{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T16:17:38Z","timestamp":1783009058887,"version":"3.54.5"},"reference-count":48,"publisher":"Privacy Enhancing Technologies Symposium Advisory Board","issue":"3","license":[{"start":{"date-parts":[[2021,4,27]],"date-time":"2021-04-27T00:00:00Z","timestamp":1619481600000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/3.0"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021,7,1]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Data portability regulation has promised that individuals will be easily able to transfer their personal data between online service providers. Yet, after more than two years of an active privacy regulation regime in the European Union, this promise is far from being fulfilled. Given the lack of a functioning infrastructure for direct data portability between multiple providers, we investigate in our study how easily an individual could currently make use of an indirect data transfer between providers. We define such porting as a two-step transfer: firstly, requesting a data export from one provider, followed secondly by the import of the obtained data to another provider. To answer this question, we examine the data export practices of 182 online services, including the top one hundred visited websites in Germany according to the Alexa ranking, as well as their data import capabilities. Our main results show that high-ranking services, which primarily represent incumbents of key online markets, provide significantly larger data export scope and increased import possibilities than their lower-ranking competitors. Moreover, they establish more thorough authentication of individuals before export. These first empirical results challenge the theoretical literature on data portability, according to which, it would be expected that incumbents only complied with the minimal possible export scope in order to not lose exclusive consumer data to market competitors free-of-charge. We attribute the practices of incumbents observed in our study to the absence of an infrastructure realizing direct data portability.<\/jats:p>","DOI":"10.2478\/popets-2021-0051","type":"journal-article","created":{"date-parts":[[2021,4,29]],"date-time":"2021-04-29T01:34:06Z","timestamp":1619660046000},"page":"351-372","source":"Crossref","is-referenced-by-count":27,"title":["Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Art. 20"],"prefix":"10.56553","volume":"2021","author":[{"given":"Emmanuel","family":"Syrmoudis","sequence":"first","affiliation":[{"name":"Technical University of Munich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Stefan","family":"Mager","sequence":"additional","affiliation":[{"name":"Ludwig-Maximilians-University of Munich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sophie","family":"Kuebler-Wachendorff","sequence":"additional","affiliation":[{"name":"Ludwig-Maximilians-University of Munich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Paul","family":"Pizzinini","sequence":"additional","affiliation":[{"name":"Ludwig-Maximilians-University of Munich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jens","family":"Grossklags","sequence":"additional","affiliation":[{"name":"Technical University of Munich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Johann","family":"Kranz","sequence":"additional","affiliation":[{"name":"Ludwig-Maximilians-University of Munich"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"35752","published-online":{"date-parts":[[2021,4,27]]},"reference":[{"key":"2022050305473500448_j_popets-2021-0051_ref_001_w2aab3b7c36b1b6b1ab1ab1Aa","doi-asserted-by":"crossref","unstructured":"[1] C. Jones and C. Tonetti. Nonrivalry and the economics of data. American Economic Review, 110(9):2819\u20132858, 2020.10.1257\/aer.20191330","DOI":"10.1257\/aer.20191330"},{"key":"2022050305473500448_j_popets-2021-0051_ref_002_w2aab3b7c36b1b6b1ab1ab2Aa","unstructured":"[2] J. Kr\u00e4mer, P. Senellart, and A. de Streel. Making data portability more effective for the digital economy. CERRE Report, 2020."},{"key":"2022050305473500448_j_popets-2021-0051_ref_003_w2aab3b7c36b1b6b1ab1ab3Aa","doi-asserted-by":"crossref","unstructured":"[3] I. Graef. Mandating portability and interoperability in online social networks: Regulatory and competition law issues in the European Union. Telecommunications Policy, 39(6): 502\u2013514, 2015.","DOI":"10.1016\/j.telpol.2015.04.001"},{"key":"2022050305473500448_j_popets-2021-0051_ref_004_w2aab3b7c36b1b6b1ab1ab4Aa","doi-asserted-by":"crossref","unstructured":"[4] M. Wohlfarth. Data portability on the internet. Business & Information Systems Engineering, 61(5):551\u2013574, 2019.10.1007\/s12599-019-00580-9","DOI":"10.1007\/s12599-019-00580-9"},{"key":"2022050305473500448_j_popets-2021-0051_ref_005_w2aab3b7c36b1b6b1ab1ab5Aa","doi-asserted-by":"crossref","unstructured":"[5] A. Sunyaev, N. Kannengie\u00dfer, R. Beck, H. Treiblmaier, M. Lacity, J. Kranz, G. Fridgen, U. Spankowski, and A. Luckow. Token economy. Business & Information Systems Engineering, pages 1\u201322, 2021.10.1007\/s12599-021-00684-1","DOI":"10.1007\/s12599-021-00684-1"},{"key":"2022050305473500448_j_popets-2021-0051_ref_006_w2aab3b7c36b1b6b1ab1ab6Aa","doi-asserted-by":"crossref","unstructured":"[6] S. Mager and J. Kranz. Stimulating economic growth by unlocking the nonrival potential of data - Review, synthesis and directions for future research. Available at SSRN 3720114, 2020.10.2139\/ssrn.3720114","DOI":"10.2139\/ssrn.3720114"},{"key":"2022050305473500448_j_popets-2021-0051_ref_007_w2aab3b7c36b1b6b1ab1ab7Aa","doi-asserted-by":"crossref","unstructured":"[7] S. Zuboff. Big other: Surveillance capitalism and the prospects of an information civilization. Journal of Information Technology, 30(1):75\u201389, 2015.","DOI":"10.1057\/jit.2015.5"},{"key":"2022050305473500448_j_popets-2021-0051_ref_008_w2aab3b7c36b1b6b1ab1ab8Aa","unstructured":"[8] I. Graef, J. Verschakelen, and P. Valcke. Putting the right to data portability into a competition law perspective. Law: The Journal of the Higher School of Economics, pages 53\u201363, 2013."},{"key":"2022050305473500448_j_popets-2021-0051_ref_009_w2aab3b7c36b1b6b1ab1ab9Aa","doi-asserted-by":"crossref","unstructured":"[9] P. De Hert, V. Papakonstantinou, G. Malgieri, L. Beslay, and I. Sanchez. The right to data portability in the GDPR: Towards user-centric interoperability of digital services. Computer Law & Security Review, 34(2):193\u2013203, 2018.","DOI":"10.1016\/j.clsr.2017.10.003"},{"key":"2022050305473500448_j_popets-2021-0051_ref_010_w2aab3b7c36b1b6b1ab1ac10Aa","doi-asserted-by":"crossref","unstructured":"[10] T. Linden, R. Khandelwal, H. Harkous, and K. Fawaz. The privacy policy landscape after the GDPR. Proceedings on Privacy Enhancing Technologies, 2020(1):47\u201364, 2020.10.2478\/popets-2020-0004","DOI":"10.2478\/popets-2020-0004"},{"key":"2022050305473500448_j_popets-2021-0051_ref_011_w2aab3b7c36b1b6b1ab1ac11Aa","doi-asserted-by":"crossref","unstructured":"[11] J. Wong and T. Henderson. The right to data portability in practice: Exploring the implications of the technologically neutral GDPR. International Data Privacy Law, 9(3):173\u2013191, 2019.","DOI":"10.1093\/idpl\/ipz008"},{"key":"2022050305473500448_j_popets-2021-0051_ref_012_w2aab3b7c36b1b6b1ab1ac12Aa","doi-asserted-by":"crossref","unstructured":"[12] S. Turner, J. Galindo Quintero, S. Turner, J. Lis, and L. M. Tanczer. The exercisability of the right to data portability in the emerging Internet of Things (IoT) environment. New Media & Society, 2020.10.2139\/ssrn.3931040","DOI":"10.2139\/ssrn.3931040"},{"key":"2022050305473500448_j_popets-2021-0051_ref_013_w2aab3b7c36b1b6b1ab1ac13Aa","unstructured":"[13] Eurostat. NACE rev. 2 - Statistical classification of economic activities in the European community, 2008. Available at: https:\/\/ec.europa.eu\/eurostat\/web\/nace-rev2\/overview."},{"key":"2022050305473500448_j_popets-2021-0051_ref_014_w2aab3b7c36b1b6b1ab1ac14Aa","unstructured":"[14] B. Willard, J. Chavez, G. Fair, K. Levine, A. Lange, and J. Dickerson. Data Transfer Project: From theory to practice, 2018. Available at: https:\/\/services.google.com\/fh\/files\/blogs\/data-transfer-project-google-whitepaper-v4.pdf."},{"key":"2022050305473500448_j_popets-2021-0051_ref_015_w2aab3b7c36b1b6b1ab1ac15Aa","doi-asserted-by":"crossref","unstructured":"[15] I. Graef, M. Husovec, and N. Purtova. Data portability and data control: Lessons for an emerging concept in EU law. German Law Journal, 19(6):1359\u20131398, 2018.","DOI":"10.1017\/S2071832200023075"},{"key":"2022050305473500448_j_popets-2021-0051_ref_016_w2aab3b7c36b1b6b1ab1ac16Aa","doi-asserted-by":"crossref","unstructured":"[16] P. Klemperer. Markets with consumer switching costs. The Quarterly Journal of Economics, 102(2):375\u2013394, 1987.10.2307\/1885068","DOI":"10.2307\/1885068"},{"key":"2022050305473500448_j_popets-2021-0051_ref_017_w2aab3b7c36b1b6b1ab1ac17Aa","unstructured":"[17] DLA Piper. Data protection laws of the world, 2020. Available at: https:\/\/www.dlapiperdataprotection.com\/system\/modules\/za.co.heliosdesign.dla.lotw.data_protection\/functions\/handbook.pdf?country=all, last accessed: November 25th, 2020."},{"key":"2022050305473500448_j_popets-2021-0051_ref_018_w2aab3b7c36b1b6b1ab1ac18Aa","unstructured":"[18] M. E. Porter. The five competitive forces that shape strategy. Harvard Business Review, 86(1):25\u201340, 2008."},{"key":"2022050305473500448_j_popets-2021-0051_ref_019_w2aab3b7c36b1b6b1ab1ac19Aa","doi-asserted-by":"crossref","unstructured":"[19] C. J. Hoofnagle and J. King. Consumer information sharing: Where the sun still don\u2019t shine. Available at SSRN 1137990, 2007.10.2139\/ssrn.1137990","DOI":"10.2139\/ssrn.1137990"},{"key":"2022050305473500448_j_popets-2021-0051_ref_020_w2aab3b7c36b1b6b1ab1ac20Aa","doi-asserted-by":"crossref","unstructured":"[20] L. Thomas and C. J. Hoofnagle. Exploring information sharing through California\u2019s \u2019Shine the Light\u2019 law. Available at SSRN 1448365, 2009.10.2139\/ssrn.1448365","DOI":"10.2139\/ssrn.1448365"},{"key":"2022050305473500448_j_popets-2021-0051_ref_021_w2aab3b7c36b1b6b1ab1ac21Aa","doi-asserted-by":"crossref","unstructured":"[21] S. Grogan and A. M. McDonald. Access denied! contrasting data access in the united states and ireland. Proceedings on Privacy Enhancing Technologies, 2016(3):191\u2013211, 2016.10.1515\/popets-2016-0023","DOI":"10.1515\/popets-2016-0023"},{"key":"2022050305473500448_j_popets-2021-0051_ref_022_w2aab3b7c36b1b6b1ab1ac22Aa","doi-asserted-by":"crossref","unstructured":"[22] J. L. Kr\u00f6ger, J. Lindemann, and D. Herrmann. How do app vendors respond to subject access requests? a longitudinal privacy study on ios and android apps. In Proceedings of the 15th International Conference on Availability, Reliability and Security, 2020.10.1145\/3407023.3407057","DOI":"10.1145\/3407023.3407057"},{"key":"2022050305473500448_j_popets-2021-0051_ref_023_w2aab3b7c36b1b6b1ab1ac23Aa","doi-asserted-by":"crossref","unstructured":"[23] J. Kr\u00e4mer. Personal data portability in the platform economy: Economic implications and policy recommendations. Journal of Competition Law & Economics, 2020.10.1093\/joclec\/nhaa030","DOI":"10.1093\/joclec\/nhaa030"},{"key":"2022050305473500448_j_popets-2021-0051_ref_024_w2aab3b7c36b1b6b1ab1ac24Aa","doi-asserted-by":"crossref","unstructured":"[24] J. Kr\u00e4mer and N. St\u00fcdlein. Data portability, data disclosure and data-induced switching costs: Some unintended consequences of the General Data Protection Regulation. Economics Letters, 181:99\u2013103, 2019.","DOI":"10.1016\/j.econlet.2019.05.015"},{"key":"2022050305473500448_j_popets-2021-0051_ref_025_w2aab3b7c36b1b6b1ab1ac25Aa","doi-asserted-by":"crossref","unstructured":"[25] P. Swire and Y. Lagos. Why the right to data portability likely reduces consumer welfare: Antitrust and privacy critique. Maryland Law Review, 72(2):335\u2013380, 2013.","DOI":"10.2139\/ssrn.2159157"},{"key":"2022050305473500448_j_popets-2021-0051_ref_026_w2aab3b7c36b1b6b1ab1ac26Aa","doi-asserted-by":"crossref","unstructured":"[26] W. Lam and X. Liu. Does data portability facilitate entry? International Journal of Industrial Organization, 69:102564, 2020.10.1016\/j.ijindorg.2019.102564","DOI":"10.1016\/j.ijindorg.2019.102564"},{"key":"2022050305473500448_j_popets-2021-0051_ref_027_w2aab3b7c36b1b6b1ab1ac27Aa","unstructured":"[27] Council of European Union. Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (General Data Protection Regulation), 2016. Available at: https:\/\/eurlex.europa.eu\/eli\/reg\/2016\/679\/2016-05-04."},{"key":"2022050305473500448_j_popets-2021-0051_ref_028_w2aab3b7c36b1b6b1ab1ac28Aa","doi-asserted-by":"crossref","unstructured":"[28] G. Malgieri. Property and (intellectual) ownership of consumers\u2019 information: A new taxonomy for personal data. Privacy in Germany - PinG, 2016(4):133, 2016.","DOI":"10.37307\/j.2196-9817.2016.04.05"},{"key":"2022050305473500448_j_popets-2021-0051_ref_029_w2aab3b7c36b1b6b1ab1ac29Aa","unstructured":"[29] Article 29 Data Protection Working Party. Guidelines on the right to data portability, 2017. Available at: https:\/\/ec.europa.eu\/newsroom\/article29\/item-detail.cfm?item_id=611233."},{"key":"2022050305473500448_j_popets-2021-0051_ref_030_w2aab3b7c36b1b6b1ab1ac30Aa","unstructured":"[30] Bureau van Dijk. Orbis, 2020. Available at: https:\/\/orbis.bvdinfo.com\/, last accessed: October 15th, 2020."},{"key":"2022050305473500448_j_popets-2021-0051_ref_031_w2aab3b7c36b1b6b1ab1ac31Aa","unstructured":"[31] CMS. GDPR enforcement tracker, 2020. Available at: https:\/\/www.enforcementtracker.com\/, last accessed: November 26th, 2020."},{"key":"2022050305473500448_j_popets-2021-0051_ref_032_w2aab3b7c36b1b6b1ab1ac32Aa","unstructured":"[32] Alexa. Topsites in Germany - Ranking, 2020. Available at: https:\/\/www.alexa.com\/topsites\/countries\/DE, last accessed: September 30th, 2020."},{"key":"2022050305473500448_j_popets-2021-0051_ref_033_w2aab3b7c36b1b6b1ab1ac33Aa","unstructured":"[33] M. Bishop. The art and science of computer security. Addison-Wesley Longman Publishing, 2002."},{"key":"2022050305473500448_j_popets-2021-0051_ref_034_w2aab3b7c36b1b6b1ab1ac34Aa","unstructured":"[34] M. Di Martino, P. Robyns, W. Weyts, P. Quax, W. Lamotte, and K. Andries. Personal information leakage by abusing the GDPR \u2019right of access\u2019. In Fifteenth Symposium on Usable Privacy and Security (SOUPS), 2019."},{"key":"2022050305473500448_j_popets-2021-0051_ref_035_w2aab3b7c36b1b6b1ab1ac35Aa","unstructured":"[35] The European Parliament and the Council of the European Union. Directive 2014\/92\/EU. Official Journal of the European Union, 2014. Available at: https:\/\/eurlex.europa.eu\/eli\/dir\/2014\/92\/oj."},{"key":"2022050305473500448_j_popets-2021-0051_ref_036_w2aab3b7c36b1b6b1ab1ac36Aa","unstructured":"[36] H. Hlavac. stargazer: Well-formatted regression and summary statistics tables, 2018. Available at: https:\/\/CRAN.R-project.org\/package=stargazer."},{"key":"2022050305473500448_j_popets-2021-0051_ref_037_w2aab3b7c36b1b6b1ab1ac37Aa","doi-asserted-by":"crossref","unstructured":"[37] W. Venables and B. Ripley. Modern applied statistics with S. Springer-Verlag, fourth edition, 2002.10.1007\/978-0-387-21706-2","DOI":"10.1007\/978-0-387-21706-2"},{"key":"2022050305473500448_j_popets-2021-0051_ref_038_w2aab3b7c36b1b6b1ab1ac38Aa","doi-asserted-by":"crossref","unstructured":"[38] M. Zhao, J. Grossklags, and P. Liu. An empirical study of web vulnerability discovery ecosystems. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 1105\u20131117, 2015.10.1145\/2810103.2813704","DOI":"10.1145\/2810103.2813704"},{"key":"2022050305473500448_j_popets-2021-0051_ref_039_w2aab3b7c36b1b6b1ab1ac39Aa","unstructured":"[39] S. Mager and J. Kranz. Consent notices and the willingness-to-sell observational data: Evidence from user reactions in the field. Proceedings on the European Conference on Information Systems (ECIS), 2021."},{"key":"2022050305473500448_j_popets-2021-0051_ref_040_w2aab3b7c36b1b6b1ab1ac40Aa","doi-asserted-by":"crossref","unstructured":"[40] C. Argenton and J. Pruefer. Search engine competition with network externalities. Journal of Competition Law and Economics, 8(1):73\u2013105, 2012.10.1093\/joclec\/nhr018","DOI":"10.1093\/joclec\/nhr018"},{"key":"2022050305473500448_j_popets-2021-0051_ref_041_w2aab3b7c36b1b6b1ab1ac41Aa","doi-asserted-by":"crossref","unstructured":"[41] P. Constantinides, O. Henfridsson, and G. Parker. Introduction - Platforms and infrastructures in the digital age. Information Systems Research, 29(2):381\u2013400, 2018.10.1287\/isre.2018.0794","DOI":"10.1287\/isre.2018.0794"},{"key":"2022050305473500448_j_popets-2021-0051_ref_042_w2aab3b7c36b1b6b1ab1ac42Aa","unstructured":"[42] European Commission. Special Eurobarometer 487a, 2019. Available at: http:\/\/dx.doi.org\/10.2838\/579882."},{"key":"2022050305473500448_j_popets-2021-0051_ref_043_w2aab3b7c36b1b6b1ab1ac43Aa","unstructured":"[43] D. Hardt. The OAuth 2.0 authorization framework. RFC 6749, RFC Editor, 2012. Available at: http:\/\/www.rfc-editor.org\/rfc\/rfc6749.txt."},{"key":"2022050305473500448_j_popets-2021-0051_ref_044_w2aab3b7c36b1b6b1ab1ac44Aa","doi-asserted-by":"crossref","unstructured":"[44] S. Landau and T. Moore. Economic tussles in federated identity management. First Monday, 17(10), 2012.10.5210\/fm.v17i10.4254","DOI":"10.5210\/fm.v17i10.4254"},{"key":"2022050305473500448_j_popets-2021-0051_ref_045_w2aab3b7c36b1b6b1ab1ac45Aa","unstructured":"[45] Data Portability Cooperation. Telecoms as the \u201csecured data hub\u201d for the digital society, 2019. Available at: https:\/\/www.dataportabilitycooperation.org\/assets\/Telecoms_Secured_Data_Hub.pdf, last accessed: November 27th, 2020."},{"key":"2022050305473500448_j_popets-2021-0051_ref_046_w2aab3b7c36b1b6b1ab1ac46Aa","doi-asserted-by":"crossref","unstructured":"[46] S. Spiekermann and J. Korunovska. Towards a value theory for personal data. Journal of Information Technology, 32(1): 62\u201384, 2017.10.1057\/jit.2016.4","DOI":"10.1057\/jit.2016.4"},{"key":"2022050305473500448_j_popets-2021-0051_ref_047_w2aab3b7c36b1b6b1ab1ac47Aa","doi-asserted-by":"crossref","unstructured":"[47] B. Caillaud and B. Jullien. Chicken & Egg: Competition among intermediation service providers. RAND Journal of Economics, 34(2):309\u2013328, 2003.","DOI":"10.2307\/1593720"},{"key":"2022050305473500448_j_popets-2021-0051_ref_048_w2aab3b7c36b1b6b1ab1ac48Aa","doi-asserted-by":"crossref","unstructured":"[48] T. Urban, D. Tatang, M. Degeling, T. Holz, and N. Pohlmann. A study on subject data access in online advertising after the GDPR. In Data Privacy Management, Cryptocurrencies and Blockchain Technology, 2019.10.1007\/978-3-030-31500-9_5","DOI":"10.1007\/978-3-030-31500-9_5"}],"container-title":["Proceedings on Privacy Enhancing Technologies"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.sciendo.com\/pdf\/10.2478\/popets-2021-0051","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,12,25]],"date-time":"2022-12-25T20:01:41Z","timestamp":1671998501000},"score":1,"resource":{"primary":{"URL":"https:\/\/petsymposium.org\/popets\/2021\/popets-2021-0051.php"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,4,27]]},"references-count":48,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2021,4,27]]},"published-print":{"date-parts":[[2021,7,1]]}},"alternative-id":["10.2478\/popets-2021-0051"],"URL":"https:\/\/doi.org\/10.2478\/popets-2021-0051","relation":{},"ISSN":["2299-0984"],"issn-type":[{"value":"2299-0984","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,4,27]]}}}