This is a new two-part right set out in Article 20.
In cases where an individual has:
- provided their personal data directly to the controller; and
- it is processed by automated means: and
- it is processed only on the legal grounds of
- their consent, or
- in connection with a contract to which they are a party
they have the right to:
- receive that personal data in a structured and commonly used and machine readable format; and/or
- to require the controller to transmit those data directly to another controller (where technically feasible)
This right is limited in its application and does not:
- apply where processing is based on any other legal ground
- apply to personal data processed by a public authority in the exercise of its public duties
- prejudice the other rights of the individual
- require data controllers to adopt or maintain systems which are technically compatible
- imply that the data should be erased by the data controller in particular to the extent that it is still required for the purposes of the performance of the contract with the individual.
Recital 68 provides further guidance.