Artikolu 20 📖 RĠPD (GDPR). Dritt għall-portabbiltà tad-data

Artikolu 20 RĠPD (GDPR). Dritt għall-portabbiltà tad-data

Article 20 GDPR. Right to data portability

1. Is-suġġett tad-data għandu d-dritt li jirċievi d-data personali li tikkonċerna lilu, li huwa jkun ipprovda lil kontrollur, f’format strutturat, użat komunement u li jinqara permezz ta’ magna u jkollu d-dritt li jibgħat dik d-data lil kontrollur ieħor mingħajr tfixkil mingħand il-kontrollur li lilu tkun ingħatat id-data personali, fejn:

1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

Kummentarju

(EN) Author

(EN) Siarhei Varankevich CIPP/E, CIPM, CIPT, MBA, FIP

(EN) Co-Founder & CEO of Data Privacy Office LLC. Data Protection Trainer and Principal Consultant

(EN) Ask a question

(a) l-ipproċessar ikun ibbażat fuq kunsens skont il-punt (a) tal-Artikolu 6(1) jew il-punt (a) tal-Artikolu 9(2) jew fuq kuntratt skont il-punt (b) tal-Artikolu 6(1); u

(a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and

Testi relatati

Artikolu 6 RĠPD (GDPR). Legalità tal-ipproċessar

Article 6 GDPR. Lawfulness of processing

1. L-ipproċessar għandu jkun legali biss jekk u safejn mill-inqas ikun japplika wieħed mill-punti li ġejjin:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) is-suġġett tad-data jkun ta l-kunsens għall-ipproċessar ta’ data personali tiegħu għal fini speċifiku wieħed jew aktar;

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) l-ipproċessar ikun meħtieġ għat-twettiq ta’ kuntratt li għalih is-suġġett tad-data huwa parti jew sabiex jittieħdu passi fuq talba tas-suġġett tad-data qabel ma jidħol f’kuntratt;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

[…]

Artikolu 9 RĠPD (GDPR). Ipproċessar ta' kategoriji speċjali ta' data personali

Article 9 GDPR. Processing of special categories of personal data

1. L-ipproċessar ta’ data personali, li jiżvela oriġini razzjali jew etnika, opinjonijiet politiċi, twemmin reliġjuż jew filosofiku, jew sħubija fi trade union, u l-ipproċessar ta’ data ġenetika, data bijometrika sabiex tidentifika b’mod uniku persuna fiżika, data dwar is-saħħa jew data dwar il-ħajja sesswali u l-orjentazzjoni sesswali ta’ persuna fiżika huma projbiti.

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

2. Il-paragrafu 1 ma għandux japplika jekk japplika wieħed minn dawn li ġejjin:

2. Paragraph 1 shall not apply if one of the following applies:

(a) is-suġġett tad-data jkun ta kunsens espliċitu għall-ipproċessar ta’ dik id-data personali għal fini speċifiku wieħed jew aktar, għajr fejn il-liġi tal-Unjoni jew il-liġi ta’ Stat Membru tipprevedi li l-projbizzjoni msemmija fil-paragrafu 1 ma tistax titneħħa mis-suġġett tad-data;

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

[…]

(b) l-ipproċessar jitwettaq b’mezzi awtomatizzati.

(b) the processing is carried out by automated means.

2. Fl-eżerċitar tad-dritt tiegħu għall-portabbiltà tad-data skont il-paragrafu 1, is-suġġett tad-data għandu d-dritt li jkollu d-data personali trażmessa direttament minn kontrollur għal kontrollur ieħor, fejn dan ikun teknikament fattibbli.

2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

3. L-eżerċizzju tad-dritt imsemmi fil-paragrafu 1 ta’ dan l-Artikolu għandu jkun mingħajr preġudizzju għall-Artikolu 17. Dak id-dritt ma għandux japplika għall-ipproċessar meħtieġ għall-prestazzjoni ta’ kompitu li jsir fl-interess pubbliku jew fl-eżerċizzju ta’ awtorità uffiċjali mogħtija lill-kontrollur.

3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Testi relatati

Artikolu 17 RĠPD (GDPR). Dritt għal tħassir (“dritt li wieħed jintesa”)

Article 17 GDPR. Right to erasure (‘right to be forgotten’)

4. Id-dritt msemmi fil-paragrafu 1 ma għandux jaffettwa b’mod ħażin id-drittijiet u l-libertajiet ta’ oħrajn.

4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

Regolament Ġenerali dwar il-Protezzjoni tad-Data (RĠPD, GDPR)

General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

Kummentarju ISO 27701 Premessi Linji ta 'Gwida & Ġurisprudenza Ħalli kumment

Kummentarju

(EN) The right to data portability is presented primarily as a way to support “user choice, user control, and user empowerment” (Guidelines on the Right to Data Portability), as it aims at reinforcing an individual’s control over her/his personal information (recital 68). Data portability allows users to receive a copy of their personal data and can be seen in that sense as an extension of the right of access (article 15). It can also help them to switch services without losing their data, enabling users to transfer their information from one service to a potentially better one.

(EN) […]

(EN) Sign in
to read the full text

(EN) Author

(EN) Louis-Philippe Gratton PhD, LLM

(EN) Privacy Expert

(EN) Ask a question

(EN)

Data Subject Request Letter Sample

Concern: Exercise my right to data portability

Dear Madam, Dear Sir,

I would like to exercise my right to data portability under Article 20 of the General Data Protection Regulation (GDPR)…

(EN) […]

(EN) Sign in
to read the full text

(EN) Author

(EN) Louis-Philippe Gratton PhD, LLM

(EN) Privacy Expert

(EN) Ask a question

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 20 GDPR:

7.3.8 Providing copy of PII processed

Control

The organization should be able to provide a copy of the PII that is processed when requested by the PII principal.

Implementation guidance

The organization should provide a copy of the PII that is processed in a structured, commonly used, format accessible by the PII principal.

(EN) […]

(EN) Sign in
to read the full text

Premessi

(68) Sabiex isaħħu aktar il-kontroll fuq id-data tagħhom stess, fejn l-ipproċessar ta' data personali titwettaq b'mezzi awtomatizzati, is-suġġett tad-data għandu jitħalla wkoll jirċievi data personali li tikkonċernah, li huwa pprovda lil kontrollur, f'format strutturat, li jintuża komunement, li jista' jinqara b'magna u li jkun interoperabbli, u jittrażmettih lil kontrollur ieħor. Kontrolluri tad-data għandhom jiġu inkoraġġuti jiżviluppaw formati interoperabbli li jippermettu l-portabbiltà tad-data. Dak id-dritt għandu japplika fejn is-suġġett tad-data jkun ipprovda d-data personali abbażi tal-kunsens tiegħu jew l-ipproċessar ikun neċessarju għall-eżekuzzjoni ta' kuntratt. Ma għandux japplika fejn l-ipproċessar huwa bbażat fuq raġuni legali oħra għajr il-kunsens jew kuntratt. Min-natura proprja tiegħu dak id-dritt ma għandux jiġi eżerċitat kontra l-kontrolluri li jipproċessaw id-data personali fl-eżerċizzju tad-dmirijiet pubbliċi tagħhom. Għalhekk m'għandux japplika fejn l-ipproċessar tad-data personali huwa meħtieġ għall-konformità ma' obbligu legali li għalih il-kontrollur huwa soġġett jew għat-twettiq ta' kompitu mwettaq fl-interess pubbliku jew fl-eżerċizzju ta' awtorità uffiċjali mogħtija lill-kontrollur. Id-dritt tas-suġġett tad-data li jittrażmetti jew jirċievi data personali dwaru ma għandhux joħloq obbligu għall-kontrolluri li jadottaw jew iżommu sistemi tal-ipproċessar li huma teknikament kompatibbli. Fejn, f'ċertu sett ta' data personali, ikun ikkonċernat aktar minn suġġett wieħed tad-data, id-dritt ta' riċezzjoni tad-data personali għandu jkun mingħajr preġudizzju għad-drittijiet u l-libertajiet ta' suġġetti tad-data oħrajn f'konformità ma' dan ir-Regolament. Barra minn hekk, dak id-dritt ma għandux jippreġudika d-dritt tas-suġġett tad-data li jikseb it-tħassir ta' data personali u l-limitazzjonijiet ta' dak id-dritt kif stabbilit f'dan ir-Regolament u, b'mod partikolari, ma għandux jimplika t-tħassir ta' data personali li tikkonċerna s-suġġett tad-data li jkunu ġew ipprovduti minnu għall-eżekuzzjoni ta' kuntratt, safejn u sakemm id-data personali hija meħtieġa għall-eżekuzzjoni ta' dak il-kuntratt. Fejn ikun teknikament fattibbli, is-suġġett tad-data għandu jkollu d-dritt li jkollu d-data personali trażmessa direttament minn kontrollur għal ieħor.

(68) To further strengthen the control over his or her own data, where the processing of personal data is carried out by automated means, the data subject should also be allowed to receive personal data concerning him or her which he or she has provided to a controller in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another controller. Data controllers should be encouraged to develop interoperable formats that enable data portability. That right should apply where the data subject provided the personal data on the basis of his or her consent or the processing is necessary for the performance of a contract. It should not apply where processing is based on a legal ground other than consent or contract. By its very nature, that right should not be exercised against controllers processing personal data in the exercise of their public duties. It should therefore not apply where the processing of the personal data is necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller. The data subject's right to transmit or receive personal data concerning him or her should not create an obligation for the controllers to adopt or maintain processing systems which are technically compatible. Where, in a certain set of personal data, more than one data subject is concerned, the right to receive the personal data should be without prejudice to the rights and freedoms of other data subjects in accordance with this Regulation. Furthermore, that right should not prejudice the right of the data subject to obtain the erasure of personal data and the limitations of that right as set out in this Regulation and should, in particular, not imply the erasure of personal data concerning the data subject which have been provided by him or her for the performance of a contract to the extent that and for as long as the personal data are necessary for the performance of that contract. Where technically feasible, the data subject should have the right to have the personal data transmitted directly from one controller to another.

Linji ta 'Gwida & Ġurisprudenza

(EN)

Documents

Article 29 Working Party, Guidelines on the Right to Data Portability (2017).

Information Commissioner’s Office, Right of Access (2020).

EDPB, Guidelines 02/2021 on Virtual Voice Assistants (2021).

Ħalli kumment

[js-disqus]