white_paper_on_data_protection_in_india_171127_final_v2

. the processing is unlawful and the individual opposes the erasure of such data,
c. the organisation no longer needs the personal data for the purposes of the processing,
but they are required by the individual for the establishment, exercise or defence of
legal claims,
d. the individual has exercised her right to object to processing - for the time period the
organisation determines whether its legitimate interests trumps those of the individual.
(v)
Right to Data Portability
The right to data portability empowers individuals regarding their personal data as it
facilitates their ability to move, copy or transmit personal data easily from one IT
environment to another. 608 For example, by exercising this right an individual should be able
to transfer her playlist from one music streaming service to another. In the context of medical
data and financial information, this would empower the individual by serving as a protection
against that individual being locked into a service. Limited data portability has already been
allowed in the context of the telecom industry where individuals are allowed to port their
number from one service provider to another. This concept could be more broadly applied
across all sectors in which personal data of the individual is stored with data controllers to
ensure that the individual is given control over her own data.
There are two rights guaranteed by the right to data portability: the right to receive the
personal data provided by the individual to the organisation in a commonly used machinereadable
format, and the right to transmit personal data from one organisation to another,
where technically feasible. Further this right is only exercisable when the ground for
processing the data is either consent or the performance of a contract, and when processing is
carried out via automated means. 609
9.2 Issues
(i)
Costly implementation
The newly introduced rights such as those of data portability and the right to erasure are
expected to be particularly expensive for organisations to implement. 610 For instance, after the
Google Spain ruling on the right to be forgotten, Google received thousands of removal
requests (91,000 in three months) and had to set up a team of people to review each
application individually. 611 Similarly, data portability requires an organisation to modify
608 Article 29 Data Protection Working Party, ‗Guidelines on the Right to Data Portability‘, European
Commission (13 December 2016), available at:
http://ec.europa.eu/information_society/newsroom/image/document/2016-51/wp242_en_40852.pdf, (last
accessed 24 October 2017).
609 Article 20(1)(a), EU GDPR.
610 Ministry of Justice, UK, ‗Impact Assessment of Proposal for an EU Data Protection Regulation‘ (22
November 2012), available at: https://consult.justice.gov.uk/digital-communications/data-protection-proposalscfe/results/eu-data-protection-reg-impact-assessment.pdf
, (last accessed 21 October 2017).
611 Samuel Gibbs, ‗Google to extend ‗Right to be Forgotten‘ to all its domains accessed in EU, The Guardian (11
February 2016), available at: https://www.theguardian.com/technology/2016/feb/11/google-extend-right-to-beforgotten-googlecom,
(last accessed 21 November 2017); David Drummond, ‗We need to talk about the right to
131