privacy data-ownership
Is it legal to ask users to pay for exporting their data?
<p>I have a RescueTime account (rescuetime.com) and I want to export all of my data with its API. However based on my experimentation the API can access data of only three most recent months.</p>

<p>If I want to access reports of last year on the website, I need to pay for a subscription. I believe the API for raw data export has similar restrictions. Is it legal to charge me for my own data?</p>

<p>Thanks to <a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation" rel="nofollow noreferrer">Europe's General Data Protection Regulation (GDPR)</a> the answer to your question generally now seems to be &quot;No, it is not legal to ask users to pay for exporting their data&quot;. Specifically, <a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Information_and_access" rel="nofollow noreferrer">Article 15 grants users (or what the GDPR calls &quot;data subjects&quot;) a right to access their personal data</a>:</p>
<blockquote>
<p>A data controller must provide, upon request, an overview of the categories of data that are being processed (Article 15(1)(b)) as well as a copy of the actual data (Article 15(3)</p>
</blockquote>
<p>and they must do so in a useful way:</p>
<blockquote>
<p>In addition, the data must be provided by the controller in a structured and commonly used standard electronic format. The right to data portability is provided by Article 20 of the GDPR</p>
</blockquote>
<p>With regards to RescueTime specifically: while they still <a href="https://help.rescuetime.com/article/96-premium-reports#exporting" rel="nofollow noreferrer">charge for access to their sorted, filtered, and aggregated report data through the dashboard</a>, they now allow anyone with an account to download a copy of their full, raw logged time data every 30 days: <a href="https://www.rescuetime.com/accounts/your-data" rel="nofollow noreferrer">https://www.rescuetime.com/accounts/your-data</a></p>
<p>They talk more about their compliance with the GDPR in a blog post: <a href="https://blog.rescuetime.com/personal-data-gdpr/" rel="nofollow noreferrer">https://blog.rescuetime.com/personal-data-gdpr/</a></p>

<p>RescueTime Lite has a 3 month report history limit. You agreed to the <a href="https://www.rescuetime.com/tos" rel="nofollow noreferrer">RescueTime TOS Terms of Service</a> when you signed up, and that included the stipulation that you only get 3 months of data with the free plan. That's clearly on the subscription page:</p>

<p><a href="https://i.stack.imgur.com/VWmMq.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VWmMq.png" alt="enter image description here"></a></p>

<p>That's legal. They can charge you for access to more than 3 months of data in the form of a longer subscription. You're not being asked to pay to access your data; you agreed to a free plan that included limited access to that data.</p>

<p>And this is part of what <a href="https://www.rescuetime.com/tos" rel="nofollow noreferrer">you "signed"</a> as a click-wrap contract that is relevant to your dispute:</p>

<blockquote>
  <p>...You understand and agree that the cancellation of your membership or a
  particular component of the Service is your sole right and remedy with
  respect to any dispute with RescueTime. This includes, but is not
  limited to, any dispute related to or arising out of: (a) any term of
  the TOS or RescueTime’s enforcement or application of the TOS; (b) any
  policy or practice of RescueTime, including the Privacy Policy, or
  RescueTime’s enforcement or application of these policies; (c) the
  data available through the Service; (d) your ability to access and use
  the Service; or (e) the amount or type of fees, surcharges, applicable
  taxes, and any RescueTime billing methods. RescueTime, in its sole
  discretion, may terminate your membership and remove and discard any
  of your Recommendations without notice if RescueTime believes that you
  have violated or acted inconsistently with the TOS. RescueTime will
  not be liable to you for termination of your membership to the
  Service....</p>
</blockquote>

<p>You only recourse in a dispute with them is to stop using the service. (Also see <a href="https://law.stackexchange.com/questions/13549/are-terms-of-service-legal-contracts/13571#13571">Are terms of service legal contracts?</a> )</p>

<p>And RescueTime retains all rights to your data. It might be the data that you contributed to the service, but you granted them a permanent license to use it.</p>

<blockquote>
  <p>The license granted in these TOS does not constitute a transfer or
  sale of RescueTime’s ownership rights in the RescueTime Database.
  RescueTime retains all right, title, and interest in and to the
  RescueTime Database including all related intellectual property
  rights.</p>
</blockquote>
