Article 20 of data portability presents substantial obstacles for AI. The provision gives the data subject the right to receive personal data about him or her that he or she has provided to a controller in a structured, commonly used, and machine-readable format, as well as the right to transmit those data to another controller without interference from the controller to which the personal data was provided. This provision is subject to limitations as the right is only granted where the processing is based on consent or a contract and is carried out by automated means.
The controller will thus be compelled to share both provided and inferred data, as long as it meets the definition of personal data in article 4.1 - and as was previously discussed, there is a broad margin of appreciation, implying that it will most likely be included.

Nevertheless, the transfer of data to another controller, as specified in Article 20, poses a problem. In addition to the complexities associated with the right to be forgotten, as discussed in the last blog post, data subjects may force controllers to give up their competitive advantage. Given that AI research is primarily reliant on big data, where large datasets impart competitive advantage, businesses invest significant sums in perfecting their data collecting techniques.

By allowing data subjects to access or retrieve such data, smaller companies may be able to collect equivalent numbers without investing as much, possibly levelling the playing field.

In principle, Article 20 might promote data equality, resulting in more competitive AI marketplaces that benefit consumers, who gain the ability to forum shop. Companies would no longer have unfair advantages or disadvantages based purely on data availability. However, although data parity appears to promote AI research, it also exposes organisations to more risk, thereby limiting AI growth.

GDPR on AI - a series of posts written by Maria Mot