: justify;" ><p>Additionally, the law establishes obligations for the State including to encourage the use of data for economic and innovation purposes, specifically for the development of new data-driven industries as long as they comply with the law (see article 1). Also, it has the obligation to coordinate the national data security, and draft and implement the national data security strategy (see article 5).</p></div><div style="text-align: justify;" ><p>In general the law enables the State to collect data if it is necessary to safeguard national security or investigate crimes, subject to approval procedures (see article 35). Data processors and individuals are obliged to cooperate, and refusal is subject to fines (see article 48).</p></div><div><p style="text-align: justify;" >Infringing the law can result in sanctions which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a crime or a threat to national sovereignty, security, or economic development interests, infringements can result in criminal prosecution (see articles 45 and 52).</p></div><div><p><br></p></div><div>
== '''Personal Information Protection Law''' ==
</div><div><p style="text-align: justify;" ><span style="font-size: 14.4px;">The Personal Information Protection Law (of 2021) is a comprehensive legal framework that protects personal information similarly to the European General Data Protection Regulation (GDPR). Although the law is not directly related to China’s digital sovereignty, it establishes obligations relevant to it: State agencies, critical infrastructure operators, and data processors that collect, process, or use data above a certain threshold (defined by State authorities) must store within China all personal information they collect or generate in the country’s territory. Additionally, they must pass a security evaluation and get State authorization to transfer data abroad (see articles 36 and 40).</span><br></p></div><div><p style="text-align: justify;" >Moreover, the State is allowed to blacklist individuals and organizations and deny them access to personal information generated or collected in China if it deems that they acted against Chinese people rights or interests, as well as to adopt reciprocal measures against foreign States if it deems that they discriminated against China regarding the protection of personal information (see articles 42 and 43).</p></div><div><p><br></p></div><div>
== '''China’s State Centered Concept of Digital Sovereignty''' ==
</div><div><p style="text-align: justify;" ><span style="font-size: 14.4px;">The Cybersecurity Law and the Data Security Law are integral parts of China’s strategy to strengthen its digital sovereignty. China’s concept of digital sovereignty is characterized for its strong State-centered approach in which the State holds ultimate and supreme authority in the digital space, controlling data flows and content sharing within its borders. In a sense, China’s concept of digital sovereignty is defensive: it is essential to protect China’s social, political, and economic architecture from destabilization attempts by foreign actors, which explains why the Cybersecurity Law establishes the obligation of private actors to </span><em style="font-size: 14.4px;">“abide by the Constitution and laws, observe public order, respect social morality, and (...) not (...) use the Internet to engage in activities that endanger national security, honor, or interests (...), incite subversion of State power or overthrow of the socialist system (...), incite secession or undermine national unity (...), (or) fabricate or disseminate false information to disrupt economic and social order”</em><span style="font-size: 14.4px;"> (see article 13), and why the the Data Security Law establishes as an objective to </span><em style="font-size: 14.4px;">“preserve State sovereignty, security, and development interests”</em><span style="font-size: 14.4px;"> (see article 1).</span><br></p></div><div style="text-align: justify;" ><p>Such a concept requires the achievement of two policy objectives: territorialization and indigenization. Through territorialization China seeks to replicate its national borders in cyberspace, ensuring that online processes impacting important national interests take place within Chinese boundaries, and unwanted practices or operations can be barred from entering. Through indigenization, in turn, it strives to replace foreign actors and technologies with local equivalents, reducing foreign dependence.</p></div><div style="text-align: justify;" ><p>In this context, the Cybersecurity Law and the Data Security Law aim to protect China’s digital sovereignty through both policy objectives. In the case of territorialization, they establish the objective of protecting sovereignty in cyberspace and preventing and responding to cybersecurity risks and threats coming from inside and outside China; the obligation of CIIOs to store in China all personal information and important data that they generate or collect inside the country’s borders, and to conduct security evaluations and obtain State permission before transferring them abroad; the obligation of data processors to not transfer data to foreign judicial authorities without State authorization; the responsibility of data processors for activities carried out outside China; and the capacity of the State to block prohibited information, to temporarily restrict communications in specific areas for national security reasons, and to adopt countermeasures against foreign States that discriminate against China in data investment or trade.</p></div><div style="text-align: justify;" ><p>In the case of indigenization, the laws establish mechanisms of promotion and access control that indirectly privilege national providers. As an example, they establish the obligation of critical infrastructure operators to purchase information network products and services approved in a national security assessment; the obligation of critical information network products providers to offer products that are certified or comply with national standards; the obligation of the State to support Chinese cybersecurity industries and projects, to support Chinese Artificial Intelligence (AI) industries, to support data development and security industrial systems, to support the creation of national data markets, and to develop a national strategy for big data and data infrastructure.</p></div><div style="text-align: justify;" ><p>These efforts are related to the “Great Firewall”, the Chinese State system for censoring and controlling Internet traffic within its borders which is, arguably, the most visible example of territorialization, drawing an effective Internet frontier between China and the rest of the world.</p></div><div><p style="text-align: justify;" >In this way, China's digital sovereignty concept demands asserting control over information infrastructures and data gathered or generated within its borders as well as to protect relevant or sensitive information from foreign interference and cyber-attacks while simultaneously reinforcing its surveillance capacity and its ability to manage information flows for “social stability”.</p></div><div><p><br></p></div><div>
== '''China Model Versus the European Union Model''' ==
</div><div><p style="text-align: justify;" ><span style="font-size: 14.4px;">The European Union (EU) and China represent two different models of digital sovereignty. The EU approach contrasts with China’s State-centered and security-driven model because it emerged from a supranational, rights-centered, and democratic context.</span><br></p></div><div style="text-align: justify;" ><p>EU’s efforts to achieve digital sovereignty began in 2013 when Edward Snowden’s revelations of United States National Security Agency (NSA) interception of European communications exposed its dependence on foreign technology and triggered a wave of policy and regulatory efforts. Such efforts led to the adoption of the GDPR in 2016 which enshrined individuals' rights, including the rights of access to and objection to processing of personal data. The EU continued by developing two consumer protection regulations in 2019, in addition to conducting several antitrust proceedings against American hyperscalers such as Alphabet, Amazon, and Apple between 2015 and 2020. In 2024, the EU adopted the AI Act with the purpose of harmonizing AI development and deployment with EU values and fundamental rights. More recently, the EU initiated infrastructure initiatives such as Gaia X for cloud sovereignty and the Chips Act for semiconductor independence.</p></div><div style="text-align: justify;" ><p>Despite this extensive regulatory framework, China's claim to digital sovereignty may be considered more consolidated than the EU's because it fuses legal codification with direct State control over technology, information, and infrastructure in a way the EU market-correcting model does not yet.</p></div><div style="text-align: justify;" ><p>As European Commission President von der Leyen stated in 2019, ''"it is not too late to achieve technological sovereignty in some critical technology areas"''. The EU has been trying to catching up with China, which spent the last decade tightening its State authority over its digital infrastructure before the EU began treating its own technology dependence as a vulnerability. China's more recent legislative activity has extended this consolidation into the international stage as well as domestically. In 2024, the Shanghai Declaration on Global AI Governance, issued by China's Ministry of Foreign Affairs, committed signatories to developing AI under principles of safety, reliability, and controllability, while asserting each country's right to regulate AI according to its own national conditions. This language simultaneously projects openness to international cooperation while defending from non-foreign interference, the logic underpinning China's digital sovereignty doctrine.</p></div><div style="text-align: justify;" ><p>This declaration is not merely aspirational: it is anchored in binding domestic law, specifically Article 20 of China's Security Law, which directs the State to support AI research, infrastructure, ethical norms, and risk supervision.</p></div><div><p style="text-align: justify;" >Therefore, where the EU’s sovereignty is exercised primarily through regulating outside actors within its internal market, China's sovereignty is exercised through direct State-led development, information control, and an explicit fusion of domestic statutes and international declaratory positioning. This makes China's model arguably more comprehensive compared to the EU.</p></div><div><p><br></p>
== '''References''' ==
</div><div><p><strong style="font-size: 14.4px;">(1)</strong><span class="apple-converted-space" style="font-size: 14.4px;"> </span><span style="font-size: 14.4px;">Cybersecurity Law of the People's Republic of China (2025 Amendment).</span><br></p></div><div><p>'''(2)'''<span class="apple-converted-space"> </span>Data Security Law of the People's Republic of China (2021).</p></div><div><p>'''(3)'''<span class="apple-converted-space"> </span>Personal Information Protection Law of the People's Republic of China (2021).</p></div><div><p>'''(4)'''<span class="apple-converted-space"> </span>Ministry of Foreign Affairs of the People's Republic of China, "Shanghai Declaration on Global AI Governance" (4 July 2024).</p></div><div><p>'''(5)'''<span class="apple-converted-space"> </span>Jiang, M. Models of State Digital Sovereignty From the Global South: Diverging Experiences From China, India and South Africa, Policy & Internet, 15 December 2024, </p>[https://doi.org/10.1002/poi3.427' https://doi.org/10.1002/poi3.427']</div><div><p>'''(6)'''<span class="apple-converted-space"> </span>Rivaton, R., “The Origins and Fate of Digital Sovereignty”, Fondation pour L’Innovation Politique, 21 may 2026, </p>[https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty]</div><div style="text-align: justify;" >'''(7) '''Thumfart, J. & Cong. W., “A Chinese Precursor to the Digital Sovereignty Debate: Digital Anti-Colonialism and Authoritarianism from the Post–Cold War Era to the Tunis Agenda”, Global Studies Quarterly (2022) 2, 1–13.</div>

Infrastructures: Digital Sovereignty

Latorre Tallard Pablo — Sat, 10 Oct 2026 21:52:12 GMT

China

Show changes

Governance by markets

Latorre Tallard Pablo — Sat, 10 Oct 2026 21:50:16 GMT

Multi-homing (Juliette)

@@ Line 94: / Line 94: @@
 (4) Zhu F and Iansiti M, 'Why Some Platforms Thrive and Others Don't' (2019) Harvard Business Review (January–February) 118
 = Vertical Integration by Pablo Latorre =
 <p>'''1. Definition'''</p>
-= Vertical Integration by Pablo Latorre =<p>'''1. Definition'''</p><p style="text-align: justify;">“Vertical Integration” is the control by a single corporation of two or more consecutive steps of the same production chain of activity in such a manner that said corporation does not need to rely on others for them (1). In the context of digital markets, “Vertical Integration” usually refers to the position of a platform that operates a marketplace or infrastructure that other enterprises depend on and, at the same time, commercializes products or services in that same space (2). Therefore, in a “Vertical Integration” the platform is both, provider and competitor, of other enterprises.</p><p><br></p><p>'''2. Example: Amazon as a Marketplace'''</p><p style="text-align: justify;">Amazon operates the largest online marketplace (3) in the world and, thus, thousands of small and medium size enterprises depend on it to connect with their costumers. At the same time, Amazon commercializes its own products on its marketplace (4), acting as a retailer and competitor to those enterprises. Such dual role allows Amazon to exercise competitive advantages: first, it can access detailed, non-public data on the enterprises’ sales, including products, prices, and costumer behavior; and second, it can decide the rules that define the products that appear first as the result of a costumer search.</p><p style="text-align: justify;">In 2022 Amazon had to commit to the European Commission to not use the enterprises’ non-public data for its retail business and to treat equally rival offers in its “Buy Box” (5). Currently, the Digital Markets Act (DMA) establishes matching general obligations for designated gatekeepers (6).</p><p><br></p><p>'''3. Governance Implication'''</p><p style="text-align: justify;">“Vertical Integration” allows platforms to exercise power over enterprises through digital architecture. When a platform operates a marketplace and competes in it, its ordinary decisions on digital architecture (i.e. on algorithms, searches, products visibility) can become tools for power and competition. In a sense, platforms are the ''de facto'' private regulators of markets in which they have clear commercial interests. Such state of affairs allows to understand a strategy change in antitrust cases. Traditionally, antitrust intervenes after the harm, however regulators are moving towards ''ex ante'' conduct rules (i.e. the DMA) (7).</p><p><br></p><p>'''4. Open Question'''</p><p style="text-align: justify;">“Vertical Integration” clearly explains the incentive structure that drives platforms to favor their own products through the exercise of digital architecture mediated competitive advantages. However, “Vertical Integration” assumes that the line between one product (i.e. the marketplace, the search engine) and the other (i.e. the products, the websites competing on the platform) is clear when, in practice, this is not always so. For instance, nowadays when a user search something in Google Search, Google not only provides links to websites that contain the desired information but also the desired information itself with AI-generated summaries. In this case, two possible perspectives arise: on the one hand, that Google could be abusing its position to capture the online information market by displacing websites that depend on it; on the other hand, that Google could be simply improving its search engine and search itself because what users actually want is information and not links to it. In this example, “Vertical Integration” is incapable of settling the issue because it depends on a clear distinction between one product and the other (or one market and the other) and that is absent in this case. Moreover, even if in the presented case was possible to separate one product from the other (or one market from the other), “Vertical Integration” does not provide a clear criteria to establish when an “integration” is abusive exclusion of competitors and when it is legitimate and necessary innovation.</p><p><br></p><p>'''References'''</p><p>(1) “Vertical integration” (''Cambridge Dictionary'') [https://dictionary.cambridge.org/dictionary/english/vertical-integration https://dictionary.cambridge.org/dictionary/english/vertical-integration] accessed 4 October 2026.</p><p>(2) [https://academic.oup.com/antitrust/article/6/3/355/5034073?itm_medium=sidebar&itm_source=trendmd-widget&itm_campaign=Journal_of_Antitrust_Enforcement&itm_content=Journal_of_Antitrust_Enforcement_0 Bostoen Friso, “Online Platforms and Vertical Integration: The Return of Margin Squeeze” (2018) (6) Journal of Antitrust Enforcement 355.]</p><p style="text-align: justify;">(3) Lovell Keir, “Top 10 Ecommerce Marketplaces in the World: 2026 Rankings by GMV, Users & Reach” (''ServeRetail'', 2 January 2026) [https://www.serveretail.com/blog/marketplace/the-10-largest-ecommerce-marketplaces-in-the-world-size-reach-and-cx-strategy/ https://www.serveretail.com/blog/marketplace/the-10-largest-ecommerce-marketplaces-in-the-world-size-reach-and-cx-strategy/] accessed 4 October 2026.</p><p>(4) Ellison Mara, “What are Amazon's Brands, Explained” (''Ir Mountaintopuniversity Ng'') [https://ir.mountaintopuniversity.edu.ng/article/what-are-amazon-s-brands-explained https://ir.mountaintopuniversity.edu.ng/article/what-are-amazon-s-brands-explained] accessed 4 October 2026.</p><p style="text-align: justify;">(5) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=oj:JOC_2023_087_R_0005 Summary of Commission Decision of 20 December 2022 Relating to a Proceeding under Article 102 of the Treaty on the Functioning of the European Union and Article 54 of the EEA Agreement (Cases AT.40462 – Amazon Marketplace, and AT.40703 – Amazon Buy Box) (2023) OJ C87.]</p><p style="text-align: justify;">(6) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2022.265.01.0001.01.ENG&toc=OJ%3AL%3A2022%3A265%3ATOC Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (2022).]</p><p style="text-align: justify;">(7) OECD, "Ex Ante Regulation and Competition in Digital Markets" (''OECD Roundtables on Competition Policy Papers, OECD Publishing 2021'') [https://doi.org/10.1787/c83e178d-en https://doi.org/10.1787/c83e178d-en] accessed 4 October 2026.</p>
+<p style="text-align: justify;">“Vertical Integration” is the control by a single corporation of two or more consecutive steps of the same production chain of activity in such a manner that said corporation does not need to rely on others for them (1). In the context of digital markets, “Vertical Integration” usually refers to the position of a platform that operates a marketplace or infrastructure that other enterprises depend on and, at the same time, commercializes products or services in that same space (2). Therefore, in a “Vertical Integration” the platform is both, provider and competitor, of other enterprises.</p>

Data:Brazil

Paul Stein — Fri, 09 Oct 2026 12:23:35 GMT

Data Portability beyond the LGPD

Show changes

Data Portability (USA)

Müller Tapia Sebastián — Fri, 09 Oct 2026 12:06:21 GMT

← Older revision		Revision as of 14:06, 9 October 2026
Line 19:		Line 19:
	We have chosen California as:		We have chosen California as:

	* It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 ''dark horse contender'']” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states;<br />		* It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 ''dark horse contender'']” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states;<br>
	* It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the ''‘‘[https://archive.org/details/tradingupconsume0000voge California effect’]’''.		* It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the ''‘‘[https://archive.org/details/tradingupconsume0000voge California effect’]’''.

	As for Utah, its selection stems from the contrast it presents:		As for Utah, its selection stems from the contrast it presents:

	* Its [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022] (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy [https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report] in comparison to California’s leading score of 69/100;<br />		* Its [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022] (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy [https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report] in comparison to California’s leading score of 69/100;<br>
	* Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by “technically feasible” and “practicable”;<br />		* Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by “technically feasible” and “practicable”;<br>
	* Yet, through the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025] (DCA), it became the first US state to require social media platforms to provide [https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability] through open protocols.		* Yet, through the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025] (DCA), it became the first US state to require social media platforms to provide [https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability] through open protocols.

Line 42:		Line 41:
	=== Utah ===		=== Utah ===

	[https://le.utah.gov/~2022/bills/static/SB0227.html UCPA] entered into effect in December, 2023. Consumers are conferred portability rights via [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer’s personal data, that the consumer previously provided to the controller, in a format that:<br />		[https://le.utah.gov/~2022/bills/static/SB0227.html UCPA] entered into effect in December, 2023. Consumers are conferred portability rights via [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer’s personal data, that the consumer previously provided to the controller, in a format that:<br>
	(a) to the extent technically feasible, is portable;<br />		(a) to the extent technically feasible, is portable;<br>
	(b) to the extent practicable, is readily usable; and<br />		(b) to the extent practicable, is readily usable; and<br>
	(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.		(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.

Line 51:		Line 50:
	Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266] that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code [https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4]).		Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266] that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code [https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4]).

	Utah lead the charge introducing the [https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind] legislation amongst states requiring social media platforms to provide interoperability through open protocols under the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act] (UDCA), enacted in 2025, and whose section [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201] outlines that “''If a consumer requests a copy of the consumer’s personal data under [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html Section 13-61-201], a social media service shall provide the personal data, including the user’s social graph, in a format that:''<br />		Utah lead the charge introducing the [https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind] legislation amongst states requiring social media platforms to provide interoperability through open protocols under the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act] (UDCA), enacted in 2025, and whose section [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201] outlines that “''If a consumer requests a copy of the consumer’s personal data under [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html Section 13-61-201], a social media service shall provide the personal data, including the user’s social graph, in a format that:''<br>''(1) is portable, to the extent technically feasible;''<br>''(2) is readily usable, to the extent practicable; and''<br>''(3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.
	''(1) is portable, to the extent technically feasible;''<br />
	''(2) is readily usable, to the extent practicable; and''<br />
	''(3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.

	Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of [https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA] deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy [https://www.transunion.com/ccpa-metrics data] suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.		Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of [https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA] deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy [https://www.transunion.com/ccpa-metrics data] suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.
Line 65:		Line 61:
	“RTDP stems from technical codification and trust governance rather than legal codification”.		“RTDP stems from technical codification and trust governance rather than legal codification”.

	* Dependence and the lack of appropriate infrastructures<br />		* Dependence and the lack of appropriate infrastructures<br>
	* Need for sector-specific standardisation<br />		* Need for sector-specific standardisation<br>
	* ever-changing nature of the regulatory subject in a digital world;		* ever-changing nature of the regulatory subject in a digital world;

	makes it hard to implement data portability efficiently.		makes it hard to implement data portability efficiently.

Line 86:		Line 81:
	=== EU Comparison ===		=== EU Comparison ===

	The modern US data portability framework has been influenced, though not determined, by the EU’s GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time.		The modern US data portability framework has been influenced, though not determined, by the EU’s GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time. A chart with a comparison between each jurisdiction can be found below:

			{\| style="border-collapse: collapse; width: 1263px; height: 1px;" border="1"
			\|-
			\| style="width: 102.162px;" \| <p><br></p>
			\| style="width: 349.55px;" \| <p>EU</p>
			\| style="width: 395.625px;" \| <p>California</p>
			\| style="width: 403.663px;" \| <p>Utah</p>
			\|-
			\| style="width: 102.162px;" \| <p>Data elements</p><p><br></p>
			\| style="width: 349.55px;" \| <p>Data provided to the controller</p>
			\| style="width: 395.625px;" \| <p>Data obtained from the consumer</p>
			\| style="width: 403.663px;" \| <p>Data provided to the controller</p>
			\|-
			\| style="width: 102.162px;" \| <p>Format</p><p><br></p>
			\| style="width: 349.55px;" \| <p>Structured, commonly used and machine-readable</p>
			\| style="width: 395.625px;" \| <p>Understandable, structured, commonly used and machine-readable</p>
			\| style="width: 403.663px;" \| <p>Portable and readily usable</p>
			\|-
			\| style="width: 102.162px;" \| <p>Costs</p><p><br></p>
			\| style="width: 349.55px;" \| <p>Free unless manifestly unfounded or excessive</p>
			\| style="width: 395.625px;" \| <p>Free unless manifestly unfounded or excessive</p>
			\| style="width: 403.663px;" \| <p>Free for the first request in a 12-month period</p>
			\|-
			\| style="width: 102.162px;" \| <p>Transfer</p>
			\| style="width: 349.55px;" \| <p>Data subject or controller if technically feasible upon request</p>
			\| style="width: 395.625px;" \| <p>Consumer or business if technically feasible upon request</p>
			\| style="width: 403.663px;" \| <p>Consumer, if DP is processed through automated means</p>
			\|-
			\| style="width: 102.162px;" \| <p>Deadlines</p>
			\| style="width: 349.55px;" \| <p>1 month</p>
			\| style="width: 395.625px;" \| <p>45 days</p>
			\| style="width: 403.663px;" \| <p>45 days</p>
			\|}
	We have mainly explored data portability via the lens of consumers and personal data. The EU has taken note of this and addressed it via [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]. The US lacks an equivalent to the Data Act’s switching provisions. US businesses have nonetheless benefited indirectly, as AWS, Microsoft and Google waived exit egress fees globally in 2024 ahead of the Data Act’s obligations, exemplifying the Brussels effect.		We have mainly explored data portability via the lens of consumers and personal data. The EU has taken note of this and addressed it via [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]. The US lacks an equivalent to the Data Act’s switching provisions. US businesses have nonetheless benefited indirectly, as AWS, Microsoft and Google waived exit egress fees globally in 2024 ahead of the Data Act’s obligations, exemplifying the Brussels effect.

Data:India

Davey Kate — Fri, 09 Oct 2026 07:06:20 GMT

References

← Older revision		Revision as of 09:06, 9 October 2026
(8 intermediate revisions by the same user not shown)
Line 17:		Line 17:

	= Comparison with the European Union Data Portability Regime =		= Comparison with the European Union Data Portability Regime =
	<p style="text-align: justify;">The ~~three~~ most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.</p>		<p style="text-align: justify;">The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.</p>
	<p style="text-align: justify;">Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.</p>		<p style="text-align: justify;">Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.</p>
	<p style="text-align: justify;">The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal. As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (25). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.</p>		<p style="text-align: justify;">The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.</p>
	<p style="text-align: justify;">India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (26). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.</p>		<p style="text-align: justify;">India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.</p>
	<p style="text-align: justify;">But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (27).</p>		<p style="text-align: justify;">But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).</p>
	<p style="text-align: justify;">In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (28). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often. The Data Act has only been applicable since September 2025, so it is even harder to say how effective it has been.</p>		<p style="text-align: justify;">In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.</p>
	<p style="text-align: justify;">While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (29). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (30). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.</p>		<p style="text-align: justify;">While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.</p>
	<p style="text-align: justify;">How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (31). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (32).</p>		<p style="text-align: justify;">How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).</p>
	India has no Data Act equivalent. Khandelwal ~~considered~~ that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model~~, which extends data rights sector by sector~~, India may be attempting the same ~~sector~~ approach to make the compliance costs smaller for companies (33). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (34).<p style="text-align: justify;">What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.</p>		India has no Data Act equivalent. Although India never officially explained why it dropped the general right to data portability from the final DPDPA nor why it's taking a sectoral approach, Khandelwal considers that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, India may be attempting the same sectoral approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).<p style="text-align: justify;">What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.</p>

	= References =		= References =
Line 77:		Line 77:
	(24) GDPR (n 23).		(24) GDPR (n 23).

	(25) ~~Lazarotto~~ (~~n 22~~).		(25) Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (2023) OJ L 2023/2854.

	(26) ~~DPDP Act 2023~~ (n 6).		(26) Lazarotto (n 22).

	(27) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) ~~International Data Privacy Law 173, accessed 4 October 2026~~.]		(27) DPDP Act 2023 (n 6).

	(28) [https://~~petsymposium~~.~~org~~/~~popets~~/~~2021~~/~~popets-2021-0051.php Syrmoudis Emmanuel~~ & ~~Others~~, ~~“Data~~ Portability ~~between Online Services~~: ~~An Empirical Analysis on~~ the ~~Effectiveness~~ of ~~GDPR Article 20” [2021]~~ (3) ~~Proceedings on~~ Privacy ~~Enhancing Technologies 351~~.]		(28) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

	(29) ~~Khandelwal~~ (~~n 9~~).		(29) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

	(30) ~~Khandelwal~~ (n 9).		(30) Lazarotto (n 22).<br>(31) Data Act (n 25), art 50.

	(31) ~~[https://financialservices~~.~~gov.in/account-aggregator-framework~~ Department of Financial Services, Ministry of Finance (~~<em>~~India~~</em>~~), “Account Aggregator Framework” (~~<em>~~Department of Financial Services, last updated 27 May 2026</~~em>)~~ accessed 4 October 2026.]		(32) Khandelwal (n 9).<br>(33) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) https://financialservices.gov.in/account-aggregator-framework accessed 4 October 2026.

	(32) ~~DCB 2024~~ (~~n 19~~).		(34) Lakshmikumaran & Sridharan, “DPDP Act and Rules: A Ticking Compliance Timeline” (Lakshmikumaran & Sridharan, 12 May 2026) google.com/url?q=https://www.lkslaw.com/insights/articles/dpdp-act-and-rules-a-ticking-compliance-timeline&sa=D&source=docs&ust=1791533165444212&usg=AOvVaw0UnGsQPiEAPPEtcWmOYxaR accessed 4 October 2026.

	(33) ~~Khandelwal~~ (n 9).		(35) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act) (2022) OJ L265/1, art 6(9); DCB 2024 (n 19); Ministry of Corporate Affairs (India), Lok Sabha, Written Answer of the Minister of State for Corporate Affairs (Shri Harsh Malhotra) on the Draft Digital Competition Bill (19 August 2025).

	(34) DPDP Act 2023 (n 6)		(36) Vrabec, Bansal and Gupta (n 4); Khandelwal (n 9); ACCC (n 5).

			(37) DPDP Act 2023 (n 6), s 2(g).

Data Portability (USA)

Kayembe Rodrigue — Thu, 08 Oct 2026 22:37:29 GMT

Show changes

Data: Data Portability

Kayembe Rodrigue — Thu, 08 Oct 2026 19:35:17 GMT

United States

← Older revision		Revision as of 21:35, 8 October 2026
Line 101:		Line 101:
	== <span dir="ltr" lang="en"><span class="mw-page-title-main">[[Data:India\|India]]</span></span> ==		== <span dir="ltr" lang="en"><span class="mw-page-title-main">[[Data:India\|India]]</span></span> ==

	== <span dir="ltr" lang="en"><span class="mw-page-title-main">United States</span></span> ==		== <span dir="ltr" lang="en"><span class="mw-page-title-main">[[Data Portability (USA)\|United States]]</span></span> ==
	in progress		in progress

Data Portability (USA)

Kayembe Rodrigue — Thu, 08 Oct 2026 19:34:49 GMT

Created blank page

New page

Data:Brazil

Paul Stein — Thu, 08 Oct 2026 14:39:01 GMT

Structure and Effectiveness of Brazilian Data Portability Regulation

← Older revision		Revision as of 16:39, 8 October 2026
(4 intermediate revisions by the same user not shown)
Line 1:		Line 1:
	== Purpose and Objectives ==		== Purpose and Objectives ==
	<p style="text-align: justify;" >The LGPD is [https://e-legis.camara.leg.br/cefor/index.php/e-legis/article/download/500/689/2629 frequently] [https://reference-global.com/article/10.2478/iclr-2022-0016 described] as a legal transplant of the GDPR to the Brazilian context. However, there are significant differences between the two regulations where it relates to purpose and objective. Where the GDPR [https://gdpr-info.eu/art-1-gdpr/ explicitly prioritizes] the dual objectives of fundamental rights of citizens and the free movement of personal data, [https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf/@@display-file/file Article 2 of the LGPD] defines a broader set of objectives including “free enterprise, free competition and consumer protection” as well as “economic and technological development and innovation”.  </p>		<h3 class="mwt-heading" style="text-align: justify;" >Purpose and Objectives </h3>
	<p style="text-align: justify;" >This is especially noteworthy in context of the LGPD’s equivalent of Article 20 GDPR: the right to data portability (Article 18(V) LGPD). Though Article 18 LGPD lacks Article 20 GDPR’s stipulation that data controllers must permit data portability “without hindrance from the controller”, the explicit framing in Article 2(VI) LGPD implies a pro-competitive reading of Article 18(V) LGPD.</p>		<p style="text-align: justify;">The LGPD is [https://e-legis.camara.leg.br/cefor/index.php/e-legis/article/download/500/689/2629 frequently] [https://reference-global.com/article/10.2478/iclr-2022-0016 described] as a legal transplant of the GDPR to the Brazilian context. However, there are significant differences between the two regulations where it relates to purpose and objective. Where the GDPR [https://gdpr-info.eu/art-1-gdpr/ explicitly prioritizes] the dual objectives of fundamental rights of citizens and the free movement of personal data, [https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf/@@display-file/file Article 2 of the LGPD] defines a broader set of objectives including “free enterprise, free competition and consumer protection” as well as “economic and technological development and innovation”.  </p>
	<p style="text-align: justify;" >The “economic development” objective is further apparent in the geopolitical interests that may have in part driven the drafting of the LGPD: specifically a desire to join the OECD as a full-fledged member. Accession requires compliance with OECD guidelines, including the “[https://www.oecd.org/en/about/data-protection.html OECD Privacy Guidelines]”. In this regard, the LGPD appears to have been successful, as accession talks were officially [https://www.oecd.org/en/publications/development-co-operation-profiles_04b376d7-en/brazil_f5c1fbdb-en.html initiated in 2022]. This was evidently of lesser concern in the EU, as 22 of its 28 member states were already OECD members at the time the GDPR was drafted. </p>		<p style="text-align: justify;">This is especially noteworthy in context of the LGPD’s equivalent of Article 20 GDPR: the right to data portability (Article 18(V) LGPD). Though Article 18 LGPD lacks Article 20 GDPR’s stipulation that data controllers must permit data portability “without hindrance from the controller”, the explicit framing in Article 2(VI) LGPD implies a pro-competitive reading of Article 18(V) LGPD.</p>
	<p style="text-align: justify;" >Similar to the European Union, Brazil’s system of government features exclusive and shared competences. Both systems divide legislative competence between exclusive and shared categories. In the EU, these are set out in Articles 3 and 4 TFEU, which have not been amended since the Lisbon Treaty and do not expressly list data protection; the Union's legislative basis is instead [https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_16/oj/eng Article 16(2) TFEU]. In Brazil, [https://legis.senado.leg.br/norma/35485358 Constitutional Amendment 115/2022] added item XXX to Article 22 of the Constitution, placing the protection and processing of personal data within the Union's privative legislative competence. The same amendment made data protection a fundamental right, which the Supreme Federal Court had already recognized as implicit since at least 2020. The same amendment also made data protection a fundamental right, though the Supreme Federal Court of Brazil (Supremo Tribunal Federal) had already treated the right as implicit for several years at that point. In summary, both LGPD and GDPR are congruent in their basis in fundamental rights, but distinct in their respective complementary goals of pro-consumer economic-developmental logic (LGPD) and internal market integration (GDPR).</p>		<p style="text-align: justify;">The “economic development” objective is further apparent in the geopolitical interests that may have in part driven the drafting of the LGPD: specifically a desire to join the OECD as a full-fledged member. Accession requires compliance with OECD guidelines, including the “[https://www.oecd.org/en/about/data-protection.html OECD Privacy Guidelines]”. In this regard, the LGPD appears to have been successful, as accession talks were officially [https://www.oecd.org/en/publications/development-co-operation-profiles_04b376d7-en/brazil_f5c1fbdb-en.html initiated in 2022]. This was evidently of lesser concern in the EU, as 22 of its 28 member states were already OECD members at the time the GDPR was drafted. </p>
			<h3 class="mwt-heading" style="text-align: justify;" >Legislative Competence and Constitutional Status</h3>
			<p style="text-align: justify;">Similar to the European Union, Brazil’s system of government features exclusive and shared competences. Both systems divide legislative competence between exclusive and shared categories. In the EU, these are set out in Articles 3 and 4 TFEU, which have not been amended since the Lisbon Treaty and do not expressly list data protection; the Union's legislative basis is instead [https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_16/oj/eng Article 16(2) TFEU]. In Brazil, [https://legis.senado.leg.br/norma/35485358 Constitutional Amendment 115/2022] added item XXX to Article 22 of the Constitution, placing the protection and processing of personal data within the Union's privative legislative competence. The same amendment made data protection a fundamental right, which the Supreme Federal Court had already recognized as implicit since at least 2020. The same amendment also made data protection a fundamental right, though the Supreme Federal Court of Brazil (Supremo Tribunal Federal) had already treated the right as implicit for several years at that point. In summary, both LGPD and GDPR are congruent in their basis in fundamental rights, but distinct in their respective complementary goals of pro-consumer economic-developmental logic (LGPD) and internal market integration (GDPR).</p>

			== Nature of data concerned ==
			=== <span class="s1">Key Characteristics of LGPD<br></span> ===
			<p class="p1"><span class="s1">[https://www.dlapiperdataprotection.com/?t=law&c=BR#insight Lei Geral de Proteção de Dados (LGPD)]</span> is a Brazilian version of data protection law which resembles many characteristics of General Data Protection Regulation (GDPR) from the EU. LGPD is a '''general''', '''comprehensive, horizontal''' data privacy law which entered into force on September 18, 2020. It’s '''legally binding''' with National Data Protection Authority (ANPD) acting as an autonomous administrative authority to issue sanctions (penalties) for violations of the LGPD.</p>
			<p class="p1">From the <span class="s1">[https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf/@@display-file/file Article 18(V)]</span> of LGPD, it is stated that the portability of data to another service/product provider upon express request, '''according to the regulations of the national authority''', complying with trade and industrial secrets. Unlike GDPR Article 20 which provided detailed statutory conditions in terms of the scope of data and automated processing, LGPD renders <span class="s1">[https://wpcdn.idp.edu.br/idpsiteportal/2020/05/EN-CIPL-IDP-Paper-on-the-Role-of-the-ANPD-under-the-LGPD-04.16.20202.pdf ANPD the ultimate authority]</span> to define the regulatory framework on how to implement the right to data portability.</p>

			=== The Role of the ANPD ===
			The LGPD empowers ANPD to establish [https://bjlti.com/revista/article/view/6 interoperability standards for portability from the Article 40]. Therefore, many questions remain open for the ANPD to set its own guidelines for practical implementation in terms of:
			*Which data must be portable
			*What constitutes portability
			*How interoperability should work
			*How third-party data should be handled
			*Who transfers data
			*Allocation of responsibility between origin and destination controllers
			Yet it is important to note that the [https://platformglossary.info/data-portability/ ANPD is not actually obliged] to come up with such regulatory guidelines. According to its regulatory agenda released in 2021, details regarding establishing interoperability standards are not even included on the list of regulatory initiatives to be tackled in the first two years of activities of ANPD.
			=== Scope of Application ===
			<p class="p1">The LGPD is a horizontal law, applicable to processing by '''public and private legal persons''' (Article 3). Yet there are other sector-specific data portability regulatory frameworks in financial sector (Open finance framework from the Central Bank) and insurance sector (SUSEP) as well. <span class="s1">The LGPD has an </span><span class="s2">''''''</span>[https://www.linklaters.com/insights/data-protected/data-protected---brazil <span class="s2"><strong>extraterritorial </strong>reach</span><span class="s1">.</span>]<span class="s1"> </span>Under Article 3, a personal data processor is subject to the law when:</p>
			#The data are either collected or processed within Brazil or
			#The data is processed for the purpose of offering goods or services to individuals in Brazil.
			Hence, as long as one of these conditions is met, the country in which the company is headquartered is irrelevant, and the LGPD is fully applicable including when fulfilling data subject rights like data portability.

	== Structure and Effectiveness of Brazilian Data Portability Regulation ==		== Structure and Effectiveness of Brazilian Data Portability Regulation ==
	<p class="p1" style="text-align: justify;" >Brazilian data portability rests on distinct instruments. The [https://www.planalto.gov.br/ccivil_03/constituicao/constituicaocompilado.html Constitution, article 5(LXXIX)], protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as [https://www.bcb.gov.br/content/config/Documents/Open_Banking_CMN_BCB_Joint_Resolution_1_2020.pdf amended by 4/2022;] insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under [https://www.gov.br/aneel/pt-br/assuntos/noticias/2025-defeso-eleitoral/aprovada-consulta-para-aperfeicoar-regras-dos-servicos-de-distribuicao-em-consequencia-da-abertura-do-mercado-para-consumidores-do-grupo-a/ Public Consultation 7/2025]. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.</p>		=== Legal Framework and Sectoral Regimes ===
	<p class="p1" style="text-align: justify;" >From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the [https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1 ANPD still listed] regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.</p>		<p class="p1" style="text-align: justify;">Brazilian data portability rests on distinct instruments. The [https://www.planalto.gov.br/ccivil_03/constituicao/constituicaocompilado.html Constitution, article 5(LXXIX)], protects personal data; the General Data Protection Law (LGPD), article 18(V), establishes a request-based right to data portability. Financial data sharing is governed by CMN/BCB Joint Resolution 1/2020, as [https://www.bcb.gov.br/content/config/Documents/Open_Banking_CMN_BCB_Joint_Resolution_1_2020.pdf amended by 4/2022;] insurance by CNSP Resolution 415/2021 and SUSEP Circular 635/2021. Health-data exchange through the National Health Data Network (RNDS) follows Decree 12,560/2025. ANEEL's Open Energy remains a proposal under [https://www.gov.br/aneel/pt-br/assuntos/noticias/2025-defeso-eleitoral/aprovada-consulta-para-aperfeicoar-regras-dos-servicos-de-distribuicao-em-consequencia-da-abertura-do-mercado-para-consumidores-do-grupo-a/ Public Consultation 7/2025]. Consumer and competition legislation provides complementary safeguards. These regimes have different purposes and levels of legal maturity, not a single uniform portability standard.</p>
	<p class="p1" style="text-align: justify;" >For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. [https://www.bis.org/publications/paper-168-opening-doors-open-finance-evidence-international-experience Research] identifies continued concentration and implementation costs; competition effects require direct assessment. Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. [https://www.cgap.org/blog/success-in-open-finance-requires-trust-lessons-brazil Survey findings ]associate lower income with lower reported adoption, without establishing national causal effects. [https://doi.org/10.1016/j.jfineco.2022.12.003 Economic theory] additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. [//doi.org/10.1108/IJOEM-07-2025-1439 Technical standardisation] therefore requires public oversight, not merely industry agreement. </p>		=== Assessment and Policy Priorities ===
	<p class="p1" style="text-align: justify;" >Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established</p>		<p class="p1" style="text-align: justify;">From a rights perspective, article 18(V) establishes a statutory entitlement, but its exercise remains incompletely specified: it requires an express request, follows ANPD regulation and preserves commercial and industrial secrecy. In September 2026, the [https://www.gov.br/anpd/pt-br/assuntos/regulacao/agenda-regulatoria-1 ANPD still listed] regulation of data-subject rights as under internal preparation. That demonstrates an implementation gap, not suspension of the statutory right. RNDS interoperability likewise must not be mistaken for a general patient-directed portability mechanism.</p><p class="p1" style="text-align: justify;">For markets, mandatory participation and standardised interfaces can lower informational barriers to entry. Yet Open Finance activity measures technical uptake, not causally established reductions in prices or concentration. [https://www.bis.org/publications/paper-168-opening-doors-open-finance-evidence-international-experience Research] identifies continued concentration and implementation costs; competition effects require direct assessment. Consumers may gain access to comparison tools and tailored offers, subject to comprehensible consent, security, and genuine choice. [https://www.cgap.org/blog/success-in-open-finance-requires-trust-lessons-brazil Survey findings ]associate lower income with lower reported adoption, without establishing national causal effects. [https://doi.org/10.1016/j.jfineco.2022.12.003 Economic theory] additionally suggests that refusal to share could disadvantage borrowers when lenders interpret non-disclosure adversely. For industry, shared interfaces reduce integration duplication but entail security and maintenance costs that smaller providers may struggle to bear. Ambiguous trade-secret exceptions and weak downstream safeguards can undermine confidence. [//doi.org/10.1108/IJOEM-07-2025-1439 Technical standardisation] therefore requires public oversight, not merely industry agreement. </p><p class="p1" style="text-align: justify;">Further legislation is neither necessarily sufficient nor the best immediate remedy. The stronger priority is binding ANPD regulation on scope, formats, timelines, secure direct transmission and reviewable secrecy refusals, coordinated with sector regulators. Accessible consent processes, independent testing, shared technical tools, consumer education and collective redress should complement regulation. Success should be measured against completed transfers, switching, prices, market entry, complaints, security incidents, and distributionBrazilian Data participation. Brazil demonstrates operational possibilities; its broader rights and welfare effects remain to be established.</p>