Research On The Legal Application Of The Data Portability Provision Of Personal Information Protection Law

The right to data portability was initially established in Article 45(3)of the Personal Information Protection Law introduced in China in 2021.Although this right is close in form to the right to data portability in the GDPR,it has distinct Chinese characteristics in terms of legislative purpose,regulatory structure,rights model and regulatory level: under the framework of the dichotomy between information and data,the more accurate term for the right to data portability in China should be the "right to transfer personal information".Accordingly,the legal application of this provision must address such Chinese issues as the operability of the rules,the relationship with the relevant rights provisions and the prevention of the risk of transfer of personal information.China’s data portability provisions need to be further clarified in terms of the scope of personal information that can be transferred,the response time of the obligated subject and the restrictions on the exercise of the right,and the relationship between the data portability provisions and related provisions is not clear.In order to make the right to data portability more operational in China,the existing legal regulations need to be further refined.In terms of establishing operational standards: transferable personal information should not be restricted by source,and observation data should not be included in its scope of application;limit information processors to respond to subject requests within one month;determine a uniform information format and differentiated transfer requirements,while setting classification protection standards for data and establishing a three-tier national-provincial-municipal regulatory body for subjects.In terms of clarifying the relationship between the right to data portability and other rights: the exercise of this right should give way to the right to erasure and the right to privacy,while not compromising the public interest and the free realisation of other rights.In terms of information transfer risk prevention: establish a personal-led,secure and orderly flow coexistence application model,while clarifying the division of responsibility between obligated subjects and multiple remedies for right subjects.