Will “smart” devices be required to allow import and export of data under the GDPR?

Question

In May 2018, the European Union's General Data Protection Regulation will come into force, and EU citizens will be given additional rights in regards to their data. As well as this, data controllers (organisations that collect data on users) will have additional obligations placed upon them.

Interestingly, one of the new rights given to users is the right to data portability. Wikipedia defines it like so:

A person shall be able to transfer their personal data from one electronic processing system to and into another, without being prevented from doing so by the data controller. In addition, the data must be provided by the controller in a structured and commonly used electronic format. The right to data portability is provided by Article 18 of the GDPR. Legal experts see in the final version of this measure a "new right" created that "reaches beyond the scope of data portability between two controllers as stipulated in Article 18."

For the purpose of this question, take the example of a smart health tracker (such as a FitBit). Will I be able to export data from my FitBit tracker and then import the data into a competitor's tracker?

In addition, how will I be expected to comply with this regulation if I design my own IoT device that synchronises with the Internet?

Answer 1

I think this will be difficult to answer, ask three lawyers get four answers, not to mention that it is something in the future. However, I would argue, that not each device (in the technical sense) would be required to comply with this rule.

Consider a use case where smart devices work without an external or cloud-based data service, e.g. a smart home system where IoT devices report to a central node in said home, but not uploading anything. In this case there is simply no data controller.

If on the other hand a system uses the data services of a data controller to collect, process, and store user data (e.g. the mentioned FitBit) they shall be required to enable you to take hold of this data and use it with another provider. I argue that the electronic processing system is not necessarily your device (the tracker itself) but the external data service this provider offers. This (to me) also implies that your right to get this data in a structured and commonly used electronic format does not require the first provider to give you the data in the file format of the second provider if their format is proprietary and not commonly used. From a technical standpoint we would expect a common API to allow for this interchange of data but I dare say that we will have to wait for this for some time and quite a number of disputed court decisions.

In addition, how will I be expected to comply with this regulation if I design my own IoT device that synchronises with the Internet?

If it is DIY and only you use it you'll most likely be fine. If you start turning this into a business plenty of regulations including this one shall hit you.