The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used, and machine-readable format, and shall have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
The processing is based on consent pursuant to Article 7, or on a contract to which the data subject is party; and
The processing is carried out by automated means.
In exercising the right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible. Controllers shall not erect unnecessary technical barriers to such direct transmission.
The exercise of the right referred to in paragraph 1 shall be without prejudice to Article 12. The exercise of the right to portability shall not constitute a request for erasure unless the data subject expressly indicates otherwise.
The right to data portability shall not adversely affect the rights and freedoms of others. In particular, where the personal data concern more than one data subject, the controller shall not transmit such data where doing so would infringe upon the data protection rights of another data subject, unless appropriate measures are taken to safeguard those rights or unless the other data subject has consented to the transmission.
The data referred to in paragraph 1 shall be provided in a format that complies with open, interoperable standards where such standards exist and are reasonably applicable. The controller shall document the format in which the data are provided and shall make available to the data subject a description of the structure and content of the data sufficient to enable its meaningful reuse.
The controller shall respond to a request under this Article without undue delay and in any event within thirty days of receipt of the request. That period may be extended by a further thirty days where necessary, taking into account the complexity and volume of the data to be ported. The controller shall inform the data subject of any such extension within the initial thirty-day period, together with the reasons for the delay.
The right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.