Compliance guide: Navigating the new right to data portability

Antoine Guilmain

Hi everyone, today we are going to talk about the right to data portability. The right to data portability will come into effect as of September 22nd, 2024, as the third and final phase of Law 25 in Quebec. This provision will allow individuals to request and obtain from an organization that collected the personal information, their computerized personal information in a structured and common use technological format. The objective is to enable individuals to hold their personal information for personal use or to communicate it to a third party of their choice.

So I do have many questions, and the first one being what's the difference between the specific right to data portability and the broader right to data portability and the broader right of access to personal information?

Nawal Sassi

So the right to portability should be seen as an extension of the right of access, right? Unlike in the EU, where the GDPR provides that the right to portability is a distinct right, in Quebec, the mechanism for exercising this right, mostly follow those of the right of access, of course, subject to certain specific conditions.

Antoine Guilmain

Speaking of specifics, is there a difference between personal information on one hand and computerized personal information under this new right?

Nawal Sassi

Absolutely. So, the Law provides that only computerized personal information can be the subject of a portability request. Now, what is personal information? It's information concerning an individual that can directly or indirectly identify them. So, phone number, address, etcetera. Computerized personal information implies that the information has been collected in a computerized form. So, someone who's filled out an online form.

Antoine Guilmain

I'm actually wondering what's the exact meaning of structured and commonly used technological format. Can you please provide slightly more detail in this regard?

Nawal Sassi

Two criteria must be met regarding the transmission format. First, the transcription must be written and intelligible, meaning that a person must be able to read and understand what has been collected about them. Encrypted information, for example, is not intelligible. Now, the second requirement is concerning the structured and commonly used technological format. This concept is not clearly defined here in Quebec, but in the EU, they have their own equivalent of data portability. The European Data Protection Board has published guidelines with a list of formats considered compliant with portability, formats such as JSON, CSV, and XML.

Antoine Guilmain

So, does it mean this right to data portability is unconditional? In other words, are there any restrictions that may apply depending on the situation?

Nawal Sassi

Yes. So, there are restrictions that limit the right to data portability. The first one that comes to mind is information created or inferred from collected personal information. For example, process data such as generated recommendation based on a user's purchase history is excluded from data portability, right? Because it's commercial, confidential information, and it constitutes intellectual property.

Antoine Guilmain

So, obviously, non-compliant with the law may result in sanctions that may be imposed by the Quebec Privacy Commissioner.

To help you comply with this new requirement, we've put together a guide to the right of data portability, and the idea is to outline the key concepts as well as providing key insights for updating your internal processes.