What the right to data portability is
The right to data portability lets the subject take their own data along when moving from one service to another. Under Article 18 of the Law on Personal Data Protection, in the case of automated processing based on the grounds provided by law, where technically possible, the subject has the right to receive from the controller, in a structured, commonly used and machine-readable format, the data provided by them, or to demand their transfer to another controller.
On which grounds it works
The portability right is tied to subpoints (a) and (b) of point 1 of Article 5 — the subject's consent, and the performance of a contractual obligation or the conclusion of a transaction at the subject's request — and, for special categories of data, to written consent. It must be said plainly: the Georgian portability right is by its essence narrower than the corresponding institute described in Europe's General Data Protection Regulation — no portability right is provided for processing based on public interest, statutory duty or legitimate interest. Each request therefore begins with establishing the ground, and only then the format. Point 2 of Article 5 puts the substantiation of the legal basis on the controller itself — the ground's existence is confirmed by the organization, not the subject.
The format and direct transmission
The law names two paths: the subject receives the data in a structured, commonly used and machine-readable format — not a mere picture of a document but a form readable in another system — or demands direct transmission of the data to another controller where technically possible. Only the data the subject supplied themselves must be provided — the controller's conclusions and profiles are not the object of this right.
Portability versus access — what differs
Portability is often confused with the right of access, but the aim differs. The right of access lets the subject examine the data concerning them and obtain copies — to know what the organization holds. The aim of portability is use: the received data must work in another service — hence the mandatory machine-readable format. Access is thus an instrument of knowledge, portability one of transition. In practice both requests may be submitted together, but the controller processes them differently: for access, a statutory fee may apply to a different format, while for portability no fee is provided — rights operating on consent and contract grounds are exercised free of charge.