Hacker News Reader

Comment by tpmx | Hacker News Reader

Right. Forgot that.

Regarding GDPR and data portability:

In practise you can expect to receive a (link to a) zip file via email with a bunch of XML documents after going through a convoluted dance. Also, it often takes some time (days) to receive the data. Basically, nothing that can easily be automated by a third part service - you need user auth of the requesting user to access the data.)

"You must comply with a request for data portability without undue delay and at the latest within one month of receipt of the request"

I guess it's because data portability isn't trivial, and it was wasn't the key aspect of GDPR.

As a contrast: The EU mobile number portability legislation says: max 1 working day.

View on HN

Carriers pay to port numbers to a neutral third party that maintains the Number Portability service. In the US, that used to be $6 per number port (which is basically just a DB row update operation) but a new vendor has reduced it by more than half. Carriers view that expense as pocket change as subscriber acquisition cost is well over $100 in total.

Without a legislative mandate and a third party integration partner that assures the port is successful, seems unlikely that a market leader like Spotify would ever allow them to exist.

Yeah, data portability is hard to define as a strict standard as it is extremely product specific.

Even when we implemented it for my last company, we did JSON exports on signed S3 paths. I thought structured data was the easiest way for any competitor or user to use their data.

I feel they could have included a clause that would let a designated third party access the extracted data on the requester's behalf in an automated way.

I think it could have worked pretty well to keep it as vague as that. (The auth aspects would need more detail, obviously.)

I don't think data format fragmentation is a big issue (just implement adapters for the top five competitors in your market...), but rather the impossibility of doing it in a quick and seamless manner on behalf of someone wanting to migrate their data to your service from some other service.

> I feel they could have included a clause that would let a designated third party access the extracted data on the requester's behalf in an automated way.

Yeah, this would have been nice. I am not sure if legally you could enforce that as automation itself is vague and depends on the source and target both.

> I don't think data format fragmentation is a big issue (just implement adapters for the top five competitors in your market...), but rather the impossibility of doing it in a quick and seamless manner on behalf of someone wanting to migrate their data to your service from some other service.

I think if companies were being honest in their efforts for data portability, as a first step they would not try to reap the benefit of the 30 day window by as much as they can.

For most, it should take mins or hours to get the export yet the best turnaround I have seen from any service has been from Tinder, it was I think 3 days.

This really depends on the service. In my experience, Netflix and Facebook took only a few hours to export the data.

> just implement adapters for the top five competitors in your market

Is there anything to prevent the export file format from shifting regularly? You know, for ongoing product improvement reasons, naturally.

Reply on news.ycombinator.com