1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

 FEDERAL TRADE COMMISSION

 DATA TO GO: 

AN FTC WORKSHOP ON DATA PORTABILITY

 TUESDAY, SEPTEMBER 22, 2020

 8:30 A.M.

 VIRTUAL EVENT 
5

10

15

20

25

2 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 

2 

3 FEDERAL TRADE COMMISSION 

4 I N D E X

 PAGE: 

6 Welcome and Opening Remarks 3 

7 

8 An Overview of Data Portability: 10 

9 Concepts and Terminology 

11 Data Portability Initiatives in the European 

12 Union, California, and India 31 

13 

14 Financial and Health Portability Regimes:

 Case Studies 82 

16 

17 Reconciling the Benefits and Risks of Data 

18 Portability 134 

19 

Realizing Data Portability’s Potential: 

21 Material Challenges and Solutions 198 

22 

23 Closing Remarks 257 

24 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

3 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 P R O C E E D I N G S 

2 - - - - -

3 WELCOME AND OPENING REMARKS 

4 MS. SIGNS: Good morning and welcome to Data 

To Go, the FTC’s workshop on data portability. My 

6 name is Kelly Signs. I’m a Deputy Assistant Director 

7 with the Bureau of Competition at the FTC. On behalf 

8 of the entire FTC workshop team, we're delighted that 

9 you're joining us today via our live webcast.

 Before we begin our program, I have a few 

11 administrative details to cover. First, a video 

12 recording and transcript of these proceedings will be 

13 available on our workshop webpage shortly after the 

14 event. Our intent is to a create a lasting resource 

for anyone who’s interested in this important topic. 

16 Second, as with any virtual event, we may 

17 experience technical issues. If these occur, we ask 

18 for your patience as we work to address them as 

19 quickly as we can. We will let you know if there are 

going to be any significant delays. 

21 Third, we’ll be accepting audience questions 

22 via our dedicated email address, dataportability@ 

23 ftc.gov. Due to time constraints, we may not be able 

24 to get to all the questions, but we will review all 

the ones that we receive. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

4 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Finally, please join us on Twitter. Our 

2 Twitter handle is @FTC, and we’ll be tweeting using 

3 the hashtag #datatogoftc. 

4 And now I have the great pleasure to 

introduce our first speaker, Andrew Smith. Andrew is 

6 the director of the FTC’s Bureau of Consumer 

7 Protection. He came to the FTC from the law firm of 

8 Covington & Burling, where he chaired the financial 

9 services practice group. Earlier in his career, 

Andrew was a staff attorney at the FTC where he led 

11 the agency’s rulemaking efforts under the 

12 Fair Credit Report Act. 

13 Andrew has written extensively on consumer 

14 protection and financial services issues, and served 

as Chair of the American Bar Association’s Consumer 

16 Financial Services Committee. Welcome, Andrew. 

17 MR. SMITH: Thank you, Kelly, and welcome, 

18 everyone, to Data To Go, an FTC workshop on data 

19 portability. Thank you all for tuning in. I'm sorry 

we can't all be in the same room this morning to 

21 interact with one another in person, but I’m grateful 

22 that we still have the ability to host a workshop on 

23 such an important issue with experts from around the 

24 world. This is the FTC’s third virtual workshop, and 

I'm confident that it will be another success. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

5 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 In the last few years, data portability has 

2 emerged as a hot topic in both antitrust and consumer 

3 protection circles. Freeing up data promises to 

4 increase consumers’ choice and control their own 

privacy. It could also foster competition by, among 

6 other things, lowering barriers to entry. But there 

7 are risks. While there may be privacy benefits to 

8 allowing consumers greater choice and control, 

9 increased data flows raise serious questions about how 

to make sure that data is kept safe. This convergence 

11 of issues has presented the FTC, which has both 

12 competition and consumer protection missions, with the 

13 opportunity for staff from across the agency to 

14 collaborate.

 This workshop is a prime example. And I’d 

16 like to thank Jarad Brown and Kate White from the 

17 Bureau of Consumer Protection; Andrea Zach, Kelly 

18 Signs, Chris Grengs and Ryan Quillian from the Bureau 

19 of Competition; Ben Smith from the Bureau of 

Economics, and Guilherme Roschke from the Office of 

21 International Affairs for bringing us this event. 

22 The term “data portability” can mean 

23 different things to different people. For some, data 

24 portability refers to the ability of consumers to 

receive a copy of the data about them either for their 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

6 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 own conveniences or to move the data to another 

2 service. For others, data portability means the 

3 transfer of data about multiple individuals so that, 

4 for example, a business can easily move its customers 

database from one vendor to another. 

6 Across the globe and here in the U.S., we 

7 have seen various approaches to portability. Some 

8 approaches such as in the EU and California have 

9 focused on an individual’s rights to portability. 

These jurisdictions have enacted general consumer 

11 privacy laws, and although there are differences in 

12 their regulations, both jurisdictions give consumers 

13 the right to receive their data in a format that more 

14 easily allows the transfer of that data to another 

entity. 

16 India, on the other hand, does not have a 

17 general privacy law, and its data portability 

18 initiatives aim to increase consumer access to 

19 services, especially health and financial services. 

 Other approaches such as the UK’s Open 

21 Banking initiative and the interoperability rule at 

22 HHS Office of the National Coordinator for Health 

23 Information Technology, have taken a sector-specific 

24 approach. They have each created secure standardized 

methods for data to be transferred with the goal of 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

7 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 providing consumers with better access and control 

2 over data and increasing competition. 

3 At the same time as these government 

4 initiatives, there are industry-wide efforts such as 

the Data Transfer Project that are working on ways to 

6 create open source service-to-service data portability 

7 platforms to allow consumers to easily move their data 

8 between companies. 

9 We're fortunate today to be joined by 

regulators and other experts and stakeholders to 

11 discuss their experiences with these rules and 

12 projects. We'll start the day with a presentation 

13 from Peter Swire, who will provide relevant background 

14 on the issue and set the table for the rest of the 

day’s discussion. 

16 Then our first panel will offer a look at 

17 data portability initiatives in the EU, India and 

18 California. Our second panel will explore sectoral 

19 approaches to data portability. Our afternoon 

sessions will take a more general look at data 

21 portability, and beginning with our third panel, which 

22 will discuss the attributes, benefits and challenges 

23 of data portability initiatives with an eye toward the 

24 twin aims of protecting consumers and promoting 

competition. Our final panel of the day will tackle 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

8 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 some key concerns confronting data portability 

2 initiatives -- security, privacy, standardization and 

3 interoperability -- and will consider some solutions. 

4 So I'm looking forward to hearing all of our 

panelists’ thoughts on these issues. The goal of 

6 today's discussion isn’t a broad policy pronounced 

7 measure or legislative recommendation. Rather 

8 we intend for today’s program to be a contribution to 

9 the broader discussion among global policymakers about 

how data portability can empower consumers and promote 

11 competition without compromising data security. 

12 For example, the OECD has recently sponsored 

13 similar events on data portability, and we also will 

14 be paying close attention to other developments such 

as the CFPB’s recently announced effort to make rules 

16 under the Dodd-Frank Act to facilitate consumers’ 

17 access to financial data. 

18 Before I close, I want to thank the 

19 panelists for giving us their time. Because this is a 

virtual event, many of our speakers are participating 

21 from other time zones. So a special thanks to those 

22 of you who are joining us for a very early morning or 

23 a very late night. And thank you to everyone who is 

24 attending virtually. We appreciate the opportunity to 

engage with the public on this important issue, and I 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

9 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 hope you enjoy the FTC’s Data To Go. We will open 

2 with a presentation from Professor Peter Swire that 

3 will begin at 8:40. Thank you. 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

10 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 AN OVERVIEW OF DATA PORTABILITY: CONCEPTS AND 

2 TERMINOLOGY 

3 MR. SWIRE: Hi, everybody. This is Peter 

4 Swire. I’m calling -- speaking to you from my 

cluttered office in Atlanta, Georgia, where I’m a 

6 professor at Georgia Tech. My thanks to the FTC for 

7 organizing this fantastic workshop today. 

8 Could we have the background slide, please? 

9 So as an overview of what I’m going to do in about 15 

or 20 minutes, I'll give a brief story of my own 

11 background, including a 125-page study on data 

12 portability that’s available this week. I'll explain 

13 three reasons for the current interest in data 

14 portability, then talk about some terminology that I 

propose as a way to make it clear that portability 

16 could be transfers of one person or of many persons, 

17 as Andrew Smith just said. 

18 I'll try to talk about the dilemma here that 

19 antitrust and other factors tend to open data flows, 

but privacy and security tend to close data flows. 

21 And the proposed answer to the dilemma is to have what 

22 I call a portability and other required transfers 

23 impact assessment, a PORT-IA, which is a structured 

24 way to try to figure out how to work your way through 

these different issues. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

11 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 In the course of talking about the PORT-IA, 

2 I'll talk about results from sectoral case studies 

3 that I’ve done in the United States and Europe, and 

4 I’ll explain the importance of having a 

multidisciplinary assessment of these issues. Next 

6 slide. 

7 So, as I said, I'm a professor now at 

8 Georgia Tech. I'm wearing my Georgia Tech colors on 

9 my tie today. I’m also a senior counselor with the 

law firm of Alston & Bird. I’ve worked on privacy and 

11 related issues since the mid-1990s. In the late 

12 2000s, I worked in the White House in the U.S. Office 

13 of Management & Budget as the chief counselor for 

14 privacy with U.S. government-wide responsibility for 

privacy policy. That’s when HIPAA and Gramm-Leach16 Bliley happened, for instance. 

17 If you get certified as a U.S. privacy 

18 professional, I’m the lead author on the textbook for 

19 taking that test. And I've been a professor at law 

schools and elsewhere in privacy, in cybersecurity, 

21 and in antitrust law. So I have a relatively unusual 

22 background of having taught all of these subjects. 

23 I’ve also worked at the intersection of 

24 privacy and antitrust for quite some time. In 2007, 

the FTC asked me to testify about that intersection, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

12 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 and I proposed that we could understand privacy as a 

2 nonprice or a quality aspect of competition. And this 

3 approach of a nonprice aspect of competition has been 

4 widely adopted since then.

 In 2013, after the draft of GDPR was 

6 released, with a co-author, Yianni Lagos, I wrote an 

7 extensive article on data portability, and I decided 

8 over a year ago to come back to data portability to 

9 see if we could try to make sense out of what to do 

next. Next slide. 

11 So, again, as Andrew said, there's a number 

12 of reasons for the current interest and for having 

13 this workshop today. One thing is that we have new 

14 broadly applicable laws on the right to data 

portability. The GDPR in Europe went into effect in 

16 2018, just two years ago. In California, the 

17 California Consumer Privacy Act went into effect in 

18 2020, at the beginning of this year. And so for very 

19 large numbers of companies, they’re facing an 

obligation to have an individual right of data 

21 portability. 

22 A second reason for these debates are the 

23 intense policy debates that everyone on this call 

24 probably knows about, about the digital platforms. 

What about privacy? What about antitrust and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

13 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 competition issues? And these intense debates are 

2 happening both in the European Union and the United 

3 States. And in my research project, I try to give 

4 roughly equal attention to both the EU and U.S. I’ve 

worked on EU law for many years. 

6 A third reason for the current interest is 

7 there’s multiple sectors, important sectors, in the 

8 United States and Europe that now have mandated data 

9 flows. So, for instance, HHS, the U.S. Department of 

Health and Human Services, issued it’s healthcare 

11 interoperability rule in final form in February of 

12 this year, March, I guess. And in EU, the open 

13 banking in the UK and the Payment Services Directive 

14 for the entire European Union, is in the late stages 

of being implemented. So you have healthcare, you 

16 have financial services, major sectors that are 

17 subject to these data portability issues. Next slide, 

18 please. 

19 So for the terminology, because it’s been 

confusing to talk about the different kinds of data 

21 flows, I suggest one -- others may find better ways to 

22 define it. And so for me the right to data 

23 portability is about an individual right to transfer 

24 data. And especially if you talk to European Union 

lawyers, but I think also California lawyers, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

14 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 portability with a small “p” is becoming a term of 

2 art. If a European lawyer says there’s a portability 

3 issue, that means there’s an issue of one person 

4 having their data transferred to a different place. 

And so that’s an individual right to transfer it to 

6 that person himself or herself, whereas an individual 

7 right to transfer from the original service to a 

8 different service, that's an individual transfer 

9 right. For me, that's a small “p”.

 Now, there’s also a lot of discussion, 

11 again, as Andrew Smith mentioned, about having 

12 mandates, proposed or actual now, to transfer entire 

13 databases, to transfer data involving more than one 

14 person. In Europe, this has typically been called 

data sharing. So you’d move a lot of data from this 

16 database to that database, and they call it data 

17 sharing. 

18 In my view, that’s a vague term because data 

19 is shared in so many ways for so many different 

reasons around our digital economy. And so my paper 

21 proposes calling these “other required transfers.” 

22 It’s either portability about one person or it’s other 

23 required transfers about a lot of people. 

24 And so to give an example of other required 

transfers, in the United States under the new rule 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

15 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 that HHS issued this year, a hospital or doctor's 

2 office has a right to transfer all of its records from 

3 one software provider to another one. That’s a 

4 massive transfer of records partly so it doesn't get 

locked into the particular software provider or cloud 

6 provider it has today. 

7 And that kind of law is very familiar in the 

8 European Union. They have a regulation on it to go to 

9 the General Data Protection Regulation on personal 

data. They have what’s called the free flow of data 

11 regulation for nonpersonal data, for other business 

12 data, and it has these same kinds of rules of transfer 

13 of one database from one place to another. Next 

14 slide, please.

 So continuing on terminology, the word 

16 interoperability features very highly in discussions 

17 of these kinds of issues. And I suggest that the 

18 proposed definition of interoperability has to do with 

19 the technical ability of two or more systems to 

exchange information. That might be common data 

21 formats, you know, having a picture look like a 

22 picture. It could be common communication protocols, 

23 how my computer speaks to your computers to structure 

24 the interactions between the computers. And it can 

include other technical mechanisms that enable 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

16 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 operation of two or more systems. So, for me, I think 

2 it’s least confusing, most clear, if we use 

3 interoperability to be a technical word about 

4 transfers from one place to another.

 Now, the HHS rule, which they call the 

6 interoperability rule, I think can learn from the 

7 discussions that this workshop is having today, 

8 because HHS has used the word “interoperability” in 

9 what I think are three pretty different situations.

 So it applies to the technical issues I just 

11 described higher in this slide. Second, it applies to 

12 individual portability. So under HHS you’d be able as 

13 an individual to move your data from a provider to 

14 your app on your phone. And it also applies to other 

required transfers such as moving a doctor’s office’s 

16 records from one cloud provider to another. 

17 So for me the first of these threes would be 

18 interoperability; the second would be lowercase “p” 

19 portability, and the third would be other required 

transfers such as to a new cloud provider. Next 

21 slide, please. 

22 Now, one reason certainly for having the 

23 interest we have here and having the regulators we 

24 have from different countries in the world, is that 

this individual right to data portability has gained 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

17 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 great new prominence in recent years. So under 

2 Article 20 of the GDPR, data subjects -- individuals 

3 -- have a right to receive data or transfer it to a 

4 third party in most cases that they have provided to 

the controller. So if I use a service, I have a right 

6 to transfer it to myself or to others. And the 

7 language in the GDPR has been picked up in a lot of 

8 laws around the world. The transfer has to be what? 

9 It has to be without hindrance, super quick, easy, 

without hindrance portability. That's the law in the 

11 European Union. 

12 California picked up similar kinds of words. 

13 So in the California law that’s on the books and in 

14 effect today, there’s an individual right to access 

data, but that access has to be done in a way that is 

16 portable -- there’s our word “portable” -- and a 

17 readily usable format. So the service must provide 

18 the consumer with the data in a portable and readily 

19 providable format.

 So conclusion on this slide, just since 

21 2018 -- and now it’s 2020 -- we’ve had implementation 

22 done in the European Union and in California -- and 

23 California is economically significant. It’s often 

24 said that California would be the fifth biggest 

economy in the world if it was a standalone economy in 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

18 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 terms of gross national product. Next slide, please. 

2 So that brings us to our dilemma. Overall, 

3 as we think about this, should we open up or close 

4 down data flows? And for antitrust and competition 

reasons, there are many compelling reasons to open 

6 data flows. Let's just imagine that there’s important 

7 databases in our economy, valuable databases about 

8 people that are large, that contain a lot of people's 

9 data. Well, that's what we live with. We have those 

in the major services and lots of other places in our 

11 data-oriented economy. 

12 So the idea for antitrust people is if more 

13 companies have access to that commercially valuable 

14 data, then those companies can compete, they can 

innovate, they can have a more effective competition 

16 around that valuable resource. Okay. That's what the 

17 antitrust people’s intuition is. 

18 For people who start from privacy and 

19 cybersecurity, often they’re looking to have ways to 

close data flows. What if data goes to the wrong 

21 person? Well, that’s not good. The game for privacy 

22 in cybersecurity is to stop it from getting to the 

23 wrong people. So cybersecurity tends to focus on 

24 unauthorized access. That’s a hacker getting into the 

data, pretending to be you to transfer the data, or 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

19 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 that’s an insider who’s not supposed to look at the 

2 data getting it. That’s the cybersecurity angle. 

3 The privacy angle is more about what focus 

4 we have on access that should be authorized. And 

often in privacy, those complicated set of rules, 

6 often the rules are let's be cautious unless the 

7 individual consented or basically knew what was going 

8 to happen. 

9 So in terms of antitrust, we've seen clear 

evidence that the interest in portability from 

11 regulators in Europe and the United States. The 

12 Federal Trade Commission Director of Competition, who 

13 I believe is speaking later today, in February said 

14 the breadth of additional relief that may be 

considered include obligations to provide data. And 

16 you can see the rest of the quote on the slide. Well, 

17 obligations to provide data sounds like data 

18 portability. And we have the workshop today showing 

19 the FTC’s interest in this issue.

 In Europe, their Commissioner for 

21 Competition, Ms. Vestager, discussed the prominent 

22 position of data in digital markets, which I think we 

23 all accept, and she said the need to ensure the 

24 possibility of entry, new entry, by more competitors 

may argue in favor of mandating access to data. And 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

20 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 those other required transfers, those mandates, are 

2 central to what we’re talking about. And the European 

3 Union released it’s European data strategy earlier 

4 this year with many discussions of portability. Next 

slide, please. 

6 So to respond to that dilemma, I'm 

7 suggesting in my study that's available today at 

8 ssrn.com to create a well-designed Portability and 

9 Other Required Transfers Impact Assessment. And the 

method here is similar to privacy impact assessments 

11 that are required for U.S agencies, for instance, in 

12 the United States where the data protection impact 

13 assessments that are required under GDPR. 

14 And the methodology for the study, for all 

this work I’ve been doing for over a year, has been 

16 first to try to draft structured questions of what the 

17 impact assessment would ask, to try to have a 

18 systematic assessment, and then test those assessments 

19 against all those case studies that I showed you 

earlier. And then the case -- the structured 

21 questions change quite a bit. We learn from all these 

22 case studies. And we can validate the structured 

23 questions based on these numerous case studies across 

24 different geography, across different sectors, across 

different types of data. Next slide, please. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

21 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 So to look at the case studies a little bit 

2 more, for the EU and the U.S. we looked at phone 

3 number portability. You can go to one phone company 

4 provider and keep your phone number when it goes to 

another provider. That’s been on the book for almost 

6 20 years. 

7 Now, this portability approach has been 

8 super successful. But after I’ve looked at it, 

9 compared to other case studies, it looked like a 

misleadingly -- a misleadingly easy case. Most people 

11 want their phone numbers known to the other people in 

12 their lives. So it's not a privacy problem. They 

13 want the data out there. So you don't have that 

14 tension between privacy and competition that we see in 

some other sectors. 

16 The study looks at a U.S. financial services 

17 and EU financial services case study, and the Dodd18 Frank Act of 2010 where there’s rules that are 

19 supposed to be developed now by a U.S. agency requires 

portability for consumer financial records. 

21 Looking at EU and U.S. healthcare -- and in 

22 March this year we’ve been talking about this HHS rule 

23 where individuals get portability to their smart phone 

24 apps, that’s small P portability, and there’s other 

required transfers to move to a new healthcare 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

22 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 provider. 

2 I also have a case study on open data for 

3 government databases. You can think of when 

4 government has open data requirements, it's a 

mandatory portability out to the internet. People can 

6 get the data. And there’s a set of laws in Arizona 

7 and three other states that were recently passed that 

8 have to do with when auto dealers are locked into a 

9 provider for their software services, what are the 

rules for being able to move to a different software 

11 provider? Next slide, please. 

12 So now we'll do a very quick overview of the 

13 top-level questions in the PORT-IA, not the sub14 questions. First, the first question is, define the 

challenge or opportunity that leads to a possible 

16 port. Where does the data come from? Where does it 

17 go? What types of data are covered? What 

18 specifically are the legal requirements? You get your 

19 engineers in here to do a data map and then you look 

at the legal requirements so you know what you're 

21 talking about. You have to do that first. What does 

22 the world look like? Next slide, please. 

23 For benefits, here's a set of questions. 

24 Question two is, assess the PORT rationales based on 

competition. And there’s subquestions on network 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

23 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 effects, on lock-in effects, on barriers to entry and 

2 on other competition issues. 

3 Next, assess innovation and other commercial 

4 benefits due to the PORT. If we move the data around, 

maybe there’ll be new and cool companies that can do 

6 things with it. Question four is, assess the 

7 noncommercial benefits due to the PORT. And this is 

8 where individual rights come in. The individual has a 

9 right to control their own data. And that’s not 

primarily about finances. It’s about some self11 determination about your right to data. 

12 Question five is, assess the regulatory 

13 benefits that come from this new rule. Question six 

14 is, watch out, there might be less benefits, reduced 

benefits, because maybe there's technical feasibility 

16 problems. It’s not interoperable. Maybe there's 

17 market limitations. People aren’t actually asking for 

18 the data. So you might dream of a huge benefit and it 

19 might be less in practice.

 And then question seven is, assess the 

21 incentives of those presenting evidence for the 

22 benefits. Maybe there's a company that’s trying to 

23 get data from another company. They have a reason to 

24 say portability is wonderful. It doesn’t mean they’re 

wrong, but at least you should recognize why it is 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

24 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 that they’re doing what they’re doing. Next slide, 

2 please. 

3 So once you’ve done these data portability 

4 benefits, let's do our risks and our costs that come 

from portability. Question eight is, assess the 

6 privacy risks. And there’s subquestions about 

7 identify data, de-identify data, data of third 

8 persons. 

9 Next is assess the security risks about 

unauthorized access or problems with security in 

11 transit. Next in question 10 is, assess the risk from 

12 the PORT that may arise for either security or privacy 

13 reasons. And there’s two here that I go into more 

14 detail in the paper. One of them is the risk of 

onward transfer. If the data goes to the receiving 

16 service and then they send it on to A and B and C 

17 after that, is it still under control for privacy and 

18 security? 

19 Another one is that people might use 

standards. Companies might use standards to 

21 discriminate so that they get the data and other 

22 companies don't get the data. And if they have market 

23 power, that might be something that the antitrust 

24 people would look at.

 Question 11 is, assess the risk to 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

25 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 competition from the portability initiative. If the 

2 three biggest companies in an industry get together 

3 and set standards so they get all the data and nobody 

4 else does, then there’s an antitrust risk that comes 

from them having all the data. 

6 Question 12 is, assess the regulatory and 

7 legal consequences. Question 13 is, look at other 

8 obstacles to adoption and other costs that maybe 

9 haven’t been included in the list yet. And the last 

one is, assess the incentives for those preventing 

11 evidence of risks of costs. There might be companies 

12 that love having the data. They’re going to say 

13 portability is very, very dangerous; don't make us 

14 move the data, it’s just too scary. They may be 

right, but you should check to see what their 

16 incentives are. Next slide, please. 

17 A couple of other points. I talked to the 

18 FTC. They asked for a couple of other clarifications 

19 or distinctions that help us understand how these 

PORTs, these portability and other required transfers, 

21 might work. And the first distinction is whether you 

22 take action as a government before or after the 

23 violation. So one approach is to have regulation 

24 ahead of time, ex ante regulation.

 So if you want to do that for HHS, for 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

26 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 instance, for the healthcare interoperability rules or 

2 Dodd-Frank for financial interoperability rules, you 

3 don't have to find an antitrust violation first in the 

4 healthcare sector. You don't have to find an 

antitrust violation first in the banking sector. 

6 Instead, you say we have enough reasons here to pass a 

7 law, to pass a policy and mandate, even though we 

8 haven’t found an antitrust violation. That’s ex ante, 

9 that's before the violation regulations.

 Another approach is to think of portability 

11 as a way to use as a remedy when there is an antitrust 

12 problem. This is expost, afterwards. So this has 

13 been -- I spoke at the ABA antitrust section a few 

14 months ago, and the antitrust lawyers in the U.S. are 

thinking, oh, we need a remedy. If there’s a mess 

16 under antitrust laws, require portability and that way 

17 we might undo the mess. 

18 And the court might order portability. 

19 There might be a negotiated consent decree. And the 

regulators who are tempted by these kinds of remedies 

21 say, well, breaking up the company, that's radical. 

22 Maybe just have the data move around a little bit, 

23 let’s have some portability, that’s less radical. So 

24 portability seems attractive because it's not as 

decisive an action. It’s a more moderate action. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

27 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Okay. So that’s the end of this slide on 

2 before or after the violation. Next slide, please, on 

3 general or sectoral. 

4 So another distinction of the kinds of rules 

we have about portability is some of them are general 

6 portability rules that applies to furniture stores and 

7 drug stores and every other thing. And GDPR does that 

8 in its right to data portability, and California does 

9 that as well. It's across different business sectors. 

 But we've also seen that there’s been a lot 

11 of sectoral rules. In the United States, where we’re 

12 often careful about regulation, we have it for phone 

13 numbers and financial services. That’s 20 percent of 

14 the economy. Healthcare, that’s 20 percent of the 

economy. And we’re seeing it pop up in other places 

16 like the auto dealer software standards. So there's 

17 different kinds of laws that go across sectors or 

18 vertical by vertical. Next slide, please. And I’ve 

19 just got two more slides to go.

 So now that we've gone through this, there’s 

21 some reasons to consider using this portability impact 

22 assessment. One is we have all these new laws and all 

23 these new proposals. So we’d have a regular way to 

24 look at all of them informed by what we’ve learned 

already. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

28 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Another reason to do the impact assessment 

2 is that most people haven’t taught privacy and 

3 cybersecurity in antitrust. They’ve had a life that’s 

4 led to lots of other good things. And so in many 

instances it'll be best to have a team to assess 

6 portability proposals. You want your economists and 

7 your technical engineers and your lawyers and your 

8 privacy people, your cybersecurity people, your 

9 antitrust people. If you can find people who can do 

all those things, then you can work through this 

11 checklist. 

12 Another advantage is that the PORT-IA 

13 provides a systematic technique to assess so that 

14 regulators case after case, or company situation after 

situation, can be consistent. For antitrust 

16 regulators, or courts, they can realize that privacy 

17 and cybersecurity not just be offered as a pretext or 

18 an excuse. There's real issues here. 

19 For people who work on privacy and 

cybersecurity, they can realize that consumers benefit 

21 from having greater competition. And so the benefit 

22 for users on the privacy side and the benefit for 

23 users on the competition side both are going to those 

24 individual data subjects. So that might be something 

to think through. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

29 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 And then the suggestion is the private 

2 sector can assess their most promising PORT 

3 initiatives, looks like when it’s going to work the 

4 best or what are the risks if they try to do it. 

Final slide, please. 

6 So, in conclusion, for opening up data 

7 flows, for transferring data, portability of data, 

8 there can be great benefits for competition, 

9 antitrust, to have innovation, to have freedom of 

individual choice. These are valuable reasons to 

11 consider portability. 

12 We also have strong reasons to consider 

13 closing data flows: privacy and cybersecurity. So 

14 there's benefits from opening and there’s benefits 

from closing, and so we need, in order to come to some 

16 mature view of the situation, to look at both of 

17 those. 

18 The Portability Impact Assessment provides a 

19 method that's essentially agnostic about each 

proposal. You don’t know -- when you give me a 

21 proposal, I don’t know whether it’s going to have net 

22 benefits or not. So then let’s work through what are 

23 the benefits and costs for this required transfer. 

24 Can we increase the benefits? Maybe we can focus 

transfers on where it really, really helps 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

30 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 competition. Can we reduce the costs? Maybe we can 

2 tailor privacy rules so that they’re very effective 

3 over here, but when there's benefits from transfers we 

4 don't have to be as strict.

 And so for this complex and increasingly 

6 important topic, the PORT-IA can assist policymakers, 

7 can assist companies, I hope, stakeholders, people 

8 watching today, to reach better decisions on this --

9 better informed decisions.

 I'll be back with you today for Panel 3, but 

11 for now I thank the FTC for holding the workshop and 

12 having an opportunity to have all these great experts 

13 from around the world gather today. Thanks very much. 

14 

16 

17 

18 

19 

21 

22 

23 

24 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

31 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 DATA PORTABILITY INITIATIVES IN THE EUROPEAN UNION, 

2 CALIFORNIA, AND INDIA: CASE STUDIES 

3 MR. ROSCHKE: Good morning, everyone, and 

4 welcome to this, our first panel of the day of our 

data portability workshop. My name is Guilherme 

6 Roschke. I’m counsel for International Consumer 

7 Protection at the FTC’s Office of International 

8 Affairs. 

9 In this, our first panel today, we hope to 

set out the baseline and begin to explore three 

11 approaches to data portability. Three of our 

12 panelists are here to represent each of these 

13 approaches, and our other two panelists will also 

14 bring their expertise in how they’ve seen data 

portability in action. 

16 I’ll now introduce our panelists. Inge 

17 Graef is Associate Professor of Competition Law at 

18 Tilburg University. She’s affiliated with the Tilburg 

19 Law and Economics Center and the Tilburg Institute for 

Law, Technology and Society. Inge is an expert 

21 in the areas of competition law, platform regulation 

22 and the governance of data. She is Co-chair of the 

23 Digital Clearinghouse initiative, which aims to 

24 facilitate cooperation, dialogue and exchange of 

insights between regulatory authorities across Europe 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

32 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 and beyond in the areas of competition, data 

2 protection and consumer law. Inge is also an 

3 appointed member of the European Commission’s expert 

4 group to the EU Observatory on the Online Platform 

Economy. 

6 Rahul Matthan is a Partner at Trilegal. 

7 He is part of the telecommunications, media and 

8 technology, or TMT, practice group of the firm. Rahul 

9 has advised on some of the largest TMT transactions in 

India. He has also been involved in a number of 

11 policy initiatives in the TMT space, including 

12 assisting the government in preparing the country’s 

13 privacy law. Rahul is a published author and a 

14 regular speaker across the world on matters relating 

to emerging technology and the law. He also writes Ex 

16 Machina, a weekly column on the interface of law and 

17 technology. 

18 Karolina Mojzesowicz is the Deputy Head of 

19 the unit responsible for data protection at the 

European Commission, Directorate-General for Justice 

21 and Consumers. She was on the European Commission’s 

22 representatives in the interinstitutional negotiations 

23 with Parliament and Council on the General Data 

24 Protection Regulation, and is now responsible for its 

implementation in the EU. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

33 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Karolina previously served as a member of 

2 the EC’s legal service, focusing on EU competition law 

3 and international trade law. In that capacity, she 

4 represented the EC in numerous cases before the 

European courts and the World Trade Organization 

6 panels and appellate body. Karolina studied law in 

7 Poland, the Netherlands and Germany, where she 

8 obtained her Ph.D. in 2001. 

9 Stacey Schesser is a Supervising Deputy 

Attorney General for the Privacy Unit and Consumer 

11 Protection Section of the Office of the California 

12 Attorney General. Her recent matters include People 

13 v. Equifax, People v. Uber, and leading the team 

14 charged with drafting regulations for the California 

Consumer Privacy Act. 

16 Stacey began her career at the Attorney 

17 General’s Office in 2007 in its Criminal Division and 

18 has worked in the Privacy Unit since its inception in 

19 2012. Stacey received her JD from the University of 

California-Berkeley School of Law, where she wrote on 

21 privacy issues for the California Law Review and 

22 received a BA from Douglass College, Rutgers 

23 University. 

24 Gabriella Zanfir-Fortuna is Senior Counsel 

for the Future of Privacy Forum, where she leads work 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

34 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 on global privacy developments and European data 

2 protection laws. She has a Ph.D. in civil law from 

3 2013, the University of Craiova, with a thesis 

4 focusing on the rights of the data subject, including 

the right to data portability, and an LLM on human 

6 rights. 

7 Previously she served as the Legal and 

8 Policy Officer for the European Data Protection 

9 Supervisor in Brussels, where she was involved in the 

legislative practice of the General Data Protection 

11 Regulation, and the assessment of the EU-U.S. Privacy 

12 Shield. Gabriella is coauthor of GDPR, a Commentary, 

13 from Oxford University Press of 2020. 

14 So I’ll begin by asking each panelist a 

question for their initial contributions, and we’ll 

16 move on to a more conversational Q&A later. We’re 

17 also listening to audience questions via our email 

18 address, dataportability@ftc.gov. Finally, you can 

19 also follow along on Twitter via #datatogoftc. So 

let’s begin. 

21 Karolina, the GDPR effected a broadly 

22 applicable data portability scheme over two years ago. 

23 We’ll get into the experience a bit later. But for 

24 now can you explain the GDPR’s data portability 

requirement, including what circumstances it applies 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

35 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 to who gets the data and what data; is it all of their 

2 data? Karolina, over to you. 

3 MS. MOJZESOWICZ: Hello. Thank you. Thank 

4 you for having me. Indeed, the GDPR introduced a new 

right, a right to portability, which is related to but 

6 not equal to right of access which existed already 

7 previously, so under the previously applicable laws in 

8 the European Union. 

9 Why did we want to introduce portability 

right concerning personal data? Well, in the European 

11 Union we made very good experiences with the use of 

12 portability. For example, in the area of the 

13 liberalization of the telecom markets, so the 

14 portability of the telephone number have proven 

to liberate, to open up, the consumers in order to try 

16 new alternatives than telecom operations. 

17 Well, this thought led us to introduce this 

18 right in the GDPR, General Data Protection Regulation, 

19 in order to further empower the consumer in order to 

allow for more innovation and in order to also enable 

21 consumers to choose services also on the basis of 

22 their privacy friendliness. 

23 So what our idea was is that a free consumer 

24 who does not have the sunk cost, let me call it, of 

the data which he/she provided to a certain business 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

36 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 controller, this consumer can take this data and move 

2 it freely to somebody else who offers him/her a 

3 service which is better from different point of views, 

4 point of view of innovation but also point of view of 

privacy friendliness. 

6 This has the procompetitive effect for new 

7 commerce on the market for maybe also SMEs, small and 

8 medium size enterprises, and prevents the so-called 

9 locked-in consumers which already used for several 

years platforms, social media, and provided a lot of 

11 data. 

12 Now, when does this right apply on the basis 

13 of the regulation? This right applies only if the 

14 data subject, so the individual, provided this data on 

the basis of the consent, so consented, the business 

16 controller to use this data, or on the basis of 

17 contract. 

18 The GDPR, for all those who are maybe not so 

19 familiar with the GDPR, allows for several legal bases 

to process data, so the tools to use data and consent 

21 and contract to only some of them. Other legal bases 

22 are law-tasked, pursued by public administration, or 

23 also legitimate interest. 

24 Well, if the data is processed by somebody 

on the basis of law or task of a public 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

37 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 administration, or legitimate interest, this data, the 

2 data subject of individual does not have the right to 

3 port this data. So the data can be ported only again 

4 if this data was provided by the data subject on the 

basis of consent or contract. 

6 So this is when. Now, which kind of data 

7 can be ported? Not all of this. Obviously only 

8 personal data. And the personal data, so not 

9 anonymous data or data which is not concerning the 

individual who wants to use this right. Which data? 

11 Now, data provided, the regulation says very clearly 

12 it needs to be data provided to to the controller. 

13 But -- so as to the full effect to this right, the 

14 European Data Protection Board, which gathers all the 

European data protection authorities, the enforcers of 

16 the GDPR in Europe, specifies that this data provided 

17 by means not only data which was actively and 

18 knowingly provided by the individual to the 

19 controller, but also data which was observed by the 

controller, so the business, by the virtue of the use 

21 of specific service, by this individual service, which 

22 is offered by the business. 

23 So what is meant here is the search history, 

24 the board in its guidelines provides also that it can 

be traffic data or even location data. The very 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

38 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 important difference here which needs to be done 

2 between this data actively and knowingly provided and 

3 data observed on the one hand is the difference 

4 between data inferred or derived by the data 

controller, by the business. And such data is being 

6 defined as data created by the data controller on the 

7 basis of the data provided by data subject, the data 

8 which is inferred or derived, so created by the data 

9 controller. Imagine it will be the profile kept or 

analysis made on the basis of the behavior of data 

11 subject while using certain service and the 

12 consequences of this observation, this cannot be 

13 ported. 

14 So to give you a very clear delineation 

between which data can and cannot be ported, I would 

16 say that “provided by” included which data provided by 

17 which can be ported, is data which relates to an 

18 individual's activity or observation of individual 

19 behavior, but it is not the data which results from 

the subsequent analysis of such a behavior. 

21 I think it’s a very important difference 

22 because it attaches because it has an impact also on 

23 the intellectual property of the business who is 

24 processing the data.

 What are the restraints to the right? So I 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

39 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 cannot port data when my exercise of the right would 

2 have an adverse effect on other individuals, on third 

3 parties. What is is meant here? If I port -- because 

4 it’s sometimes difficult to confirm when would it be 

the case because, of course, for example in my 

6 telephone book, in my mail contacts, there are also --

7 there is also personal data of third parties which 

8 will be then affected by my exercise of the 

9 portability right.

 Well, again, here the delineation line, and 

11 as if a “lackmustest,” when the -- when my exercise of 

12 the right would amount to somebody else being 

13 adversely affected, will be when the data which is 

14 ported will be processed by this new receiving 

business, by the new controller, for a purpose which 

16 has completely nothing to do with the purpose for 

17 which it was processed by the initial data controller. 

18 I think I gave you as even outline of what 

19 the data portability is about in our EU understanding 

and how the GDPR conceived this right. But let me 

21 know if I can adhere something. 

22 MR. ROSCHKE: Okay. Thank you for 

23 introducing us to the GDPR approach. We’ll get to 

24 more of that in our discussion later.

 Our next question is to Stacey in 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

40 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 California. Stacey, the CCPA includes a requirement 

2 that under certain circumstances data be portable. 

3 Can you detail the portability requirement in 

4 California, including what data it applies to and how 

it interacts with the right of access in the CCPA? 

6 MS. SCHESSER: Good morning. Thank you so 

7 much for having me. It's really an honor to be here 

8 joined by such experts in the field on this panel. 

9 And thank you to the FTC.

 Before I begin, I have to give a typical 

11 disclaimer that the views I share here are my own, and 

12 the Attorney General may not share these same views. 

13 With that, I’m going to dive right in. The 

14 CCPA, the California Consumer Protection Act, contains 

one small reference to portability, and that is in 

16 Section 1798-100(d). I'm just going to read it 

17 briefly just so that people are oriented to what the 

18 statute provides. “A business that receives a 

19 verifiable consumer request from a consumer to access 

personal information shall promptly take steps to 

21 disclose and deliver, free of charge to the consumer, 

22 personal information required by this section. 

23 Information may be delivered by mail or 

24 electronically, and if provided electronically, the 

information shall be in a portable and, to the extent 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

41 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 technically feasible, readily usable format that 

2 allows the consumer to transmit information to another 

3 entity without hindrance. A business may provide 

4 personal information to a consumer at any time, but 

shall not be required to provide information more than 

6 twice a month in a 12-month period.” 

7 So there’s a couple things at play there 

8 that I just wanted to walk through here as it relates 

9 to that one reference to portability. This is a 

significant section. It comes at the outset of the 

11 law, and it lays out the framework for access rights 

12 within the law. 

13 CCPA does not prohibit collection. It only 

14 requires that there be notice at or before the point 

of collection. But as it relates to access rights or 

16 what we refer to as the right to know, portability is 

17 going to be balanced with verification, costs and 

18 timing. Right? So, the idea is that data can be 

19 portable if it’s verified. It needs to be provided 

free of charge. And the timing is no more than two 

21 times a year to balance the interest of the burden on 

22 the business with the rights of the consumer. 

23 What's interesting enough is that these 

24 access rates apply to presumably all data that is 

produced in response to a consumer request both from a 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

42 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 general description of categories down to the 

2 granular, specific pieces of information that are 

3 collected about the consumer. 

4 The reference that I’m -- the point of the 

statute that I'm referring to is in 1798.110, where it 

6 goes through what the consumer is entitled to receive 

7 as part of this disclosure. That includes the 

8 categories, the general broad categories of personal 

9 information a business has collected about the 

consumer, the sources from which that -- the 

11 categories of sources from which the personal 

12 information is collected, the business or commercial 

13 purposes for collecting or selling personal 

14 information, the categories of third parties with whom 

the business shares personal information, and then the 

16 specific pieces of personal information it has 

17 collected about the consumer. 

18 So that is all that’s required to be 

19 provided in this portable format. So I can't really 

speak to the motivations for why portability is only 

21 mentioned once and how it’s structured within the 

22 framework of the legislation. What I can infer is 

23 that there was this motivation to balance consumer 

24 protection, ownership, control of data, all reasons 

why we see portability as a right in other sectoral 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

43 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 laws within the United States, such as, for example, 

2 the medical privacy law, HIPAA, that's been around for 

3 a very long time. 

4 What I can speak to is the regulations that 

take into consideration the impact of the portability 

6 of data. So when we were -- the attorney general has 

7 authority to draft regulations that operationalize the 

8 requirements of CCP for businesses and clarify how 

9 consumers can exercise their rights under the law. 

And so concerns about portability were really at the 

11 forefront of our minds when we were drafting the 

12 regulations. 

13 One specific area in which portability 

14 impacted the rules was in the requirement that 

businesses not disclose any of the personal data 

16 that’s set forth in 1798.81.5. These are data points 

17 that more of the classic data points. So, for 

18 example, name plus Social Security number, your 

19 account information related to your finances. So 

these information points are particular here because 

21 it could place the business in somewhat of a catch-22 

22 where they’re required to provide the information, but 

23 it also could be triggering some of their breach 

24 obligations if that data goes into the wrong person's 

hands. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

44 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 So the regulations state that you cannot 

2 disclose those actual data points, but you have to 

3 inform the consumer that that's part of what you 

4 collect in a general category sense.

 The other area in which the regulations 

6 really address portability has to do with 

7 verification. As many people know, the CCPA did not 

8 define what is included in the verifiable consumer 

9 request. That was something that the legislature 

specifically charged the attorney general with 

11 figuring out –- so the verification and what 

12 principles a business has to consider before 

13 disclosing information from both the general 

14 categories all the way down to specific pieces, 

because verification is required for any type of 

16 request to know or right to know, is what –- is part 

17 of what a business must consider before they go and 

18 provide all of this information in a portable, usable 

19 format.

 So considering the risk of harm and the 

21 sensitivity of information is part of what the general 

22 principles for verification lay out in our rules. We 

23 were considering things like identity theft, but also 

24 far worse, what happens when the wrong person has 

access to data. Complete records of specific pieces 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

45 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 of personal information could fall into the wrong 

2 hands, and then you could have something far worse 

3 than just, you know, stealing somebody’s identity, but 

4 even committing great acts of harm.

 The one small exception in the regulations 

6 has to do with businesses are not required to produce 

7 in a portable format certain data that needs specified 

8 criteria, including if the data is not searchable or 

9 not reasonably -- in a reasonably accessible format, 

as well if the data is used solely for legal or 

11 compliance purposes and not sold. 

12 These regulations were concluded based upon 

13 public comment that we received saying that this would 

14 be a huge burden on businesses to go and search, for 

example, a consumer's personal address that was on the 

16 return portion of a check. So that is one example in 

17 which portability is not required. 

18 From a practical standpoint, you know, we 

19 have one data point which is an attorney that works 

for me who has made a request, and what does that mean 

21 when he actually receives all the information? 

22 According to him, he said I got one gigabyte of files 

23 of gibberish from a large company with a hell of a lot 

24 of data about me, some photos, but mostly text or 

code, and it’s not particularly useful for switching 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

46 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 over to another similar platform. 

2 So while there is a robust right to receive 

3 your data in a portable format, I think there are lots 

4 of practical implications about how that can be 

consumer-friendly. 

6 MR. ROSCHKE: Well, thank you for sharing 

7 your experiences, Stacey, as well as your quite 

8 detailed knowledge of the law. 

9 So we'll continue our virtual journey across 

the globe by turning now to hearing about the 

11 developing data portability framework in India. 

12 Rahul, you bring us the perspective of how 

13 India is creating data portability infrastructure 

14 outside of their privacy law, which is still in 

development. Can you introduce your role in this and 

16 describe the data portability infrastructure being 

17 developed in India? What is hoped to be the impact of 

18 this developing infrastructure? 

19 MR. MATTHAN: Thank you, Guilherme, and 

thank you to the FTC for inviting me to be a part of 

21 this panel. I was just listening, you know, to the 

22 comments of GDPR and CCPA. And as you mentioned, 

23 Guilherme, we in India don't have a privacy law -- a 

24 full-blown privacy law at this point in time. It's 

still making its way through Parliament. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

47 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 But I think, you know, just to set the 

2 context of what India has done, India is digitizing at 

3 a furious place. So, as you know, we’re a large 

4 country with 1.3 billion people. 1.2 billion of them 

have a digital identity at this point in time. And 

6 that’s what we call the other unique identity. 

7 We also have a tremendous digital payment 

8 system. Through COVID and the lockdowns, in the last 

9 month alone our Universal Payment Interface, or UPI, 

did 1.6 billion transactions just in the month of 

11 August. And then we've got this -- we're rolling out 

12 this huge goods and services tax network which is a 

13 very powerful system that essentially is going to keep 

14 track of every invoice that every business exchanges 

between each other as part of commerce. 

16 So two or three years ago, we came to the 

17 realization that even though India -- and much of 

18 India is still economically poor –- given this rate of 

19 digitization, we are going to become data rich far 

before we become economically rich. And there was 

21 this thought to -- you know, to try and figure out how 

22 do we leverage this particular situation to try and 

23 make it more beneficial to those in the economy who 

24 are actually not touched by the financial system.

 And, you know, if you think about it, we 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

48 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 have 1.3 billion people. Maybe 300 million of them 

2 are on the formal banking system, which leaves a 

3 billion people untouched by the banking system. 

4 And so the thought was to try and build a 

portability infrastructure, a digital portability 

6 infrastructure, that will allow people who are not 

7 part of the various financial, healthcare and 

8 education and other systems to leverage some of the 

9 data that is already contained about them in the 

system to get some benefits. And this is how the idea 

11 of DEPA, the Data Empowerment and Protection 

12 Architecture, was built. This is essentially a 

13 digital framework that allows for data portability 

14 from -- and I'll just make up some examples and you 

can actually apply them in all the sectors. But if 

16 you think about the financial sector, if you have --

17 you know, in order to access -- to get a loan in 

18 India, you need to provide evidence of collateral, 

19 that is typically some real estate, some property, and 

a lot of people actually don't have access to that. 

21 But what they do have is a rich history of 

22 transactions. And if there is some way in which we 

23 can, in a digitally secure manner, present the 

24 information of transactions that your bank account has 

to the potential lender, that may be the basis on 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

49 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 which the lender can give you a loan. And that was 

2 the idea behind DEPA. 

3 So what DEPA does is it empowers users to 

4 port data from one financial information provider to a 

financial information user. And in this case, the 

6 financial information provider is your bank, the 

7 entity that has the data that it needs to provide to 

8 the financial information user, which is the lender, 

9 that would use this information in order to come to an 

assessment as to whether it can give you a loan or 

11 not. 

12 The core of this is the creation of consent 

13 managers. And so what we've done in India is we’ve, 

14 in a sense, disintermediated content from this 

framework. And so there are consent managers built 

16 into the financial system who will manage the consent 

17 part of the portability. 

18 And so, you know, once again, just to give 

19 you an example, if your lender wants to assess whether 

you are worthy of a loan, they will send a request 

21 through your consent manager to you. And that 

22 request, when it comes, says yes, I consent to allow 

23 my bank to provide the information that my potential 

24 lender wants from me. And once that has been 

digitally signed, you know, by me saying that I have 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

50 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 consented to provide this information, the information 

2 flows on the basis of that digital consent to the 

3 lender, and then the lender takes his or her decision 

4 on that and provides consent.

 You know, there's a lot of detail in this 

6 that, you know, maybe we can get to in subsequent 

7 questions. But, you know, at the bottom of it, the 

8 consent artifact is digital, which means that encoded 

9 into the consent artifact is information about the 

person requesting the consent, information about the 

11 purpose for which that consent is being provided, 

12 information for -- about how long that consent or that 

13 data needs to be kept. 

14 So, for instance, if it's information about 

a loan, there's no need for the lender to keep that 

16 information beyond the time that is required either by 

17 its internal processes or even by law to keep that 

18 information. And so the digital consent actually has 

19 coded within it information about the expiry of the 

data. 

21 And, you know, so to add another layer, the 

22 manner in which consent can be sought is not a carte 

23 blanche. So you can’t sort of turn on the spigot, 

24 look, I want all the information about the user. 

There are consent templates which would say that, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

51 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 look, you can ask for certain sorts of information. 

2 One category that’s prescribed is all information. 

3 And in that manner, once again, we can moderate the 

4 purposes for which you can request this portability. 

 So it's fairly early days for the system. 

6 As I said earlier, we don't have a privacy law, but 

7 the privacy law that is making its way through 

8 Parliament has provisions that would give legal 

9 sanctity to the consent manager baked in. So 

hopefully if it passes in the current form we will 

11 have legal statutory basis for this intermediated 

12 consent. 

13 But already in the financial system we have 

14 seven licenses that have been provided to consent 

managers they call account aggregators. We already 

16 have two working apps for the consent managers. So 

17 two account aggregators are already live in the 

18 system. 

19 And what's really interesting is that 

particularly through COVID we've come to the 

21 realization that, you know, we need to build out a 

22 digital health infrastructure. And there is some very 

23 active work going on as part of India's national 

24 digital health mission to roll out a similar framework 

for portability in health. And, you know, that 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

52 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 framework would mean if you need a second opinion you 

2 can actually make a request through a consent manager 

3 for your digital health information that's stored in 

4 some health information provider and port it to a 

health information user. 

6 Core to all of this, of course, is the 

7 standards and the protocols based upon which this 

8 infrastructure is built. You know, essentially there 

9 isn’t much in terms of heavy pipes. This is 

essentially a protocol-based system where the heavy 

11 lifting is actually to get the banks, the hospitals, 

12 all of the other participants in this ecosystem 

13 to actually change their systems such that they can 

14 work with the protocols that create the sharing. 

 So there's a lot to unpack. I’m going to 

16 pause there and let everyone else speak, but happy to 

17 get into the weeds in any of this in a little more 

18 detail. 

19 MR. ROSCHKE: Thank you, Rahul, for the 

perspective. And I think we will have time to get 

21 into more of the detail. 

22 Our next question is to Professor Graef. 

23 Professor, your research has addressed how data 

24 portability interacts with other legal interests 

beyond privacy and data protection. Can you take a 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

53 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 few minutes to introduce some of your research 

2 findings in the area of data portability, including 

3 its impact on consumers and competition? 

4 MS. GRAEF: Yes, happy to do so. And thank 

you for the opportunity to speak here. So in these 

6 introductory remarks, I would like to focus in 

7 particular on what is the impact of data portability, 

8 but I will start by making some comments on the nature 

9 of concept because I think its nature is really a key 

factor that determines the impact of data portability. 

11 And these are issues that are not only of academic 

12 interest to researchers like myself, but I think they 

13 also allow us to draw some insights for future 

14 policymaking and even enforcement. So I will also try 

to share some of my own observations on this as well. 

16 So as to the nature of data portability, in 

17 my view it is really a hybrid between various 

18 interests. So in Europe the concept originated in the 

19 GDPR, which is really a data protection instrument 

which aims to empower individuals to strengthen their 

21 control over personal data by allowing them to 

22 transfer data and take it with them to another 

23 service. So in this sense, data portability really 

24 fits with the fundamental rights nature of data 

protection because it enhances your informational 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

54 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 self-determination. 

2 But at the same time, you can also 

3 characterize data portability by the sharing and reuse 

4 of data that it facilitates. And here you should 

keep in mind that the GDPR really serves a dual 

6 objective. So it promotes the fundamental rights to 

7 data protection on the one hand, but on the other hand 

8 it also promotes the free flow of personal data across 

9 the EU.

 And the second objective, which is more 

11 about stimulating the EU’s internal market, that 

12 objective is very much present in the right to data 

13 portability as well. And this is also what brings the 

14 concept closer to other policy areas, in particular 

those of competition and innovation. 

16 And in Europe now you can really see this 

17 concept of data portability emerging in many areas, so 

18 from data protection to consumer law. It has also 

19 already been integrated into competition analysis in 

some cases, and it also forms part of broader 

21 innovation policies, for instance, in the context of 

22 the EU’s data strategy which was published earlier 

23 this year. And you also see it coming up in sector24 specific frameworks, for instance, in the banking 

sector, energy and automotive industries. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

55 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 So this really makes it a concept with a 

2 very hybrid nature. And this hybrid nature also 

3 determines in my view what impact data portability can 

4 have on consumers and competition. And because of the 

various interests that’s come together in this notion 

6 of data portability, there’s also still questions 

7 about how tensions between these interests should be 

8 reconciled in concrete cases. 

9 So one issue that deserves more clarity in 

my view is what I would refer to as the issue of 

11 overlapping legal entitlements over data. And this is 

12 an issue that can take different shapes. So we have 

13 already heard that personal data can relate to more 

14 than one individual. So then the question is how you 

can guarantee the privacy interests of the other 

16 person when you want to port your data. 

17 Another example is that personal data may at 

18 the same time be protected by intellectual property 

19 rights held by the business, for instance copyrights 

or trade secrets. And such other legal entitlements 

21 can limit the effectiveness of data portability of 

22 course, depending on the extent to which they stand in 

23 the way of requests of individuals to have their 

24 personal data transferred to another provider.

 And how exactly these interests and legal 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

56 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 entitlements should be balanced against each other, 

2 it's not entirely clear from the text of the GDPR 

3 itself. So these are issues that will still need to 

4 be addressed through future cases, although some 

guidance is already available as we heard before. But 

6 the application in concrete cases can still raise 

7 issues. And until there is more clarity on the 

8 concrete application, there is still quite some 

9 discretion also from data controllers to strike this 

balance themselves. And this may not always lead to 

11 desirable outcomes because data controllers could 

12 point to the existence of some of these overlapping 

13 entitlements as a sort of excuse to limit the scope of 

14 the data that should be ported.

 And the message -- the broader message that 

16 I want to give here is that in my view the impact of 

17 data portability is not an abstract or aesthetic 

18 issue, but it is something that regulators and 

19 enforcers can really influence by guiding and steering 

the implementation. And this is true for how data 

21 portability interacts with privacy interests of other 

22 individuals, with the IP rights of data controllers, 

23 and it also holds, I think, for the impact of data 

24 portability on competition.

 So then moving on to what the impact of data 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

57 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 portability on competition can be. I think it's still 

2 unclear now what effects the GDPR is having in this 

3 regard and if indeed the right to data portability is 

4 really fostering competition on the market and is 

really encouraging data-driven innovation, which were 

6 things that were expected as a sort of positive side 

7 effect because it would be easier with the right to 

8 data portability for individuals to switch between 

9 services if they could take their data with them.

 But at the same time, I also now see 

11 concerns being expressed that data portability could 

12 actually strengthen the position of established 

13 players by letting users invoke the right to data 

14 portability to get even more data. And this would 

then lower competition because smaller firms could 

16 then see their users move to the established players 

17 with their data. 

18 So one idea to make sure that data 

19 portability would really create opportunities for 

newcomers to innovate could be to introduce what I 

21 would call a symmetric regulation and enforcement. 

22 And what I mean with a symmetric regulation is that 

23 more powerful firms would be subject to stricter 

24 conditions. And this could then also include 

requirements to enable data portability. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

58 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 And this could be done in several ways. It 

2 could happen through antitrust enforcement, for 

3 instance, by requiring merging parties to facilitate 

4 data portability as a condition to approve a merger, 

or by qualifying restrictions on data portability as 

6 one monopolization or in the EU as an abuse of 

7 dominance. And beyond antitrust enforcement in the 

8 EU, in fact, the European Commission is currently 

9 preparing a proposal for a new legislative instrument, 

the Digital Services Act, which is also expected to 

11 introduce a new ex ante regulation for so-called 

12 gatekeeping platforms. And data portability could be 

13 one of those ex ante requirements applicable to these 

14 platforms.

 And, of course, here there are still 

16 questions about how to design such requirements, to 

17 whom they should apply, but I do believe that his idea 

18 of asymmetric regulation makes sense in an effort to 

19 increase the opportunities for smaller firms to 

compete and also to make markets overall more 

21 contestable. 

22 And then at the same time, I think still a 

23 question is whether data portability is enough to 

24 achieve this, especially in markets where there are 

strong user site network effects where the value of a 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

59 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 service depends on how many others are using it; so, 

2 for instance, in a social network. Data portability 

3 cannot -- may not really address user log-in because 

4 users will still want to be where everyone else is. 

So even if users would move, for instance, to a new 

6 social network provider and take their data with them, 

7 they will not be able to reach the friends on the old 

8 network anymore. So data portability may not be 

9 enough to address the impact of these network effects. 

 And how data portability can affect 

11 competition in markets without network effects, I 

12 think will also depend on how actively individuals 

13 overall invoke such requests to transfer their 

14 personal data. And here I think data portability 

certainly helps to empower individuals in their 

16 individual relationships with the data controller. 

17 But in order for competition in the market as a whole 

18 to increase, it is not enough that just a few 

19 individuals invoke data portability.

 So for this reason, beyond data portability 

21 under the control of individuals to address risks of 

22 market tipping, increasing market concentration data 

23 for industries, requirements for businesses to share 

24 data with other market players directly may be needed, 

so without being dependent on a portability request of 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

60 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 an individual, but of course taking into account 

2 privacy interests when personal data will be involved. 

3 And I think this may be needed because the 

4 porting of data also creates what you can call a 

positive externality through the better predictions or 

6 better search results that all users will receive when 

7 an additional user brings her personal data to a new 

8 provider. But users typically don’t take this benefit 

9 for other users into account when they make a request 

to port data. So for this reason we could expect too 

11 little data portability requests to remedy market 

12 tipping in data-drive markets. 

13 So to conclude, I think in my view data 

14 portability is really a hybrid concept. It emerged as 

a data protection concept but is now also becoming 

16 part of policies aiming to stimulate competition and 

17 innovation. And I think to reap the full benefits of 

18 the data portability, my observation is that there is 

19 really a need to steer its implementation in practice 

and also to provide guidance on how businesses should 

21 handle tensions between interests and those 

22 overlapping legal entitlements. 

23 So in my view data portability can certainly 

24 empower consumers to make better choices, but also 

more asymmetric enforcement may be needed to ensure 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

61 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 that data portability will really stimulate 

2 competition. 

3 MR. ROSCHKE: Thank you, Professor Graef, 

4 for those perspectives.

 We'll continue our tour here with a question 

6 for Gabriela. Gabriela, can you tell us about the 

7 Future of Privacy Forum’s work on data portability? 

8 We've heard from India, Europe, and California. Can 

9 you provide us with a comparative view and what you’re 

seeing and how businesses are implementing these new 

11 requirements and how consumers are using them? Is 

12 there evidence of this being a burden on businesses? 

13 MS. ZANFIR-FORTUNA: Thank you very much, 

14 Guilherme, and hello, everyone. Thank you to the FTC 

for the invitation to be part of this expert panel and 

16 for putting together what seems like an impressive 

17 program for today’s workshop. 

18 The Future of Privacy Forum is a nonprofit 

19 organization that serves as a catalyst for privacy 

leadership and scholarship. We bring together 

21 businesses, consumers, regulators and academics to 

22 promote principled data practices by supporting 

23 emerging technologies. 

24 We've been following and contributing to the 

debate on data portability for a long time now both in 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

62 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 the United States and Europe, and increasingly we pay 

2 attention to global development. 

3 Well before my regulator experience in 

4 Brussels, in my policymaking experience in U.S., I 

wrote a Ph.D. thesis under EU law on the right of the 

6 data subject -- and this is how we call the individual 

7 whose data are being processed, the data subject. 

8 Data portability was the newest one of those rights, 

9 at that time having just been proposed in the GDPR 

bill back in 2012. 

11 Thanks to that extensive legal research, I 

12 know that even if data portability is also seen as a 

13 means to facilitate competitiveness on the market and 

14 can be deemed more useful in some markets other than 

others, the European legal system right now recognizes 

16 portability of personal data is a right of the data 

17 subject. And this means it is a prerogative of the 

18 right to the protection of personal data as detailed 

19 by the GDPR. Underpinning it is the idea that 

individuals should have control over how their 

21 personal data is collected and used. And it is with 

22 this background that I will make my remarks. 

23 In the first part of my intervention, I will 

24 draw your attention to three challenges to effective 

portability that we learned about from our work with 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

63 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 FPF stakeholders. Authentication and verification of 

2 their requesters of data -- and we already heard 

3 Stacey addressing this a bit -- the social nature of 

4 some personal data and the further uses of data by the 

receiving organization. And then in the second part I 

6 will make a couple of comparative remarks following 

7 what one of my copanelists had said but also referring 

8 to other developments around the world because I think 

9 we should pay attention to those as well.

 I will start with the lessons learned from 

11 practice. And besides the reality that there are very 

12 few portability requests from individuals right now, 

13 we’ve seen that one key challenge is the 

14 authentication and verification of the identity of the 

individual making the portability request. 

16 The lack of effective verification and 

17 authentication leads to data breaches, so it can pose 

18 significant risks. Think of scammers getting all your 

19 account data with one click. This is a common 

challenge with the right to access one's own data, but 

21 it has its additional complexities under portability, 

22 whose purpose is to make this data much easier to be 

23 used for other services, or even to be 

24 directly transferred to those new services.

 Now, if we talk about interoperability and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

64 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 allowing third parties to access personal data 

2 directly on the platform or from a particular service, 

3 this challenge translates into the need to verify, 

4 perhaps even vet, the third parties who are given 

access to data. But who should do that and how can it 

6 be done in practice? 

7 Now, a second key challenge is the social 

8 nature of some personal data. And by that I mean that 

9 often one’s personal data also includes personal data 

of others, like in photos and with conversations. 

11 This raises a couple of questions. What kind of 

12 permissions, if any, should be required for those 

13 personal data of third parties involved in a 

14 portability request, or what kind of safeguards should 

cover this third-party personal data? What happens if 

16 the personal data of the third party is ported to a 

17 service provider that has weaker privacy protections 

18 or weaker security in place? Should anyone have 

19 responsibility for requesting or allowing the 

transmission of personal data to such a service? 

21 All these are difficult questions, but they need to be 

22 solved if we want to have effective portability that 

23 does not lower the level of protection of privacy 

24 overall.

 Finally, there is the issue of 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

65 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 further uses of the data by the organization receiving 

2 important personal data. Does the service receiving 

3 personal data as part of a portability request rely on 

4 consent? Whose consent, especially when we talk about 

third-party personal data? Are there any limits on 

6 how it can use data? 

7 The receiving party should not be doing 

8 surprising things, right, with the personal data they 

9 are given access to. The CCPA does not really address 

risk. The GDPR and other frameworks inspired by it 

11 address it through purpose limitation rules and rules 

12 on having a lawful basis or processing place for any 

13 of the new processing taking place. 

14 But even under those frameworks, there are 

other issues that appear in practice. For example, 

16 there are challenges when those rules intersect with 

17 other prescriptive sectoral stages such as the payment 

18 services that are taken in Europe, or PSD2, which 

19 might have the opposite effect of overly limiting uses 

of the data being accessed. 

21 In fact, a couple of weeks back we held an 

22 expert roundtable, together with our partners from 

23 Vrije Universiteit Brussel, to discuss the 

24 intersection of the GDPR and PSD2, this payment 

services directive. One of the key objectives of the 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

66 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 PSD2 directive is to open up the banking sector and 

2 encourage participation to the payments industry of 

3 nonbanks like emerging PINTEC organizations through 

4 data sharing.

 Now, we've learned that there are still many 

6 unresolved questions when it comes to banks sharing 

7 data with third parties. The consumer representatives 

8 that participated in the roundtable highlighted that 

9 the landscape appears complex to a regular consumer, 

making it difficult to allow for actual decision 

11 making about [indiscernible, brief VTC lapse] to move 

12 their data. 

13 One of the biggest challenges identified was 

14 the lack of trust among the wider public to move their 

data across services. A particular challenge 

16 highlighted by experts was also the reuse of the data 

17 by the receiving service as the result of applying the 

18 prescriptive PSD2 rules in the GDPR framework 

19 together. For example, it was not clear to them to 

what extent or on what local ground using data -- with 

21 using the data that has been shared for fraud 

22 prevention would be allowed. 

23 Another example of our work in this space is 

24 the panel which convened at the Computer Privacy and 

Data Protection conferencing process in January 2019, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

67 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 where we explored extensive limits and benefits of 

2 portability under the GDPR. And we had a chance to 

3 get early insight into the data transfer project about 

4 which you will learn later on today in one of the 

following panels. 

6 This is a relevant and interesting industry7 led open source effort which shows that data 

8 portability can work in practice, but we’ve also 

9 learned about the many challenges those involved in 

the project had to overcome. And I remember an 

11 example that was given within that debate, and it was 

12 catalogued as a challenge of a syntactic nature. And 

13 the example used was a jaguar. So when a data set 

14 refers to a jaguar, is it a car or the animal? And 

this actually had consequences on whether the data 

16 should be ported or not. 

17 Now, I will certainly be tuning in later to 

18 hear about the lessons learned on that project over 

19 the past three years. As for the comparative remarks 

that you’re referring to, I would say there are two 

21 big differences between portability in the GDPR and 

22 portability in the CCPA. And we’ve heard a bit about 

23 them. 

24 First under the GDPR, the scope of the right 

to portability is very nuanced. It’s actually limited 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

68 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 compared to the CCPA if we refer to the scope of the 

2 personal data being transferred. And we’ve heard the 

3 details about that, and I think the key difference is 

4 that the GDPR does not include inferences about 

individuals within the scope of the right. 

6 Then in the CCPA, portability follows 

7 access. It is not a separate right like in the GDPR. 

8 As the CCPA -- and we’ve heard Stacey -- requires all 

9 access to personal data to be given in a portable 

format. So then really portability follows access. 

11 Before I conclude, I would just like to add 

12 that for India -- and we’ve heard from Rahul about the 

13 specific project on financial data, but we are also 

14 following the personal data protection field that’s 

currently being discussed by the Indian Parliament, 

16 which includes a general right to portability and 

17 which is actually very broad because it also includes 

18 portability of profiles being created about 

19 individuals.

 Now, in Brazil, the new general law for 

21 protection of personal data, the LGPD, which just 

22 entered into first last week, also has a broad right 

23 to data portability provided therein. 

24 There’s an amendment built to Singapore’s 

general data protection law that includes a right to 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

69 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 portability which has some very interesting nuances. 

2 It tackles, for example, third-party personal data in 

3 an interesting way and limits when such data can be 

4 transferred to a third party.

 To conclude, there are many difficulties and 

6 complicated questions to answer in order to make 

7 portability work in practice without lowering the 

8 level of protection of privacy and security, including 

9 the fact that it doesn't seem to be appealing to 

consumers or users or the timing. 

11 However, more and more legal systems around 

12 the world recognize the ability to move the data 

13 seamlessly and securely across services as a part of 

14 new generation of rights that individuals have with 

regard to how their data is collected and used. Thank 

16 you. 

17 MR. ROSCHKE: Thank you, Gabriella, for this 

18 overview, your initial comments in the comparative 

19 perspective and also bringing in perspectives outside 

of what we’ve considered so far. 

21 I think now we'll move on to some of our 

22 follow-ups. We have a follow-up to Karolina about 

23 recently the European Commission issued a two-year 

24 report on the implementation of the GDPR, including 

reviewing the experiment of data portability. Can you 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

70 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 tell us more about what the review showed and what 

2 some of the next steps are being considered, including 

3 the new European strategy for data? 

4 MS. MOJZESOWICZ: Thank you. Indeed. Well, 

to some extent what I wanted to say was already 

6 covered by the lady who was speaking before me. So, 

7 Gabriela, for example, underlined that indeed this 

8 right to data portability was not used to its full 

9 potential. And we saw that what we have seen that 

data -- so the individuals do not exercise it so much, 

11 they do not use it so much, and that it's so far used 

12 within sectors only. 

13 Why? Mainly because of the lack of 

14 standardized machine-readable formats and clear 

indications as to the structure in which the data 

16 should be provided so as to port it easily from one 

17 controller to another one. 

18 So this is what we have observed. We did 

19 not see a lot of complaints from individuals to data 

protection authorities that they are right -- that 

21 they were not able to exercise this right, and mainly 

22 probably because they were not using it that much. 

23 But having said that -- and we still think 

24 that this potential of data portability needs to be 

further explored, and this is what we are going to 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

71 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 tackle now with the legislative instruments which 

2 we’ll be following up, this communication, the paper 

3 the Commission published in February this year, and 

4 which will be following fairly quickly now, we want to 

use this potential of data portability also in the 

6 context which was so far not contemplated very much, 

7 but to push it into the direction of almost as much as 

8 possible real-time data portability, and also within 

9 different services. So not only from one platform to 

another platform and so on so as to resolve a 

11 competition problem, but so as to exploit if it means 

12 to empower the consumer. 

13 And here we are in particular thinking about 

14 the possibility to use this real-time portability 

right in -- the real-time portability in the further 

16 development of Internet of Things devices. Yeah, so 

17 which we want to resolve by providing standards and 

18 more -- and clarifications of the structures in which 

19 data should be ported, and by designing appropriate 

tools by designing this standardized, as I said, 

21 formats and interfaces in order to facilitate this 

22 exercise so that this consumer put in the center of 

23 the future digital economy will be able to switch 

24 easily between different service providers, taking 

different consideration and different aspects into 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

72 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 consideration; also aspect of more privacy-friendly 

2 solutions, which we hope will by -- in the case of, 

3 let me call it, digital illiterate and privacy4 sensitive consumers will start to -- well, work 

against this network effects which were mentioned 

6 before. 

7 And this is what we see, that our consumers 

8 start to be in particular now in the coverage times 

9 where we moved all to more use of digital services, 

they start to be much more sensitive about what is 

11 going on with their data and are much more proactively 

12 looking for services which also bring them this 

13 protection which they so far did not receive, so that 

14 this will rebalance the network effects probably longterm, because indeed some operators and some service 

16 providers, big platforms, have a huge advantage in 

17 there. 

18 But, yes, well, I don't want to repeat what 

19 was discussed already before. Let me just make one 

comment. Let's not forget that this portability 

21 right, it's exercised on the basis of the General Data 

22 Protection Regulation which actually stems from --

23 it’s there in order to exercise fundamental right. 

24 Protection of personal data, it's a fundamental right 

in Europe. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

73 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Therefore, the ideas -- I'm very skeptical 

2 as a person only about this idea about degrees of 

3 enforcement. It's a fundamental right, and the scope 

4 of the exercise of this fundamental right cannot vary 

dependent in front of whom it's being exercised. And 

6 this is also why the GDPR was conceived in, actually, 

7 let me call it, size independent, or size not taken 

8 into account way, and obligations and the scalability 

9 of obligations depends -- goes together not with the 

size of the enterprise, but with the amount of the 

11 sensitivity of data which is being processed, and the 

12 possibility of affecting the rights of individuals 

13 while this data is being processed. 

14 So this responsibility of the businesses 

controllers, their accountability goes hand-in-hand 

16 with what they do and not how much they do of it, so 

17 that we can have enterprises which will be processing 

18 enormous amounts of data but of a very nonintrusive 

19 nature. And we can have a much smaller enterprise, I 

would think here about, you know, laboratories working 

21 on DNA, the strictest data protection obligations 

22 would apply. So this is a little bit of comment to 

23 what one of the previous speakers mentioned. 

24 But to sum up, this is a right with a lot of 

possibility. We are developing on it and you will see 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

74 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 soon the results. And we think that not only it's not 

2 being exercised sufficiently, but it's not being -- so 

3 often enough, but the areas in which it can be 

4 exercised should be expanded, and in particular in 

this almost immediate way so one can port in the 

6 moment when one uploads. Thank you. 

7 MR. ROSCHKE: Well, thank you for telling us 

8 about, you know, some of these next plans and also 

9 with some of the implications of the derivation of 

portability from a fundamental rights perspective. 

11 You know, we only have a few minutes left in 

12 our panel, but I did want to continue to discuss and 

13 see what some of the next steps are, or potential next 

14 steps are in our jurisdictions that we're looking at. 

 Maybe we could take two or three minutes 

16 each to hear from California and India about what 

17 potential changes are coming up. Maybe we'll go to 

18 California first. 

19 Stacey, can you give us some explanations of 

any potential changes coming in your legislative 

21 scheme? 

22 MS. SCHESSER: Sure. I’ll try to go as 

23 quickly as possible. The one thing I also wanted to 

24 note that we didn't touch on is that CCPA contemplates 

that agents can make requests, including access 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

75 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 requests on behalf of consumers. And so agents is 

2 somewhat defined by regulation. There's a requirement 

3 that there's reasonable security when data is being 

4 transferred to the agent and to the consumer from the 

agent, as well as a level of permission that needs to 

6 be authorized by either electronic or written 

7 signature. 

8 And so that, I think, will also impact 

9 portability because people may take advantage of 

agents that can make requests on their behalf. That 

11 may include, for example, products or services to make 

12 those types of requests and be able to facilitate 

13 that. 

14 So with respect to next steps, I think that 

one of the most important things is that we are 

16 enforcing CCPA. We started enforcing CCPA on day one. 

17 We have to issue a notice and cure letter for 

18 companies regarding alleged noncompliance of CCPA. We 

19 are now also enforcing the regulations as they are 

effective as law since August 14th, 2020. And so a 

21 violation of the regulations constitutes a violation 

22 of CCPA. 

23 And what we’re doing is we're looking at, 

24 you know, a variety of different sources to determine 

where consumers are running into roadblocks for 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

76 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 purposes of exercising their rights, as well as how 

2 companies are interpreting what their business 

3 obligations and compliance requirements are. So we 

4 review consumer complaints, we conduct our own 

investigations, we even look on Twitter to see what 

6 people are talking about, as well as engaging in a 

7 good deal of consumer education so that consumers 

8 understand their rights. 

9 There may be additional rulemaking on our 

horizon that could impact this area. And then, of 

11 course, there’s a ballot initiative in November which 

12 does impact how the access rights are going to be for 

13 consumers. It's not yet law; we'll know in November 

14 what the results of that are.

 Interestingly enough, the section I referred 

16 to earlier has been somewhat moved around. There's no 

17 express reference to portability in the ballot 

18 initiative, but it is implied in terms of the fact 

19 that, you know, personal information still has to be 

provided in a format that’s easily understandable and 

21 technically feasible, machine-readable format. 

22 So there’s an implication of portability, although 

23 it’s not as express as in the initial -- as in the 

24 original CCPA that's in effect now.

 In addition to that, you know, we continue 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

77 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 to amend data protection laws with last year's 

2 amendment to the reasonable security law to include 

3 biometric information and government issued IDs. And 

4 so, again, that requires additional protections when 

produced in response to a request to know. 

6 MR. ROSCHKE: Thank you for those 

7 perspectives. 

8 Rahul, maybe two or three minutes on the 

9 next steps in India?

 MR. MATTHAN: Sure. And, look, next steps 

11 in India, very simple. We want to get this draft 

12 privacy law through Parliament. It's currently before 

13 the Joint Parliamentary Committee. And even, you 

14 know, through this COVID time and with all the 

lockdowns, the Parliamentary Committee has been 

16 meeting, and so we’re hoping that when things get sort 

17 of back to normal slightly we're going to have the 

18 law, after it’s been looked at by the Joint 

19 Parliamentary Committee, amended perhaps, presented 

before Parliament and then enacted into law. 

21 And at the same time, a lot of the 

22 infrastructure that I described is being built out and 

23 a lot of work that’s going on there. I think, you 

24 know, just listening to everyone, as I thought that 

it’s probably important to put the Indian portability 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

78 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 framework in a slightly different context. We talk 

2 about portability, we think about portability, we 

3 think about, you know, changing from one service 

4 provider to the other.

 Being in the portability framework is not 

6 thinking about it from that perspective. We're 

7 looking to keep our service provider but move that 

8 information to another entity where it might be a 

9 different sort of use to us. And we do this realtime. We do this with all of -- because it's digital, 

11 we’ve got all of these protocols, particularly in 

12 terms of purpose limitations in terms of use and all 

13 of those things. 

14 So, yeah, this is slightly different from 

what Europe and California are talking about, and it 

16 needs to go to a shift of perspective to understand 

17 what India is doing. 

18 MR. ROSCHKE: Okay. Thank you for that 

19 perspective. I think we have time for one more short 

follow-up. 

21 Professor Graef, what can we say about the 

22 distinction between a general approach and a sectoral 

23 approach to implementing data portability? We’ve 

24 heard examples of both. Are there advantages or 

disadvantages to each? And, please, two minutes. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

79 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 MS. GRAEF: Yeah. So indeed we see general 

2 regimes occurring like the GDPR where the right of 

3 data portability applies across the entire economy, 

4 and at the same time there's also sector-specific 

frameworks being developed. So the Payment Services 

6 Directive 2, for instance, was already mentioned. 

7 So I think to some extent sector-specific 

8 regulations has advantages because you can design much 

9 more concrete requirements, for instance, in terms of 

the infrastructure to be used or establishing common 

11 standards for portability or what other modalities 

12 should apply. But in a way this can also create 

13 spillovers to regimes of general application like the 

14 GDPR. So if you have various sectors regulated in 

terms of portability, this could also make the general 

16 portability in regimes like the GDPR more effective, 

17 because the infrastructure is already there, standards 

18 are being developed that may also be relevant in 

19 sectors that are not regulated yet.

 Disadvantage of purely sector-specific 

21 regulation could be that it is not enough in the 

22 dynamic context where you also want market and 

23 services to be connected, so in the context of 

24 internet of things, for instance. So at some point 

you also want the sector-specific forms of portability 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

80 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 being connected with one another. 

2 And I think one other issue to keep in mind 

3 is that it is logical to start from a more sector4 specific approach even for implementing more general 

regimes like the GDPR, but you also need to take into 

6 account effects that go beyond the sector as such. 

7 And then one more comment to reply to 

8 Karolina’s points on the idea that I put forward for 

9 asymmetric regulation, so I should clarify that indeed 

I was not suggesting that the GDPR or data portability 

11 only applies to powerful players. It's indeed a 

12 fundamental right and it applies generally across the 

13 economy. But I think that data portability, because 

14 it is a hybrid concept, there is also room for other 

regimes like antitrust rules or new regulatory regimes 

16 that the Commission is looking at in the Digital 

17 Services Act to top up additional requirements for 

18 firms that have more market power, for instance. 

19 MR. ROSCHKE: Well, thank you, Professor 

Graef. 

21 You know, I think we've reached the end of 

22 our time here. I want to thank all of our panelists 

23 for this fantastic discussion. And I know several of 

24 you have joined from inconvenient time zones 

throughout the world, so thank you for that as well. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

81 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 We've touched on topics such as competition, 

2 sectoral approaches, different motivations, different 

3 advantages and disadvantages of data portability, 

4 which we can continue talking about that for the rest 

of the day. And, in fact, that’s what the workshop 

6 will do for the rest of the day. 

7 So this ends our panel here. Please join us 

8 for Panel 2 on financial and health portability 

9 regimes starting at 10:30 a.m. Eastern time. Thank 

you. 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

82 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 FINANCIAL AND HEALTH PORTABILITY REGIMES: CASE STUDIES 

2 MS. WHITE: Good morning. Welcome to the 

3 second panel of our workshop. We'll be taking a look 

4 at some sector-specific approaches today to 

portability. I'm Kate White, I’m an attorney in the 

6 FTC’s Division of Privacy and Identity Protection. 

7 I’m grateful to be joined today by an esteemed panel 

8 with experience in data portability in the health and 

9 financial sectors.

 In the interest of time, I’ll try to keep 

11 my introductions a little brief, but I encourage 

12 everyone to take a look at our event page to learn 

13 more about their expertise and really impressive work. 

14 First, we’re joined by Dr. Don Rucker, the 

national coordinator for health information technology 

16 at the the U.S. Department of Health and Human 

17 Services, where he leads the formulation of the 

18 federal health IT strategy and coordinates federal 

19 health IT policies, standards, programs, and 

investments. 

21 Dr. Rucker has three decades of clinical and 

22 informatic experience. He started his informatics 

23 career at Datamedic Corporation, where he co-developed 

24 the world's first Microsoft Windows-based electronic 

medical record. He then spent over a decade serving 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

83 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 as chief medical officer at Siemens Healthcare USA. 

2 Dr. Rucker has also practiced emergency medicine for a 

3 variety of organizations. 

4 Next we have Dan Horbatt, the chief 

technology officer at Particle Health. Dan's also a 

6 life-long technologist who's worked on building global 

7 scale big data systems across a number of industries. 

8 We're joined today by Bill Roberts, the head 

9 of Open Banking for the Competition and Markets 

Authority of the United Kingdom, where he led the 

11 design of the CMA’s open banking remedies and is 

12 responsible for its implementation. He's also a 

13 member of the Advisory Group on Open Finance and the 

14 Smart Data Working Group.

 And, finally, we're joined by Professor 

16 Michael Barr, the Joan and Sanford Weill Dean of 

17 Public Policy, Frank Murphy Collegiate Professor of 

18 Public Policy, and Roy F. and Jean Humphrey Proffitt 

19 Professor of Law at the University of Michigan. 

 Professor Barr served from 2009 to 2010 as 

21 the U.S. Department of Treasury's Assistant Secretary 

22 for Financial Institutions, and was a key architect of 

23 the Dodd-Frank Wall Street Reform and Consumer 

24 Protection Act of 2010.

 As with the last panel, I'm going to start 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

84 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 by asking each of the panelists to sort of introduce 

2 themselves and tell us a bit about their experience 

3 with data portability, and then we'll move to more 

4 conversational Q&A later. We'll try to save some time 

at the end for questions. So if you have a question 

6 you’d like to send, we are monitoring our email box, 

7 dataportability@ftc.gov. 

8 And so I’d like to get started by asking Dr. 

9 Rucker, ONC recently finalized its interoperability 

and anti-blocking rules. Can you give us a little bit 

11 of background on their developments and their 

12 requirements? 

13 DR. RUCKER: Sure, Kate, thank you very 

14 much. And I’d like to say I'm speaking here on behalf 

of Kathryn Marchesini, who just went out on maternity 

16 leave a couple days early for folks who looked at the 

17 schedule. 

18 Yeah, so portability of data in health has 

19 been, you know, a desire for a long time. If you go 

back to the -- what is seen as the defining privacy 

21 law in the United States back into the mid-‘90s, 

22 HIPAA, it actually -- you know, the P is for 

23 portability. The problem is the A is for 

24 accountability. Neither of those actually happened, 

as everyone knows. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

85 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 And, so, what has actually happened is much 

2 more limited and is sort of fueled by an interesting 

3 combination of technology and policy. So I think the 

4 first substrate was, if we talk about data 

portability, what’s really implicit in there is that 

6 it's electronic data portability as opposed to 

7 getting, let's say, a copy of your medical record in a 

8 photocopy or something along those lines. 

9 So the first part really was the work over 

the last 20 years to have electronic medical records 

11 be widespread so there was actually data to share. 

12 Prior ONC rulemaking, now about probably eight, nine 

13 years ago -- eight years ago -- took a stab at 

14 portability, and it was really sort of portability in 

a sort of a very light way because that's what was 

16 available. 

17 And that portability was the requirement 

18 that providers, so doctors and hospitals, in their 

19 electronic medical record products which ONC 

certifies, that they have a web portal, which was used 

21 by a number of patients. Roughly 20 percent of the 

22 population has used those web portals to get their 

23 information out. 

24 When you look at the web portals, obviously 

it’s -- there are some features to sort of view, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

86 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 download and transmit the data, but what you get is 

2 something that is, you know, a rather complicated file 

3 format that one would really need to have a fair 

4 amount of tech skills and ambition to move forward. 

 So Congress, looking at all of that in 2016, 

6 passed as part of the 21st Century Cures Act –- so if 

7 you remember back to December of 2016, we’d just had a 

8 national election, and there was sort of a brief 

9 moment where, you know, there was some bipartisan 

ability or interest to do things. And so most of the 

11 Cures Act deals actually with data requirements for 

12 the FDA. But there is an entire title in there on 

13 interoperability and portability. 

14 And what did Congress want there? When you 

look at that, the two key things from a data 

16 portability point of view was Congress said, first, 

17 the data shall not be subject to information blocking, 

18 and, second, there shall be standard application 

19 programming interfaces, right? And that makes total 

sense. So if you think about what would it take to 

21 get your data on your smartphone, right, into a form 

22 factor that's actionable for the public, I mean, that 

23 sort of pretty much these days means a smartphone. 

24 In that -- to get that data in there, you 

have to be able to get the data both legally and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

87 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 technically. The legal issues, the so-called 

2 information blocking, is just unfortunately a 

3 reflection that in the U.S., because we don't have a 

4 market economy, we don't have a rational allocation of 

healthcare through market-set prices, it's all done by 

6 third parties where we've commingled equity issues but 

7 have lost efficiency in a massively harmful-to-the8 economy type of way. 

9 In our system, what we have between the 1942 

rules on making health insurance a pre-tax benefit and 

11 then Hill Burton cross-subsidization ‘46, and the 

12 administrative prices in ‘65, the Medicare Act, we 

13 really have -- that soup has ended up with a lot of 

14 oligopoly delivery systems whose main economic 

incentive has actually become so large that they’re 

16 price set is to payers as opposed to being really 

17 interested in sharing the data the way that somebody 

18 who's in a consumer competitive marketplace would have 

19 had to.

 So Congress said, no, that is now illegal as 

21 of the law, and also said there shall be application 

22 programming interfaces with -- as Congress put it, 

23 “without special effort.” What did that all mean for 

24 data portability? Well, ONC has just released a 

couple of months ago our Cures Act interoperability 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

88 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 rule. And we were required to have some allowable 

2 exceptions, information blocking for things like 

3 security and privacy. There’s some complicated things 

4 in that on having reasonable returns on investment to 

the various activities of building application 

6 programming interfaces. You know, the challenge is 

7 the Congressional intent to have an API can be blocked 

8 by just setting the price to be infinitely high. So 

9 without having some mechanism to have accountability 

on prices, you don't have interoperability either. 

11 And, of course, most of this healthcare is ultimately 

12 paid for by taxpayers, so there was a huge public 

13 interest in all of this. 

14 So the information blocking rules are now 

out there to provide the legal basis to get the data. 

16 The other part of it is, are there technical 

17 standards? So rather than each vendor being in a 

18 position to have their own private APIs to release 

19 this data, they can still have their own APIs, and 

most of them do for a wide variety of business 

21 purposes. 

22 We have in our rulemaking required read --

23 at the moment read-only APIs so the data can come out. 

24 There's a two- to three-year timetable that involves 

data standards. It involves moving to a technology 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

89 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 called RESTful APIs, R-E-S-T, which is the way the 

2 modern internet web economy tools work, and then the 

3 FHIR standards in healthcare to move that data, so 

4 standardized data tools that the app economy can use, 

and we believe that that will actually result in, over 

6 time, in a wide variety of apps and a true ability for 

7 patients to have economic control of their health; to 

8 take their data and to move it somewhere else if 

9 they're not happy.

 So we think that is a major, major advance 

11 in data portability in healthcare. It's playing out 

12 over the next couple of years, so stay tuned. So, 

13 Kate, let me turn it back to you. 

14 MS. WHITE: Thanks for that.

 Dan, I know you're familiar with these 

16 rules. Could you tell us a little bit about your 

17 company, Particle Health, and how these rules are 

18 affecting, you know, your industry and consumers? 

19 MR. HORBATT: Absolutely. Thank you, Kate. 

So I just want to start off and say that Mr. Rucker is 

21 a hard act to follow. He has touched on a lot of the 

22 points that I was going to bring up, so I appreciate 

23 the intro there. But this is very much a personal 

24 mission for myself.

 In 2017, I had a chronic medical condition, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

90 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 and unfortunately I was hospitalized when I stopped 

2 responding to the medication and treatment I was on. 

3 As part of that hospitalization, I was unable to 

4 collect medical records from a previous specialist 

team to give them to my current specialist team in a 

6 timely enough fashion, and I had to go through a bunch 

7 of unpleasant testing to confirm everything that I 

8 already knew, but I didn't have the papers or 

9 electronic documents to actually prove to anyone.

 So as part of that, I realized that this was 

11 a mission that I could get behind and a change I 

12 wanted to see in the world, and so I helped co-found 

13 Particle Health in early 2018 with my co-founder, Troy 

14 Bannister.

 And, so, the mission that we're looking to 

16 accomplish here is we want to build out a very 

17 patient-centric process to enable the distribution and 

18 sharing of electronic medical records. As Mr. Rucker 

19 mentioned, the P in HIPAA is for portability, not for 

privacy, and you have a number of rights under HIPAA. 

21 You have the right to access your medical 

22 records. You have a right to share them with 

23 authorized third parties. You have the right to make 

24 corrections. You have the right to revoke the consent 

of sharing at any point. But it's one of those things 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

91 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 where it’s very hard to actually exercise those 

2 rights, and the harder it is to exercise the rights, 

3 the less likely you are to really have those rights. 

4 And so that’s what we're looking to spin up. 

We’re looking to act as the stewards of consent on 

6 behalf of patients and, using that consent being able 

7 to collect their medical records, no matter where they 

8 may be, and provide them to either the patient 

9 themselves or to authorized third-party companies that 

they interface with. 

11 So, for instance, if they're looking to 

12 onboard into a telemedicine application, they’re 

13 looking to participate in a direct consumer pharmacy, 

14 if they’re engaging with a care coordination platform, 

we want to be able to bring the patient's rich medical 

16 history with them such that they get treated faster 

17 and more reliably than what they might currently have. 

18 And, yeah, so just to reiterate a lot of 

19 what was said already, it's great that we're 

addressing this from both the policy and the 

21 technology landscape, from the policy side of things, 

22 the anti-information blocking. We already know that 

23 it's possible to share these electronic medical 

24 records right now for purposes of use, including 

treatment, payment and operations, as carved out by 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

92 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 the HIPAA privacy rule. But beyond that, like, we're 

2 looking at making sure that we're able to collect 

3 electronic medical records with patient consent as 

4 well, so making sure that patients who would typically 

have to fax a form or provide a somewhat blank filled 

6 out HIPAA authorization form can now do so in 

7 electronic fashion, making it easier for them, making 

8 sure they know how to actually follow up, see who has 

9 their consent, making sure that they know how to 

revoke that consent at a certain point in the future 

11 if they no longer have a business relationship with 

12 whomever, and as well from the technology standpoint. 

13 So TEFCA standardizing on the Fast 

14 Healthcare Interoperability Resource, FHIR, making it 

very easy for app makers, for companies, vendors, IT 

16 providers to use very robust open-source libraries to 

17 work with this data and transfer it and utilize it in 

18 a number of ways, all resulting in better patient 

19 outcomes. So exciting times ahead.

 MS. WHITE: Definitely. 

21 So, Bill, now that we've talked a little bit 

22 about the U.S. healthcare experience with data 

23 portability, I’d like to shift gears and talk about 

24 the financial sector a bit.

 Can you tell us a bit about the UK's open 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

93 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 banking rules and why they were created and how they 

2 work? 

3 MR. ROBERTS: Okay. Well, let me start by 

4 defining what we mean by open banking or what some 

people these days are calling consumer-directed 

6 banking, I think. So by open banking, we're referring 

7 to an ecosystem in which consumer or small businesses 

8 can, first of all, instruct a bank to share their 

9 transaction data securely with a third party, and, B, 

instruct a third party to move money around in and out 

11 of that bank account. So open banking allows 

12 consumers to take control of their own bank data. 

13 I just had a further qualification here, 

14 which is that we include in the definition of open 

banking the requirement that APIs rather than screen 

16 scraping is used to access that data. It's a much 

17 more secure process for both the customers and its 

18 provider alike. 

19 So, second, why do we adopt it? Well, the 

CMA carried out a market investigation which reported 

21 in 2016, and that had taken two years, and it found 

22 pretty much the same as every other investigation into 

23 banking had found over the previous 20 years, which 

24 was that the market was dominated by four big banks 

who between them had over 80 percent of the market. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

94 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 People didn't switch banks even though they 

2 were dissatisfied with their services, with service 

3 quality. Banks charged a lot for overdrafts, short4 term credit, and the sector wasn't really 

characterized by innovation at all. New entry and 

6 expansion is rare, as small businesses got a 

7 particularly raw deal and had limited choices about 

8 where they could find money. 

9 So to tackle those problems, we adopted a 

package of measures, but the center of which was open 

11 banking. That was supposed to breathe fresh rivalry 

12 into the whole sector to get existing banks to compete 

13 more vigorously with each other and, in particular, to 

14 allow the entry and expansion of new firms -- fintechs 

basically -- who would not be banks but would offer 

16 banking services. That was the objection -- the 

17 objective at the time. 

18 Now, at that time, by coincidence, we were 

19 implementing the EU's snappily titled Second Payment 

Services Directive, PSD2, and that kind of required 

21 some of the same things. It required data sharing 

22 between payment services, but it didn't specify the 

23 use of common standards for APIs. And that was the 

24 big difference with what we did in the UK.

 What we said in the UK was we agreed 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

95 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 absolutely that APIs should be used to share data, not 

2 screen scraping, but if each bank could design and 

3 implement its own API, then life would be very 

4 difficult certainly for small developers. Bad enough 

trying to produce a mobile application for three or 

6 four mobile platforms. But if each bank -- and there 

7 are hundreds of banks in Europe. If each bank had its 

8 own APIs, then you would have to make versions for all 

9 of them or you’d have to rely on intermediary services 

to connect you. That's exactly what's happened in 

11 continental Europe now, whereas it hasn't happened in 

12 the UK. 

13 So we required the -- not all of the banks, 

14 we didn't have the powers to do that, but we did have 

the powers to require the nine largest banks in the UK 

16 to agree -- agree to common and open standards for 

17 APIs, data formats and security. And though we'd 

18 never done anything like this before, and because we 

19 weren't in a position at the end of the inquiry to 

specify exactly what those standards should be, we had 

21 to figure out some way of evolving them with the 

22 industry but in such a way that the stakeholders’ 

23 interests were met, too. 

24 So we did something that we hadn't done 

before, which was that we required -- because the CMA 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

96 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 has awesome legal powers, and we used them to require 

2 the banks to make their best endeavors to reach an 

3 agreement over these standards. But because no matter 

4 how awesome your powers are, you can't compel the two 

people to agree with each other because they can 

6 always blame the other person for the lack of 

7 consensus, we created what we called an implementation 

8 trustee, and this person would act as the chair of the 

9 group which would discuss these issues, but he or she 

would have the power at the end of the day to say, 

11 well, I heard what everybody said, there's no 

12 agreement here, so I’m going to decide this for you. 

13 And we had never done that before. I think it was 

14 quite unusual amongst regulators to impose or 

delegate, almost, rules to a third party. 

16 Can you still hear me? 

17 MS. WHITE: Yes, we can hear you. 

18 MR. ROBERTS: Can -- you can hear me? Okay, 

19 sorry. Something strange has happened to my computer. 

Okay, I'll carry on. 

21 So how is all this supposed to help 

22 consumers? We envisage that the open banking would 

23 allow in new people with new -- who would be able to 

24 offer new services. We weren't sure, again, exactly 

what they would be, but we could see what a 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

97 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 liberalization of the market could bring about. 

2 Just as an aside, I’ll say that at the time 

3 we were asked why, if we wanted to get open banking 

4 started, we wouldn't run a campaign to promote open 

banking. We said we didn't think that would work 

6 because that would be kind of like promoting 

7 electricity in the 19th Century. I mean, you’re 

8 trying to -- it’s a struggle to describe what it was, 

9 really, as most people wouldn't understand open 

banking. 

11 And in the course of describing what it was, 

12 people would eventually say, well, do you mean it 

13 could actually kill me? There were risks involved. 

14 So we said, no, we wouldn’t do that. So that was the 

third kind of unusual thing in this remedy that we 

16 didn’t specify exactly what the applications were 

17 going to be. We just said we can see some examples of 

18 things that we think would be great, and we picked 

19 occasionally.

 The first was sweeping services. These are 

21 services which would -- basically, if you had too much 

22 cash in your checking account at the beginning of the 

23 month, it would take that money -- the app would take 

24 some money out of your account and put it on deposit 

and guarantee you would get a better rate than your 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

98 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 bank is giving you. 

2 If you were running a bit into the red at 

3 the end of the month, then rather relying on the bank 

4 overdraft, the app would pay money into your account 

and guarantee they would charge you less than your 

6 bank would charge you. And all of this would be 

7 hands-free. You would need to do nothing. This would 

8 take over the management of moving your money about. 

9 And that would be a very big threat to the banks in 

the UK because the most profitable customers are those 

11 who leave large balances in their current account and 

12 who run up big overdrafts. So that would be very 

13 important. 

14 And there are a whole raft of other examples 

that we can see particularly for customers who you 

16 could describe as challenged in some way or 

17 vulnerable. That’s been a very fruitful area of app 

18 development. 

19 So just briefly, where we got to two years 

in, two years after the first API traffic started? 

21 Well, in the first -- in July 2018, which was the 

22 first quarter when all the banks had the APIs running, 

23 API call volumes in the month of July 2016 were about 

24 two million. In August this year, they were 450 

million. We’re cumulatively now up to about nearly 5 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

99 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 billion, 5 billion API calls, and the number of active 

2 users of open banking has gone through the million 

3 mark. It's approaching one and a half. It’s going up 

4 toward -- in the direction of two.

 And adoption has been very, very strong in 

6 the SME section. SME is just to say adopted mobile 

7 phones first, fax machines first, everything else 

8 first. Yeah, they've adopted Open Banking first 

9 because it integrates beautifully with their cloudbased accounting systems. 

11 All the major banks have introduced Open 

12 Banking apps. All of the banks -- all the remaining 

13 banks, including the challenger banks, they’ve done 

14 the same. They weren't compelled to, but they have 

done the same because it allows them to comply with 

16 PSD2 and the software is free, so they found out. 

17 And we have, I think, 700 providers of Open 

18 Banking services now enrolled under the banking 

19 implementation entity. So there's a huge amount of 

activity that's taken place. And today we have not 

21 had one material security event. No data has gone 

22 astray as a result of open banking. 

23 So the jobs aren't finished yet. 

24 Implementation should be completed next year, and 

people are considering whether there's a read across 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

100 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 from open banking to open finance and then to other 

2 areas, which I think is something I don’t think you 

3 are interested in. So we're not quite there yet. 

4 Implementation should be finished next year. It's 

something that, oddly enough, the UK has led the world 

6 in. I'll stop there. 

7 MS. WHITE: Thanks. 

8 So, Professor Barr, here in the U.S. we 

9 don't currently have an open banking requirement like 

in the UK. But can you give us a little background on 

11 any efforts in the U.S. to require or encourage 

12 portability of financial data? 

13 MR. BARR: Sure, Kate. And thanks for 

14 putting this terrific panel together. As you said, 

the U.S. is really quite far behind on this measure. 

16 I think it's important to start with thinking about 

17 why we want open banking or portability in finance. 

18 One of the most important things is that 

19 these kinds of measures can help empower consumers to 

have better control over their own financial lives. 

21 We're trying to empower consumers so they can take 

22 better control, make better decisions, better access 

23 their finances, and that will help them get ahead in 

24 life and spend more time doing things that they care 

about, taking care of their family and the like. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

101 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 A second major reason we want portability or 

2 open banking is to enhance competition. And greater 

3 competition can help drive down costs and improve 

4 services. As Bill mentioned, there's a lot of profit, 

for example, to be made by banks in contingent fees, 

6 overdraft fees, insufficient fund fees, and other kind 

7 of “gotcha” fees. And it turns out, as Bill said, 

8 that consumers don’t really switch bank accounts. And 

9 one of the reasons they don't is because it's hard to 

do. 

11 And I think if you had better competition in 

12 financial services, it would reduce the ability of 

13 financial services firms to have these high-cost 

14 contingent fees. It will improve the ability of the 

incentives on banks and nonbanks alike to provide 

16 better financial services. So that's the basic frame 

17 of why we care about these issues. 

18 In the United States today, we don't really 

19 have a coherent framework for dealing with these 

issues. There's screen scraping going on. There are 

21 private contracts on a bilateral basis for direct data 

22 feeds. But there's no coherent policy framework. 

23 There's fragmentation in the market. There's no real 

24 interoperability.

 The private sector is beginning to get 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

102 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 together to try and come up with standards, but 

2 there's no government policy framework that requires 

3 them to do that and no kind of guiding hand to that 

4 effort to get them to reach agreement. And there's 

significant reasons why banks and other providers 

6 don't want to necessarily reach agreement on 

7 interoperability or portability, and that's hampered 

8 the development of this area. 

9 There are no common rules about security 

protocols. There's a patchwork of privacy laws in the 

11 United States that affect this sector. And even in 

12 finance and banking, per se, the Gramm-Leach-Bliley 

13 Act privacy protections are quite weak. Decent 

14 protections on liability allocation for security 

breaches, but even there there’s significant holes in 

16 that framework. 

17 So our basic, you know, framework in the 

18 U.S. on liability allocation, on privacy, on security, 

19 on interoperability, on open banking, we lack a 

coherent, strong framework, and that's really left us 

21 behind and hurt consumers and small businesses a great 

22 deal. 

23 When you look around the world, it's not 

24 just the UK we're really far behind. The UK Open 

Banking system is terrific, but there’s been progress 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

103 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 in many countries around the world. Singapore's made 

2 huge advances in this space; India has made 

3 significant advances through their IndiaStack program; 

4 if you look at what's going on in Australia. More 

recently, California has its own new privacy rules, 

6 sort of a California version of the GDPR. But we at 

7 the federal level lack that coherent framework. 

8 There is the ability to take action here 

9 under existing law to at least begin to shape up a 

regime that makes more sense for the United States, 

11 and it's from a provision that I worked on when I was 

12 in the Obama Administration. Section 1033 of the 

13 Dodd-Frank Act provides the authority to the Consumer 

14 Financial Protection Bureau to write rules 

implementing a consumer's right to access their own 

16 information. 

17 And when we were developing this proposal in 

18 2009, it ended up getting enacted in 2010, so 10 years 

19 ago, the whole point was to give consumers access to 

their own information in a form that they could then 

21 share with third-party providers so that they could 

22 get better control over their own lives and make 

23 better choices about what products and services made 

24 sense to them.

 That provision has not been enacted with 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

104 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 rules. It's a self-executing provision with respect 

2 to the right. Consumers have that right, but there 

3 are no rules that have been written under it to 

4 actually effectuate that. And that's led to this 

incredible hodgepodge of activity I described before. 

6 So I think we could start right away in the 

7 United States by having this Consumer Financial 

8 Protection Bureau implement rules so that 1033 is not 

9 just a principle; that it actually lets consumers get 

access to their data, lets them share it safely and 

11 securely with third parties, and lets those third 

12 parties use them to provide better services to 

13 consumers. I think that will enhance competition, it 

14 will enhance consumer autonomy, and we can get started 

right away under existing law. 

16 MS. WHITE: Thank you. 

17 So, Bill and Dr. Rucker, I know that your 

18 organizations have spent years getting your respective 

19 requirements implemented. I was wondering if you 

could tell us what aspects of that process were the 

21 easiest and what were the biggest challenges. 

22 Can we start with you, Bill? 

23 MR. ROBERTS: Yeah. Well, the easiest is 

24 easy. Having spent a long time designing the process 

so that we could minimize the conflict between the 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

105 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 parties over the agreement of the standards, that was 

2 actually the easiest part of the entire process, that 

3 very quickly consensus emerged on the standards, 

4 because there are international standards for these 

things. So if the standards -- the international 

6 standards that we adopted for APIs were the FAPI 

7 standards, the financial API standards. We adopted 

8 OAuth 2.0 and ID Connect for security and for 

9 authentication purposes. So that was easy, 

unexpectedly easy, the technical side of things. 

11 The more difficult side, the bit that caused 

12 us the problems, was to do with those areas where we 

13 kind of left the decision for the bank, where we left 

14 it in a competitive space, if you want, for what they 

were to do. 

16 So, for example, the authentication journey, 

17 this is the process whereby you are sitting down, you 

18 are talking to a personal financial management app, 

19 and you tell the app that you want it to take a look 

at your bank data. So it sends you off to your bank, 

21 and you say to your bank, I wish to authorize this 

22 intermediary to take a look at my bank data. This is 

23 happening in a fraction of a second. 

24 And then your bank will put you into a 

process where you go through maybe 14 click-throughs, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

106 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 you get a one-time password texted to you by somebody 

2 or you get a call from a call center who wants to know 

3 what the maiden name of your last dog was, and there 

4 are a lot of obstacles that seem to be put in there, 

to find their way into the process there. 

6 We probably wasted -- probably the last six 

7 months on that process before we realized that, yeah, 

8 you need to have a secure process, but security 

9 doesn't always imply friction. So we basically began 

looking for another authentication journey, which were 

11 frictionist but secure, and we found it in basically 

12 mobile apps whereby you authenticated yourself 

13 biometrically rather than passwords; your secret 

14 questions or whatever. And that worked tremendously 

well when we switched to biometric authentication. 

16 One provider’s response rates, or the 

17 abandonment rate of authentication, just disappeared 

18 and shot up through the roof. So we were expecting 

19 difficulties with a technology. They did not emerge. 

We weren't expecting difficulties over authentication, 

21 and whether by accident or design, they did, and it 

22 took us a little while to sort them out. But they are 

23 now sorted out. 

24 MS. WHITE: Thank you.

 Dr. Rucker? Dr. Rucker, I think you’re on 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

107 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 mute. 

2 DR. RUCKER: Sorry. Once the Cures Act was 

3 in place, I think, you know, the two big things that 

4 took us actually a couple of years in rule writing, 

besides the whole U.S. rule writing clearance process, 

6 which you may be familiar with for folks who are 

7 students of how regulation is done in the U.S., I 

8 think there was sort of one area that was a bit more 

9 inside ball game and then one that played out 

publicly. 

11 The inside ball game was really in the 

12 information blocking. As I mentioned, you can set an 

13 infinite price for an API. So how do you balance the 

14 costs of the API? And where we came down is that the 

use of the APIs, so an application program interface 

16 to get the data from your doctor or your hospital's 

17 medical EMR product, electronic medical record, 

18 electronic health record, that was free to the patient 

19 -- free, of course, actually being as with many other 

federal rules, it's part of the provision of care -- 

21 it's not free; it's just bundled into the provision of 

22 care. 

23 Then came the delicate thing that the 

24 providers needed to then buy software to provide these 

application programming interfaces. And, you know, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

108 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 they would provide that from their electronic health 

2 record vendors who then had incumbent status on the 

3 provision of that so that the -- and there have been 

4 various behaviors of some of the EHR vendors that were 

problematic. 

6 And so we had to put in sort of, you know, 

7 costs reasonably incurred and some considerations 

8 around that so that the providers had a chance to get 

9 these application programs and interfaces, something 

that reflected reasonable costs, reasonable profit 

11 margins. And, conversely, the electronic medical 

12 record vendors also need incentives to build software 

13 and to build APIs. 

14 So that balancing was a very complicated, 

heavily lobbying activity. And I'm proud, I think we 

16 have a reasonable pro-public balance that respects 

17 everybody's interests and moves the country forward 

18 there. 

19 The other area that obviously the FTC has 

also been involved in is the whole issue of privacy, 

21 right? We don't have, as has been pointed out in your 

22 prior session, you know, we don't have sort of the 

23 GDPR kind of equivalent in the U.S., and so what are 

24 the privacy protections for third parties as patients 

move the data? 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

109 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 In HIPAA law, while there are many ways that 

2 providers can share data with payers, analytic firms, 

3 claims clearinghouses, all kinds of other entities 

4 that are part of what you sign when you just go to a 

doctor's office, if you will, what we're talking about 

6 here is the patients' individual right of access. And 

7 so once they have that data, they are in ownership of 

8 their version of the data and can do with it whatever 

9 they want. There's no further provider obligation. 

So arguably you can have an evil app, and that evil 

11 app could then, you know, do bad things with the --

12 with your private medical data. 

13 So putting in a number of protections there, 

14 working with the FTC to have it sync up with the 

unfair business practices that the FTC has enforced on 

16 other internet properties, and allowing the providers 

17 to make that very clear, those efforts took a lot of 

18 time to get a good balance there. So that was the 

19 external part.

 MS. WHITE: Thanks. 

21 Dan, what have been the biggest challenges 

22 for companies when they’re trying to implement the ONC 

23 rules? 

24 MR. HORBATT: Similar to what Bill and Dr. 

Rucker were mentioning before, a lot of it comes down 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

110 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 to authentication and identity management of the 

2 patients as well as the vendors who are holding their 

3 data. 

4 In a lot of these situations, these are very 

much trust-based ecosystems where you have a number of 

6 different disparate parties sharing data amongst 

7 themselves, and so it's important that there's a 

8 framework in place such that Company A can specify, 

9 hey, I have credentialed this patient, this is their 

identity, and passing that along with any requests for 

11 any information to Company B. 

12 And as part of this, having federally 

13 mandated levels of assurance of that identity, it is 

14 important and is really critical to ensuring that this 

trust network is able to be stood up and utilized. 

16 And so without that, everything more or less entirely 

17 falls apart. 

18 So with it, mostly it seems to be getting 

19 along the lines of identity assurance level two, which 

is, I believe, an NIST standard, is the de facto 

21 standard right now and what we're trying to push 

22 everything to and what we’re trying to coordinate on 

23 across the industry. 

24 So as part of this -- sorry, I lost my train 

of thought there for a second. But, yeah, identity is 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

111 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 important here because medical data is one of the most 

2 sensitive pieces of information about a person. And 

3 it's not just relegated to just you as the individual. 

4 If there's a genomics component to it as well, this 

extends to anybody who's directly related to you as 

6 well. 

7 So being able to know for sure that when 

8 I ask for John Smith at 123 Main Street, date of birth 

9 -- given date of birth, that I'm getting the right 

person's records and that there's no possibility of 

11 getting somebody else's records, especially if we're 

12 handing it off to a third party on behalf of that 

13 patient who is not necessarily a covered entity and 

14 has not as many obligations under the HIPAA privacy 

rule to actually maintain the sanctity of this data, 

16 is hugely important and something that we're thinking 

17 about quite often. 

18 And the other aspect of things is the actual 

19 quality of the data itself. When moving to electronic 

medical records, there still is a lot of wiggle room 

21 around how that data is represented. There are 

22 different coding systems for the same conditions, 

23 different names for medications that need to get 

24 reconciled, even just different units of measure that 

are used across. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

112 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 And being able to take all this information 

2 from various source systems and combining it into one 

3 view of a patient that can be easily reconciled at 

4 whoever's providing the treatment at that particular 

moment is also critically important. 

6 And with the latest changes to push 

7 everything to FHIR, we're moving very much in the 

8 right direction where we've standardized a lot of 

9 these things, although there are still a lot of these 

edge cases and points of expensability that are 

11 resulting in discrepancies between the various source 

12 systems that are slowly getting reconciled. 

13 So it’s definitely going in the right 

14 direction. We're definitely seeing a lot better 

standards getting pushed out. And thankfully FHIR, 

16 the Fast Healthcare Interoperability Resource, 

17 is getting pushed globally. A lot of different other 

18 countries are using it a lot. I know that they’re 

19 using it a bunch over at the NHS and other countries 

as well. 

21 So we're getting to the point where 

22 interoperability isn't just a U.S. concern. It's 

23 going to be just a worldwide concern as well. And 

24 we're slowly but surely getting there to a point where 

we're able to speak the same language of data across 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

113 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 the various institutions and eventually across 

2 different countries as well. 

3 MS. WHITE: So you say we're slowly getting 

4 there. Is there anything that can be done to help get 

there faster? 

6 MR. HORBATT: I mean, I think we're doing 

7 everything that we can right now. Specifying specific 

8 versions of these standards to use, like, I believe 

9 TEFCA is specifying FHIR version R4, is great. And 

once the industry gets comfortable with that, we can 

11 continue to make iterative progress on standardizing 

12 further and further along those lines. 

13 So you've got to start somewhere. We've had 

14 great success with HL7v2, moving to the clinical 

document architecture now to FHIR, all of it steps in 

16 the right direction. And I'm sure that we will 

17 continue to make progress along there as well. It's 

18 just unfortunately a matter of time. Nothing changes 

19 overnight. And we're discovering all sorts of new 

problems and edge cases with everything that we 

21 introduce, just the nature of progress. 

22 MS. WHITE: Dr. Rucker, have you heard a lot 

23 of these -- about these sort of authentication 

24 challenges, and have you guys at ONC been giving 

thought to ways to help with solutions? 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

114 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 DR. RUCKER: Yeah. I mean, I think 

2 everybody who has data and, frankly, everybody who's 

3 on the internet, anyway, even if it's for advertising 

4 purposes, you know, wants to identify individuals for 

any number of business reasons. 

6 Obviously, as Dan pointed out, in 

7 healthcare, robust authentication is pretty critical 

8 to doing it. I'm an optimist that the market is 

9 actually going to take care of these things, see. The 

combinations of the technologies and the richness and 

11 the ability to corroborate data sources is really 

12 advancing at an extraordinary rate. 

13 In healthcare, there are a number of people 

14 who have advocated the government should have, you 

know, another government identification number, right, 

16 on top of the Social Security number, or your driver's 

17 license number or your Medicare number. All of those 

18 numbers tend to have some very deep issues, too long 

19 to go into here, but have some deep issues.

 What we're finding is, as people do the 

21 richness of data, that the authentication becomes 

22 quite good. So for example, Surescripts, who manages 

23 almost all of the electronic prescribing of 

24 prescriptions in the United States, right, so they 

have a big authentication issue that they have to 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

115 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 solve. They do it with a combination of technologies. 

2 So some of that is just matching, you know, age, zip 

3 code, what is a demographic match. But they actually 

4 build up reference databases underneath, so they sort 

of know who moves with whom, when households move, who 

6 are family members, who are twins, so a number of 

7 these things. 

8 So the net of that is they're getting 

9 extraordinary high match rates when you do that, and 

that's one entity. But if you look at all credit 

11 bureaus, claims, clearinghouses, a whole number of 

12 other players in healthcare and, frankly, in the 

13 financial service industry, are quite good at 

14 authentication. The apps that can visibly 

authenticate you when you deposit a check on your 

16 smartphone, we've had discussions with some of those 

17 vendors, and they tell us they’re authenticating based 

18 on up to 5,000 data points, right? So that's the 

19 profile. On your smartphone, they can’t just be 

spoofed away by getting the smartphone's electronic 

21 identity and somebody who's in cahoots with somebody 

22 at the cellular phone vendor. 

23 So there are all kinds of authentication 

24 technologies. They're moving very, very rapidly. So 

I think this is a problem that will eventually lead 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

116 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 us, as Bill pointed out, to much higher levels of 

2 consumer convenience and power of these opening rules. 

3 MS. WHITE: Professor Barr, are there 

4 similar concerns about authentication in the financial 

sector, and are there any -- is there anything that 

6 could be done to address the concerns there? 

7 MR. BARR: There are always concerns about 

8 authentication. There are concerns in terms of 

9 limiting the potential for fraud. There are problems 

today with the creation of synthetic identities. 

11 And beyond the issue of fraud or abuse in 

12 the system, the current methods we use to authenticate 

13 identity can impose very high costs on the financial 

14 sector and on consumers, and that tends to limit 

access to the financial system, oftentimes for those 

16 who need it the most. 

17 So low-income consumers, immigrants, those 

18 who are sending money abroad or receiving money from 

19 abroad, the authentication costs in the system cut off 

access for all kinds of people who are quite low-risk 

21 for things like fraud or money laundering or terrorist 

22 financing. 

23 So our rules for authentication are not very 

24 good at catching bad guys and are particularly good at 

imposing costs on the system that limit access. So 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

117 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 there's enormous progress we could make on this. 

2 I agree with Dr. Rucker that there's been a 

3 lot of private sector innovation on authentication 

4 using multifactor authentication, biometric 

authentication. All these measures could make 

6 significant progress for us at lower costs and with 

7 better results than the system we have now. 

8 I think what we need is we might not 

9 need the government to innovate in that way, but we do 

need to government to set standards for what's 

11 acceptable so that the private sector, so a bank, can 

12 rely on those in transactions and know that the 

13 government believes that the authentication is 

14 appropriate.

 The government can also use those same 

16 authentication procedures to move money more quickly 

17 and more efficiently. We saw in the financial crisis 

18 and again in the pandemic that when the government 

19 wants to move money quickly to people who need it, it 

has a hard time doing that. And part of that is deep 

21 inefficiencies in the U.S. payment system, part of 

22 that is the lack of real-time settlements for retail 

23 payments, and part of that is the really not very good 

24 standards we have for authentication of 

identification. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

118 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 So I think if we make progress on this 

2 front, we can help the government help people in times 

3 of crisis; we can help banks make payments; we can 

4 improve access to the financial system for people who 

need it the most; we can expand the ability to send 

6 money abroad, to send remittances at much lower costs; 

7 we can open up channels for remittances in countries 

8 right now that are cut off from the financial system 

9 because of identification and authentication concerns 

having to do with money laundering or terrorist 

11 financing. 

12 So if we make progress on this front, we can 

13 dramatically improve the efficiency of the financial 

14 system and promote financial inclusion at the same 

time. I think it's a critical area to be working on. 

16 MS. WHITE: Speaking of financial inclusion, 

17 we were talking earlier -- in the earlier panel we had 

18 someone from India who was saying that, you know, one 

19 of their -- the impetus for their sort of data 

portability initiatives is to give more people access 

21 to the financial sector. Is that something that --

22 are there consumers in the U.S. who are sort of 

23 outside the system, and could data portability help 

24 them?

 MR. BARR: Yes. I mean, in the United 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

119 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 States, we have a significant number of people who are 

2 unbanked, who don't have access to the banking sector 

3 or had access before and got out of it because it was 

4 too costly.

 And we have quite a number of people who are 

6 -- you could think of as underbanked, who need to rely 

7 on a range of alternative financial services because 

8 the formal sector doesn't serve them well. And the 

9 costs of this are really quite extraordinary for --

again, for people who can least afford it. 

11 We've set up a system that works really well 

12 for upper-income individuals but not one that works 

13 well for lower-income individuals or even middle14 income families. We need to have a financial system 

that really is designed at its heart and that begins 

16 with, what does the consumer need? What do 

17 individuals need to be able to manage their finances 

18 better? How do they -- how can they receive their 

19 income, store it safely, and pay bills at a much lower 

cost? 

21 And our payment system really isn't set up 

22 well for that. If we made advances in this area, 

23 identification, authentication, which we talked about, 

24 a requirement for realtime payments, which is 

technologically feasible but in the United States has 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

120 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 been held back because, oftentimes, banks make a lot 

2 of money on overdraft, which is linked to not having 

3 your money right away. 

4 We need a real-time payment system that 

actually works for, supports consumers. We need an 

6 identification system that opens up access. We need 

7 low cost products and services that are safe for 

8 people to use. These are all things that we can 

9 achieve. They’re not -- there are technical issues in 

them. I don't want to say there aren't any technical 

11 issues, but the primary problem is not a technical 

12 one. It's do we have the policy and political will to 

13 create a system designed to actually serve people. 

14 MS. WHITE: Thanks.

 My next question is actually for all the 

16 panelists, which is, you know -- we've got about 20 

17 minutes left and we've already gotten a lot of 

18 questions. So I’d like to, you know, get to a few of 

19 them. But I wanted to ask all of you if you could 

tell us a little about what you see in the next three 

21 to five years, like what's on the horizon for 

22 portability? You know, will we see an increase in 

23 consumer adoption? Will we see more products entering 

24 the market?

 Let's start with you, Bill, or we could --

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

121 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 MR. ROBERTS: Sorry. I couldn't get the 

2 question. We had audio breakdown there. 

3 MS. WHITE: I was asking what you see in the 

4 next three to five years on the horizon for the open 

banking, do you see increased consumer adoption? I 

6 know you've already seen a lot of it. Do you see more 

7 competition in the marketplace? 

8 MR. ROBERTS: Yeah, I'm sorry. You broke up 

9 completely then, Kate.

 MS. WHITE: Okay. Have I been unmuted? I 

11 got accidentally muted by the host. Can you all hear 

12 me again? 

13 Oh, good. Dr. Rucker, how about you? Can 

14 you tell us what you see on the horizon in the next 

three to five years? Oh, no. Now you're on mute. 

16 MR. BARR: I think I've managed to unmute 

17 myself. So maybe I'll start us off while everybody 

18 else figures their computer system out as well. 

19 I think there's an incredible need to see 

greater improvement in this area in the next few 

21 years, and I think that there's a huge consumer demand 

22 and there's huge demand for small business, which we 

23 haven't talked about as much. These kinds of 

24 initiatives can really, really improve the ability of 

small businesses to operate efficiently, to be able to 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

122 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 process payments efficiently, to be able to do their 

2 business at much lower costs. 

3 A lot of small businesses really spend a lot 

4 more on the frictions of finance than they need to, 

and that's because we have the wrong policy framework 

6 in the United States. We need to develop a framework 

7 that really is rooted in serving people and in serving 

8 small businesses. We need real-time settlement 

9 systems; we need information authentication systems; 

we need a portability requirement implemented under 

11 the framework that we potentially have; and 

12 improvement in security and privacy. 

13 As I said, these are -- there are technical 

14 issues there, but it’s really basically an issue of 

political will. If we can get the political will, 

16 then in the next few years I can see a dramatic 

17 increase in portability, a dramatic increase in 

18 efficiency in the financial system, more competition 

19 in empowering consumers to have more control over 

their financial lives. We can get there if we have 

21 political will. And we've seen that in other 

22 countries in the world, in the UK, in India, 

23 Australia, Singapore. We can get there, but we have 

24 to make the choice that we actually care about it. 

 MS. WHITE: Thanks. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

123 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Dan, are you able to tell us how you see the 

2 next three to five years going? 

3 MR. HORBATT: Yes, I would love to. So from 

4 what I have seen so far, I believe that the process of 

utilizing a person's individual electronic medical 

6 records is going to become a much more seamless 

7 process. We're already starting to see this with a 

8 variety of different platforms acting as stewards of 

9 the data on behalf of the patient. So the patient 

owns the data. It's just these various platforms that 

11 are helping to connect the dots for them. 

12 And we're seeing this already with Apple 

13 Healthcare. You’re seeing this with Google Health and 

14 Particle Health, my company’s platform, as well, where 

patients aren't even going to necessarily need to know 

16 all the details of what's going on. They're just 

17 going to be getting better, more seamless care, 

18 faster. 

19 They're going to be able to leverage a large 

cohort of applications to provide very special care to 

21 them, especially for chronic conditions. People who 

22 have chronic, ongoing conditions are going to be able 

23 to get care 24-7 through these applications that don't 

24 necessarily even need to directly involve their care 

team except at very specific touch points. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

124 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 And, overall, I believe that there's going 

2 to be a much better increase in the efficacy of these 

3 treatments, as well as very rich data, being able to 

4 go back to an individual's care team to see how 

exactly they have been going, like have they been 

6 adhering to the medications that they’ve been on, like 

7 how are things going, without having to ask them to 

8 remember everything that's happened over the past 

9 month for them.

 So data being used for patients on behalf of 

11 the patients without the patients needing to actually 

12 actively do anything for it. 

13 MS. WHITE: Bill, do we have you back? What 

14 do you see on the horizon in the next three to five 

years? 

16 MR. ROBERTS: I think what I see is the 

17 application of data portability and information 

18 sharing applying to a much larger number of areas. So 

19 I think you will see it applied beyond financial 

sectors into what we would call the regulated sectors, 

21 too. 

22 I think the big question in my mind is where 

23 the big digital platforms will move, whether the big 

24 digital platforms will move into, say, the payment 

area, and whether the banks, maybe the big European 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

125 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 banks, will start moving in the opposite direction; 

2 whether they will say to themselves, you know, we need 

3 to reinvent ourselves now. It isn't just your money 

4 you need to keep safe these days; it's your data as 

well. So all the banks, certainly in Europe, thinking 

6 about whether they would provide a vault, not just for 

7 money, but for data as well. 

8 One of the most peculiar, strangest things 

9 I've seen in the last 12 months was a conversation 

with banks in Beijing where the banks in China were 

11 lobbying the Chinese government to be given a level 

12 playing field with Alibaba, basically, because they 

13 envy the power that Alibaba has there. 

14 So I think I see people moving into other 

people's spaces. I don't know where the big digital 

16 platforms will go. I don't know where the banks will 

17 go, but they seem to be moving closer to each other, 

18 where the device manufacturer will go, I can't tell 

19 either, but everybody seems to be moving to everybody 

else's space right now. 

21 MS. WHITE: Dr. Rucker, what do you see on 

22 the horizon? 

23 DR. RUCKER: Yeah. You know, I think 

24 there's a lot of interest in moving health to a more 

continuous 7-by-24 type of activity rather than, you 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

126 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 know, the intermittent go-to-the-doctor type of thing 

2 that we've historically had. And so I think, you 

3 know, the device we carry on our body pretty much all 

4 day long is obviously the logical thing to portal for 

that. 

6 There are several hundred thousand, by 

7 reports, apps and app stores on things like health and 

8 fitness and exercise that don't have access to medical 

9 data. So I think there will actually be a number of 

apps that, having access to medical data, especially 

11 for the folks who are sicker, for the folks who have 

12 chronic illness, will be able to engage in much richer 

13 experiences. 

14 I think these experiences are going to be 

fueled on the one hand by technology, which, you know, 

16 we've seen this in the rest of the app economy in the 

17 entire, you know, bricks versus mortar, mixes of 

18 bricks and mortar that everybody's experimenting with, 

19 and that same paradigm holds in healthcare. And we're 

also seeing it in the internet of things. 

21 So, you know, Apple just released pulse-ox 

22 on their smart watch. I think there’s one or two 

23 other brands have pulse oximeters on their smart 

24 watch. So there’s an enveloping technology out there.

 The other issue that is big out there, I 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

127 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 think, is that the markets in the U.S., transparency 

2 both on clinical care and on price. The President’s 

3 had, you know, a number of policies obviously in both 

4 areas to increase transparency. That will come 

together with the individuals bearing more and more of 

6 healthcare costs as corporations, you know, do less 

7 and less of the shielding of those costs from the 

8 public. 

9 So I think there's going to be a lot more 

consumer sovereignty demand based on just the shifting 

11 economics. You put the technology, the shifting 

12 economics together, I think we're going to see an 

13 explosive growth in, you know, the involvement of 

14 healthcare mediated via the smartphone.

 MS. WHITE: So we’ve gotten several 

16 questions today about consumer adoption, and so it’s 

17 sort of two questions. The first one for any and all 

18 of you is, what can we do to increase consumer 

19 adoption to make them more comfortable with adapting 

technologies that are giving them the ability to port 

21 their data? 

22 MR. BARR: I mean, I'll just jump in again. 

23 It depends on having the policy framework. You know, 

24 right now, again, in the United States, we don't have 

the right policy framework to advance this. So people 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

128 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 are using either screen scraping or these bilateral 

2 directive data feeds. And until we have a coherent 

3 policy framework that looks out for consumers -- and 

4 that we could do based on the CFPB's current authority 

-- I think we're not going to have the kind of 

6 adoption that people eventually want to see once we 

7 have those protections in place. 

8 DR. RUCKER: Yeah, if I can give the 

9 healthcare version of that, I think we do actually 

have in healthcare, but I agree with Professor Barr. 

11 On the financial side in healthcare, I think we do now 

12 have the policy framework. We have a robust set of, 

13 let's say, starter rules, starter data elements, and a 

14 pathway to get those.

 I think a lot of it goes back to our earlier 

16 discussion of just raw convenience. People have --

17 you know, we're all busy, we can't remember 5,000 

18 passwords. You know, we're overwhelmed by technology, 

19 by technology choices. So I think we naturally 

gravitate to things that have lower friction costs. 

21 So the background work on -- all the 

22 background work on infrastructure, as Dan mentioned, 

23 data quality, that makes these things more elegant and 

24 explanatory to patients. And, frankly, I see the 

issues around authentication and informed consent, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

129 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 probably two of the bigger ones we don’t have in the 

2 U.S., you know, as elegant consent policies. So we do 

3 it with a sort of jury-rigging approach that basically 

4 works, but it's a high-friction approach, as, again, 

Professor Barr mentioned. So I think that's, in fact, 

6 a great role for the FTC, frankly, is to think about 

7 consent policies as well. 

8 MS. WHITE: Dan, do you have anything to add 

9 about how we can increase consumer adoption?

 MR. HORBATT: I think the appetite is there. 

11 As soon as the apps get out there, I think that you're 

12 going to have a lot of consumer-driven downloading and 

13 using of those apps, potential for the prescription of 

14 apps, tying together with a very robust, wearable 

economy as well. So things like the Apple Watch, 

16 similar other wearable devices being able to feed 

17 information back to care teams, I think is going to 

18 drive a lot of that going forward as well. 

19 MS. WHITE: I've got a question from the 

audience, and it suggests that there might be some 

21 consumer confusion where they don't -- and I think we 

22 alluded to this before -- where they don't understand 

23 sort of the protections that follow the data when they 

24 move it. Is there anything we can do to sort of help 

with that, for anyone who's got an opinion? 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

130 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 MR. BARR: I think, you know, issuing some 

2 clarifying guidance under the Gramm-Leach-Bliley Act 

3 by both the FTC and the bank regulators, it might 

4 help. I think there is some confusion about -- among 

some about whether GLBA protections apply outside of 

6 banks. They do, but I think that making sure people 

7 understand that might help in a modest way in 

8 advancing privacy protections. 

9 MR. HORBATT: I think -- just to jump in 

here as well, I think giving individuals visibility 

11 into where exactly their data is going would also 

12 drive a lot of desire to be informed in part of the 

13 process. So as a patient, if I were able to see 

14 everywhere that I currently had outstanding HIPAA 

authorizations for myself, that would be a very 

16 enlightening experience. It would answer a lot of 

17 questions and perhaps could even freak me out a little 

18 bit based on, you know, I don't remember giving this 

19 consent four years ago; I should probably revoke that 

at this point because I no longer have a need of their 

21 services. So just being able to know that you have 

22 the rights under HIPAA and being able to exercise them 

23 would drive a lot of consumer confidence, I believe. 

24 MS. WHITE: And what about, Bill, if you can 

hear us, you had mentioned, yeah, when we talk about 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

131 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 sort of consumer adoption and sort of how can we make 

2 sure that consumers understand what they're giving 

3 consent for, how have you guys dealt with that in the 

4 open banking, making sure that consumers sort of 

understand what they're consenting to if they want to 

6 use your services? 

7 MR. ROBERTS: Basically through just trying 

8 to make it clear to people through some kind of a 

9 dashboard that they know and are clear about what --

who they're giving permission, authorization, for what 

11 purposes, for what data, and over what time period, 

12 and also that they are occasionally required to 

13 reinstate that -- that authorization so that it 

14 doesn't just lie there and it can be used until it's 

switched off. The customer will periodically be 

16 required to say, yeah, okay, I'm okay with that data 

17 still being used. 

18 There are issues. We are facing issues over 

19 the onward sharing of data because it isn't now just a 

matter of an intermediary dealing with banking -- open 

21 banking. We now have third parties handling data 

22 between the bank and the intermediary, and maybe 

23 fourth parties or maybe fifth parties. 

24 So it kind of -- it's all of the final 

pieces in the implementation that we’re trying to 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

132 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 crack to make sure that it's plain to the customer to 

2 whom they're giving authorization and for what, and 

3 that they can revoke or vary that consent through 

4 something as simple as a dashboard.

 I think the only other point I’d make is 

6 that one of the two other lines of defense, if you 

7 want, that we have are the accreditation of firms who 

8 are allowed into the ecosystem. It’s quite a big part 

9 of protection to ensure that their systems are as 

required. 

11 And then certainly on the payment side, we 

12 have a very simple method of redress, so if things do 

13 go wrong, if data does go astray, if somebody moves 

14 money as a result, then it's pretty simple to figure 

out where the consumer goes, and it's strict 

16 liability. The customer goes to the bank, the bank 

17 makes the customer whole, and then it sorts it out 

18 with whichever other party to the transaction it would 

19 claim was at fault.

 So we haven't cracked that yet. It’s a huge 

21 issue. It’s tied -- authorization is tied in heavily 

22 with issues of authentication, and I don't think 

23 anybody has an A grade on that yet with jurisdictions 

24 that we’ve looked at.

 MS. WHITE: Well, thank you all. This has 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

133 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 been -- we’ve just got another minute, and I just 

2 wanted to thank you all for a great conversation. 

3 This has been incredibly useful and informative. And 

4 so I thank you again. And, so, our next panel will be 

Reconciling the Benefits and Risks of Data 

6 Portability, and that will begin at noon. And thank 

7 you all for watching. 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

134 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 RECONCILING THE BENEFITS AND RISKS OF DATA PORTABILITY 

2 MR. QUILLIAN: Good afternoon. Welcome to 

3 Panel 3, Reconciling the Benefits and Risks of Data 

4 Portability. I'm Ryan Quillian, one of the Deputy 

Assistant Directors of the Technology Enforcement 

6 Division in the FTC's Bureau of Competition. 

7 We have a very accomplished group here today 

8 who is going to explore this important topic. Before 

9 I briefly introduce the panel, please note that their 

full biographies, which tell you much more about their 

11 distinguished backgrounds, are available on our 

12 workshop webpage. 

13 Now, our panelists. First is Ali Lange, who 

14 is a public policy manager at Google. She is based in 

the company's California headquarters and works 

16 closely with its Data Portability Product Team. 

17 Pam Dixon is Founder and Executive Director 

18 of the World Privacy Forum, a public interest research 

19 group focused on consumer data privacy issues.

 Next is Gabriel Nicholas, a research fellow 

21 at NYU School of Law, whose work focuses on tech 

22 competition and the politics of software. 

23 Hodan Omaar is a policy analyst at the 

24 Center for Data Innovation, a research institute 

focused on the intersection of data, technology, and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

135 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 public policy. 

2 And last but certainly not least is Peter 

3 Swire, who you heard from this morning. Peter is the 

4 Elizabeth and Tommy Holder Chair of Law and Ethics at 

the Georgia Tech Scheller College of Business, where 

6 he teaches cybersecurity and privacy. He is also 

7 senior counsel at the Alston & Bird law firm. 

8 We’re going to do a Q&A discussion among the 

9 panelists. If we have time at the end, we will do our 

best to answer some questions from the audience. So 

11 please send those to dataportability@ftc.gov. You can 

12 also follow us on Twitter. The FTC will be live 

13 tweeting the event using the hashtag #datatogoftc. 

14 Ali Lange is going to start off by telling 

us about Google’s own data portability project, called 

16 Takeout, and the Data Transfer Project, which is the 

17 collaboration among several large technology 

18 companies. 

19 Ali, take it away.

 MS. LANGE: Thanks so much, Ryan, and thanks 

21 to the FTC for organizing this event. We’re really 

22 excited to be here and share a little bit about our 

23 work on data portability. 

24 So Google has been working on data 

portability for more than a decade, actually starting 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

136 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 back in 2007 when a team of engineers in our Chicago 

2 office had developed an early iteration of data 

3 portability tools that allowed users to export copy 

4 from individual Google products. And then four years 

later, in 2011, we launched a data portability product 

6 called Google Takeout, which is a centralized place 

7 for users to download their account data -- a copy of 

8 their account data. 

9 And since then we really just continued to 

invest in this product and innovate and make this 

11 feature practical, easy to use, make sure it's 

12 responsive to the use cases that our users are 

13 requesting in terms of their needs for data 

14 portability. And a lot of folks have talked a lot 

about what data portability is, so I think we can 

16 assume folks understand, but just sort of for some 

17 context on how Google has implemented it, the Takeout 

18 product actually currently allows users to download 

19 machine-readable copies of data from over 70 Google 

products, in addition to making that data accessible 

21 through their Google account in general. 

22 So through this process, users can select 

23 the data format that they want to use, depending on 

24 the product, the type of data they want to download, 

what they're planning to do with it. So, for example, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

137 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 a user connects from their Google Docs from drive into 

2 a .docx file format if they're going to use it with 

3 Microsoft. So as you're going through the Takeout 

4 process, if there's an industry standard format that’s 

available, we pre-select that for export. But when 

6 you’re going through, you have the option to change 

7 that to whatever file format you’d like from the 

8 options that are available. 

9 We've also in recent years made it 

increasingly available for users to transfer data 

11 directly between a Google account to another service 

12 that they can authenticate into. So, for example, 

13 rather than downloading that drive file onto your 

14 computer and then reuploading it into Microsoft 

OneDrive, you can send it directly if you can 

16 authenticate into your OneDrive account without 

17 downloading it onto your computer first. 

18 We’ve also added other features in recent 

19 years for Takeout, including options to schedule 

recurring exports, and we're expecting to add more 

21 features. We’re always adding more features for the 

22 portability tool. 

23 As you're using Takeout, one thing that’s 

24 important and is made clear in the flow, is that it’s 

not deleting the data from your Google account. It 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

138 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 creates a copy that you can use, you know, to have a 

2 backup, to sort of get a bird’s eye view of what's in 

3 your account or move that data to a different service, 

4 as we described.

 The Takeout functionality is also -- I’m 

6 sorry, the deletion functionality is also available in 

7 your Google account, but it's on a separate page. If 

8 you're going through the deletion flow, it does 

9 actually direct you to Takeout to see if you want a 

copy of your data before you delete your account. 

11 They are linked in that way. 

12 Throughout this process, Google has 

13 implemented really strong privacy and security 

14 protections for Takeout to guard against unauthorized 

access, diversion of data or any other types of fraud. 

16 So, for example, in earlier panels there was a 

17 discussion around authentication. But for Takeout, 

18 users have to re-authenticate their account to execute 

19 a download, even if they're already signed in. And 

that would include two-factor if they have that turned 

21 on in their account. That's a protection that we have 

22 installed for our Takeout users. 

23 So after sort of a decade of work on data 

24 portability, we have made a lot of improvements as 

we’ve described, and we sort of have learned a lot of 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

139 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 information about what users expect, how things are 

2 working, what types of functionality is the most 

3 useful. 

4 And over that time, one of the things that 

we really focused on is, as I mentioned, making the 

6 data easier to move directly to another service. And 

7 one of the challenges that we found along the way of 

8 doing that is that that one-to-one connection takes 

9 quite a bit of engineering effort, right, to connect 

the APIs to every other service you might want to 

11 download your data to or sort of transport a copy of 

12 your data to. 

13 So as we were working on that project, we 

14 really thought there was probably a way to make this 

easier, particularly given that the direct transfer is 

16 such a significant improvement in user experience, but 

17 the engineering effort can be a little bit challenging 

18 for folks. And that was really the core insight that 

19 we built the Data Transfer Project on.

 So we founded the Data Transfer Project in 

21 2018 based on these insights around, you know, the 

22 challenges that we faced around direct service-to23 service portability and really wanted to make that an 

24 easier thing across the industry. The Data Transfer 

Project is an open-source data portability platform 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

140 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 and it enables people to transfer their data directly 

2 between online services. It's essentially an industry 

3 effort that we continue to lead with partners at 

4 Apple, Facebook, Microsoft, and Twitter. And this 

effort is really designed to address some of those 

6 technical challenges and help portability scale and be 

7 practical. 

8 And, in particular, it's addressed to help 

9 reducing -- or it’s designed to help address the 

engineering effort that each individual company has to 

11 put into direct service-to-service portability. So 

12 the fundamental concept -- and I would direct folks 

13 who are interested in more of the technical details to 

14 our website, which is datatransferproject.dev.

 So the fundamental concept is really that 

16 there’s a system of API adapters and common data 

17 models that are built through the open-source 

18 community and available on GitHub. Anybody can 

19 contribute, anybody can sort of see the code and 

evaluate it. And these adapters and data models, they 

21 facilitate the direct transfer between providers. 

22 And so by sort of centralizing this 

23 engineering effort, by making it open source and 

24 available for others to participate in, the concept is 

basically that you're making it much more scalable for 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

141 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 other companies to participate. 

2 So to give a sense of what this improvement 

3 to scale is through the Data Transfer Project, you can 

4 sort of imagine a world in which there are 10 

companies that offer, like, a photos product. For 

6 each of them to all be interconnected, they would have 

7 to build 90 connections. To be maintained, each 

8 company has to do nine different connections and 

9 maintain those and sort of make them operate. And 

each time a new company comes into the space, you have 

11 to build a new one. 

12 So with the Data Transfer Project, instead 

13 of building that sort of one-to-one web of 

14 connections, things go through a centralized model 

where you have a sort of conversion process. And so 

16 all you have to do as an individual company is 

17 maintain your storefront, essentially. You have to 

18 maintain your adapter into the project. But you don't 

19 have to maintain and worry about all of the other 

ones. So it really just reduces the amount of effort 

21 folks have to put in, which is the key element of the 

22 scalability of the project. 

23 We really hope and believe and have seen 

24 early evidence that this effort will enable 

innovation. We want users to be empowered to try out 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

142 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 new services and experiences. We don't want companies 

2 to have to be worrying about being integrated with, 

3 you know, N-squared providers. Portability is 

4 something that companies can look forward to enabling 

and not sort of dread having to deal with. And the 

6 Data Transfer Project is really a way to facilitate 

7 that and make that a little bit easier so that 

8 innovation can grow and thrive based on this process. 

9 Importantly, throughout the Data Transfer 

Project, we’ve spent a lot of time grappling with the 

11 privacy and security kind of elements of the project. 

12 And, again, there's actually a pretty extensive 

13 analysis of this in our white paper and in the 

14 comments we submitted to the FTC, that include, for 

example, a table of various responsibilities for all 

16 of the stakeholders in the transfer process, sort of 

17 how we think -- you know, who’s responsible for what. 

18 But fundamentally, even though portability does 

19 provide a significant benefit for users, there's an 

important element of users being able to move their 

21 data safely, maintaining strong privacy and security 

22 assurances along the way. 

23 So from our point of view, providers on both 

24 sides of the portability transaction need to have 

strong privacy and security measures such as 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

143 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 encryption in transit and other features to guard 

2 against any sort of fraud or other concerns that a 

3 user might have. They should be explained to users. 

4 Users should understand the practices of, for example, 

their destination of their data so they're clear on 

6 what is going to happen. And, like I said, this is 

7 detailed pretty extensively in our white paper and 

8 also in the comments to the FTC. 

9 So as I mentioned, fundamentally, DTP is 

helpful for folks who want to try a new service, and 

11 portability is helpful for folks who want to try a new 

12 service. But one of the main innovations of the Data 

13 Transfer Project is that it’s actually really 

14 helpful for individuals who are operating on slow or 

metered connections; people who are on mobile devices 

16 in areas without access to high-speed internet or 

17 where internet is very expensive. 

18 So if you’re thinking of portability in the 

19 sort of original conception where you would download 

your data and then re-upload it to a new service 

21 provider, that's a pretty expensive thing to do. You 

22 really have to have a personal device that has a fair 

23 amount of storage. You're talking about using a lot 

24 of bandwidth to download and re-upload the data.

 So for folks who are based in the U.S. or 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

144 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Europe, this may seem sort of like a marginal change, 

2 although not for everyone but for some. But for folks 

3 around the world, this is actually a really 

4 significant difference. You're shifting the 

infrastructure burden from the individual to have this 

6 pretty extensive infrastructure back to the company so 

7 the data is moving through the cloud, and they're not 

8 taking on these kind of expenses basically of 

9 literally moving it. So that's something we're 

feeling really positive about. 

11 Just quickly, I know I'm sort of running 

12 over your time limit, Ryan, but in addition to the 

13 partners on the project who I listed, Facebook, 

14 Microsoft, Twitter and Apple, several companies, 

developers, individuals, have made significant 

16 contributions to the implementation of DTP since it 

17 launched. So we just want to thank everyone who has 

18 participated, not only in building the code, but also 

19 participating in building kind of understanding and 

having conversations with us and thinking through some 

21 of the issues. 

22 More than two dozen contributors from a 

23 combination of partners in the open source community 

24 have inserted 168,000 lines of code and changed more 

than 85,000 files on the GitHub website. So it’s been 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

145 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 a pretty significant effort in the community, and 

2 we’re really grateful for all the work folks have put 

3 in. 

4 If you're interested in getting involved or 

interested in becoming part of that community, there’s 

6 details on the website, which again is 

7 datatransferproject.dev. I’m sorry, I think I might 

8 have misspoke earlier, datatransferproject.dev. And 

9 you can learn more about kind of what the partners are 

doing. We post periodic updates and we have some 

11 explanations on there on how people can get involved, 

12 no matter where you are, if you're an individual 

13 developer, if you’re just a thought leader interested 

14 in participating.

 So that's basically the history of Google's 

16 effort on data portability, not only making it sort of 

17 easy, practical, you know, really working in our own 

18 platform to make sure folks have what they need to 

19 move their data and to feel like they have sufficient 

access and visibility, but also to really contribute 

21 to a broader effort across all of the ecosystems to 

22 make data portability practical and to enable this 

23 direct transfer which we really see as the future of 

24 data portability.

 MR. QUILLIAN: Thanks so much, Ali. We 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

146 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 appreciate that overview. 

2 I'm now going to turn to the rest of the 

3 panel to give us some more background on themselves 

4 and their work in the data portability space, as well 

as describe their perspective on why data portability 

6 is important. 

7 Gabriel, can you please give us a little 

8 background on your interest in this area and tell us, 

9 you know, from your perspective what the goals of data 

portability are. 

11 MR. NICHOLAS: Sure. And thank you, Ryan, 

12 and thank you to the FTC for having a panel on such an 

13 important topic. I think it's really great to be sort 

14 of having these conversations now.

 So I see there as being two separate goals 

16 of data portability. On the one hand, there is this 

17 idea of giving consumers access and ownership over 

18 their data, either for archival reasons or for 

19 oversight. And we've seen a lot of strides in this 

area from Google Takeout, as Ali mentioned before, 

21 Facebook's Download Your Information tool, and sort of 

22 a number of other portability regimes that have come 

23 up after the GDPR. 

24 The other goal of data portability can be to 

encourage competition by allowing new and existing 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

147 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 products and companies to build new platforms, build 

2 new products, based off of existing data. Now, this 

3 area is much more experimental. As I think Professor 

4 Graef said in the first panel, we haven't seen many 

products, if any products, built out of portability in 

6 this way, and we don't know if it works. 

7 And so I think a great way for the FTC to 

8 look at data portability is as a big experiment in 

9 improving competition in tech. And the way to 

regulate it is to consider how do we best set up the 

11 conditions for this experiment so as to make it most 

12 likely work? 

13 And in that experiment, you know, it's 

14 important to focus on the consumers, as we've talked a 

lot about, you know, is their privacy being 

16 maintained, is the experience secure, and is it easy 

17 enough for them to actually do -- you know, to allow 

18 them to move their data, if interested, but there's 

19 also a question from the competitors' perspective, 

where is the data that companies are making available 

21 enough to actually build platforms off of? And 

22 neither -- you know, neither works alone. Portability 

23 can't improve competition if competitors can't use the 

24 data or if users aren't interested in moving.

 And, you know, I worked as a software 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

148 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 engineer at Yahoo! for about five years and I sort of 

2 got to see a little bit behind the scenes of what data 

3 it takes to actually build products, and that's what 

4 really got me interested in this area. And so, yeah, 

I look forward to talking more with the other folks 

6 here about sort of how we can architect data 

7 portability in order to see this sort of successful 

8 experiment. 

9 MR. QUILLIAN: Great. Thank you, Gabriel.

 Pam, what about you? What are the goals of 

11 data portability from your perspective and why is it 

12 important to the World Privacy Forum? 

13 MS. DIXON: Sure. So for us it's really --

14 data portability is something that effectuates data 

autonomy for consumers, and that's an incredibly 

16 important thing. Of course, we saw this really take 

17 hold when the GDPR went into effect. And there have 

18 been some interesting results from that. 

19 But our interest in data portability, beyond 

just the autonomy aspects, is also some of the privacy 

21 risks. And we'd really like to see some changes in 

22 some of the areas, particularly around health data. 

23 And I'd like to talk more about that later. But for 

24 now let's just earmark that as a definite privacy risk 

with data portability. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

149 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Also, we're very interested in the identity 

2 ecosystems that are being built up, and in some cases, 

3 identity silos that are being built up in order to 

4 authenticate individuals who want to port their data. 

So these are both very interesting privacy issues. 

6 I do think that there are solutions, and 

7 it's very clear that there are solutions. It's just 

8 that they're not always implemented at this point. 

9 Thanks, Ryan.

 MS. QUILLIAN: Thank you, Pam. 

11 Hodan, why don’t you give -- what do you 

12 view as the goals of data portability and what is the 

13 Center for Data Innovation’s interest in this issue? 

14 MS. OMAAR: Thanks very much, Ryan, and 

thanks to the FTC for having me. I think the goals of 

16 data portability, in addition to the pro-competitive 

17 market efficiencies and access goals that Gabe talked 

18 about, is also an opportunity to create innovation 

19 opportunities that kind of help create new products 

and new services. 

21 So we know what the issue is. We know that 

22 some companies unfairly restrict access to data, but 

23 data portability can kind of tackle this by creating 

24 evidence, where there is evidence-based problems, 

where it can identify that it can create solutions 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

150 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 that are sector-specific, and really where it can 

2 balance the costs of data portability regimes against 

3 the benefits to overall consumer welfare. 

4 And I think where it can create competition 

and empower consumers is really speaking to the 

6 competition goal. But, also, where it's able to move 

7 firms and the economy at large away from how can we 

8 collect data and how can we store it to how can we use 

9 it and how can we analyze it, really speaks to that 

innovation goal. 

11 And the Center for Data Innovation is 

12 concerned with how data can be used to benefit 

13 consumers, increase consumer welfare, and help the 

14 economy and society at large. And that's really where 

I think our interest in data portability and this 

16 issue really comes into play. 

17 MR. QUILLIAN: Great. Thank you, Hodan. 

18 Peter, I enjoyed your introductory overview 

19 this morning. It was very comprehensive. But is 

there anything you would like to add at this point 

21 about how we should view the goals of data 

22 portability? 

23 I think you're on mute, Peter. 

24 MR. SWIRE: Sorry. I have four very, very 

quick points. The first is there's a goal of 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

151 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 research. If we move data to different places there 

2 might be various kinds of research that work better 

3 than we did before. And that could be data from the 

4 public or private sector.

 The second is, as one of the goals around 

6 competition, all of the case studies turned out to 

7 have an aspect of lock-in about it so that if 

8 everything is unlocked and open, you don't have to 

9 write a law to open up the windows. But if there's a 

lock of some sort, that's when mandates to open up 

11 things tend to be important. And so for competition 

12 goals, looking for lock-in turned out to be more 

13 important than I would have thought before we looked 

14 at the case studies.

 The third point is I don't think we’ve heard 

16 the word "multihoming" yet today, and it’s a word that 

17 comes up often in these portability discussions. 

18 That's the idea where maybe you're using the first 

19 service and you like it, but you start to like to also 

use the second service or the third service. You 

21 don't have to leave the first service. Portability 

22 might let you do some things on the first service and 

23 do some other things you like on the second or third 

24 service. And one way you get competition and 

innovation is if people start to have multiple places 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

152 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 they call home and not just one place they call home. 

2 And the last point for the goal for having a 

3 data portability regime is to try to figure out when 

4 somebody says security and privacy, is it a pretext or 

is it real? So I think we've heard in the UK, in a 

6 banking context, the antitrust officials were thinking 

7 that maybe the banks were using cybersecurity as an 

8 excuse or pretext not to do Interoperability, and then 

9 with some hard work, they were able to build 

intraoperability. And interestingly today, the 

11 regulators said there have been no material security 

12 incidents. 

13 So having a way to detect what’s a pretext, 

14 what’s a good reason to be careful for privacy and 

security, might help us decide when the best 

16 opportunities are for having portability. Thanks. 

17 MR. QUILLIAN: That's really interesting. 

18 Thank you, Peter. And let's go a little deeper into 

19 some of these issues surrounding data portability and 

how it may affect competition. 

21 Ali, can you give a sense of how consumers 

22 are using the data they download through Takeout or 

23 port or download from the Data Transfer Project? And 

24 as you’re going through, if you could include a 

description of the categories of data that consumers 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

153 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 have access to and those that they do not, that would 

2 be really helpful. 

3 MS. LANGE: Yeah, happy to. So as I 

4 mentioned, Google Takeout currently allows users to 

explore a copy of their data from over 70 Google 

6 products. After users do that, we obviously have no 

7 visibility into what happens next, and so periodically 

8 we’ll ask people through surveys, you know, what 

9 they're planning to do with this data. And that's 

really our core insight into how data is used. This 

11 is a difference between data that's being downloaded 

12 and re-uploaded or downloaded for another purpose 

13 compared to data that you might transfer directly. So 

14 I just wanted to give some background on kind of how 

we have some of this information. 

16 So those 70 products include a lot of 

17 products where users are storing data in their 

18 account, things you would think of like emails, 

19 documents, photos, everything like that. And that 

also includes things like search history, YouTube 

21 watch history, other things you can see in your Google 

22 account that you can download a copy of if you wanted 

23 to explore them or move them to another service or use 

24 them for some other purpose, for some research purpose 

or otherwise, which we’ve seen folks sort of do some 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

154 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 research on their own browser history or things like 

2 that, which has been really cool. 

3 But basically, since launching Takeout in 

4 2011, which was the second iteration, a second 

iteration of our portability tool in general, Google 

6 users have exported more than an exabyte of data from 

7 Google products, which is a lot, a lot of data. Part 

8 of that is because some of the more popular products 

9 for folks to download are actually photos, which are 

bigger file sizes. So -- but an exabyte, it is a 

11 significant amount of data for people to download. 

12 And, actually, right now, there is currently 

13 an average of about 2.25 million exports a month, and 

14 over 200 billion files were exported in 2019. So 

there’s a lot of different ways you can count, you 

16 know, what’s being moved, how is it being moved, and 

17 that gives you a sense of, like, the volume of the 

18 data in total as well as sort of the frequency of 

19 using the tool and how many files there are, which is 

a pretty good spread of information. So it’s very 

21 popular. Folks are definitely taking advantage of the 

22 service that we provide. 

23 Takeout is part of the Google account, which 

24 is linked directly from basically every single one of 

our products, so if anybody is on Chrome right now, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

155 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 you might see a little icon in the corner with a 

2 letter of your name or a picture. If you click on 

3 that, you can easily get to your Google account, and 

4 in your Google account, you'll find Takeout, as well 

as any other services you need to manage the data 

6 that's in there. So we're sort of moving it as 

7 proximal as we can, your account, to the services that 

8 you're using with Google to make it easy to access 

9 that and use it.

 So as I mentioned, we do sometimes take 

11 these surveys, what are people planning to do with 

12 this data that they download their Takeout. Actually, 

13 we’ve found a wide variety of use cases that 

14 portability supports, all of which have been 

referenced already on this call, and, in particular, I 

16 heard a reference on the regulatory call from Mr. -- I 

17 can’t remember his last name, I’m sorry, from India, 

18 who referenced the idea folks are downloading a copy 

19 of their data, which I think is a really good way to 

describe it, right? They might not be trying to leave 

21 a service or switch a service. They might be trying 

22 to do something new, which is also the concept Peter 

23 just referenced and the idea of multihoming. 

24 So when we’ve seen folks downloading data, 

sometimes they’re downloading data from an individual 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

156 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 product because they do want to try a new feature on a 

2 different product. Photos is a really good example of 

3 this. People will download photos, they might want to 

4 upload it to a different service that offers a 

different kind of functionality, they might want to 

6 share it with a different person, they might just want 

7 to have a copy. So that's another place where we 

8 really put a lot of effort into enabling that direct 

9 transfer, probably because those are fairly 

considerable file sizes, and we know it's a common use 

11 case for people, so we want to make it as easy as 

12 possible. 

13 So we actually recently just implemented 

14 some new features in the fall that allow users to 

directly export their photos to Flickr and OneDrive, 

16 in addition to Dropbox and Box. So we have a pretty 

17 robust set of places folks can move their photos. 

18 Users also sometimes want to download their 

19 data to create a backup. They just want to have a 

copy on their local device. If they want to -- they 

21 feel better having a copy around. That’s a use case 

22 we hear reported. And sometimes folks are exploring 

23 the data that's in their account, something we see 

24 periodically reported through blogs or the news or 

things folks are curious what’s in their account. It 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

157 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 allows them to make changes to their settings and do 

2 some adjustments where they feel they want to make any 

3 changes to what’s stored there. 

4 You had also asked about what we've seen 

through the Data Transfer Project. Since the July 

6 2018 sort of announcement and launch of the project, 

7 in addition to significant investment in the open 

8 source protocols sort of in the GitHub repository, 

9 several of the partners have launched product features 

that are powered by DTP. So, as I mentioned, last 

11 fall, for example, Google announced -- I’m sorry, 

12 launched a new feature that enables you to move your 

13 photo library directly to Flickr or Microsoft 

14 OneDrive. And this includes album selection. So it 

can be individual photos, all your photos or specific 

16 albums. 

17 Facebook also recently had some new 

18 announcements enabling users to move their photos 

19 directly to new services. So they had offered Google 

previously in the year and now they’ve added Dropbox 

21 and -- I'm sorry, I’m going to say this wrong, but I 

22 think it's Koofr, which is a European cloud storage 

23 company. So Facebook has some good features that 

24 they've offered as well through data transfer.

 Twitter and Apple are sort of testing and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

158 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 building and planning to roll things out in the near 

2 future. And Microsoft has released an open source 

3 log-viewing tool for Office 365 enterprise customers 

4 that’s built on DPT technology.

 So basically in addition to all of that 

6 work, one of the things that the Data Transfer 

7 partners are doing is trying to build awareness of 

8 the product and sort of encourage more folks to 

9 participate, to greater facilitate those involvements.

 So, for example, Google has presented a demo 

11 of MyData even as far back as 2018, showing how you 

12 can move cat photos between two services, sort of a 

13 classic internet participation process. 

14 So, again, DTP is an open source project. 

Anyone can establish a usable format or translate from 

16 existing ones and they’ll immediately become available 

17 for everybody. So we're expecting to see a lot more 

18 development on DTP in the coming months. But those 

19 are the current implementations and those are some of 

the things that we've seen on Google Takeout as far as 

21 what folks are interested in doing and the best way to 

22 make that -- sort of facilitate that for them to make 

23 it work. 

24 MR. QUILLIAN: Great.

 Hodan, the comment submitted by the Center 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

159 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 for Data Innovation notes that data portability can 

2 increase market efficiency, but in some cases, it will 

3 not encourage competitors to create more innovative 

4 products. Can you expound on those concepts? And in 

particular, are there particular market dynamics or 

6 types of data that would lend themselves toward 

7 increasing market efficiency? 

8 MS. OMAAR: I think markets are most 

9 efficient when consumers are best informed, when 

markets are most transparent and when firms are best 

11 able to innovate with data. But the issue is, in some 

12 sectors, the incentives of who holds the data and the 

13 incentives of the data subject can differ greatly. 

14 So today we talked about utility data, and 

so -- and because of the kind of economic models, 

16 utility providers can want to reduce overall energy 

17 consumption to save money. And, for me, that's great. 

18 I, too, want to lower my energy consumption to save 

19 money, so our incentives are aligned. But in other 

cases, like we heard in the last panel, in finance and 

21 in healthcare, those incentives can be really 

22 different, and the greater the discrepancy between 

23 incentives and the greater the need for data 

24 portability.

 So I think where we can make data available, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

160 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 that kind of works toward the market dynamics we want 

2 to see. So more market transparency, more informed 

3 consumers, and like Peter said, where we can have 

4 multiple economic agents using the same data rather 

than having to replicate it, we will move toward 

6 overall market efficiency. 

7 And I think that's a more useful framework 

8 to think about what types of data might help market 

9 efficiency, rather than kind of creating an exhaustive 

list of all the different data types and the 

11 variabilities within those data types. Because data 

12 is -- data isn’t like any other economic asset. It 

13 doesn’t have value in and of itself. Its value really 

14 comes from the context in which it's being used.

 So I think where we can kind of balance how 

16 data is being used to improve those three things --

17 market transparency to help promote competition, to 

18 fuel choice engines for consumers so that they can 

19 make the optimal choice for them, and to help firms 

really focus on using data rather than storing it and 

21 collecting it -- will help us kind of move toward 

22 overall market efficiency. 

23 MR. QUILLIAN: Great. Thanks, Hodan. 

24 And, Gabriel, building on that, from a 

competitive perspective is the data that consumers can 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

161 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 download or port under the existing data portability 

2 initiatives, is that data competitively significant? 

3 Like, in other words, could a competitor use the data 

4 that consumers port to develop products that compete 

with existing companies? 

6 MR. NICHOLAS: Yeah. So I think it’s a 

7 great question. And I think it is -- as Hodan was 

8 saying, it’s not necessarily the same answer in every 

9 sector. But we do see a number of sectors, including 

finance, including agriculture, as one of the FTC 

11 comments talks about; auto dealers per Peter Swire’s 

12 work, where there are a lot of places that they’re 

13 feeling like they are not getting enough data to 

14 actually build competitors or to lower the switching 

costs in the way that data portability promises. 

16 And at NYU I’ve done some research on this 

17 case in social media where we looked at Facebook 

18 Download Your Information data and we gave it to 

19 developers and product managers and other people that 

we would expect to compete with Facebook and said, 

21 what can you do with this information? Are you able 

22 to use it to build products? And in general the 

23 answer was, no, because there were certain 

24 shortcomings in the data. And some of these I think 

are -- there are shortcomings that could be addressed 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

162 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 in a way that would be be useful across sectors. 

2 Right? 

3 So some really basic things such as 

4 documentation describing what data users can expect in 

-- when they port. And, you know, the structure of 

6 that data; versioning, you know, so that companies 

7 can't change the way that their data portability 

8 regime looks without expecting; encrypted versions of 

9 unique identifiers so that, you know, you can tell 

when it's the same person or same entity across ports. 

11 And I think in a similar vein going off of 

12 what Ali was talking about before, it’s also important 

13 for users moving their data to have a smooth 

14 experience, which I think a lot of places right now 

isn't necessarily that. It is the antiquated 

16 “download your data, upload it somewhere else” model. 

17 And I think shifting toward the direct transfer model 

18 is another area that could really help sort of make 

19 this data actually more competitively significant.

 MR. QUILLIAN: Great. Thank you, Gabriel. 

21 So, Peter, we've heard a fair amount today 

22 about some potential tension between the goals of 

23 privacy and competition in the context of data 

24 portability. I was just hoping, if you could expound 

on that a little bit from your perspective and give us 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

163 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 a sense of what is that tension and can it be 

2 resolved? 

3 MR. SWIRE: Well, on cybersecurity the 

4 case study suggested three areas to look at. The 

first, which we've heard a lot about today, is 

6 authentication. Who is going to get access to the 

7 health data? And I think Pam is nodding her head in 

8 part because the authentication in the health care 

9 system is not very good right now. And so somebody 

might be able to fake and get into someone else's 

11 data. 

12 The second area for security is security in 

13 transit. And I think there's a norm emerging that it 

14 should be encrypted when it goes from point A to point 

B. The trick is whether you do screen scraping or you 

16 do API, application programming interfaces. And 

17 there's been some vague calls on some of the regimes 

18 for open APIs, but actually getting everybody to 

19 connect to everybody faces the problems that Ali 

talked about, the 90 connections even if there's just 

21 10 companies. So how to have standards for security 

22 in transit. 

23 And the third area for security is you're 

24 going to need to have pretty effective standards. It 

sounds like a lot of lines of code in GitHub for DTP, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

164 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 and these standards will have security and privacy 

2 components to what the standards are, who gets to see 

3 what, who has what access privileges, et cetera. 

4 So those are three areas for security, 

authentication, security in transit, and standards, 

6 having the right stuff built in that really have to be 

7 built, and you're probably going to need quite a bunch 

8 of engineers and technical people to do that. 

9 On privacy, the biggest risks -- well, the 

categories in my outline of questions are what's going 

11 to happen to identify data? What’s going to happen to 

12 deidentify data because of data transfers and bulk 

13 deidentify? People might be able to figure out who it 

14 is.

 There's a big issue about privacy issues 

16 about other people. So if I have a picture that I 

17 want to transfer and the picture is of a 10-year-old 

18 kid of some other family, do I have to get the 

19 parents’ permission before I transfer the data? So 

those are some of the privacy issues. 

21 And then the last one I'll say is what was 

22 mentioned earlier about onward transfers, which is it 

23 goes from sending company to the receiving company, 

24 and then it can go to other places, the fourth and 

fifth place. And what the rules are going to be for 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

165 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 that, does there have to be new consumer consent? 

2 Does there have to be some visibility of that for the 

3 consumer? The rules for onward transfer can make it a 

4 lot more complicated. And if you’re really going to 

try to clamp down on the privacy and security risks, 

6 you’re probably going to have to give some attention 

7 to onward transfer. Thanks. 

8 MR. QUILLIAN: Thanks, Peter. Pam, I mean, 

9 I’d love to get your thoughts on onward transfer as 

well. But in addition to that, you know, data 

11 portability has been presented as a consumer right and 

12 it becomes easier to transfer that information. Is 

13 there a risk that consumers will share too much of 

14 their own data? And, similarly, are there cases in 

which security or privacy risks might arise after the 

16 transfer to the data recipient kind of along the lines 

17 of what Peter was describing? 

18 MS. DIXON: I'll try to bundle all of this 

19 up. So, again, there are benefits to data 

portability, and I don't want to discount that. But I 

21 do have to state that there are some very significant 

22 risks, particularly in the health care sector. 

23 So, there are short-term risks but there are 

24 very significant long-term risks as well. To just 

start with the short-term risks right off the bat --

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

166 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 and I think Peter may have alluded to this -- let's 

2 say you're signed into a health care portal and you’re 

3 looking at your record. 

4 Most portals assume you're authenticated and 

it's a one-click transfer. Meanwhile, when you go to 

6 make that transfer of your health data out of your 

7 healthcare portal, I've personally not yet seen a 

8 notice that explains to a patient that their data is 

9 changing from a HIPAA-protected regulatory structure 

to a completely different regulatory structure, which 

11 may mean none at all. It may -- it gets really 

12 complex depending on where you’re transferring it to. 

13 But not every transfer of patient data -- in fact, I 

14 would wager that the majority of them are not 

necessarily going to another health care provider. A 

16 lot of people are transferring data for COVID 

17 research. But they didn't know that they were 

18 actually creating a situation where their entire 

19 health record was then going because that's what they 

transferred. 

21 And there's such direct transfer that is 

22 frictionless within the health care context. It's 

23 literally like a one-click. So it's really important 

24 to consider something, and that is this: HIPAA does 

confer affirmative rights to patients. For example, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

167 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 you will have the affirmative right to request 

2 something called an accounting of disclosure; who’s 

3 seen your record. There are limits, but it’s still 

4 important. You have the right to restrict disclosure 

of your records in some instances. If there's a 

6 subpoena for your records, you will be notified so you 

7 can quash that subpoena. 

8 None of that happens when you allow your 

9 records affirmatively by that click to go outside of 

the HIPAA context. And I think that the number of 

11 patients who know this and truly understand the 

12 consequences of this action are far and few between. 

13 Maybe health care attorneys and privacy geeks, but 

14 that's -- that would be the limit of it.

 And then we get to long-term consequences, 

16 which several of the panelists have alluded to, which 

17 is the onward transfer problem. So, first off, what 

18 we're seeing is that some people unfortunately 

19 transfer their data to fraudsters and then are subject 

to absolutely heinous situations that arise from that, 

21 all sorts and manners of the worst kinds of identity 

22 theft you can think of. But the other problem is a 

23 little bit less onerous but has a long tail, which is 

24 data transfers to data brokers that are posing as a 

health care researcher or doing market research and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

168 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 calling themselves research, health research. Well 

2 they don't say that it's for marketing purposes. 

3 But, you see, there's no rules around this 

4 yet. And as a result it's a bit of the wild west. 

And unfortunately when that data healthcare file, a 

6 medical file, is transferred outside of HIPAA, it's 

7 free and clear. No further regulations apply to it, 

8 save for perhaps a privacy policy that’s posted on the 

9 website, which would then bring that health care file 

under FTC Act Section 5 or perhaps under no regulation 

11 at all. 

12 So right now one of the things we're seeing 

13 are brand new data sets since the rules took effect 

14 this year that are just loaded with new health data. 

So health data is on the market now. And once this 

16 data escapes the HIPAA-protected system, it's a very, 

17 very big challenge to try to reign that back in. 

18 Now, all of that being said, there are some 

19 very good instances of people acquiring data for 

legitimate purposes. They're very clear. That 

21 exists. But we're kind of focused on the risks and 

22 mitigating those risks. So, there you go. 

23 MR. QUILLIAN: Thanks, Pam. And as kind of 

24 a followup, the data that's covered by HIPAA is at 

least covered by a sector-specific data privacy 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

169 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 regime. What’s your view of efforts to set up 

2 portability rights more broadly outside the context of 

3 the universal privacy framework? 

4 MS. DIXON: Yeah, that's a really great 

question. So, as we all know, the U.S. has a sectoral 

6 privacy regime. So what ends up happening is you'll 

7 have, you know, financial privacy regulation like 

8 Gramm-Leach-Bliley or the FCRA, Fair Credit Reporting 

9 Act. Then over here you'll have HIPAA and so on and 

so forth. For education privacy, it's the Family 

11 Educational Rights and Privacy Act. But in between 

12 those areas are significant gaps in coverage, and 

13 that's where things get really, really difficult 

14 because the moment that -- especially health data 

leaves the sectoral protections, those protections do 

16 not attach to the data. They attach to the healthcare 

17 provider only. And I do think that if there were an 

18 omnibus situation then it would be much more like 

19 Europe, where the protections travel along and there 

are fewer gaps. It's not perfect, but the gaps are 

21 further apart and much fewer. 

22 MR. QUILLIAN: Thanks, Pam. 

23 Peter, you covered this a little bit earlier 

24 but I was wondering, based on your experience, what 

are the greatest data-security-related risks from 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

170 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 portability? 

2 MR. SWIRE: I tried to answer that in terms 

3 of authentication, security and transit and having the 

4 standards with good security and privacy practices 

built in. Maybe I can just quickly follow up on 

6 something Pam was saying about the comparison with 

7 Europe and the United States. 

8 In Europe, there are these general rules in 

9 the background. So if it went from a health provider 

who might be under stricter rules to someone else, 

11 there’s still GDPR in place. In the United States, if 

12 it goes from a HIPAA entity relatively strict to some 

13 other entity outside of the sector, maybe the FTC can 

14 enforce for deceptive practices, but in practice 

there's a much lower level of requirement. And so the 

16 risks to privacy when you don't have a national law 

17 are higher when it goes out of the sector by sector. 

18 And then the one other point is even in 

19 Europe where they have the general background privacy 

rules, when they were doing their open banking and 

21 payment services rules, the lead privacy supervisor, 

22 Giovanni Buttarelli, believed that for each sector it 

23 was important to have sector-specific laws that went 

24 beyond it.

 And so even in Europe with the back-end 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

171 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 privacy rules, the privacy experts thought there 

2 needed to be some sector-specific protections. So I 

3 think as it moves from one sector to another from a 

4 regulated entity to another, that really deserves a 

lot of attention in any overall policy decisions the 

6 FTC looks at. 

7 MR. QUILLIAN: Thanks, Peter. 

8 Gabriel, what would a data portability 

9 regime that facilitates competition by reducing 

barriers to entry, by example reducing switching 

11 costs, helping overcome network effects, reducing 

12 lock-in, et cetera, what would that actually look like 

13 in practice? 

14 MR. NICHOLAS: Yeah. So, I think to your 

question, it's important that if data -- the approach 

16 to data portability is hoping to improve competition 

17 that I think it not just focus on user lock-in, 

18 because user lock-in is just one of many effects of 

19 this going on that make competition difficult in the 

tech sector. 

21 And one of those -- and an important one, I 

22 think, is network effects that -- and I think there 

23 are ways that data portability can also help network 

24 effects. So, for example, there's the idea of group 

portability or collective portability wherein users 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

172 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 who share data might want to move all of their data 

2 together to another platform. And that sort of helps 

3 mitigate the empty platform idea of like, well, you 

4 don't want to go to a platform where nobody is. And 

you don't necessarily -- in some cases you don't want 

6 to go to a platform where you don't know anyone. 

7 And so allowing, say, you know, in the 

8 social example a group of friends who are all 

9 messaging on Viber wants to move to WhatsApp, by 

giving them a mechanism to all opt into that and to 

11 allow them to move the data that they share together, 

12 I think can make sure that data doesn't fall into the 

13 gaps. You know, right now in a lot of portability 

14 regimes when you download a conversation that you have 

with someone, you only get your side of the 

16 conversation, which isn't particularly useful. And 

17 the other person only gets their side of the 

18 conversation. And even if you uploaded them together, 

19 there can be insufficient data, data that falls in the 

cracks, that prevents that whole conversation from 

21 actually being rebuilt. So I think collective 

22 portability is a way to address that. 

23 I also think that there are -- it's 

24 important to be careful with the way that we address 

switching costs, because there are -- as someone in 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

173 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 the first panel mentioned, there are ways that 

2 lowering switching costs could end up harming 

3 competition. And I think this is really important 

4 when we think about data portability reciprocity, or, 

you know, if you import data from elsewhere, do you 

6 also have to make your data exportable? 

7 And this is very tricky question, but there 

8 are some places where that might actually prevent 

9 competitors from using ported data. So there's the 

example of -- let's take the example of Salesforce, 

11 right, which is the dominant customer relationship 

12 management -- the customer relationship management 

13 platform. So, you know, they have very strong network 

14 effects. They have a lot of customers and, you know, 

they’re very difficult to compete with. 

16 Now, smaller places can really only compete 

17 on price. They have to offer a lower price for a CRM 

18 that does not as much enjoy network effects and does 

19 not have as many users on it. And currently switching 

costs for CRMs are high. You have to either pay a 

21 consultant to do it or buy an expensive tool to move 

22 the data over, and these high switching costs make 

23 sure that the small CRMs have a little bit of room to 

24 grow that they can enjoy some of their own network 

effects. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

174 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 And there is precedence for dealing with 

2 this in the law. So the Access Act has this, which 

3 was the proposed portability law that placed a monthly 

4 active user count. And I think there's a number of 

ways that really should be looked at to make sure that 

6 data is flowing in the direction that we're interested 

7 in it flowing. 

8 MR. QUILLIAN: Thanks, Gabriel. 

9 Pam, do you have any thoughts on that topic? 

 MS. DIXON: Yeah. Just, you know, Gabe, I 

11 might have to call you and talk with you about this 

12 more. I had a thought, and I just realized something 

13 listening to you, which is this: The data portability 

14 types that we look at the most are data portability 

types wherein an entire very data-rich file is 

16 transferred all in one lump. 

17 So, for example, financial reports that 

18 include a lot of rich data, and health files, which 

19 is, of course, reams of very rich data. So there's 

not this, you know, multidimensional, multiperson 

21 aspect to this data. It doesn't have to be 

22 reconstituted in order to have a lot of value to 

23 multiple types of actors. So I do think that that is 

24 an important distinguishing characteristic, and 

perhaps a point of risk that can be addressed by 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

175 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 rules, whereas if you have a complete file type that's 

2 very rich, what are the rules and notifications, et 

3 cetera, that need to be involved with that data type. 

4 Thanks, Ryan.

 MR. QUILLIAN: Thanks, Pam. 

6 Hodan, did you want to add anything about 

7 the difference in jurisdictional laws or approaches? 

8 MS. OMAAR: Yes. So I just wanted to add on 

9 to what Pam said. I think when we think about what 

works in the EU and what will work in the U.S., we 

11 need to remember the real differences or just be 

12 cognizant of the differences in those sectors. So if 

13 we think about banking in Europe, the banking sector 

14 is a lot more concentrated than it is here in the U.S. 

And world bank data really supports that. And as 

16 someone who lives in the UK or lived in the UK and 

17 have just come to the U.S., you know, everyone I knew 

18 growing up, everyone is with one of six or seven --

19 you know, less than 10 banks.

 But here you go to different towns, you go 

21 to different places, everybody's with a different 

22 bank, a local bank. And so really the kind of rules 

23 that we enforce on sectors, how they work in the EU 

24 how they’re going to work in the U.S., has to have --

be really steeped in research and evidence-based, and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

176 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 we have to think about how that might actually -- just 

2 because somebody worked in the EU, it doesn't 

3 necessarily mean that economy-wide rules are going to 

4 be -- work here or that they’re going to help those 

smaller banks or just be effective overall. 

6 MR. QUILLIAN: Great. Thank you, Hodan. 

7 And we appreciate everybody who submitted 

8 questions to dataportability@ftc.gov. We have one 

9 question from the audience here for Peter. Going back 

to your concern about pretextual arguments against 

11 developing interoperability, is it possible to 

12 distinguish between pretextual arguments from one --

13 like, pretextual arguments from ones that arrive from 

14 privacy or security?

 MR. SWIRE: Thanks. To me, that was one of 

16 the big questions I tried to think about during my 

17 research. I love privacy and cybersecurity. I love 

18 having competition and innovation. And you see 

19 cybersecurity and privacy being made as an argument 

when it might be a pretext. 

21 So based on all the case studies, I'll tell 

22 a story from the automobile dealers case studies, and 

23 there’s litigation on this and I’ve been an expert 

24 witness in it, but I think I can describe it 

neutrally. So the claim has been from the automobile 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

177 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 dealers that they need to be able to get access to 

2 their own company's data and move it to a different 

3 supplier and have other software help. And the claim 

4 has been made by the companies who run the operating 

system that that would have terrible cybersecurity and 

6 privacy problems with it, especially the 

7 cybersecurity. And so that’s a fight. And there's 

8 facts about that. 

9 So after working through all the case 

studies, one way you might have a guess that it's a 

11 pretext is if the company that’s running things, that 

12 has the data, allows all sorts of transfers to itself 

13 and its affiliates on special terms that advantage it, 

14 but acts more strictly against outside groups. And 

that kind of discriminatory treatment might be a hint 

16 that it's not really worried about cybersecurity; that 

17 it's actually trying to get economic advantage. 

18 So in antitrust law there’s the idea of 

19 FRAND -- fair, reasonable and nondiscriminatory terms 

-- basically that you treat the outside and inside 

21 companies the same. And it turns out in a bunch of 

22 the portability laws that we have, including the HHS 

23 interoperability rule, including in the Arizona auto 

24 dealers rule, and I think there's two or three more, 

in Europe there’s some of them, all of them -- payment 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

178 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 services directive. There's an emerging standard that 

2 when the company is saying, no, I can't do it because 

3 of cybersecurity or privacy, there's an emerging 

4 standard that you can apply those FRAND approaches 

that is fair, reasonable and nondiscriminatory. 

6 And that gives at least a start to saying, 

7 this time it looks like they're doing it for their own 

8 advantage, or this time it looks like they have a bona 

9 fide cybersecurity point. So in my paper, which is up 

at SSRN, there’s a fairly long discussion about these 

11 FRAND kind of approaches. And I think that’s one hint 

12 about whether we trust the cybersecurity argument or 

13 not. 

14 MR. QUILLIAN: Thanks, Peter.

 So I'd like to turn now, since this workshop 

16 is a data-gathering and explanatory exercise, I’d like 

17 to get everybody's thoughts on research that's been 

18 helpful to them and things that still need to be done. 

19 So, Hodan, do you have any thoughts on the 

types of research that would help us better understand 

21 whether existing data portability requirements are 

22 benefitting consumers? 

23 MS. OMAAR: I think to better understand the 

24 extent to which data portability is helping consumers, 

we really need to understand how much these regimes 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

179 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 cost financially; how effective they actually are in 

2 specific sectors, and also the kind of risks 

3 associated with potential data breaches. 

4 ITIF, the Information Technology and 

Innovation Foundation, wrote a report called “Costs of 

6 Unnecessarily Stringent Federal Data Privacy Law” that 

7 estimated the total cost of data portability 

8 requirements for all U.S. organizations that handle 

9 personal data would be roughly around $510 million. 

Professor Graef’s work that we heard in the first 

11 panel, her work analyzing and comparing GDPR versus 

12 sector-specific data portability regimes, has also 

13 been really useful to me. 

14 And then finally Oxford University, James 

Pavur showed that confusion over data access 

16 requirements in the GDPR has led to significant 

17 security incidents with a substantial number of 

18 organizations responding to malicious data requests 

19 with approximately one in four turning over personally 

identifiable information. 

21 So I think if we can quantify the financial 

22 costs and qualify the kind of privacy and security 

23 issues and really balance this against kind of 

24 evidence-based, sector-specific benefits, then 

policymakers will be able to better kind of create 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

180 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 targeted specific data portability rules that kind of 

2 are successful in increasing consumer welfare. 

3 MR. QUILLIAN: Great. Thank you, Hodan. 

4 Ali, what research related to data 

portability have you found most helpful, and what do 

6 you think needs to be done to advance our 

7 understanding the benefits and risks related to it? 

8 MS. LANGE: Yeah, there's certainly a lot of 

9 good scholarship on potential benefits of portability. 

And big thanks to folks on this panel and across this 

11 workshop for all the work that they’ve done to really 

12 think through some of these issues and put pen to 

13 paper and describe things and sort of move the ball 

14 forward on how we think through portability. So I 

just want to acknowledge all that work already. 

16 One thing that's interesting hearing today's 

17 discussion is lot of the conversation is really 

18 focused on frameworks and kind of protocols and rules 

19 for the conceptualization of portability. From our 

point of view, I think it sort of -- and it makes 

21 sense because I think it feels like it should be a 

22 technically simple exercise. It certainly seems 

23 simpler than a lot of other things that our phone 

24 might do, which feel a little bit like magic.

 But from our point of view after a decade of 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

181 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 work on this, we found that portability is actually a 

2 pretty technical challenging puzzle. The favorite --

3 like the favorite kind that folks at Google like to 

4 solve. And so I would say that work doesn't need to 

be or shouldn't be discounted in the broader scheme of 

6 what work needs to be done. You know, it’s not the 

7 case that if you can just solve a framework question 

8 then everything else will fall into place without that 

9 effort.

 And so from our point of view in addition to 

11 that work and the actual technical engineering that 

12 we're sort of trying to advance with our partners in 

13 the Data Transfer Project or ourselves on our 

14 platform, there's a lot of judgment that needs to be 

made in decision-making throughout the process. So I 

16 guess the answer to your question from my point of 

17 view is to sort of think through other ways to help 

18 inform that decision-making, things about the use 

19 cases people care about, the portability actions they 

find useful, things that work as expected, what are 

21 expectations for people who are moving data; technical 

22 needs to make data portability practical so the work 

23 we're advancing through DTP. 

24 We welcome more folks to participate in that 

to help really move that ball forward, and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

182 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 fundamentally thinking through how do you keep this 

2 sustainable, right? Echoing back to some of Peter's 

3 points on the sort of N-squared problem, how do we 

4 think about things that scale successfully, how do we 

think about things that are useful for those folks? 

6 So I do think there's a pretty strong set of 

7 technical questions that can also merit attention. 

8 And this is one of the reasons why we really like the 

9 open source solution space for Data Transfer Project, 

is to create the space for folks to come and iterate 

11 and think through some of those questions, in addition 

12 to all the great policy work that’s being done by 

13 folks on this call and otherwise. 

14 MR. QUILLIAN: All right, Pam. Same 

question to you: What research has been most helpful 

16 and what do we need to do to advance the ball? 

17 MS. DIXON: Yeah. So I think that for me 

18 the research that I'm really looking at right now and 

19 that's been very helpful has been research around 

digital identity ecosystems and how they interact in 

21 regards to verifying and authenticating someone and 

22 identifying who they are. 

23 We're seeing the emergence of a lot of what 

24 I call strong identity. Strong identity requirements 

include biometrics. Now, that doesn't always occur, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

183 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 but we’re seeing more of it. So there’s a rich 

2 literature on tokenization versus requiring strong 

3 identity everywhere. There’s a rich literature that’s 

4 emerging on how identity ecosystems are working in 

this context. And I think that this is a very under6 researched area in terms of how it's working from the 

7 consumer's point of view. 

8 There's a lot of research on how it's 

9 working from the business entity that's attempting to 

either acquire or port the data. But from the 

11 consumer perspective, what identification mechanisms 

12 are going to be required of them and how good are 

13 they? What’s their quality? What’s their endurance? 

14 What are their -- what are the qualities of that type 

of identity? Is it a biometric? Is it something 

16 else? What is it? And what are the kinds of 

17 standards we want in place for that? 

18 So I do also think that the role of 

19 standards becomes very important here. And it can be 

technical standards as well as data typing standards, 

21 as well as other kinds of procedural standards. 

22 MR. QUILLIAN: All right. Gabriel, in 

23 addition to your own publications, what research 

24 related to data portability have you found most 

helpful, and what's coming next for what needs to be 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

184 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 done? 

2 MR. NICHOLAS: So I think there are three 

3 general -- so I do want to echo, I think that Pam and 

4 Hodan and Ali all bring up really great points that 

sort of do need additional research. So I’ll add 

6 three to that. 

7 One of them is I think there needs to be 

8 historical research on sort of analogs to portability. 

9 Peter has talked about before how mobile number 

portability, it gets used a lot, but it's sort of a 

11 bad example of what data portability looks like in the 

12 wild. I think there might be better examples out 

13 there. 

14 One that comes to mind is the ‘96 Telecoms 

Act and unbundling where that was an area where sort 

16 of per what Hodan was saying before that, you know, it 

17 wasn't able to lead to innovation because companies 

18 weren't able to differentiate their products enough or 

19 they weren’t able to compete on price.

 So I think there’s a lot of areas where 

21 there have been things similar to portability before 

22 that have succeeded or failed that could be brought 

23 into these conversations. 

24 A second thing I think is important is this 

question that's come up a lot in this panel of general 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

185 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 versus sectoral approaches. Is there any kind of data 

2 portability law that really is useful across sectors 

3 and should be implemented, and what are the kind of 

4 things that need to be thought about sectorally. And 

at NYU Law, we're hoping to put on a conference about 

6 this sort of thing, so if this is the kind of thing 

7 that interests you, please reach out to me over 

8 Twitter or email or otherwise. 

9 And a final topic that has not -- a sort of 

whole Pandora's box that we’ve not really opened is 

11 API portability versus one-off exports. I know that a 

12 number of comments discussed this where, you know, 

13 there’s this tradeoff of API portability can mean --

14 it can sort of increase the number of risks, it can 

increase the threat to the data-sending entity, but it 

16 can also open up a whole world of other products that 

17 could be built that couldn’t otherwise be built. 

18 So I think there's a million questions 

19 around those things, around API portability versus 

one-off exports that need to be sorted out, and it's 

21 really an exciting area that’s a wide open space for a 

22 lot of research. 

23 MR. QUILLIAN: Great. Thanks, Gabriel. 

24 And, Peter, to wrap up, same question to 

you. What’s been good and what needs to happen? 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

186 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 MR. SWIRE: Well, first I want to say 

2 briefly why it's a hard problem. In a lot of ways 

3 it’s when you open up data flows and when do you close 

4 data flows in a database society. And that’s one 

reason that the issues sort of spread out all over the 

6 place, and I think the FTC will have to figure out how 

7 to cabin in some way in order to have its best 

8 recommendations going forward. 

9 I’ll mention three areas of research. One 

is a plug for Gabe’s work on group or collective 

11 portability. I had never heard of it or thought of it 

12 until he wrote his article last year about it. And so 

13 if you’re a set of people who like bird feeders, you 

14 know, and you want to move your comments from one 

place to another, how can you scale it so the groups 

16 can move to different services or competing services. 

17 A second is there’s been work done by 

18 Professor Inge Graef, who was on the first panel, and 

19 others about other case studies, after-markets for 

cars in the European Union; electric utility 

21 portability in Australia and the UK and the EU. And 

22 so keeping -- learning from the case study so you're 

23 not just off in theory land but you have some real 

24 examples.

 And the third one -- and I think the area 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

187 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 for the most work, and sometimes it seems like the 

2 least glamorous work, is how to do the standards, the 

3 technical standards. We’ve had several people mention 

4 how much hard work it is, whether it’s on APIs, open 

APIs, or having a clearinghouse kind of structure like 

6 DTP has, how to do the data formats so that people in 

7 healthcare are transferring the right stuff and not 

8 everything like a fire hose. 

9 I think there's a lot more work to be done 

by the technical people, by the patience of working on 

11 the standards, and might be 60 or 80 or 90 percent of 

12 the work that has to get done. And policy people 

13 never want to go into a standards conversation. I've 

14 had horrible experiences in standards processes with 

do not track. But that’s where the portability that 

16 will happen or won’t happen, and so a much bigger 

17 fraction of the work should be how do we get the 

18 standards in place for secure and effective transfer, 

19 even though nobody’s going to want to do it.

 MR. QUILLIAN: Thanks, Peter. 

21 So we have a question from the audience, and 

22 I will ask Pam to lead off here. Have you looked at 

23 the way that individuals can play a part in enabling 

24 the market and ensuring the fair exchange of value for 

the use of their data, calling out misuse, supported 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

188 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 by tools that enable and empower them as active 

2 participants in the ecosystem? 

3 MS. DIXON: So if I could ask the person 

4 asking the question a little bit more, clarifying 

about their question, but I'm going to take two 

6 different stabs at it very briefly. 

7 So, first, I mean, when you're dealing with 

8 data portability and you're pulling data, this goes 

9 back to something that's come up on this panel several 

times, which is sometimes this data is commingled. 

11 Additionally -- and that's with the data of other 

12 people that are, you know, on the platform with you, 

13 in group conversations or joint conversations, et 

14 cetera.

 But there's another complicating factor, 

16 which is whatever the platform or entity put into that 

17 data, there may be analytical information that's been 

18 added and so on and so forth. So at the end of the 

19 day, you can come up with a very complex analysis 

that, you know, there are a lot of people that own 

21 this data. So we have a paper that we workshopped at 

22 the Privacy Law Scholars Conference, Jane Winn and I, 

23 but we haven’t quite published it yet. We will this 

24 year.

 But the paper is really about common pooled 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

189 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 resources, a la Elinor Ostrom and the governance of 

2 the commons, and what do you do when there's a 

3 resource that is rivalrous, to use those terms, and it 

4 can be claimed by several different entities or 

individuals. What do you do? And there's a whole 

6 philosophy on what you do with that. 

7 But the thing that you don't do is claim 

8 that you own it. So there is that school of thought. 

9 And I do think that this has to be looked at very 

carefully. This is -- we're in an active research 

11 phase on this idea. But I think it's an important 

12 idea to consider, and let's see if it has merit in 

13 this context. We’re in the exploration phase. But I 

14 do think it's important to understand that it's very 

difficult to just say, oh, here's my health record; 

16 let me sell it to someone. I think that that can have 

17 just profoundly deleterious, unintended consequences 

18 if we start looking at monetizing your own data in 

19 that way, kind of turns into a Les Miserables where 

people are selling their teeth. So I just think we 

21 have to be very, very, very cautious in that area. 

22 And because I chatted so much, I think I'll 

23 stop there. It’s a great question, though. 

24 MR. QUILLIAN: Thanks.

 Gabe, did you have something you wanted to 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

190 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 add on this audience question? 

2 MR. NICHOLAS: Yeah. I just wanted to add 

3 that I think the way it currently is today, this is a 

4 really difficult process to do from the bottom up, 

because platforms really in many industries have a lot 

6 of control over the data that they make available. 

7 So I know that there’s the example of the 

8 Light Collective, which is a patient advocacy group 

9 that's interested in, you know, taking groups where, 

you know, it's like you take back a conversation or, 

11 you know, patient groups with diseases, where they’re 

12 sharing sensitive medical information. And Facebook 

13 has advertently or inadvertently monetized that data. 

14 And there are groups that want to be able to move off 

to another platform, but the data that’s made 

16 available to them is inefficient. It’s insufficient 

17 and there aren’t legal mechanisms to get the data that 

18 would be sufficient there. 

19 So I think this is a place where for those 

bottom-up initiatives to happen, there also needs to 

21 be legal support for those to happen. 

22 MR. QUILLIAN: Thanks, Gabe. 

23 Peter, you wanted to add something really 

24 quick?

 MR. SWIRE: Yeah. This is a -- the question 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

191 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 illustrates where there's tension between the 

2 antitrust outlook and the privacy outlook. So when 

3 you talk about individuals enabling the market, 

4 ensuring fair exchange of value for their data, for 

antitrust trained people it seems natural to want to 

6 get the market to move to allow transfers to have 

7 higher value. 

8 And as Pam said, and as many people in 

9 Europe have said, if you look at this as a privacy 

right that's going to be invaded and treated badly, 

11 there's a lot of people on the privacy side that are 

12 super skeptical of it. So the different discourses of 

13 antitrust people and privacy people are really far 

14 apart on this particular issue.

 MR. QUILLIAN: Great. 

16 Hodan? 

17 MS. OMAAR: So I just wanted to add 

18 something on a rather different point. But just while 

19 we have time in this forum, I just wanted to bring up 

that not all data is digitized, right? Some of it is 

21 analog, a lot of it is. And when we have very kind of 

22 strict data portability regimes that apply only to 

23 electronic data, we can create these sort of kind of 

24 perverse incentives that have companies wanting to 

avoid digitizing their data and in some sense actually 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

192 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 making lock-in problems even worse, and also dampening 

2 the kind of trends toward digitization. 

3 So as we think about what rules and regimes 

4 we want to kind of implement, that's something to 

think about. 

6 MR. QUILLIAN: Great. Thank you. And so 

7 we’ve got about five minutes left. So I have kind of 

8 a round-up question for each of you, maybe one or two 

9 minutes in response.

 We’ll start with you, Ali. So where do you 

11 see data portability moving or going in the next three 

12 to five years, and are there any concerns, you know, 

13 as we go in that direction or things that you think 

14 we need to address before we get there?

 MS. LANGE: Yeah, I mean, I think that the 

16 alignment toward more service-to-service portability 

17 is something I really see growing in the coming years. 

18 I think the reason for that is really fundamentally 

19 back to the core motivation for Google and the core 

insights that we’ve had throughout the process and I 

21 think that I’ve heard others on the panel echo, which 

22 is that making the design users to focus on what 

23 people want to do, making it useful for folks, making 

24 it practical both in terms of feature kind of 

expectations and in terms of, you know, the lighter 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

193 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 technical infrastructure placed on individuals and 

2 things like this. 

3 This all sort of merges toward a world in 

4 which I think we’ll see more kind of behind the scenes 

work done by the technical community, the open source 

6 community and others. 

7 I should say I'm speaking mostly from my own 

8 sector. I think the observations others have made 

9 about the healthcare sector and financial sectors, who 

have been more regulated than sort of slightly 

11 different sectors. I probably have less youthful 

12 insight into that work. But fundamentally where I see 

13 it going is really more toward focusing on user-center 

14 design, making things more usable, making things more 

practical for individuals to make decisions about 

16 trying new features or staying in control of their 

17 data in other ways. 

18 MR. QUILLIAN: Great, thanks. 

19 Gabriel, do you have thoughts on the next 

three to five years? 

21 MR. NICHOLAS: I guess I do and I don't, 

22 because, again, I just want to reiterate this feeling 

23 that, like, we don’t -- there are some sectors that 

24 have experimented around with data portability, but by 

and large we don't know its effectiveness at 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

194 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 introducing competition. 

2 And I hope that in the next couple years we 

3 will find out. You know, I think there's a little bit 

4 of a “if you build it, they will come” mentality, but 

in reality we'll build it, and we’ll hopefully build 

6 it as well as we can and hope they come. And so I'm 

7 definitely excited to see in the next couple of years 

8 what happens with data portability, what competitors 

9 end up building with it, what issues users run into 

it, and both how this policy adjusts to improve those 

11 ways that competitors are benefitting and add further 

12 user protections where those get trampled on. 

13 MR. QUILLIAN: Well, I certainly appreciate 

14 any “Field of Dreams” reference, so I appreciate you 

throwing that in there. 

16 Hodan, do you have any thoughts on what's 

17 coming up next and anything that needs to get 

18 corrected as we’re going in that direction? 

19 MS. OMAAR: Yes. So I think I’d just add on 

to what Gabe said and say I can say where I hope to 

21 see data portability go, which is kind of increasing 

22 that market efficiency by, you know, making markets 

23 more transparent, making consumers better informed, 

24 and helping firms really be able to use and analyze 

that data rather than spending so much time on kind of 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

195 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 collecting and storing it. 

2 MR. QUILLIAN: Great. Thanks, Hodan. 

3 Pam, what are your thoughts? 

4 MS. DIXON: Sure. I’d really love to see 

more standards work and more individuals involved with 

6 the standards work. Peter is right, people don't like 

7 doing standards, but they’re going to be the backbone 

8 of a lot of this. 

9 For example, there could be a standard and 

it wouldn’t take 15 years to develop, but there could 

11 be a standard for notifications in the healthcare 

12 sector prior to transfer out. And this would be 

13 fantastic and it would really solve some problems. 

14 And that’s the second thing I would say, is I really 

do think that we can reach out and get some very good 

16 low-hanging fruit that would help a lot of people 

17 fairly quickly. And I don't think it would be that 

18 difficult. I think there is some low-hanging fruit. 

19 There's some harder fruit and I think that has to do 

with the standards and also with the identity 

21 ecosystems. But I think that that will proceed. I 

22 would be surprised if it didn't. 

23 MR. QUILLIAN: And, Peter, let's stick with 

24 baseball, cleanup hitter, finish us off with the --

 MR. SWIRE: I’m batting fifth. Anyway, so 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

196 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 one thing to note is that data portability is popular. 

2 And there’s bills in Congress from both the Republican 

3 side and Democratic side, and both of them include 

4 data portability for comprehensive privacy legislation 

in the U.S. Most of the states who proposed laws in 

6 the last two years have had data portability in them. 

7 So it’s a hooray kind of term. People are in favor of 

8 portability from a lot of perspectives, so we should 

9 expect a lot more of that.

 The second thing, I hope in the next 

11 three to five years, is to build on what the FTC is 

12 doing today by bringing together different sectors --

13 health care, financial services, digital platforms. 

14 They don't talk to each other necessarily that much. 

People think their own world is the whole world 

16 because each of those worlds is very huge. 

17 Also, doing it cross nationally. We’ve 

18 talked about the EU today and Australia and others are 

19 doing it. So I think that if we can continue the 

learning process instead of thinking we're having to 

21 create it from scratch and learn from these different 

22 experiences and case studies that we're likely to have 

23 better ideas of how to do the next thing and meet some 

24 of Gabe's hopes for it actually being useful, and the 

rest of everybody's hopes for having privacy, security 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

197 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 and competition. 

2 So I think, you know -- I'm a professor. 

3 Further study will help. And I think this workshop is 

4 a very big step toward doing that.

 MR. QUILLIAN: Well, great. Well, in 

6 response I’d just like to thank all of you for 

7 participating today. I think this has been a really 

8 great discussion, in addition to the other panels, 

9 which I found really interesting. It's a complex 

topic and there's a lot more to do. So I appreciate 

11 your time and all your thoughts. 

12 We're going to take a short break now and 

13 reconvene at 1:30 Eastern for our final panel, which 

14 will focus on several key concerns confronting data 

portability initiatives: namely security, privacy, 

16 standardization and interoperability. So stay tuned 

17 and thanks, everybody. 

18 (Brief recess.) 

19 

21 

22 

23 

24 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

198 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 REALIZING DATA PORTABILITY’S POTENTIAL: 

2 MATERIAL CHALLENGES AND SOLUTIONS 

3 MR. BROWN: Welcome back. Thank you for 

4 joining us for our final panel of the day, Realizing 

Data Portability’s Potential: Material Challenges and 

6 its Solutions. 

7 My name is Jarad Brown. I’m an attorney in 

8 the Division of Privacy and Identity Protection. On 

9 this panel, we will further discuss some specific 

topics that have been raised throughout the day: 

11 privacy, security, standards and interoperability, as 

12 well as possible solutions. 

13 If we have time, I’ll try to incorporate any 

14 questions we receive from viewers. So please send any 

questions you have to dataportability@ftc.gov. 

16 I’d like to introduce my panelists. In the 

17 interest of time, I’m going to keep to very brief 

18 introductions, but I highly recommend you read their 

19 full bios on the event page to learn more about their 

impressive work. 

21 First is Erika Brown Lee. Erika is Senior 

22 Vice President and Assistant General Counsel at 

23 Mastercard, where she is the global lead for the 

24 company’s privacy advocacy efforts, including 

cybersecurity, and led the team that provides guidance 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

199 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 and ensures compliance with privacy and data 

2 protection laws across the company’s products and 

3 services. 

4 Next, we have Sara Collins. Sara Collins is 

Policy Counsel at Public Knowledge, focusing on 

6 privacy, data and platform accountability. Public 

7 Knowledge is a public interest advocacy organization 

8 with a mission to promote freedom of expression, an 

9 open internet and access to affordable communication 

tools and creative works. 

11 Next is Bennett Cyphers. Bennett is a staff 

12 technologist at the Electronic Frontier Foundation and 

13 works on the tech projects team. EFF is a nonprofit 

14 organization working to preserve and enhance civil 

liberties in the digital world, promoting privacy, 

16 free expression and innovation online through 

17 activism, technology, products, law and policy. 

18 Next is Michael Murray. Michael co-founded 

19 the Mission:data Coalition in 2013 and serves as its 

president. Mission:data advocates for data 

21 portability in the power sector in order to promote 

22 energy efficiency and reductions in carbon emissions. 

23 And, finally, last but not least, is Julian 

24 Ranger. Julian is Executive President and Founder 

of digi.me, a decentralized personal data solution 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

200 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 that is operational today. 

2 Thank you all for joining me today. 

3 Let's get right to it. We’ve got a lot of 

4 interesting topics to talk about.

 Sara, if I could ask you to get started. 

6 I’d like to talk about privacy first. And can you 

7 tell us a little bit about Public Knowledge’s work in 

8 the area of data portability, and then also kind of 

9 describe some of the privacy concerns data portability 

may present, in your opinion. 

11 MS. COLLINS: Thank you, Jarad, and thank 

12 you to the FTC for having me here today. So to think 

13 about data -- think about Public Knowledge as our work 

14 in data portability, it's important to think about our 

values, which is open access to the internet, free 

16 expression. So data portability for us is a mechanism 

17 to either promote consumer welfare, to improve 

18 competition in the tech space. So we look at data 

19 portability as a tool. It’s a means to get to an end 

we're looking for. 

21 So in that case, we want to make sure any 

22 data portability regime or scheme protects the privacy 

23 of users. We already know from privacy work -- I 

24 mean, if any of you have been following this in the 

day-to-day, that privacy harms are running rampant. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

201 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 We have seen loss of opportunity. We’ve seen -- we’ve 

2 seen economic harms. We’ve seen all sorts of harms 

3 arising from privacy violations. So when we evaluate 

4 data portability, we think about it in a sense of, 

one, is it giving consumers autonomy; and, two, does 

6 the scheme that's being proposed sufficiently protect 

7 privacy and sufficiently do that in a way where 

8 consumers can trust that when they share their data 

9 they’re only sharing it for the purpose of trying a 

new service or moving their data to a service that 

11 better meets their needs. 

12 MR. BROWN: Thank you, Sara. 

13 Erika, can I turn to you next? Could you 

14 talk about data portability at Mastercard and how are 

you thinking about privacy, both for existing data 

16 portability requirements you're under as well as 

17 future proposals? 

18 MS. BROWN LEE: Sure. And, thanks, Jarad, 

19 for putting this great panel together, and to the FTC 

for hosting a day on this important topic. So as a 

21 technology company and a payment network, Mastercard 

22 doesn't actually issue cards, credit cards. That's 

23 done by our customers, who are the banks. And we do 

24 have a product and take a very consumer-centric 

approach with respect to privacy and our practices. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

202 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 And so if I could start by just talking a 

2 little bit about those because they fit into our 

3 discussion. 

4 Last fall, we launched what we call the Data 

Responsibility Initiative, which is grounded in four 

6 principles. First, that consumers, individuals, own 

7 their own data. Second, that individuals control 

8 their data and have the right to understand how their 

9 data is used. Third, that individuals should benefit 

from the use of their data. And, fourth, really is 

11 from a security prospective in that individuals data 

12 should be protected and used responsibly. 

13 So data portability is really about, for us, 

14 we think about giving individuals more control over 

their data. And it's an important tool and a way in 

16 which that really makes sense with respect to the 

17 expectations that individuals have around their 

18 data. And ideally when it works data portability has 

19 that potential to not only open up possibilities for 

consumers, but to enable business innovation and 

21 competition. 

22 And so at Mastercard we have a consumer23 facing, public-facing portal that we call the My Data 

24 Portal where any individual can go to make a request 

to access their personal information and then receive 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

203 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 it in a portable form. 

2 In terms of just the current legal 

3 requirements, we've heard a lot today about the 

4 existing regimes, including GDPR and the CCPA, both of 

which have certain limitations with regard to scope in 

6 terms of, you know, what data portability applies to. 

7 And really with respect to those laws and 

8 any privacy laws, it requires companies to do a very 

9 deep assessment in terms of what the data they have is 

and how that data is maintained in order to be able to 

11 comply with privacy laws, but the difference with data 

12 portability law requirements is that technical aspect, 

13 because you have to do a sort of deep assessment from 

14 a technical prospective of how to make data available.

 With regard to future laws and some of the 

16 proposals that are on the table, you know, we see 

17 various legislatures across the globe contemplating 

18 different, you know, ways of addressing data 

19 portability. You know, they’re not necessarily 

homogeneous, though, and so there is that potential 

21 for divergence, which then would, you know, 

22 potentially affect the ability for companies to 

23 provide that data in a portable way. 

24 And this goes toward that point that we’ve 

heard about a lot today with interoperability, which 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

204 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 is the key to creating an environment that is 

2 compatible not just within an industry but across 

3 industries so that the principles that we see around 

4 data portability are consistently applied, even if 

there are sectoral differences. 

6 And then I’ll just wrap up by saying that as 

7 part of the conversation there should be consideration 

8 of the ethical factors in terms of how we think about 

9 data portability. And it’s not so much just whether 

you can but whether you should port the data. So I'll 

11 pause there. Thanks, Jarad. 

12 MR. BROWN: Thanks. 

13 Michael, if I could turn to you next, could 

14 you tell us a little bit about your background and 

work in energy sector data portability, and then how 

16 does privacy come up in that space? 

17 MR. MURRAY: Thank you, Jarad. And thanks 

18 to the FTC for holding this. This is a really great 

19 workshop today. So, Mission:data is a nonprofit 

coalition of about 30 technology companies that 

21 provide energy management services to homes and to 

22 businesses. Many of you may be familiar with the use 

23 cases around banking and healthcare that have been 

24 talked about so far today, but you may not be familiar 

with the use cases in the energy sector. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

205 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 So let me just give you a quick example. 

2 You may have heard about the blackouts that occurred 

3 in California about five or six weeks ago. There were 

4 some record-breaking temperatures that created a 

supply crunch; power went out for just about a couple 

6 of hours. And one of Mission:data’s member companies 

7 has turned energy conservation into a game that sort 

8 of directly helps keep the lights on in California. 

9 So if you save energy in your house, for an 

hour here or an hour there, you can earn points that 

11 were redeemable through the software application for 

12 cash or gift cards. And in aggregate, there were over 

13 100,000 households participating across the state. 

14 They delivered several hundred megawatts of demand 

reduction to the California wholesale power market and 

16 literally helped keep the lights on for millions of 

17 Americans. 

18 So the way that this works is that a demand 

19 response aggregator, as we call it, gets the 

customer's permission to share usage data that’s held 

21 by the electric utility. And once utility provides 

22 the usage data, the aggregators goes to the wholesale 

23 market and says, you know, energy usage across this 

24 fleet of homes, you know, was X, and then I 

intervened, and now it’s Y. And so that delta X minus 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

206 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Y is what you get paid for for delivery by the 

2 wholesale market. 

3 And so consumers win. They get a share of 

4 that revenue. Costly power plants don't need to be 

built, and we can use this demand flexibility to 

6 increase the amount of renewable energy sources on the 

7 grid. 

8 So data portability for me is really 

9 important among electric utilities because of 

climate change. I don’t know about you all, but we’ve 

11 been living in smoke out here on the west coast ever 

12 since Labor Day. It’s one of the warmest summer on 

13 record and unfortunately it’s probably going to be the 

14 coldest summer for the next 100 years. So this is 

something that really concerns me. 

16 And data portability is tricky in the 

17 electric sector because we have over 3,500 retail 

18 electric utilities. Some are regulated by states, 

19 some by municipalities and some by cooperative boards. 

It’s a diverse patchwork and it makes it very 

21 difficult to establish standards, whether we’re 

22 talking about API standards, informed consent 

23 standards or privacy standards. 

24 So as for privacy, I have always believed 

that I think you can be both pro-privacy and proFor The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

207 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 customer choice at the same time. Incumbents, the 

2 utilities in my case, often inflate the real privacy 

3 risks. And we heard a bit -- a little bit about this 

4 earlier in the day. Some privacy concerns are, of 

course, very legitimate, but others are exaggerated 

6 and I think serve some pretty nakedly anticompetitive 

7 purposes. With residential energy usage data, there 

8 are Fourth Amendment search issues when law 

9 enforcement is involved. We absolutely understand 

that. However, if a customer wants their information 

11 shared and it's opt-in, it's really untenable these 

12 days for a utility to say, you know, no, we're not 

13 going to allow that. And so the debate in the 

14 energy sector really hasn’t been should a customer be 

able to share his or her data, instead it’s about the 

16 method, about how that's accomplished both in terms of 

17 technical exchanges, API standards and most 

18 importantly the user experience issue and whether the 

19 user experience is -- you know, leads to fully 

informed consent. 

21 MR. BROWN: Thank you, Michael. 

22 Julian, if I could turn next to you, your 

23 company is a solution for porting data between 

24 numerous services. Could you tell us a little bit 

more about that and the other work you’ve done in this 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

208 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 area and then give us the thoughts about how you’re 

2 thinking about enabling data portability without 

3 undermining privacy. 

4 MR. RANGER: Certainly. So at digi.me, we 

use data portability today both explicit and implicit, 

6 because it's not everywhere. I’ll try and explain why 

7 and how. So the most important thing is that all of 

8 the future capabilities we as citizens, businesses, 

9 governments and society are looking for actually 

require us to share more data and better data as 

11 individuals, not less. We can’t do a lot of the 

12 future things without sharing more. So we have to 

13 find a way that's private, secure and consented. 

14 And an obvious example is precision or 

personalized medicine where I may need to share my 

16 health data since I was born, my advanced wearables, 

17 my genomics, the food I buy and eat, even my social 

18 data is a good indicator of my mental state. 

19 But how do I do that? I can't. How can 

anybody get their hands on that because it's all 

21 locked away in different data silos. And even then, 

22 how do I control it? And that's where we come in as 

23 what’s called a data facilitator, or my data operator, 

24 as your librarian and your postman, and to do that 

fully privately, fully securely and with consent. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

209 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 So we enable you to get a full copy of your 

2 data. And we’re just like an email program in many 

3 ways. You download an email program to your device, 

4 authenticate your 2-3-4 email channels and then a 

miracle happens, all your data is there. Well, it’s 

6 the same with digi.me. You download digi.me, you 

7 connect to your various sources of data, and we’ve got 

8 health and bank and wearables and media and social. 

9 You authenticate and then your digi.me gets a full 

copy of your data, normalizes it, and then you choose 

11 where to store it. So you choose. It’s all fully 

12 encrypted with your own encryption. So you actually 

13 end up with a full copy of your data. Nobody else has 

14 it. Nobody, not any of the big five, have as much 

data as you end up with yourself. And it’s 100 

16 percent private because only you have it. And it’s 

17 fully secure because it’s all encrypted with a key 

18 held only on your device, so fully decentralized. 

19 So now the other thing that we do then is 

provide a full consent stack enabling any business or 

21 service to ask you for elements of that data for a 

22 value exchange that you agree with and that might be 

23 different for lots of different people. 

24 And if you say yes, your digi.me extracts 

just the data that’s covered by the consent 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

210 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 certificate and passes it securely to the Apple 

2 service, which actually may be fully on your device. 

3 So your data doesn't have to get repromulgated around 

4 the universe. Imagine most of the things can be done. 

My diabetes service can be on your device, or the bank 

6 service can be on the device. 

7 Now, it's really important that that value 

8 exchange, because you received your data by data 

9 portability, but then when you pass it on, it’s 

dependent on -- and I use the words from GDPR, 

11 explicit and informed consent. And so we use the 

12 certificate that’s been designed over many years to 

13 meet that bar and actually exceed it. And it says 

14 explicitly what the data will be used for, whether it 

will be processed on a device or taken off a device, 

16 whether it will be shared with third parties; if so, 

17 who and why, and more details including your ability 

18 because you own the data now to actually see the data 

19 you’re going to share before you share it.

 And then, most importantly, because we’re 

21 really worried about reuse, of course, but that 

22 certificate is a legal contract. If the receiving 

23 party uses the data other than as stated in the 

24 certificate, then it’s a breach of contract law, 

in addition to any privacy breach. And that's -- the 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

211 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 penalties are significantly harsher. 

2 So if we actually look at it, we can 

3 actually meet all of the future requirements for data 

4 exchange by not thinking about data going from Company 

A to Company B, and so on and so forth, all those 

6 complications, but just straight to the individuals. 

7 Now, we’re one of the world-leading data facilitators. 

8 There are others. And you bring the data to the 

9 individual who build the best composite view of all of 

their data and over time, and then shares it when 

11 companies ask for them and the data can be local. So 

12 if we look today -- and I mean today -- we enable 

13 U.S., European and Australian citizens to aggregate 

14 more data on themselves and to subsequently share it 

than any company has today, including the top five. 

16 So if you think Facebook and Google and 

17 Apple have a lot of data on you, you can have more 

18 data yourself today. So effective data portability 

19 exists today. But as we'll discuss as we go through 

this session, we can and should do more. 

21 MR. BROWN: Thanks, Julian. 

22 Bennett, if I could turn to you next, could 

23 you talk about your work and your organization's work 

24 in data portability, and also address whether we have 

the solutions, in your opinion, for other privacy 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

212 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 problems data portability can present, or are there 

2 outstanding questions about how sort of get to yes on 

3 data portability? 

4 MR. CYPHERS: Sure, yeah. So the way EFF 

looks at data portability is, I think, through two 

6 separate lenses. The first is as like a user rights 

7 issue and as a user control issue. And so just kind 

8 of at a bare minimum people who generate data, people 

9 about whom data is generated and stored by companies, 

should have the rights to see, to download, to 

11 manipulate, to use that data however they want. 

12 The second lens is competition and 

13 innovation. And so as a lot of people have already 

14 said, there are competition issues where large walled 

gardens can get access to tons and tons of data from 

16 tons and tons of different people and then use that --

17 monetize that data, use it as sort of anticompetitive 

18 cudgel against their competitors, and kind of act as 

19 jealous dragons sometimes sitting on top of their data 

hordes and refusing to share it with their users or 

21 with other smaller companies who would like to use it 

22 for other things as well. 

23 And so data portability can go a long way -- 

24 data portability mandates and good data portability 

standards and practices can go a long way toward sort 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

213 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 of chipping away at those monopolies and making the 

2 marketplace more competitive and more innovative. 

3 So in terms of the challenges associated 

4 with data portability, I think there are some privacy 

issues with -- around, like, forcing companies to make 

6 data portable, for opening up laws so that small 

7 innovators like digi.me and their friends can do more 

8 to extract data on users’ behalf, but for the most 

9 part those issues are just sort of microcosm of the 

privacy issues that we already face. 

11 As Sara was saying, the world is not a 

12 private place right now. There's a lot of data 

13 flowing around, and the vast majority of the time, I 

14 think, users don't have enough control or knowledge 

about what's happening with their data already, and so 

16 data portability might in some cases sort of bring 

17 attention to or exacerbate the existing privacy issues 

18 with the internet today. But I don’t think it’s going 

19 to create many new privacy issues. And a lot of time 

I think, like, the idea that a user being given access 

21 to their own data is going to create more privacy 

22 issues than, like, the status quo where data is being 

23 collected and shared about users without their 

24 knowledge or consent much of the time. It is a little 

bit -- it is often argued in bad faith by incumbents 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

214 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 who benefit from data not being shared enough. 

2 And so I think Sara is going to talk about 

3 this more later, but our perspective is generally that 

4 we need good general privacy laws. User need to feel 

like they have rights to access their own data and 

6 that when companies are using their data to provide 

7 them products or services, those companies have 

8 certain responsibilities to handle that data in a way 

9 that is going to benefit the users.

 And so we look at it as there's a general 

11 privacy problem and data portability brings attention 

12 to that problem, but we need to solve the bigger 

13 problem. 

14 MR. BROWN: Sorry. Thank you, Bennett. And 

actually I’ll redirect this to Sara, which is I’d like 

16 to open up a similar question to other speakers, you 

17 know, what are the privacy solutions that can help us 

18 with the data portability challenges or do you think 

19 there’s too many questions here? And, Sara, could you 

take that first? 

21 MS. COLLINS: Yeah. So, yes, definitely. 

22 We need comprehensive federal privacy legislation. 

23 And there's a couple of major benefits not just to 

24 portability but to the digital ecosystem at large. 

 First, we need something that makes sure 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

215 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 consumers aren’t exploited for their data. This makes 

2 the internet ecosystem better. This also makes it 

3 easier to port for a couple reasons. One, you have a 

4 set of minimum standards about how data must be 

treated by all parties involved in a portability 

6 schema. Two, it removes a pretextual reason for a 

7 larger incumbent who may not want to share data for an 

8 anticompetitive reason to then share data. 

9 Right now, a platform or a large competitor 

might look at the U.S. landscape, know that they 

11 aren’t really covered by any privacy rules and say, 

12 frankly, I don't think I can open up APIs because I'm 

13 not sure my data -- this data will be safe. And 

14 that's a reasonable argument at the moment, or at 

least it is supported by the facts on the ground. 

16 If you remove that argument, you now have another 

17 reason or one impediment left to data portability. 

18 One other thing I’d like to flag and 

19 something Public Knowledge has been thinking about 

is creating explicitly a digital regulator. And this 

21 regulator would act as a neutral arbiter for some of 

22 these pretextual reasons we’ve been hearing about. 

23 Peter Swire brought this up in the last panel. But a 

24 digital regulator with expertise, technical expertise, 

that can really make decisions sector by sector on 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

216 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 what data is needed to make portability worthwhile, is 

2 something bigger like interoperability needed; how 

3 these different markets work together, are so 

4 important to really getting an ecosystem that's safe 

and also respects consumers. 

6 And just a final point I’d like to make, 

7 we've been hearing a bunch about, like, consumer 

8 consent or understanding of risk. And I don't 

9 particularly love that framework. I don’t think 

consumers should be expected to understand each app’s 

11 privacy policies and pros and cons. I think a 

12 reasonable expectation is that people are going to act 

13 with your data reasonably; that they’re not going to 

14 do harm with it; that they’re not going to exploit it. 

 And so I would love to see a regulatory and 

16 statutory ecosystem that supports that belief that 

17 consumers already have. We know people aren’t going 

18 to read privacy policies because frankly they’re 

19 unintelligible to nonlawyers. So let's do away with 

the fiction and let’s create a system that creates the 

21 benefits of data portability while it also minimizes 

22 the privacy risks that Bennett’s brought up. 

23 MR. BROWN: Thank you. Before we switch 

24 over to other topics, I wanted to see if any of my 

panelists wanted to follow up on Sara and Bennett's 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

217 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 thoughts. 

2 MR. RANGER: Yeah, just a quick point 

3 because I’m very much of the opinion that data 

4 portability actually reduces the privacy risk because 

it doesn’t come in on its own, and it shouldn’t come 

6 in on its own. 

7 So if we look at GDPR, it came in with the 

8 explicit and informed consent. So you crack down hard 

9 on the tracking stuff which you’re not consenting to. 

Now, GDPR does have three or four other uses when you 

11 can use data, and they’re fair. But all of the 

12 illegal use, as we would say in Europe, of the data 

13 needs to be cracked down on. So therefore the way in 

14 which you get data is from the individual who gets it 

from data portability. 

16 So actually data portability, which at the 

17 end of the day, even for all the big companies 

18 together, means that everybody can access more data 

19 and use more data. Right? But it’s counterbalanced 

by that explicit and informed consent. 

21 And, Sara, you talk about people don't read 

22 terms and conditions, and they don’t. But that 

23 doesn't mean, say, you can't have a clear consent 

24 certificate. You just have to put the work into it. 

And we have and we've done it with Kantara Initiative 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

218 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 as well, and it is clear. And we've got years of 

2 evidence to show that. You can show people, but what 

3 you have to want is to make that your whole reason for 

4 being; that you want to make it clear for people. And 

if you want to make it clear, and therefore if you're 

6 a digital data facilitator, which is our whole role in 

7 life, then just like you want to make the electricity 

8 safe if you facilitate bringing electricity, you can 

9 make the sharing of your data safe and you can make 

people understand it. 

11 But I just wanted to make the point that 

12 data portability comes with explicit and informed 

13 consent as the safety net. 

14 MS. BROWN LEE: Yeah. And I just wanted to 

add, I mean, I think that that's really correct. And, 

16 you know, to your point, Sara, about the idea of 

17 privacy, you know, is not having as much, I think it 

18 really does come down to an issue of trust. And if 

19 data portability can be used in a way to enhance that 

trust, I mean, putting aside some of the security 

21 issues separately, but just from a control perspective 

22 in that, you know, we want to be able to port your 

23 data, to exercise control over your data, trust that 

24 you will be able to get your data from companies or 

from organizations, and then be able to exercise 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

219 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 control. I think that's really a good starting place. 

2 But you can't really do that, I think, 

3 toward Julian's point, without having information 

4 about it. It has to be informed consent. And so you 

have to have that access base to be able to get the 

6 data and then be able to exercise control, which I 

7 think addresses some of those concerns about misuse or 

8 not having knowledge or awareness of how an 

9 individual's data is being used.

 MR. BROWN: Thanks, Erika. And if I could 

11 unfortunately go right back to you, I think we need to 

12 switch over now to security. And I will say to the 

13 extent my panelists, if there's a thought that I 

14 didn't give you a minute to ask, I will not be too 

frustrated if you want to sneak it in as we talk about 

16 these other topics which I know have some important 

17 overlaps. But let me switch now to the topic of 

18 security concerns and actually turn right back to you, 

19 Erika, as I said. Could you kick us off by talking 

about the security concerns, some of which we heard 

21 earlier in the day, that data portability efforts can 

22 really introduce. 

23 MS. BROWN LEE: Sure. And, I mean, I think 

24 all of these topics are related. Security is that 

critical pillar of data portability. And so, you 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

220 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 know, and certainly for us, you know, it's part of our 

2 commitment with respect to data practices. As you 

3 mentioned, Peter Swire did refer to some of the pieces 

4 of security and how they come up. And so, you know, 

building upon that, it certainly, for us, comes up in 

6 the aspect of -- well, first for authentication and 

7 verification of the request itself. The financial 

8 services industry certainly has a lot of experience in 

9 preventing and monitoring and detecting fraud, and so 

that's really crucial in terms of the security piece 

11 for any data sharing circumstances. 

12 But it goes back also to a point I raised 

13 earlier, which is understanding the type of data that 

14 you have and that would be part of what would be 

provided to individuals is critical because from a --

16 you know, from a corporate perspective, 

17 operationalizing the security piece requires an 

18 understanding of the different types of data so that 

19 you can build in those security steps and appropriate 

verification steps as part of that process. 

21 And so, you know, the consumer-centric or 

22 individual-centric approach ensures that really from 

23 the start that the transfer and the port of data is 

24 coming from a place of consumer or individual requests 

and making sure that it's not only at their request, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

221 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 but also for their benefit. 

2 The second part that really comes into play, 

3 of course, with the security piece of data portability 

4 is the transmission itself. And so, you know, there 

are certain regimes that do talk about the types of 

6 mechanisms to ensure the security in transit, the 

7 guidance around the GDPR, from Article 29 Working 

8 Party Statement mentions encryption. That’s something 

9 that has been raised in other panels. And so that's 

an example of where you see, you know, protection of 

11 data that's in transit. 

12 I do think that it is important when you 

13 talk about security that you address that flip side, 

14 which is what happens if it doesn't go right and, you 

know, liability is triggered. And so thinking about 

16 the norms for how liability is evaluated is a bit more 

17 complex because we were talking about -- or it was 

18 mentioned earlier in other panels that there is sort 

19 of sectoral approach and very different approach in 

different jurisdictions. So not just, of course, with 

21 GDPR, but for financial services, the Payment Services 

22 Directive, or PSD2, is one of the sectoral laws that 

23 also comes into play. 

24 And so when you think about the liability 

perspective, you have the data breach notification 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

222 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 requirements, whether it's GDPR or CCPA or any of the 

2 54 jurisdictions across the U.S. that have 

3 notification laws, and how they intersect with other 

4 sectoral regulations becomes a very nuanced and 

jurisdiction-specific exercise. 

6 There is an argument to be made for viewing 

7 from the perspective, especially if you're looking at 

8 a company that has data moving across borders, looking 

9 holistically at all of the rights that are available 

to individuals under the various regimes, whether it's 

11 access, deletion or portability, and looking 

12 holistically from a sort of 360-degree view of how to 

13 implement the structure and a process for addressing 

14 compliance for all of those rights in a way that works 

seamlessly and reduces friction for consumers. 

16 So that's the way we think about it in terms 

17 of from a liability perspective. But, of course, 

18 going back to the first part, the verification 

19 identification, you know, making sure that that part 

is particularly strong, hopefully avoids the liability 

21 pitfalls in the second instance. 

22 MR. BROWN: Thanks, Erika. 

23 One of my goals of my panel is to really 

24 give my great speakers an opportunity to kind of 

illustrate how these things are coming up in some very 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

223 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 different contexts that they’re all kind of working 

2 and thinking about. So I’m not going to be overly 

3 prescriptive with this next question. What I want to 

4 open up to all of you is, how are you thinking about 

it in the various spaces you’re working about 

6 reconciling the security and liability concerns, and 

7 what solutions are you thinking about or have you seen 

8 that work to move forward. 

9 And, Michael, maybe you could start off and 

talk about this in the energy space. 

11 MR. MURRAY: Sure. So I tend to think of 

12 security as being downstream from liability. I’m a 

13 former, you know, start-up entrepreneur; ran a 

14 software company doing energy management. And the 

security problems are really solvable in my sector. 

16 Information needs to get securely from A to B, and 

17 that's really not that difficult. Totally, totally 

18 solvable, did that a long time ago. 

19 But the liability really, really matters. 

So the electric utilities typically do not have 

21 specific requirements, technical requirements, around 

22 security that they have to meet for handling customer 

23 data. You know, there’s a broad range of, you know, 

24 legal regimes and liability that they have, and that 

sort of drives -- you know, drives the particular 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

224 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 security measures that they take. And one of the 

2 models that I think has worked really successfully 

3 that I wanted to mention is California. So long 

4 before CCPA in 2011, the California Public Utilities 

Commission adopted some really excellent privacy rules 

6 which gave customers the right to share their data 

7 with anyone, but most importantly the rules immunized 

8 the utilities from a third party’s privacy breach. 

9 And this was absolutely critical. So if a 

customer wants to share their data with Acme Energy, 

11 let's say, and Acme Energy, after the transfer has 

12 already happened securely, has a subsequent breach, 

13 then the utility has no liability for that Acme 

14 Energy’s behavior. And that was really important 

because no one wanted the electric utilities to be the 

16 enforcer, to be the market policemen. The utilities 

17 didn’t want that, the energy management companies 

18 didn’t want that, and so, you know, that’s where we --

19 you know, the liability shifted to one of -- you know, 

it’s whoever causes the harm is the one who is 

21 responsible for it. And I think that's just a 

22 framework that makes a lot sense and one that we've 

23 been advocating for in other states. 

24 MR. CYPHERS: If I can jump in as well --

sorry, Julian. Yeah, yeah, I want to just sort of 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

225 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 “plus one” a lot of what Michael was saying. I think 

2 in some context it definitely does make sense for 

3 there to be liability for when a company shares data 

4 with another company and the other company does 

something bad with the data; for example Facebook, in 

6 Cambridge Analytica. But I think in a lot of those 

7 contexts, the reason that the company that does the 

8 sharing should be liable is because they did the 

9 sharing in a way that was not in the user's best 

interest and without the user's complete consent or 

11 knowledge of what was going on. 

12 But in a portability context, the company 

13 that does the bad thing, whether it's accidentally 

14 releasing data to the public through like a database 

breach or something, or exploiting it in a way that 

16 users don't like, the person who does the bad thing 

17 should be liable. 

18 So another point on security is I think when 

19 we start thinking about putting this kind of thing 

into law or regulation and, like, say, creating a new 

21 portability mandate and attaching some sort of 

22 security guidelines to it or something like that, one 

23 thing we want to be wary of is overspecifying the way 

24 security should work in law, because security is a 

moving target. There is no such thing as a right set 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

226 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 of security practices for the world for even a 

2 particular industry, and definitely not over time. 

3 Like, things are always changing. And I think in this 

4 case companies are -- the companies who are actually 

working with data and working with users are usually 

6 best positioned to make judgments about what kinds of 

7 security their customers need. Obviously they have to 

8 have the right goals in mind, like companies are not 

9 just going to build really robust security 

infrastructure if they don't have to and if there’s no 

11 incentive for them to. 

12 But I think if the incentives are aligned 

13 properly and companies who do mishandle user data are 

14 going to be liable in the right kinds of ways, then 

the government shouldn’t get overinvolved and say, 

16 like, oh, you have to use like AES 256 and you have to 

17 use this kind of encryption and you have to, like, do 

18 this exact series of events to authenticate users. 

19 Because I think a lot of times that ends up being 

counter-intuitive and it can actually freeze in place 

21 security practices that might sound reasonable at the 

22 time something is written but are out of date a year 

23 or two years, and definitely five or ten years later. 

24 MR. RANGER: I’d probably like to “plus one” 

what Erika, Michael and Bennett have all said for 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

227 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 various different reasons, but I want to go a bit 

2 further. So clearly the originator, when you’re doing 

3 data portability, is responsible for the 

4 authentication security, et cetera, as Erika said.

 Clearly, as Michael said, when a company 

6 gives the data back to an individual, an individual 

7 says give it to the other company, the originating 

8 company can’t then be responsible for use. The 

9 individual has taken that responsibility but through 

explicit and informed consent. 

11 But the look at the security. And what I 

12 want to make as a really strong point is -- and I 

13 would almost finish with it, but I'll start with it, 

14 It isn't a show stopper to data portability and can be 

fully managed, and we’ve proven that -- and we're just 

16 one company. Lots of companies have done it. 

17 So at digi.me, we don't see, touch or hold 

18 individual's data at all. It goes to the individual, 

19 decentralized to the individual, which of course 

greatly reduces the security threat itself. All data 

21 is encrypted to a very high standard, and only the 

22 individual has the key. 

23 There's a lot more we have to do with data 

24 at rest and it being passed around. But we've been 

audited by governments -- UK, Dutch, Iceland and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

228 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 various others. We had a wonderful study run by a 

2 company called Control Shift in the UK last year with 

3 five blue chip companies and the UK government looking 

4 at all of data portability and everything else. And 

they came to one stunningly simple conclusion: It can 

6 be made secure and safe. And they looked at us and 

7 they audited through everything else. 

8 The EU, though, is saying, you know what, 

9 when you’ve got a company like digi.me or a data 

intermediary, the individual has to trust them. So 

11 they are looking at whether or not there should be 

12 appropriate certification of companies that are acting 

13 as a data intermediary because we're helping handle 

14 all of this data. And I support that. But as Bennett 

said, don't say exactly how to do it. Do it like ISO 

16 27001 does for security. Just state the principles 

17 and the company is audited to the principles. And 

18 that works across everything. 

19 So, yes, security is an issue, but it's only 

an issue because it’s an issue whenever you're dealing 

21 with data and it's totally, totally solvable and not 

22 difficult as a concept. Obviously, you want to be 

23 careful how you implement it. 

24 MS. COLLINS: So just to sort of put a 

button on this, I completely agree with Bennett and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

229 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Julian and Michael. I think actually everyone has 

2 said this, that security is a bit of a moving target 

3 and has to be. Therefore, enshrining it in the law, 

4 especially the way the American legal system works, 

it’s a really bad idea. 

6 But I think this makes a very good argument 

7 for a technical regulatory that either can put out 

8 guidance or something like NIST, which can update 

9 companies on the latest security standards. Because I 

think having, again, an outside arbiter that can say, 

11 like, bare minimum, especially depending on your 

12 regulatory sector, what data you have -- house, 

13 finances, education data, et cetera, is super 

14 important.

 And while I’m sure companies could come up 

16 with a solution among themselves about what sort of 

17 data and security standards we’d want them to use, 

18 having a sort of trusted outside party, a governmental 

19 regulator, do at least some of that work or verify 

some of that work can really improve trust in a 

21 system. 

22 MS. BROWN LEE: So can I just make another 

23 point there? I mean, it sort of underscores what 

24 we've been saying, but companies can innovate with 

respect to security, as well. I mean, I think, you 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

230 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 know, you always think of it in terms of products and 

2 what not. But I think however it's -- you know, 

3 however we approach this, the incentives need to be 

4 there to encourage that because I think that, you 

know, there are ways in which companies can really 

6 develop and be on the cutting edge of innovative 

7 security, you know, practices. And so we want to make 

8 sure that that’s not, you know, stifled in any way. I 

9 just really want to just underscore that.

 MR. BROWN: Thank you, thank you all. 

11 Before we switch topics, on the last panel some of you 

12 may have heard Peter Swire talk about one of the 

13 issues coming out of security of this -- of it being 

14 pretextual. I mean, I know we’ve talked about this a 

little bit already and in the privacy context, but I 

16 wanted to get your sense, at least Michael and Sara, I 

17 know you guys have thoughts on this, on how we might 

18 be thinking about distinguishing between those 

19 legitimate security concerns and those that might be 

just a pretextual barrier. Are there things we can 

21 look to to try to differentiate that or other 

22 solutions? 

23 Maybe, Sara, do you want to start? 

24 MS. COLLINS: Sure. I mean, so I think 

Peter sort of hit it right on the money. If within a 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

231 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 preferred network or within a selection of companies 

2 that the data holder might prefer, there’s incredibly 

3 easy transfer and the security standards aren’t as 

4 high as the standards they put for outside third-party 

sharing. That's a really big red flag. 

6 I think another thing that could be a big 

7 red flag in the security context is not making it 

8 clear to competitors or to data users who would want 

9 to do this, what set of security standards you're 

operating on, like whether you follow, like, a sort of 

11 -- a set of NIST security standards, like what your 

12 best practices are, so that they can be met. 

13 If it's a moving target or it's really hard 

14 to comprehend, or if it's not clear or maybe it 

changes depending on who’s talking to you, that's a 

16 pretty good indication that it's probably pretextual. 

17 MR. BROWN: Michael? 

18 MR. MURRAY: Yeah, I think Professor Swire 

19 had a great point. This sort of differential 

requirement comes up with utilities quite a bit; for 

21 example, with authentication requirements. So if the 

22 utility is trying to authenticate you so that you can 

23 pay your bill, your monthly utility bill on time, they 

24 make that extremely easy and there’s a very minimal 

set of authentication requirements, your account 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

232 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 number, maybe your telephone number and that's it. 

2 But then when you want to share your data with another 

3 entity, they throw the book at you. And there’s --

4 you know, you need to know, oh, what was it, it’s like 

my cat's maiden name or something like that. There's 

6 all these pieces of information that you need to 

7 require. And that’s just a very simple -- you can 

8 just look at those two requirements and say if they 

9 don't match, well, then it’s probably -- there's some 

anticompetitive impulse here that needs to be, you 

11 know, squelched. 

12 And the second thing is, just to tell a 

13 brief story, I asked a utility last week to -- they 

14 had proposed a data-sharing system for third parties 

with permission; it sounded great. And I said, well, 

16 tell me what are your requirements for these third17 party recipients. And they said -- you know, they 

18 gave me some standard forms, which was expected. And 

19 then they said, you also have to agree to company 

cybersecurity policies. And I said, okay, well, give 

21 me a copy of those cybersecurity policies because my 

22 members have to meet those requirements. 

23 And this is when the utility, who will 

24 remain nameless, said, sorry, that's all confidential. 

And so, in my experience, these cybersecurity concerns 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

233 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 are -- it's really about wielding power and control. 

2 It's not really about your security requirements. If 

3 you have to hide your security requirements, they're 

4 probably not legitimate. We know that security 

through obscurity doesn't work. 

6 MR. BROWN: Thank you, both. I'm hopefully 

7 not cutting anybody off, but I'd like to move now to 

8 another kind of intermediate topic that really I think 

9 elides security as well as standardization -- and I'm 

going to ask Bennett maybe to discuss this at first. 

11 And that's the issue of credential sharing, or as 

12 other panelists today have called screen scraping. 

13 Bennett, could you explain a little bit, 

14 what is this idea of screen scraping and how does it 

fit into the subject of data portability in your mind? 

16 MR. CYPHERS: Sure, yeah. So screen 

17 scraping in general is this practice of one company or 

18 anyone, really, running, like, a headless browser or a 

19 piece of technology that's instrumented to look like a 

regular human user interacting with a website or with 

21 an app. But that actually is automated and can scrape 

22 or collect data from an interface that is designed to 

23 be interacted with by humans. 

24 So this is, like -- this comes up in a lot 

of different contexts, but with portability, it 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

234 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 usually means, like, something like Plaid or Mint, 

2 where you have an account with, say, a bank or a 

3 different kind of institution and you want to access 

4 the data -- you have some data in that institution 

that you can access through, like, some sort of web 

6 interface, but you want to grant access to it to 

7 another company who can, like, do some cool analysis, 

8 or reformatting of that data on your behalf. 

9 And so what you do is you might grant -- you 

might give your credentials to an intermediary. That 

11 intermediary will take your credentials and log into 

12 the bank or other company on your behalf, and, like, 

13 use a headless browser to read the data from a human14 readable webpage into a computer, and then do whatever 

they want with that data, or hopefully whatever the 

16 user wants. 

17 So this is -- this is a practice that is 

18 part of a broader sort of set of practices that we 

19 like to call a competitive compatibility. And this is 

where, like, one company or organization has 

21 information that a user might like to use in a way 

22 that the company doesn't allow or doesn't support. 

23 And other companies can step in and say, like, hey, 

24 you know, your bank's not going to do this thing for 

you, but we can do it on your behalf. And so we’re 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

235 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 going to -- even though the bank doesn't offer, like, 

2 APIs or technology to do this specific thing, another 

3 company can work around -- work with what the bank 

4 does offer, which is often a webpage or an app, and 

find ways to use that information in new and creative 

6 ways for new and creative products that users might 

7 like. 

8 And so screen scraping is sort of one 

9 technique that's often used for competitive 

compatibility purposes. Obviously, it can be used for 

11 nefarious purpose as well, and this goes back to, 

12 like, the need for comprehensive privacy law to make 

13 sure that when you do grant your credentials to 

14 someone and say, like, hey, like I want to see a cool 

spreadsheet with all my data in it, they're not going 

16 to turn around and, like, use your password for other 

17 stuff or sell your data to someone else without your 

18 knowledge or consent. I hope that's a decent 

19 introduction.

 MR. BROWN: Thank you. I'd like to give 

21 other folks -- and, Bennett, you can add to it as well 

22 if you have more to share -- just a quick chance to 

23 talk about how does this play a role in data 

24 portability. Is it effective? Can it be a way to not 

have to deal with the problem of standards? You know, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

236 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 what do you guys think of it? Maybe Michael -- sorry, 

2 Julian, did you want to start? 

3 MR. RANGER: Yeah, I was just going to jump 

4 in if you don’t mind. I don't think it replaces 

standards or whatever. Look, if asked the question, 

6 are APIs a better alternative than screen scraping for 

7 data portability, the answer is yes, a thousand times 

8 yes. Right? 

9 Screen scraping is the last possible thing 

that you want to do. You're giving your credentials 

11 to a third party, and that may be abused. It may open 

12 up liability to the data originator because nobody's 

13 approved it. It's no good. But -- and here's the 

14 point: It has to be legitimate if the data source 

company isn't providing my data back to me in any 

16 other form. Right? 

17 So if you had a law that was absolutely 

18 explicit that you had to have data portability via 

19 APIs, which is our recommendation, then you could ban 

screen scraping, and I think that would be a good 

21 thing. But in the absence -- if I can only get my 

22 data back or allow it to be used in another service 

23 through screen scraping, then, I'm sorry, that's what 

24 I have to be able to do.

 So it is not the right answer, but it's an 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

237 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 adequate answer in the absence of data portability via 

2 APIs. And that's the key thing to say. 

3 MR. BROWN: Erika, did you want to add 

4 something?

 MS. BROWN LEE: Yes, yes. Thanks, Jarad. 

6 Just a quick addition, because it is a topic, 

7 obviously, that is, you know, very important in the 

8 financial services sector. And, you know, not 

9 everyone in the industry participates, but I wanted to 

sort of mention that there is work being done in the 

11 industry by the financial data exchange, or FDX, 

12 which, you know, is working to coalesce around common 

13 interoperable standards for the -- for an API, an FDS 

14 API, for consumers and businesses to access their 

financial data. 

16 So, as Julian mentioned, when you have an 

17 API, you're not sharing the credentials like passwords 

18 and user names. That stays with the individual 

19 themselves. And the individual themselves gets to 

choose, you know, who and how their data is served, 

21 you know, or is ported or used. 

22 So you have the advantage of API standards 

23 that would give consumers additional transparency, 

24 additional control, and it also addresses that 

security piece as we were just talking about, where, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

238 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 you know, you worry about how it's being used onwards 

2 or by the intermediaries who get the data. 

3 This, of course, if you don't -- or if 

4 you're not sharing the credentials or the passwords in 

the first place, it takes away a level of security 

6 threat risk. And so in light of those benefits, 

7 certainly there is -- you know, it's important to sort 

8 of think through and support standards that are 

9 developing within the industry. So we see that in the 

financial services sector, and that might be, you 

11 know, an example for other sectors as well. 

12 MR. MURRAY: You were just on mute, Jarad, 

13 but I'll jump in. So screen scraping is really not 

14 ideal. A lot of companies use it in the energy 

sector. We don't want to. Nobody likes to do it, 

16 right? It's expensive. It can be buggy. It can be 

17 inconsistent. Utilities change their website; we have 

18 to accommodate it. It's just a silly cat-and-mouse 

19 game.

 But the reason why it continues is, one, 

21 there isn't a good alternative, APIs. But I think 

22 there’s a couple of other things that play at least in 

23 the utility industry. I think the utilities like 

24 having -- like screen scraping being sort of the only 

option because, you know, then they can, you know, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

239 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 claim, you know, CFAA violations and get legal on 

2 these incumbents who are trying to access this 

3 information with customer consent. It’s sort of --

4 it’s just a convenient way of, you know, running out 

the clock and, you know, incurring a lot of costs for 

6 those entities. 

7 But I think there's another case that we 

8 also have to be careful of, which is where utilities 

9 can also manipulate screen scraping, too. So it's not 

that screen scraping is the best, always true source. 

11 There have been cases in the financial services where 

12 banks have, you know, started withdrawing information 

13 from their web portals because they didn't want that 

14 to be scraped and available to competitors. 

 And, similarly, we’ve seen a couple instances 

16 where utilities will say, oh, well, you know, we're 

17 only going to put your bills online if you agree to, 

18 you know, have ACH payments for your monthly utility 

19 bills. And so there’s this, like, sort of withholding 

of information that can happen both in the API sector 

21 as well as getting data through screen scraping on 

22 these incumbents’ websites. 

23 MR. CYPHERS: Yeah, and so I could just make 

24 another couple of points. Screen scraping, as 

everyone has said, is never the best option. Like, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

240 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 obviously, if there's some kind of data that you would 

2 like to port or use for a secondary purpose, it's 

3 always better, for everyone involved, if there is an 

4 API for that specific piece of data.

 But where screen scraping comes in is when 

6 the data holder doesn't want to share that data, or 

7 they're not compelled to, or there's a law that says 

8 they should be sharing this data but they can find a 

9 way to interpret that law that says, oh, we don't 

actually have to share it in this form, or we don't 

11 actually have to share the critical piece of it that 

12 people need to make it useful. 

13 And so screen scraping, I think our 

14 perspective is to disagree a little with Julian. 

Screen scraping should never be banned. There should 

16 never be a law that says that you cannot scrape a 

17 company's screens for this kind of data. You can talk 

18 about bans on specific uses of screen scraping, which 

19 is fine. But, I mean, EFF’s position in general is 

that CFAA is an overbroad law that can be used to shut 

21 down a lot of very legitimate activities, screen 

22 scraping in a competitive compatibility context being 

23 one of them. 

24 And the other reason it's important is 

because it -- like, regulations are really hard, new 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

241 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 regulations are really hard to create. And the tech 

2 sector, especially, is moving really fast, and there's 

3 going to be new kinds of data and new industries where 

4 people want to use their data for new things, and 

regulation is never going to be able to keep up with 

6 that no matter how much we might like to believe that 

7 it is. And so there’s always going to be, like, 

8 things that people want to do with their data where 

9 there is not an API yet or it’s not in a company's 

interest to make an API for that particular data, and 

11 regulators can’t catch up fast enough to say, like, 

12 you have to make an API for this. And so keeping 

13 screen scraping as sort of a last-resort option that 

14 competitors can always fall back on we think is 

invaluable and actually necessarily. 

16 And screen scraping as an option actually 

17 makes it beneficial, like, for data holders to create 

18 APIs a lot of time. And, like, we saw this in the 

19 financial services industry 10, 15 years ago, where, 

like, Plaid and Yodlee and Mint were scraping data 

21 from banks, and banks didn't like that a lot. But 

22 they realized that customers really liked the product 

23 that those aggregators were putting out. And so 

24 eventually that helped pressure them into creating 

these APIs that a lot of banks now do support, and 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

242 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 it's better for everyone, especially consumers. 

2 MR. BROWN: Thanks, Bennett. 

3 I'd like to shift us now to the last subject 

4 we want to talk about today, which is a critical one, 

and I apologize as a privacy and security lawyer for 

6 at all giving this short shrift. But we want to talk 

7 about standardization and interoperability and get 

8 your great thoughts on that. 

9 All day we’ve heard speakers talk about how 

important these two aspects are to helping realize 

11 many of the benefits of data portability. 

12 I want to start off with Julian. It's been 

13 a while since Peter Swire's presentation this morning, 

14 and I thought maybe you could talk a little bit about 

what are we talking about with the difference between 

16 these two concepts and their goals, and then how do 

17 you think they fit into data portability initiatives? 

18 MR. RANGER: Okay. So I'm going to be a bit 

19 controversial here, because I believe totally in 

interoperability but want to see standardization 

21 delayed so that we get on with data portability and 

22 bring standardization downstream. Interoperability is 

23 different. Interoperability is the ability to 

24 effectively exchange data, not perfectly, but 

effectively. Standards help with that. But I can 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

243 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 create interoperability where there is no 

2 standardization, right, as a business. 

3 We do that at digi.me. We normalize all 

4 data received by the individual no matter what data 

format it arrives in, all to a single normalized 

6 ontology, and that creates interoperability as any 

7 system using the data gets the data in a single form 

8 no matter what the input. 

9 So if you use digi.me for health data, it 

doesn't matter whether it’s U.S., UK, Dutch or 

11 Icelandic, you get it one form. No standards 

12 required. I can assure you that there’s umpteen 

13 different implementations across that set, even though 

14 nominally most of them are following a standard called 

FHIR, but even then it wouldn’t work. So you must 

16 distinguish between interoperability and 

17 standardization. 

18 Now, standardization makes interoperability 

19 easier, so if more parties use the same standards and 

are really compliant to those standards -- that’s the 

21 real key -- then my job at digi.me is made much 

22 easier, as is everyone’s. But their standards are not 

23 a panacea. There are always interoperability issues 

24 even with standards. And I spent 20-plus years doing 

this for the military. I was called "Mr. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

244 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Interoperability.” I made a large amount of money 

2 solving the problems. And standards help, but they 

3 don't solve all the problems. 

4 So it's for that reason that I strongly --

and I sort of say that strongly times 100 -- that the 

6 EU -- like the EU has done, data portability comes 

7 first, specifying something along the lines of a well8 formed API but without specifying the standards. Get 

9 the data moving first, and then let businesses solve 

the interoperability problem, then get the standards 

11 developed and implemented for each sectoral area. But 

12 please, please, don't wait for standards before 

13 opening up the data or you'll never get to the new 

14 data economy you want.

 And as a final cautionary tale, look at the 

16 -- and I'm sorry to do this to you, my colleagues and 

17 friends in Australia because we work there, but the 

18 Australians have the consumer data right, and it’s 

19 adopted a standards-first approach to opening up the 

data, and it's frankly a mess. Right? It is a mess. 

21 It's heavily delayed, much to their economic 

22 detriment, across the whole thing. All right? 

23 So in this case, follow the EU. Open up the 

24 data, well-formed API, any format, businesses will 

solve interoperability. But then really encourage --

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

245 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 and standards because we all want them, but let it 

2 follow opening up the data. 

3 MR. BROWN: Thanks, Julian. 

4 And I think -- my other panelists, I 

suspect, will have some interesting thoughts to 

6 respond to your suggestions. But I want to first turn 

7 to Michael to talk a little bit about your experience 

8 with standards in terms of how those have played out 

9 in the energy sector as an interesting case study, and 

what you're thinking and recommending for the future 

11 based off what's happened so far. 

12 MR. MURRAY: So the standards and energy 

13 came, actually, out of the American Recovery and 

14 Reinvestment Act originally. There was some great 

work done by the FCC in the National Broadband Plan, 

16 which I hope folks are brushing that document off as a 

17 potential guideline for economic revitalization post18 pandemic. 

19 And one of the key principles, one of the 

key objectives, in the National Broadband Plan at the 

21 time was for every American to have access and the 

22 ability to share their real-time energy usage, using 

23 home broadband connections. That's from 2010. 

24 And so that's sort of, again, a standards 

development process led by NIST, the Department of 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

246 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Energy, Smart Grid Interoperability Panel, and others, 

2 and it resulted in the standard we now call Green 

3 Button. And it's -- you know, it’s been used, the 

4 Green Button has been adopted as the API version of 

it, in about five states covering 36 million electric 

6 meters. There's about, you know, 120 million homes 

7 across the U.S. So, you know, it's a sizable 

8 percentage of the total. 

9 And the standard was -- it was, yes, there 

was some important things technically to be done 

11 there, but to be honest, it was mostly politically 

12 important because it was -- the lack of a standard and 

13 the lack of federal involvement, you know, pre-2011 in 

14 this area was just a really great reason for the 

utilities to say, oh, you know, nobody can even agree 

16 on a standard, so let's not do anything; let's just, 

17 you know, pretend this whole issue disappeared. 

18 And so I think that sort of political 

19 leadership helped make it possible, that there was, 

you know, buy-in from the government and industry and 

21 a lot of players. 

22 Now, with that said, I think Julian is 

23 exactly right. Standard is just one tool in the 

24 toolbox. Just because, you know, two entities claim 

to follow the same standard doesn't mean you have true 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

247 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 interoperability. And one of the challenges that I 

2 think we have in energy that maybe you don't have in a 

3 sector like banking is that the banks have a bit of an 

4 incentive for interoperability, because although they 

might not like their information going to their 

6 competitors, they want to be able to get their 

7 customers' information that's held at their 

8 competitive financial institutions. 

9 And so there's a bit of a backflow in terms 

of data that can benefit them. And utilities just 

11 don't have that incentive whatsoever. If I move from 

12 Baltimore to Florida, the Florida utility really 

13 doesn't gain any value whatsoever on my usage history 

14 in Baltimore, and so -- and that's why it's much 

easier for, I think, utilities to just sort of, you 

16 know, dig their heels in and say, you know, we're just 

17 going to do the bare minimum, provide the absolute 

18 bare minimum of data and maybe not even fully comply 

19 with the standard. And that's why I think there's a 

much bigger need for not necessarily standards 

21 development but standards enforcement. 

22 MR. BROWN: Thanks, Michael. 

23 I'd like to open it up now to my other 

24 panelists to respond to what you guys have both said 

in terms of examples and also maybe just address what 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

248 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 models you think work for getting us to 

2 standardization or interoperability and what should be 

3 first. And maybe, Sara, could you go first? 

4 MS. COLLINS: Yeah. So, again, we are big 

proponents of interoperability. And while I 

6 appreciate what Julian said, I do think things happen, 

7 like what Michael’s described, when there isn't a 

8 business interest to incentivize interoperability. 

9 You can imagine there's a large dominant social 

network which has all of the people on it. There is 

11 an up-and-coming social network that you or myself 

12 would like to try. However, no one else is on it. So 

13 you spend a couple of hours there, get nothing out of 

14 it and then go back. You may have even moved all of 

your data, too, so all of your photos and other things 

16 are there, but nobody else is there, either. 

17 The large dominant platform has no incentive 

18 to create an interoperable system where you can post 

19 or interact between those two because it doesn't 

benefit them. So while I don't think there's anything 

21 wrong with sort of these organic systems coming up 

22 naturally, I do think where there's significant 

23 competitive concerns you have to get a mandate from 

24 either the legislature or a regulator, and you may 

have to do the really nitty-gritty standards process 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

249 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 to get it to move in order for it to be useful. 

2 MR. CYPHERS: Yeah, I'd like to just give a 

3 huge “plus one” to what Sara just said. This is a 

4 portability panel, and we’ve talked a lot about 

portability. But to solve, I think, a lot of the 

6 bigger issues that we're looking at in the tech sector 

7 right now, especially around competition, portability 

8 is good but it's just not enough. It’s not enough to 

9 be able to take your data, take, like, the names of 

all of your friends and move over to Martagon because 

11 none of your friends are going to be on it and 

12 Facebook -- sorry -- and the large incumbent social 

13 network has zero incentive to, like, allow you to 

14 interact with people off of its platform who don't 

have an account with the large incumbent social 

16 network. 

17 And so it's about -- like, portability gives 

18 you this outflow of data. It lets people take their 

19 data and take it somewhere else, but you -- to have 

real competition and to undermine the network effects 

21 that can be so powerful in a lot of these sectors, you 

22 need the inflow. You need the other direction where 

23 the company has to say, like, yes, we will respect 

24 people who don't have accounts on our platform as real 

people and allow them to interact with our users on a 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

250 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 level playing field. 

2 And I don't think it makes sense -- I don't 

3 want to get overbroad here and say, like, oh, every 

4 company that exists should have to do interoperability 

using these standards, but, like, when you have these 

6 giant, pseudomonopolist platforms that just control 

7 everything and it doesn't look like they're going 

8 anywhere anytime soon, I think those deserve special 

9 regulation to say, like, hey, you know, you have to 

play with these other up-and-coming platforms on a 

11 level playing field; you can't just have all your 

12 users and let inertia carry you forward forever. 

13 MR. RANGER: Well, I suppose, Sara and 

14 Bennett, whilst I agree with you, that isn't data 

portability. That's a more broader competition point. 

16 And so I'm not going to disagree with you on the 

17 competition point at all. 

18 But on the data portability point it would 

19 be dangerous, and that’s why I’m saying. Because it 

would delay the availability of data, and that's the 

21 worst possible thing that could happen to us all. 

22 MR. BROWN: Thank you, all. 

23 Oh, Erika, I was actually just going to turn 

24 to you and just ask you a little bit from the business 

perspective, your thoughts on what your co-panelists 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

251 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 have said. So, please, take it away. 

2 MS. BROWN LEE: Sure, sure. I think, you 

3 know, we're all in agreement in the sense that, you 

4 know, there's support broadly for interoperability as 

an overarching principle and standards in particular. 

6 You know, just sort of adding onto some of 

7 the comments, I would just suggest that industry 

8 participate -- that industry participation in 

9 development of the standards is also important because 

if you -- without it, ideally you want to be able to 

11 have and build scale and adoption. And, you know, if 

12 standards are set in a particular rigid fashion where 

13 there's asymmetric adoption, that also can have, you 

14 know, a negative impact on consumers, in particular, 

because they won't be able to -- you know, there will 

16 just be some players that don’t participate. 

17 And so, you know, I think that point of 

18 having a level playing field is important, but I do 

19 think that, you know, there does need to be sort of 

industry participation and recognition of not only the 

21 various differences within an industry, but also 

22 between industries. 

23 MR. BROWN: Thanks, Erika. And thank you 

24 all for jumping in on this.

 We have just a few minutes left, and I'm 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

252 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 going to move to give my panelists an opportunity to 

2 just throw in some closing thoughts if they want to 

3 sneak in any responses to what we’ve just said. I'll 

4 give them that chance there.

 And, Erika, I'll switch you to the end of 

6 the order because you just spoke, but maybe, Sara, 

7 could you go first, and just give us a minute or so of 

8 any closing thoughts you’d like? 

9 MS. COLLINS: Yeah, I think data portability 

really shows how interconnected some of these very 

11 hard questions in this sort of digital economy are, 

12 and that if we're going to -- that we can't think 

13 about data portability as if acting by itself. It 

14 affects privacy. It affects security. It obviously 

has implications for competition. 

16 So while obviously creating rules around 

17 data portability you need to have a focus, I think 

18 there also needs to be a sort of perspective of 

19 looking around at how it will affect the larger 

digital ecosystem going forward and what exactly we 

21 want out of that ecosystem. 

22 Obviously at Public Knowledge, we want it to 

23 be user centric and user friendly and ultimately not 

24 harmful.

 MR. BROWN: Bennett, would you like to go 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

253 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 next? 

2 MR. CYPHERS: Sure. Yeah, I'll try and make 

3 a few points very quickly. First, mandates are great, 

4 where we can get regulators and users and industry to 

agree on what the right data is to be sharing, and 

6 what the right APIs look like. But competitive 

7 compatibility is key to allowing small upstarts and 

8 tinkerers to innovate on data portability and figure 

9 out what kinds of uses for their data there might 

exist if companies are not moving forward with APIs 

11 and regulators can't keep up with new technology. 

12 Finally, we need a privacy law. We need 

13 good privacy law in the United States. We don't need 

14 it as a prerequisite for data portability. Data 

portability doesn't create new risks to privacy, but 

16 it should bring attention to the risks that are 

17 already out there and remind everyone that data is not 

18 always going to be used in your interest if there are 

19 not liabilities and incentives for companies to use 

data in ways that you would like. 

21 MR. BROWN: Michael? 

22 MR. MURRAY: So I'd like to end with a 

23 request. Given this large patchwork of utility 

24 regulation, including state, public utility 

commissions, city councils and cooperative boards, all 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

254 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 of them are struggling with what the heck is informed 

2 consent. And so if I had a request, it would be to 

3 the FTC, and I would -- I would, you know, humbly, 

4 respectfully, on one knee, ask that the federal 

government and the FTC please provide some guidance on 

6 online consents and what they should look like and how 

7 they should function. 

8 The Consumer Data Right in Australia, 

9 they've done some fantastic work through CSIRO, that’s 

their NIST equivalent down there, and it's just 

11 amazing to see, you know, actual screenshots of, this 

12 is what it should look like. And that's exactly the 

13 level of detail that we'd love to see, because there 

14 are tons and tons, you know, thousands of regulators 

who oversee electric utilities who are all scratching 

16 their heads saying, we don't know what informed 

17 consent is. 

18 MR. BROWN: Julian. You're on mute, Julian. 

19 MR. RANGER: I’m going to add to that 

previous question by saying, of course, look 

21 at the digi.me consent certificate because it 

22 hopefully is best practice. But, plus-one to what 

23 you've all said. I think the key point is that with 

24 data portability, access to data is no longer going to 

be the competitive barrier it is. And that's the 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

255 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 point. 

2 Any company can get better data than the big 

3 four or five have today if the individual consents. 

4 And it's the value that you offer individuals that 

causes them to agree to share their data that becomes 

6 the determining competitive practice. So if I can 

7 misquote your own declaration, all companies then 

8 become equal when it comes to data. So data 

9 portability is an absolute key. It doesn't solve the 

other competitive issues, but it solves the data 

11 competitive issues. 

12 MR. BROWN: Thanks. 

13 And, Erika, I'll give you the last word. 

14 MS. BROWN LEE: Well, I know we're over, so 

I don't want to take too much of it. You know, I 

16 think everyone has really expressed a lot of what I 

17 would say. Certainly as individuals become 

18 increasingly aware of the uses of their data, they're 

19 demanding more control, and so portability is an 

accord of that. And to the extent that we can -- as 

21 we see these proposals coming up across, you know, the 

22 various jurisdictions, you know, and hopefully drive, 

23 you know, concerns for interoperability as a 

24 consistent approach, I think we would all benefit. So 

I'll just sort of end my comments there. 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

256 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 MR. BROWN: Thank you all for a really great 

2 discussion this afternoon. Thank you for all your 

3 time and contributions in this process. And thank 

4 you, viewers, for joining us.

 I'm now going to hand it over to the 

6 Director of the Bureau of Competition, Ian Conner, for 

7 some closing remarks. Thanks. 

8 (Brief pause.) 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

257 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 CLOSING REMARKS 

2 MR. CONNER: So thank you all for joining us 

3 today and for participating in today’s timely, 

4 excellent discussion. This was a great event with a 

great lineup of speakers. And while I wasn't able to 

6 attend every session, I am pleased with how the day 

7 did unfold. 

8 Data portability is one of those issues that 

9 cuts across the FTC’s work. It raises questions about 

how best to protect consumers and promote competition. 

11 As a law enforcement agency, the FTC carries 

12 out its dual missions primarily by using its law 

13 enforcement tools. We find and stop conduct that 

14 directly harms consumers or denies them the benefits 

of competition. But just as important as finding and 

16 stopping those law violations is how we fix them. Our 

17 remedies must address the sources of harm. This is 

18 always a challenging exercise, but it may -- it can be 

19 particularly challenging in the digital sectors, 

especially data-driven ones. 

21 More and more, businesses are relying on a 

22 steady stream of data to serve customers, develop new 

23 products, and improve operational efficiencies. 

24 Acquisitions can involve the acquisition of data 

itself or raise concerns because of the ability to 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

258 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 harvest more data or foreclose data access to rivals. 

2 Whether data is available and can be moved is a key 

3 issue in understanding the competitive implications of 

4 both acquisitions and conduct by market participants.

 Today's discussion highlighted some of the 

6 challenges of understanding how data is used and 

7 moved, and, more importantly, how those practices 

8 might affect consumers and competition. Because data 

9 will continue to be important to consumers and 

competition, understanding what is at stake is of 

11 critical importance to the Federal Trade Commission, 

12 and we are grateful to our panelists today that you 

13 have given us so much to consider. Your hard work was 

14 evident and you have provided us must intellectual 

food for thought, so I thank you. 

16 Data's a competitive role and its 

17 portability is not just a question assessed in looking 

18 at the effects of a proposed transaction or practice. 

19 It is key to understanding what it is going to take to 

remedy potential or actual competitive harms from 

21 those transactions and that conduct. Without 

22 understanding the role of data portability, we can't 

23 fully assess the remedy necessary to address those 

24 competitive harms. And making more and more users' 

data more accessible and held by more entities can 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

259 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 itself actually raise privacy and consumer protection 

2 concerns that we must consider in crafting our 

3 competition remedies. 

4 Our panelists have given us a lot to 

consider on these issues, both from a competition and 

6 from a consumer protection standpoint. In addition to 

7 the informative and thoughtful presentations from our 

8 panelists today, I would also like to thank the groups 

9 of individuals who have filed comments in response to 

our initial workshop notice. 

11 I would like to close by acknowledging our 

12 organizers for their enthusiasm, dedication and 

13 patience in assembling today’s program, especially 

14 under such challenged circumstances as have been 

brought on by the pandemic. It takes many people to 

16 organize workshops such as this one, and our team 

17 included staff was from all three bureaus and our 

18 Office of International Affairs. 

19 Thus, although it is late in the day, please 

indulge in some well-deserved expressions of 

21 appreciation from myself in the Office of Policy 

22 Planning, the Bureau of Competition, the Bureau of 

23 Economics and the Bureau of Consumer Protection. 

24 For our planning team, Andrea Zach, Jarad 

Brown, Chris Grengs, Ryan Quillian, Guilherme Roschke, 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555 
5

10

15

20

25

260 

Data to Go: An FTC Workshop on Data Portability 9/22/2020 

1 Kelly Signs, Leah Singleton, Ben Smith, and Kate 

2 White. 

3 For our workshop and logo work, Daniele 

4 Apanaviciute; from our Office of Public Affairs, 

Juliana Henderson and Nicole Drayton; for today's 

6 webcasting, Bruce Jennings and our Web Team; and last 

7 but definitely not least, our events planner, Kristal 

8 Peters. 

9 It is our staff members who make workshops 

like this one possible and productive, and it is our 

11 staff who work tirelessly every day to investigate, 

12 and when necessary, go to court to protect the 

13 American consumers. Thank you very much for your 

14 attendance. Have a good day.

 (Hearing concluded at 2:57 p.m.) 

16 

17 

18 

19 

21 

22 

23 

24 

For The Record, Inc. 

(301) 870-8025 - www.ftrinc.net - (800) 921-5555