A controller refuses a data portability request because the personal data were collected on a legal-obligation basis rather than consent or contract. Is that refusal typically aligned with GDPR portability rules?
Select an answer to reveal the explanation.
Short Explanation
Portability is a suitcase for data you handed over under consent or a contract deal—not a moving truck for every legal archive. If the controller held the data because the law forced collection, that suitcase usually stays closed. Know the gate conditions before packing.
Full Explanation
Data portability is intentionally narrower than the right of access. It generally covers personal data provided by the data subject where processing is based on consent or contract and carried out by automated means—not every lawful basis and not every field the controller holds. Refusing portability because data were collected on a legal-obligation basis is typically aligned with those limiting conditions, while access and transparency duties may still apply separately and should not be confused with portability’s reuse goal.
Portability does not apply to every processing activity regardless of lawful basis. Paying a fee does not expand portability to non-qualifying bases. Portability is not limited to special-category data; special-category data raise additional Article 9 constraints rather than unlocking portability by default.
Exam caveat: memorise the portability triangle—data provided by the subject, consent or contract, automated means. Operational check: classify the lawful basis and data origin before exporting; offer Article 15 access if portability does not apply; use structured, commonly used, machine-readable formats when it does. Public bodies processing under legal obligation should explain to residents why portability may not fit that dataset while still honouring access where due—clarity about the distinction builds civic trust instead of a blunt total refusal.