Data Portability (USA) - Revision history

Müller Tapia Sebastián at 12:06, 9 October 2026

2026-10-09T12:06:21Z

← Older revision		Revision as of 14:06, 9 October 2026
Line 19:		Line 19:
	We have chosen California as:		We have chosen California as:

	* It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 ''dark horse contender'']” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states;<br />		* It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 ''dark horse contender'']” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states;<br>
	* It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the ''‘‘[https://archive.org/details/tradingupconsume0000voge California effect’]’''.		* It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the ''‘‘[https://archive.org/details/tradingupconsume0000voge California effect’]’''.

	As for Utah, its selection stems from the contrast it presents:		As for Utah, its selection stems from the contrast it presents:

	* Its [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022] (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy [https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report] in comparison to California’s leading score of 69/100;<br />		* Its [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022] (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy [https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report] in comparison to California’s leading score of 69/100;<br>
	* Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by “technically feasible” and “practicable”;<br />		* Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by “technically feasible” and “practicable”;<br>
	* Yet, through the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025] (DCA), it became the first US state to require social media platforms to provide [https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability] through open protocols.		* Yet, through the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025] (DCA), it became the first US state to require social media platforms to provide [https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability] through open protocols.

Line 42:		Line 41:
	=== Utah ===		=== Utah ===

	[https://le.utah.gov/~2022/bills/static/SB0227.html UCPA] entered into effect in December, 2023. Consumers are conferred portability rights via [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer’s personal data, that the consumer previously provided to the controller, in a format that:<br />		[https://le.utah.gov/~2022/bills/static/SB0227.html UCPA] entered into effect in December, 2023. Consumers are conferred portability rights via [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer’s personal data, that the consumer previously provided to the controller, in a format that:<br>
	(a) to the extent technically feasible, is portable;<br />		(a) to the extent technically feasible, is portable;<br>
	(b) to the extent practicable, is readily usable; and<br />		(b) to the extent practicable, is readily usable; and<br>
	(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.		(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.

Line 51:		Line 50:
	Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266] that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code [https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4]).		Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266] that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code [https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4]).

	Utah lead the charge introducing the [https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind] legislation amongst states requiring social media platforms to provide interoperability through open protocols under the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act] (UDCA), enacted in 2025, and whose section [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201] outlines that “''If a consumer requests a copy of the consumer’s personal data under [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html Section 13-61-201], a social media service shall provide the personal data, including the user’s social graph, in a format that:''<br />		Utah lead the charge introducing the [https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind] legislation amongst states requiring social media platforms to provide interoperability through open protocols under the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act] (UDCA), enacted in 2025, and whose section [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201] outlines that “''If a consumer requests a copy of the consumer’s personal data under [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html Section 13-61-201], a social media service shall provide the personal data, including the user’s social graph, in a format that:''<br>''(1) is portable, to the extent technically feasible;''<br>''(2) is readily usable, to the extent practicable; and''<br>''(3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.
	''(1) is portable, to the extent technically feasible;''<br />
	''(2) is readily usable, to the extent practicable; and''<br />
	''(3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.

	Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of [https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA] deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy [https://www.transunion.com/ccpa-metrics data] suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.		Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of [https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA] deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy [https://www.transunion.com/ccpa-metrics data] suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.
Line 65:		Line 61:
	“RTDP stems from technical codification and trust governance rather than legal codification”.		“RTDP stems from technical codification and trust governance rather than legal codification”.

	* Dependence and the lack of appropriate infrastructures<br />		* Dependence and the lack of appropriate infrastructures<br>
	* Need for sector-specific standardisation<br />		* Need for sector-specific standardisation<br>
	* ever-changing nature of the regulatory subject in a digital world;		* ever-changing nature of the regulatory subject in a digital world;

	makes it hard to implement data portability efficiently.		makes it hard to implement data portability efficiently.

Line 86:		Line 81:
	=== EU Comparison ===		=== EU Comparison ===

	The modern US data portability framework has been influenced, though not determined, by the EU’s GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time.		The modern US data portability framework has been influenced, though not determined, by the EU’s GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time. A chart with a comparison between each jurisdiction can be found below:

			{\| style="border-collapse: collapse; width: 1263px; height: 1px;" border="1"
			\|-
			\| style="width: 102.162px;" \| <p><br></p>
			\| style="width: 349.55px;" \| <p>EU</p>
			\| style="width: 395.625px;" \| <p>California</p>
			\| style="width: 403.663px;" \| <p>Utah</p>
			\|-
			\| style="width: 102.162px;" \| <p>Data elements</p><p><br></p>
			\| style="width: 349.55px;" \| <p>Data provided to the controller</p>
			\| style="width: 395.625px;" \| <p>Data obtained from the consumer</p>
			\| style="width: 403.663px;" \| <p>Data provided to the controller</p>
			\|-
			\| style="width: 102.162px;" \| <p>Format</p><p><br></p>
			\| style="width: 349.55px;" \| <p>Structured, commonly used and machine-readable</p>
			\| style="width: 395.625px;" \| <p>Understandable, structured, commonly used and machine-readable</p>
			\| style="width: 403.663px;" \| <p>Portable and readily usable</p>
			\|-
			\| style="width: 102.162px;" \| <p>Costs</p><p><br></p>
			\| style="width: 349.55px;" \| <p>Free unless manifestly unfounded or excessive</p>
			\| style="width: 395.625px;" \| <p>Free unless manifestly unfounded or excessive</p>
			\| style="width: 403.663px;" \| <p>Free for the first request in a 12-month period</p>
			\|-
			\| style="width: 102.162px;" \| <p>Transfer</p>
			\| style="width: 349.55px;" \| <p>Data subject or controller if technically feasible upon request</p>
			\| style="width: 395.625px;" \| <p>Consumer or business if technically feasible upon request</p>
			\| style="width: 403.663px;" \| <p>Consumer, if DP is processed through automated means</p>
			\|-
			\| style="width: 102.162px;" \| <p>Deadlines</p>
			\| style="width: 349.55px;" \| <p>1 month</p>
			\| style="width: 395.625px;" \| <p>45 days</p>
			\| style="width: 403.663px;" \| <p>45 days</p>
			\|}
	We have mainly explored data portability via the lens of consumers and personal data. The EU has taken note of this and addressed it via [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]. The US lacks an equivalent to the Data Act’s switching provisions. US businesses have nonetheless benefited indirectly, as AWS, Microsoft and Google waived exit egress fees globally in 2024 ahead of the Data Act’s obligations, exemplifying the Brussels effect.		We have mainly explored data portability via the lens of consumers and personal data. The EU has taken note of this and addressed it via [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]. The US lacks an equivalent to the Data Act’s switching provisions. US businesses have nonetheless benefited indirectly, as AWS, Microsoft and Google waived exit egress fees globally in 2024 ahead of the Data Act’s obligations, exemplifying the Brussels effect.

Kayembe Rodrigue at 22:37, 8 October 2026

2026-10-08T22:37:29Z

Show changes

Kayembe Rodrigue: /* Definition */

2026-10-08T20:31:03Z

Definition

← Older revision		Revision as of 22:31, 8 October 2026
Line 4:		Line 4:
	According to the Cambridge Dictionary, [https://dictionary.cambridge.org/dictionary/english/portability portability] refers to “the ability to be used for a different purpose or on a different system”. Data portability (DP) can essentially boil down to an individual’s ability to move personal data from one service to another or to themselves. On top of DP conferring control to individuals over their data and [https://www.eff.org/deeplinks/2018/09/what-we-mean-when-we-say-data-portability depending on the context and platform], it can also nurture competition between service providers by clearing paths for dynamic of choice whilst lowering barriers for new providers.		According to the Cambridge Dictionary, [https://dictionary.cambridge.org/dictionary/english/portability portability] refers to “the ability to be used for a different purpose or on a different system”. Data portability (DP) can essentially boil down to an individual’s ability to move personal data from one service to another or to themselves. On top of DP conferring control to individuals over their data and [https://www.eff.org/deeplinks/2018/09/what-we-mean-when-we-say-data-portability depending on the context and platform], it can also nurture competition between service providers by clearing paths for dynamic of choice whilst lowering barriers for new providers.

	In this ~~presentation~~, we will address the way in which DP is regulated in the United States, both at a federal and state level. Subsequently, we will analyze some of the main effects of its regulation (or lack thereof), to ~~finalize~~ with a comparison with its counterparty in the EU.		In this analysis, we will address the way in which DP is regulated in the United States, both at a federal and state level. Subsequently, we will analyze some of the main effects of its regulation (or lack thereof), to finalise with a comparison with its counterparty in the EU.

	<span id="us-overview"></span>		<span id="us-overview"></span>

	=== US Overview ===		=== US Overview ===

Kayembe Rodrigue at 20:19, 8 October 2026

2026-10-08T20:19:38Z

Show changes

Kayembe Rodrigue at 20:09, 8 October 2026

2026-10-08T20:09:09Z

Show changes

Kayembe Rodrigue at 20:03, 8 October 2026

2026-10-08T20:03:58Z

Show changes

Kayembe Rodrigue at 19:52, 8 October 2026

2026-10-08T19:52:37Z

← Older revision	Revision as of 21:52, 8 October 2026
Line 1:	Line 1:
		<div>== Definition ==</div><div><br></div><div>According to the Cambridge Dictionary, [https://dictionary.cambridge.org/dictionary/english/portability portability] refers to “the ability to be used for a different purpose or on a different system”. Data portability (DP) can essentially boil down to an individual’s ability to move personal data from one service to another or to themselves. On top of DP conferring control to individuals over their data and [https://www.eff.org/deeplinks/2018/09/what-we-mean-when-we-say-data-portability depending on the context and platform], it can also nurture competition between service providers by clearing paths for dynamic of choice whilst lowering barriers for new providers.</div><div><br></div><div>In this presentation, we will address the way in which DP is regulated in the United States, both at a federal and state level. Subsequently, we will analyze some of the main effects of its regulation (or lack thereof), to finalize with a comparison with its counterparty in the EU.</div><div><br></div><div>== US Overview ==</div><div><br></div><div>The extent to which data portability is recognised varies considerably in the US. At one level, the right may simply entitle individuals to receive their data in a format that meets specific requirements, such as a portable and readily usable format. A second level goes a step further by imposing an obligation of direct transfer on the service provider; this obligation has not been comprehensively legislated at federal level in the US.</div><div><br></div><div>Instead, the underlying legal framework of DP is a patchwork of state statuses and sector-specific regulations. [https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf Health Insurance Portability and Accountability Act, 1996 (HIPAA)] is an example of the latter. Initially, the [https://www.govinfo.gov/content/pkg/FR-2000-12-28/pdf/00-32678.pdf Privacy Rule 2000] provided only for the access to data with no element of portability attached. The [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act 2009] then augmented HIPPA with a portability aspect: under [https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf §13405(e)], and codified at [https://www.law.cornell.edu/uscode/text/42/17935 42 U.S.C. §17935(e)], fulfilling a data request in a given format became a right for the individual and an obligation on the provider. More recently the [https://www.govinfo.gov/content/pkg/PLAW-114publ255/pdf/PLAW-114publ255.pdf Cures Act 2016] introduced an infrastructure-layer requirement to enable true data portability and enforcement avenue with [https://www.law.cornell.edu/uscode/text/42/300jj-52 information blocking ban] aspect.</div><div><br></div><div>The finance industry attempted making similar strides by way of [https://www.govinfo.gov/content/pkg/PLAW-111publ203/pdf/PLAW-111publ203.pdf Dodd-Frank Act, Pub. L. 111-203] as codified under [https://www.law.cornell.edu/uscode/text/12/5533 12 U.S.C. §5533]. However, this has been stalled with an [https://infobytes.orrick.com/wp-content/uploads/2025-10-29-Order-Granting-Injunction-1.pdf injunction] due to contention on who exactly this right is conferred to and who should bear the cost. Federally, other sectoral statutes grant individuals a right of access to data held about them. The [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act] is one example: it obliges consumer reporting agencies to disclose [https://www.law.cornell.edu/uscode/text/15/1681g “''all information in the consumer’s file''”], but only “''in writing''” by default, with electronic disclosure made available where a consumer authorises it and the agency [https://www.law.cornell.edu/uscode/text/15/1681h offers] it. It imposes no specific format requirement and grants no right of direct transfer to third parties.</div><div><br></div><div>Despite the lack of a comprehensive federal privacy that encompasses DP, [https://privacylawmap.com/blog/how-many-states-have-data-privacy-laws several states] have adopted general data protection and privacy laws, including: California, Virginia, Colorado, Connecticut, Utah. For the purpose of this presentation, we will be focusing on the regulation of California and Utah.</div><div><br></div><div>We have chosen California as:</div><div>* It emerged as a “[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3433922 ''dark horse contender'']” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states;</div><div>* It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the “[https://archive.org/details/tradingupconsume0000voge ''California effect'']”.</div><div><br></div><div>As for Utah, its selection stems from the contrast it presents:</div><div>* Its [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf Consumer Privacy Act 2022] (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy [https://publicinterestnetwork.org/wp-content/uploads/2025/01/State-of-Privacy-2025-updated-scorecard.pdf report] in comparison to California’s leading score of 69/100;</div><div>* Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by "technically feasible" and "practicable";</div><div>* Yet, through the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Digital Choice Act 2025] (DCA), it became the first US state to require social media platforms to provide [https://news.bloomberglaw.com/privacy-and-data-security/utah-data-sharing-law-creates-path-to-upend-social-media-model interoperability] through open protocols.</div><div><br></div><div>== California ==</div><div><br></div><div>[http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5 California Consumer Privacy Act (CCPA)] is a regulation that modified California’s Civil Code, incorporating several data protection provisions in the context of consumer relations.</div><div><br></div><div>To begin with, section § 1798.110(b) states that “''a business that collects personal information about a consumer shall disclose to the consumer, pursuant to [https://1.next.westlaw.com/Link/Document/FullText?findType=L&originatingContext=document&transitionType=DocumentItem&pubNum=1000200&refType=SP&originatingDoc=I911c51d0009711f1a766b53df0bebe74&cite=CACIS1798.130 subparagraph (B) of paragraph (3) of subdivision (a) of Section 1798.130], the information specified in subdivision (a) upon receipt of a verifiable consumer request from the consumer''”. To comply with this obligation, section §1798.130(a)(3)(B)(iii) adds that the business shall “''Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumer’s request without hindrance. “Specific pieces of information” do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumer’s personal information from one business to another in the context of switching services''”.</div><div><br></div><div>It is worth mentioning that, under the CCPA, data portability is mainly considered as a format requirement of the business obligation if consumers exercise their access rights pursuant to section § 1798.110(b). This has direct effects for reporting obligations. As stated in Section § 7102, businesses that process personal information of 10,000,000 or more consumers in a calendar year shall compile the metrics on the number of “requests to know” that the business received, complied with in whole or in part, and denied. Thus, while businesses are indeed required to disclose metrics on the amount of access request received during the year, they are not obliged to disclose the format in which these were delivered, nor if the consumer is required to port the data to a different business. Out of several business reports from 2025, we were only able to identify that Cisco voluntarily provided information on data portability, indicating that they received “[https://www.cisco.com/c/en/us/about/legal/ccpa-metrics-report.html 21 extra requests]” (which include types of Port Data, Subprocessor Disclosures, and Restrict Auto Decision). This starkly contrasts with the total of 731 requests to know during the same year, which could signal an underuse of data portability rights.</div><div><br></div><div>== Utah ==</div><div><br></div><div>[https://le.utah.gov/~2022/bills/static/SB0227.html UCPA] entered into effect in December, 2023. Consumers are conferred portability rights via [https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html?v=C13-61-S201_2022050420231231 §13-61-201(3)], it provides: A consumer has the right to obtain a copy of the consumer's personal data, that the consumer previously provided to the controller, in a format that:</div><div>:(a) to the extent technically feasible, is portable;</div><div>:(b) to the extent practicable, is readily usable; and</div><div>:(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.</div><div><br></div><div>There has not been much effort to further define technologically natural 'Readily usable', 'to the extent practicable' and 'without impediment' under UCPA. Similar to [https://dl.acm.org/doi/epdf/10.1145/3267305.3274152 GDPR] the lack of specificity here results in a wide array of inconsistent results.</div><div><br></div><div>Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per [https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf §13-61-102(1), lines 257–266] that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code [https://le.utah.gov/xcode/Title13/Chapter61/13-61.html §13-61-402(4)].</div><div><br></div><div>Utah lead the charge introducing the [https://utahnewsdispatch.com/2025/03/12/utah-app-store-social-media-data-laws/ first-of-a-kind] legislation amongst states requiring social media platforms to provide interoperability through open protocols under the [https://le.utah.gov/Session/2025/bills/enrolled/HB0418.pdf Utah Digital Choice Act] (UDCA), enacted in 2025, and whose section [https://le.utah.gov/xcode/Title13/Chapter61/C13-61-S201_2026070120250507.html §13-81-201] outlines that “''If a consumer requests a copy of the consumer's personal data under Section 13-61-201, a social media service shall provide the personal data, including the user's social graph, in a format that: (1) is portable, to the extent technically feasible; (2) is readily usable, to the extent practicable; and (3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means''”.</div><div><br></div><div>Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of [https://le.utah.gov/interim/2025/pdf/00003568.pdf UCPA] deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy [https://www.transunion.com/ccpa-metrics data] suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.</div><div><br></div><div>== Landscape Impact ==</div><div><br></div><div>The World Wide Web movement sought to allow free flow and access to data to all, built on liberalist ideologies. Contrarily, the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users - creating a new power dynamic with data. The Right to Data Portability (RTDP) was established by the GDPR as a solution to empower individuals to attain data sovereignty and regulate competition in the market, ultimately resulting in innovation and platform dependency. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox”.[https://doi.org/10.1093/qje/ (2)]</div><div><br></div><div>“RTDP stems from technical codification and trust governance rather than legal codification”.</div><div>* Dependence and the lack of appropriate infrastructures</div><div>* Need for sector-specific standardisation</div><div>* ever-changing nature of the regulatory subject in a digital world;</div><div>makes it hard to implement data portability efficiently.</div><div><br></div><div>=== Case study: Vehicle Data Access ===</div><div><br></div><div>The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) [https://en.wikipedia.org/wiki/Motor_Vehicle_Owners%27_Right_to_Repair_Act (3)] which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access as it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.[https://www.dhs.gov/science-and-technology/safety-act (4)]</div><div><br></div><div>=== Influence of hyperscaler in the United States ===</div><div><br></div><div>When we discuss personal data transfer in a digital space, cloud computing stands as critical infrastructure. The GDPR prescribes for the "free of charge" rules ([https://gdpr-info.eu/art-12-gdpr/ Article 12(5)] for access requests, [https://gdpr-info.eu/art-20-gdpr/ Article 20] for portability) for transfer of personal data. However, its limited application extends to the '''controller''' in relation to the '''data subject, exempting''' cloud vendors. Currently, the US hyperscalers - namely Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares in the cloud computing space and have also well integrated themselves into multiple layers of the AI stack, serving several core functions through their subsidiaries. Due to the scale of investment required and the high barriers of entry, a non-competitive market is created making it hard for meaningful participation and innovations from new entrants.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (5)]</div><div><br></div><div>Data portability is recommended as a solution to break such monopolistic tendencies, however, does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. While some hyperscalers do allow portability services, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of [https://windowsforum.com/news/azure-cloud-exit-fees-are-falling-but-microsoft-licensing-and-portability-still-block-switching.447160/ Microsoft increasing licensing cost] if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)]</div><div><br></div><div>The US’ reliance on a patchwork of state statuses rather than a comprehensive federal privacy and data protection framework to regulate DP has had mixed results. An alliance of businesses have aligned to [https://itif.org/publications/2022/01/24/looming-cost-patchwork-state-privacy-laws/ report] that this patchwork could likely create duplicate compliance costs exceeding $1 trillion over 10 years, with small businesses bearing around $20–23 billion annually. States such as Utah have legislated with this in mind with revenue requirements. The Right to Data Portability (RTDP) largely depends on the type of data and where the consumer lives. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox”.[https://doi.org/10.1093/qje/ (2)]</div><div><br></div><div>=== Case study: Vehicle Data Access ===</div><div><br></div><div>The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) (3) which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access it could lead to vulnerabilities and possibly hacking (access to the steering and break systems); with reference to the federal Safety Act.(4)</div><div><br></div><div>=== Influence of hyperscale establishment concentration in the United States ===</div><div><br></div><div>The World Wide Web movement sought to allow free movement and access of data to all, built on liberalist ideologies, but the last two decades saw the big corporations (social media, Internet Service Providers, Government) “[https://www.scientificamerican.com/article/long-live-the-web/ walling off information]” gathered from their users. Utah has led the charge on tackling this with UDCA, however the impact is still unknown at this stage.</div><div><br></div><div>“RTDP stems from technical codification and trust governance rather than legal codification”.</div><div>* Dependence and the lack of appropriate infrastructures</div><div>* Need for sector-specific standardisation</div><div>* ever-changing nature of the regulatory subject in a digital world;</div><div>makes it hard to implement data portability efficiently.</div><div><br></div><div>Data portability does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. All these facts feed into the established [https://research-portal.st-andrews.ac.uk/en/publications/how-portable-is-portable-exercising-the-gdprs-right-to-data-porta/ status quo] of portability not being highly portable.</div><div><br></div><div>We have mainly explored data portability via the lens of consumers and personal data. A gap that is prevalent for the right of businesses to port from one hyperscaler to another. This is particularly interesting as Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares and subsequently [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 influence] globally. The EU has taken note of this and addressed it via [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R2854 Data Act 2023/2854]. In doing so hyperscalers have begun enabling portability services globally as a side effect, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of Microsoft increasing licensing cost if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6222822 (6)]</div><div><br></div><div>== EU Comparison ==</div><div><br></div><div>The modern US data portability framework has been influenced, though not determined, by the EU's GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time.</div>

Kayembe Rodrigue: Blanked the page

2026-10-08T19:40:45Z

Blanked the page

Show changes

Kayembe Rodrigue at 19:36, 8 October 2026

2026-10-08T19:36:53Z

Show changes

Kayembe Rodrigue: Created blank page

2026-10-08T19:34:49Z

Created blank page

New page