September 22, 2020 

Washington, DC 
 

 

OPENING REMARKS 

Andrew Smith 

Federal Trade Commission 

Bureau of Consumer Protection 
 

 

 

 

AN OVERVIEW OF DATA PORTABILITY: 

CONCEPTS AND TERMINOLOGY 

Professor Peter Swire 

Scheller College of Business, Georgia Tech 

Alston & Bird LLP 
 

 

 

 

 

 

 

Overview 

• Swire background, current 125-page study 

• Three reasons for current intense focus on data portability 

• Terminology: PORT 

• “Portability” – transfer data of one person, Right to DP 

• “Other Required Transfers” – transfer data of more than one person 

• Dilemma: antitrust tends to open data flows, but privacy/security tend to 

close them 

• Proposed answer: the Portability and Other Required Transfers 

Impact Assessment (PORT-IA) 

• Show results from sectoral case studies, in U.S. and EU 

• Multi-disciplinary assessment needed 
 

 

 

 

 

 

 

 

Swire Background 

• Now: Georgia Tech: Scheller College of Business 

• Senior Counsel, Alston & Bird LLP 

• Privacy since mid-90’s

• Clinton Administration Chief Counselor for Privacy, in OMB, 

1999-2001 

• Lead author textbook for CIPP-US exam 

• Professor of privacy, cybersecurity, and antitrust 

• Privacy and antitrust FTC testimony 2007 

• Privacy as a non-price/quality aspect of competition 

• Law review article on data portability 2013 
 

 

 

 

 

 

 

 

 

Reasons for Current Interest 

• Right to Data Portability (RtDP) - new laws 

• GDPR, in effect 2018 

• California, in effect 2020 

• Intense policy debates now about digital platforms, both 

privacy and antitrust, both U.S. and EU 

• Multiple sectors in U.S. and EU now have mandated data flows 

• U.S. health care interoperability rule (new) 

• EU Payment Services Directive (new) 
 

 

 

 

 

 

 

 

 

 

Terminology: PORT 

• RtDP is about an individual right to transfer data 

•“portability” is a term of art for transfers of data of one person 

• An individual right to transfer to self or 3d party 

• Actual or proposed mandates to transfer databases, more than one person 

• In Europe, called “data sharing”; vague term, because data is shared in

so many ways 

• My paper proposes “Other Required Transfers”

• PORT: Portability or Other Required Transfers 

• U.S. health care – a hospital has a right to transfer all of its records to a 

new software provider 

• EU Free Flow of Data Regulation - similar 
 

 

 

 

 

 

 

Terminology (2) 

•“Interoperability”

• Proposed definition - the technical ability of two or more systems to 

exchange information 

• Common data formats 

• Common communications protocols 

• Other technical mechanisms to enable operation of two or more 

systems 

• HHS Interoperability Rule (2020) uses the term in 3 ways: 

• Term applies to the above 

• And individual portability of health records 

• And ORT, such as to new cloud provider 
 

 

 

 

 

 

 

RtDP and Privacy: Existing General Laws 

• Article 20 GDPR Right to Data Portability (RtDP) 

• Data subjects have right to receive data they provided to controller 

• Transfer “without hindrance” to another controller

• California Consumer Privacy Act, §1798.100 

• Individual right to access data in a “portable” and “readily usable

format”

• Conclusion: since 2018 implementation of GDPR, RtDP widely 

mandated in EU and U.S. 
 

 

 

 

 

 

 

 

 

The Dilemma: Open or Close Data Flows? 

• Antitrust/competition – many reasons to open data flows 

• Assume some large, valuable databases 

• Easy to assume that in our data economy 

• Idea: if more companies have access to commercially valuable 

data, then more innovation and competition 

• Privacy and Cybersecurity – close data flows 

• What if data gets to the “wrong” people? 

• Cybersecurity – focus on unauthorized access 

• Privacy – focus on what access should be authorized, and often be 

cautious unless there is user consent 
 

 

 

 

 

 

 

 

 

 

Antitrust: Strong Interest in Portability 

• FTC Director of Competition, Ian Conner, in February: 

• “The breadth of additional relief that may be considered include

obligations to provide ... access or other rights [or] data ... to one or

more entrants on specified terms or a non-discriminatory basis.”

• Today’s FTC workshop

• In Europe, Commissioner for Competition Margrethe Vestager discussed 

“the prominent position of data in digital markets”

• “The need to ensure the possibility of entry may argue in favor of

mandating access to data.”

• Portability prominent in new European Data Strategy 
 

 

 

 

 

 

 

Responding to the Dilemma 

• Create a well-designed Portability and Other Required Transfers 

Impact Assessment (“PORT-IA”)

• Similar to Privacy Impact Assessment (U.S.) or Data Protection 

Impact Assessment (EU) 

• New study: methodology 

• Draft “structured questions” for a systematic assessment

• Test the draft questions against multiple case studies 

• Validate the structured questions based on the case studies 
 

 

 

 

 

 

 

 

 

 

PORT-IA: Case Studies to Develop It 

• US/EU Phone number portability 

• Successful, but misleadingly easy case – most users want their (private) 

phone number made known to friends and colleagues 

• US/EU financial services 

• Dodd-Frank requires portability for customer records 

• US/EU health care 

• March 2020 HHS Inter-operability Rule 

• Individuals get portability to smartphone apps 

• Health IT requirements that a covered entity can PORT to a new 

health IT provider 

• Open Data for government databases 

• Arizona & other laws – auto dealers 
 

 

 

 

 

 

 

PORT-IA: The Structured Questions 

• Q1: Define the challenge or opportunity that leads to a possible data 

portability or other required transfers (“PORT”)

• Where does the data come from? 

• Where does it go? 

• What types of data are covered? 

• What specifically are the legal requirements? 
 

 

 

 

 

 

PORT-IA: (Top-Level Questions) 

• Data PORTability Benefits: 

Q2: Assess PORT rationales based on competition 

Q3: Assess innovation and other commercial benefits due to the PORT 

Q4: Assess non-commercial benefits due to the PORT (user control) 

Q5: Assess regulatory or legal benefits of the initiative 

Q6: Assess any reduced benefits due to lack of technical or market 

feasibility 

• Q7: Assess incentives for those presenting evidence of benefits 
 

 

 

 

 

 

 

 

 

 

PORT-IA: Risks and Costs 

Data PORTability Risks and Costs: 

Q8: Assess privacy risks from the PORT 

Q9: Assess security risks from the PORT 

Q10: Assess risks from the PORT that may arise for either security or privacy 

(onward transfer; discriminatory standards) 

Q11: Assess risks to competition from the PORT 

Q12: Assess regulatory or legal risks of the initiative 

Q13: Assess any other significant costs or risks from the PORT, including 

obstacles to adoption 

Q14: Assess incentives for those presenting evidence of risks or cost 
 

 

 

 

 

 

 

 

 

Distinction 1: Before or After Violation? 

• Require portability before or after a violation occurs? 

• Ex ante regulation 

• No need to find an antitrust violation 

• US Dodd-Frank, portability for financial records 

• Ex post remedy 

• Much antitrust discussion in U.S. to date 

• If an antitrust violation, then court can order portability, which is 

less intrusive than breaking up the company 
 

 

 

 

Distinction 2: General or Sectoral? 

• General PORTability rule – applies broadly 

• GDPR RtDP 

• CCPA RtDP 

• Sectoral, in U.S. 

• Phone number portability 

• Financial services 

• HHS interoperability rule 

• Arizona and other auto dealer statutes 
 

 

 

 

 

 

 

 

 

Reasons to consider using a PORT-IA 

• Numerous PORT new laws and proposals 

• Most individuals are not expert in privacy, cybersecurity, and antitrust 

• Need a team to assess PORTability proposals 

• PORT-IA provides a systematic technique to assess 

• Antitrust regulators can realize privacy or security is not simply an 

excuse 

• Privacy regulators can realize how competition benefits individuals, and 

be open to consent for PORTability 

• Private sector can assess the most promising PORT initiatives 
 

 

 

 

 

 

 

 

 

Conclusion 

• Opening up data flows – transferring data – can have great benefits, for 

competition, innovation, freedom of choice, etc. 

• Closing data flows – for privacy and cybersecurity – also can have great benefits 

• PORT-IA provides a method that is agnostic about each proposal 

• What are the benefits and costs from this required transfer? 

• Can we increase the benefits? (such as focusing transfers where will help 

competition) 

• Can we reduce the costs? (such as tailored privacy rules) 

• For this complex and increasingly important topic, the PORT-IA can assist policymakers and companies to reach better decisions 
 

 

 

DATA PORTABILITY INITATIVES IN 

THE EU, CALIFORNIA, AND INDIA 

Panel Discussion: 

Inge Graef, Rahul Matthan, Karolina Mojzesowicz, 

Stacey D. Schesser, and Gabriela Zanfir-Fortuna 

Moderator: 

Guilherme Roschke 
QUESTIONS? 

Email DataPortability@ftc.gov 
 

BREAK 

Return at 10:30 AM (EST) 
 

 

 

FINANCIAL AND HEALTH 

PORTABILITY REGIMES 

Panel Discussion: 

Michael S. Barr, Dan Horbatt, 

Bill Roberts, and Don Rucker 

Moderator: 

Katherine White 
QUESTIONS? 

Email DataPortability@ftc.gov 
 

BREAK 

Return at 12 PM (EST) 
 

 

 

 

RECONCILING THE BENEFITS AND RISKS 

OF DATA PORTABILITY 

Panel Discussion: 

Pam Dixon, Ali Lange, Gabriel Nicholas, 

Hodan Omaar, and Peter Swire 

Moderator: 

Ryan K. Quillian 
QUESTIONS? 

Email DataPortability@ftc.gov 
 

BREAK 

Return at 1:30 PM (EST) 
 

 

 

REALIZING DATA PORTABILITY’S POTENTIAL:

MATERIAL CHALLENGES AND SOLUTIONS 

Panel Discussion: 

Erika Brown Lee, Sara Collins, Bennett Cyphers, 

Michael Murray, and Julian Ranger 

Moderator: 

Jarad Brown 
QUESTIONS? 

Email DataPortability@ftc.gov 
 

 

CLOSING REMARKS 

Ian Conner 

Federal Trade Commission 

Bureau of Competition 
THANKS!