gdpr data-protection export
To comply to GDPR, are social networks required to have a button to &quot;Export your Data&quot;?
<p>Major social web services (such as Facebook, Instagram, Twitter, Microsoft and Google) have a page where you can click a button to export your data - posts, account data, login information, meta data, images, etc...</p>

<p>Most other companies (such as Insurance, Banks, etc) only allow exporting your data if you email/phone them with the request, not providing a way to do that through their website.</p>

<p>For social network websites to comply with GDPR, is there anything that says that they <strong>must</strong> provide a button to export user data, or is it enough to accept requests through emailing and the staff will securely send a PDF with the export?</p>

<p>In short, no.</p>

<p><a href="https://eur-lex.europa.eu/eli/reg/2016/679/oj" rel="noreferrer">Article 20 of the GDPR</a> covers the “Right to data portability”, which essentially says two main things:</p>

<ol>
<li>The data subject had the right to an exported copy of their personal data in a common format</li>
</ol>

<p>And</p>

<ol start="2">
<li>The data subject has the right to have this data transmitted directly from one controller to another where technically feasible.</li>
</ol>

<p>Neither of these rights as stated in the GDPR require the data controller to provide a button to initiate either a data export or a transfer to another controller.</p>

<p>It's definitely enough to respond to requests the controller is sent - note this could be by any means, e.g. email, twitter if you operate an account, etc. The controller would still need to do appropriate identity checks.</p>

<p>However a PDF isn't a suitable response to a data portability request. The format must be commonly-used, machine-readable and interoperable. Something like CSV, JSON, XML. A PDF, that would at a minimum require scraping to extract the data in a reusable form, would not meet the requirements.</p>
