Data portability and the collection of personal data

The current digital recruitment landscape is heavily mediated by algorithmic parsing technologies, requiring job seekers to submit highly standardized, machine-readable professional documents. Traditional word processors frequently introduce formatting anomalies, while legacy web-based resume builders suffer from constrained data portability and complex backend rendering overhead. This report provides an exhaustive architectural evaluation and operational analysis of "Resume Craft," a contemporary Single Page Application engineered to resolve these inefficiencies. Constructed utilizing React 19, Vite, and Google Firebase v12, the platform facilitates real-time data binding, cloud-synchronized persistence, and purely client-side document compilation. By employing the html2canvas and jsPDF libraries, the system translates the Virtual DOM directly into a downloadable Portable Document Format payload within the local browser environment. A comprehensive system architecture analysis is presented herein, contrasting this serverless, client-side generation paradigm against traditional server-side rendering methodologies concerning computational resource allocation, network latency, and semantic data preservation. The findings indicate that while the Backend-as-a-Service approach affords exceptional horizontal scalability, rapid deployment, and high-fidelity authoring experiences, the reliance on HTML Canvas-based rasterization for document generation introduces a critical operational vulnerability. Specifically, the conversion of text into image matrices severely degrades Applicant Tracking System parsing efficacy, effectively rendering the candidate invisible to recruitment algorithms. The study concludes by proposing hybrid rendering architectures, server-side headless browser integrations, and advanced state management migrations to optimize both infrastructural efficiency and the end-user's employment prospects in highly competitive, artificially intelligent hiring ecosystems.

Abstract This is a review of Acker’s Archiving Machines: From Punch Cards to Platforms, which is part of the Information Society series by MIT Press. The book comprises 247 pages; it is organized into Acknowledgements, six chapters (and an epilogue) of 172 pages, followed by Notes, Bibliography, and Index. The book offers an overview of the history of data archiving practices in our societies over the past decades. The initial three chapters establish the socio-technological context of our information society’s history. The rest of the book discusses new possibilities for data portability and big data archiving and examines how methods for collecting personal data are transitioning from personally controlled settings to platforms and data brokers. The author delivers a wake-up call to regain control over our data and keep it for the future, and that is the book’s central takeaway.

Dominant digital platforms in Indonesia control strategic assets in the form of massive user data and search/recommendation algorithms that serve as market access gateways. Exclusive control over these assets creates barriers to entry and forecloses competitors in the digital ecosystem. The Essential Facilities Doctrine (EFD), traditionally applied to physical infrastructure such as ports and telecommunications networks, offers a legal framework for identifying when control over digital assets can be qualified as abuse of dominance requiring access sharing with competitors. This article doctrinally examines whether and how EFD can be applied to non-personal data and algorithms under Article 25 of Law No. 5 of 1999, and explores synchronization with Law No. 27 of 2022 on Personal Data Protection, particularly regarding data portability. The research employs a library-based approach with doctrinal-normative analysis of Law No. 5/1999 and the Data Protection Law, conceptual analysis to develop criteria for "digital essential facilities," and comparative doctrinal analysis of EFD application in the European Union and United States. Findings demonstrate that data and algorithms can be qualified as essential facilities if they cumulatively meet four criteria: (1) controlled by a dominant undertaking; (2) cannot be economically and technically duplicated; (3) access is essential for competing in downstream markets; and (4) no objective justification exists for refusing access. The article recommends that KPPU develop specific guidelines on data and algorithm access, considering efficiency defense, intellectual property rights, and privacy protection. The proposed framework balances competition enforcement with innovation incentives and clarifies when data-sharing obligations arise under Indonesian competition law without requiring legislative amendment.

The emergence of lakehouse architectures represents a paradigm shift in data management, unifying the capabilities of data lakes and data warehouses. As organizations increasingly operate across multiple cloud providers and hybrid environments, the need for sophisticated multi-cloud and hybrid lakehouse strategies has become paramount. This paper provides a comprehensive analysis of multi-cloud and hybrid lakehouse architectures, exploring their fundamental principles, strategic motivations, and implementation considerations. We examine the technical and organizational factors that drive organizations toward multi-cloud strategies, including team-specific platform preferences, vendor lock-in mitigation, and compliance requirements. The paper analyzes critical considerations including cost optimization, security frameworks, performance characteristics, and operational complexity. We investigate essential patterns for cross-cloud operations, including data portability strategies, the trade-offs between open formats and proprietary services, cross-region data sharing mechanisms, and disaster recovery implementations. Additionally, we explore hybrid integration patterns that bridge on-premises infrastructure with cloud environments. Through this comprehensive analysis, we provide decision-making frameworks to help organizations determine when multi-cloud or hybrid lakehouse strategies align with their strategic objectives, while acknowledging the inherent complexities and trade-offs involved in these architectural approaches.

ABSTRACT The rapid growth of the U.S. digital health ecosystem has exposed significant vulnerabilities in health data protection, a direct consequence of a fragmented and outdated regulatory system. This paper employs a Critical Comparative Policy Analysis (CCPA) framework to critically examine the limitations of current privacy regulations, particularly the restricted scope of HIPAA and the disjointed application of general consumer protection laws, which fail to adequately regulate numerous digital health entities. By drawing insights from the European Union's robust General Data Protection Regulation (GDPR), we propose a comprehensive U.S. federal policy framework aimed at addressing these deficiencies. Our framework is built upon core principles such as risk-based data governance, harmonized consent mechanisms, and enforceable individual rights. Key policy recommendations include establishing a dedicated federal regulatory body for non-HIPAA digital health data, implementing tiered data security standards, and promoting data portability and consumer empowerment tools. The discussion section explores the complexities of implementation, considering diverse stakeholder perspectives, technical challenges, and the essential role of public education. A unified and comprehensive federal approach to health data privacy is important to restore consumer trust, foster responsible innovation, and ensure individuals maintain control over their sensitive health information in the evolving digital health landscape.

This study conducts a comparative legal analysis of digital banking regulations in Turkey and the European Union (EU), intending to identify structural divergences and opportunities for regulatory alignment. Focusing on three key legislative pillars in the EU—PSD2 (Second Payment Services Directive), GDPR (General Data Protection Regulation), and DORA (Digital Operational Resilience Act)—this research conducts a comparative evaluation of digital banking regulations. It assesses how Turkey’s framework, primarily shaped by Law No. 6493 and the Regulation on Digital Banks, aligns in terms of legal scope, implementation, and institutional preparedness. The analysis finds that although Turkey has made significant regulatory progress in establishing a legal basis for digital banking, significant gaps remain. Open banking practices are underdeveloped, with limited API integration and insufficient legal clarity for third-party providers. Personal data protection, governed by Turkey’s KVKK, lacks full alignment with GDPR standards, particularly in terms of user consent, data portability, and supervisory authority. Moreover, unlike the EU, Turkey does not yet have a comprehensive legal framework similar to DORA to address digital operational risks and ensure ICT resilience in the financial sector. Based on these findings, the study concludes that Turkey’s current framework does not fully support the creation of a resilient, secure, and innovation-driven digital banking environment. It recommends targeted reforms, including the adoption of cybersecurity legislation, the strengthening of regulatory agencies’ technical capacity, and the promotion of fintech–bank collaboration. Enhancing consumer trust and legal certainty through EU-compatible data protection and open banking standards is also critical. These steps are essential not only to improve financial inclusion and innovation domestically but also to enhance Turkey’s alignment with the EU digital finance ecosystem.

This paper explores issues linked with abuse of dominance in emerging markets, focusing on the interaction between digitalization and the global push toward decarbonization. Emerging markets face challenges unique to themselves: underdeveloped frameworks, limited capacities to enforce, and dependence on dominant foreign firms in digital as well as traditional sectors. The study discusses how data-driven monopolies, algorithmic collusion, and sustainability initiatives can enhance or obfuscate dominance abuse. Using qualitative methodology, this paper will explore cases, legal frameworks, and academic literature to recommend new ideas. These ideas include data portability; enhanced transparency in algorithms used by online platforms; and what might be described as a ‘green dominance’ doctrine balancing fairness in markets against environmental policy objectives. By responding to those challenges that competition law should adopt for the newly emerging markets, this research underlines avenues toward promoting competitive equity and sustainable development.

Fostering the interplay between data portability and competition law: <i>the Brussels effect</i> and its localization in Korea

The European Unions Data Act (DEAP) establishes a robust legal framework to regulate cross-border data flows, emphasizing data accessibility, privacy protection, and innovation. This study critically evaluates DEAPs provisions, highlighting its strengths in promoting standardized data-sharing mechanisms and user rights, while identifying limitations, such as potential compliance burdens for businesses and ambiguities in enforcement across jurisdictions. Through a comparative analysis with Chinas Personal Information Protection Law (PIPL) and Cybersecurity Law (CSL), the study explores how DEAPs balanced approach could inform Chinas data governance regime. It examines challenges in EU-China data transfers, including divergent regulatory philosophies and technical barriers, and assesses DEAPs alignment with global data governance paradigms. The analysis suggests that China could adapt DEAPs principles, such as enhanced data portability and interoperability, to bolster its digital economy while addressing sovereignty concerns. By fostering equitable data flows, DEAP offers valuable lessons for China to refine its data governance framework, potentially facilitating smoother EU-China digital trade relations.

The rapid digital transformation in education has amplified the demand for secure, verifiable, and student-controlled identity management systems. Traditional identity models, dependent on centralized authorities, face challenges of privacy breaches, data silos, interoperability gaps, and administrative inefficiencies. Blockchain-based decentralized identity (DID) frameworks provide a disruptive alternative by enabling self-sovereign identity, cryptographic security, and tamper-proof verification mechanisms. This manuscript investigates the application of blockchain-enabled decentralized identity systems in education, with a particular focus on student credential verification, transcript management, cross-institutional mobility, and regulatory compliance. The study synthesizes theoretical foundations, existing literature, and practical deployment cases to evaluate the potential of DID in streamlining admission procedures, preventing credential fraud, and promoting global recognition of qualifications. Methodologically, it combines conceptual modeling with statistical analysis of adoption readiness among educational institutions and simulation-based experiments to assess system scalability and resilience. The results demonstrate that blockchain-based identity networks outperform conventional models in terms of trust, data portability, transparency, and fraud prevention, while also presenting new challenges related to governance, interoperability, and scalability. Simulation research indicates that DID frameworks reduce verification latency by 45%, lower credential fraud incidents by 60%, and enhance cross-border recognition efficiency by 72%. The findings highlight blockchain’s capacity to redefine educational trust ecosystems, offering self-managed digital identities that empower learners while reducing institutional overhead. However, unresolved concerns regarding legal frameworks, standardization, and infrastructural readiness must be addressed to realize large-scale adoption. This research contributes to the evolving discourse on educational technology by providing a comprehensive evaluation of decentralized identity models, emphasizing their transformative potential in reshaping student-centric and globally trusted digital education ecosystems.

This study evaluates the suitability of the Draft Artificial Intelligence Basic Law (2024) for public human resource management (PHRM) in Taiwan, focusing on data privacy, algorithmic fairness, decision transparency, and accountability. PHRM involves recruitment, evaluation, and appointment processes that extensively apply personal data and algorithms, entailing significant legal and ethical risks. Using qualitative methods, this study compares Taiwan’s approach with the EU’s risk-based and the US’s market-driven models. Triangulation and institutional analysis are employed to assess the draft’s provisions on legitimacy, fairness, and accountability. Findings showed the draft omits key rights such as data portability, the right to be forgotten, and data protection impact assessments (DPIA), and lacks algorithm audits, disclosure, and appeal mechanisms. These gaps may lead to bias, opacity, and violations of rights, with risks amplified under conditions of regulatory flexibility. The novelty of this study lies in its integration of AI governance with the specific context of public human resource management in Taiwan, an area where legal-ethical risks are high but underexplored in existing literature. Unlike prior research that mainly addresses AI governance in commercial or general administrative domains, this study highlights how the unique features of PHRM—such as recruitment algorithms and performance evaluation systems—intersect with data rights and accountability requirements. By situating the Draft AI Law within this sensitive policy arena, the study extends ICT adoption theories beyond traditional models emphasizing usefulness and ease of use, foregrounding public values, ethical safeguards, and institutional legitimacy. From a policy perspective, this study recommends strengthening data rights, establishing compliance and audit systems, creating independent regulatory bodies, and implementing disclosure requirements, thereby providing both theoretical and practical insights for AI governance in Taiwan and the broader region.

The exponentially increasing capability of data engineering has radically redefined the interaction between individuals and their personal information, subjecting privacy to unprecedented threats as well as informed consent and democratic governance in digital environments. Modern enterprise analytics infrastructures illustrate unrivalled computational power, allowing a distributed architecture to enable real-time processing of behavioral data while supporting holistic digital profile formation through advanced integration methods. Stream processing platforms like Apache Kafka and Apache Flink, along with distributed computing designs like Apache Spark, make petabyte-level analytics possible that operate at the speed and level of complexity threatening traditional consent models. Technical data collection systems running on JavaScript tags, tracking pixels, and integrated software development kits operate below the thresholds of user awareness, making older consent models untenable because privacy policies demand comprehension capabilities beyond reasonable human ability. Enterprise analytics-driven automated decision-making systems create new social stratification mechanisms via black-box algorithmic processes that decide access to banking services, jobs, insurance, and criminal justice outcomes based on non-observable and unchallengeable analytical models. Governance norms like GDPR and CCPA are social attempts to reclaim democracy over data engineering practices, placing technical demands of data portability, erasure, access, and correction that challenge established architectural paradigms. Still, much remains unmatched between a legislative purpose and technical application reality, with technology developing faster than regulation has adapted, and enforcement still under-invested compared to a modern scale of data processing operation intensity.

Abstract The European Digital Markets Act (DMA) is a regulatory framework designed to ensure fair and contestable markets in the digital sector by imposing specific prohibitions and obligations on the core platform services of so-called gatekeepers. As the DMA is the first regulation of its kind worldwide, regulative uncertainties in its application need to be identified and addressed for its future review by policymakers. This is particularly true for the measures on interoperability and data portability. This paper examines key economic concepts and, thus, the reasoning behind the DMA’s interoperability and portability rules, assessing their theoretical impact on competition in digital markets. It shows that (i) the horizontal interoperability measures for number-independent interpersonal communication services are not necessarily economically justified and their current design might even lead to less competition; (ii) the effects of vertical interoperability instruments seem to be more pro-competitive for hardware, namely near field communication, while the outcome for software remains difficult to predict due to their high degree of generalization; and (iii) data portability can contribute to more competition, but its impact remains highly dependent on the effectiveness of the interoperability regime. This paper concludes that interoperability, especially in its vertical form, and data portability rules in the DMA have the potential to improve competition in digital markets. However, policymakers need to address the identified design flaws to enhance its effectiveness and efficiency. This includes establishing common standards for functionalities and data access conditions, as well as a clarifying the relationship between these measures and existing intellectual property, data protection, and trade secret rules. English Summary: The European Digital Markets Act (DMA) aims to ensure fair and contestable markets in the digital sector by imposing specific prohibitions and obligations on core platform services of gatekeepers. As the first regulation of its kind, it faces regulatory uncertainties, especially regarding interoperability and data portability. This paper examines the economic rationale behind the DMA’s rules and their theoretical impact on competition. It finds that (i) horizontal interoperability measures for number-independent communication services may not be economically justified and could reduce competition; (ii) vertical interoperability measures are more pro-competitive for hardware like near field communication, but their impact on software is uncertain; and (iii) data portability can enhance competition but depends on the effectiveness of the interoperability regime. Policymakers must address design flaws and establish common standards to improve the DMA’s effectiveness.

Many jurisdictions have implemented data portability regulation (DPR) that requires that Data Controllers (DCs) enable users to download their personal data so that they can port their data to competing DCs. The intention of DPR is to return partial control of data to users, improve user choice of DCs, increase DC participation in the market, and reduce industry concentration. To achieve this, if nonmonetary corrective measures (e.g., warnings, orders to comply) to obtain portability compliance fail, then DPR allows policy-makers to impose fixed or variable (based on revenue) fines on DCs that do not comply. Additionally, policy-makers may invest to decrease compliance costs for DCs. We model this interaction as a two-stage game where in the first stage the policy-maker sets fines and makes investments. In the second stage DCs decide whether to participate in the market, and if so whether to comply with DPR. Contrary to the current regulatory objectives, we find that with partial compliance both fines and investments decrease DC participation and increase industry concentration. Comparing the use of fines and investment to achieve a predetermined level of compliance, the use of fixed fines has a smaller (larger) collateral effect on concentration (participation) than either variable fines or investment. Once all DCs that participate comply—full compliance—then additional investment increases participation. Moreover, full compliance and full participation can occur only if there is a DPR-induced demand expansion, such as from multihoming, and investment is the only instrument that can attain this outcome. This paper was accepted by Hemant Bhargava, information systems. Funding: This work was supported by Natural Sciences and Engineering Research Council of Canada [Grant RGPIN/06571-2015]; Social Sciences and Humanities Research Council of Canada [Grant 435-2022-0460]. Supplemental Material: The online appendix is available at https://doi.org/10.1287/mnsc.2024.08404 .

While Personal Data Stores (PDSs) aim to support personal data management and enable data portability across applications, user interest remains limited. This study explores the factors influencing user adoption and willingness to share data across four PDS use case scenarios—HR, Media, Finance, and Health—through an iterative research-through-design approach. The study combined a large-scale survey (n = 2,335), prototype development, expert reviews (n = 10), and user testing (n = 17). Findings reveal that although security concerns persist, participants responded positively to the PDS concept, particularly for use cases that reduce administrative burdens. Notably, users who engaged with the prototype reported higher intentions to use and greater willingness to share data than those evaluating written scenarios. These findings highlight the importance of tangible user experiences in shaping perceptions of PDSs. The study concludes with actionable recommendations and an illustrative prototype to inform effective user-centred PDS implementation.

ABSTRACTIn the sharing economy, consumers are routinely rated based on their behavior in marketplace transactions. Increasingly, these ratings are migrating across platforms—for example, individuals may display their Uber rating on a dating site. This growing practice, further enabled by recent advances in data portability, raises a critical question: How does the disclosure or concealment of sharing economy ratings influence judgments in unrelated digital contexts? The current research investigates the broader implications of quantifying and evaluating consumer performance through sharing economy ratings across domains. In four experiments, we find that concealing (vs. revealing) one's sharing economy rating (e.g., Uber rating) on an unrelated platform reduces one's trustworthiness and appeal to a level at or even lower than that of a revealed low rating. However, these effects emerge only when the sharing economy rating is perceived as diagnostic. Concealing other, less diagnostic information (e.g., streaming platform preferences) does not decrease trustworthiness or appeal. This research advances sharing economy, privacy, and signaling theory by revealing that sharing economy ratings function as diagnostic signals beyond their native platforms, that withholding personal data can incur reputational costs when such data is perceived as diagnostic, and that data portability—despite its consumer‐centric promise—may unintentionally expose individuals to reputational harm. We conclude with a discussion of the implications for consumers, platforms, and policymakers.

The 2023 Proposal for a Financial Data Access Regulation (FIDA) aims to significantly enhance competition in the financial services sector by extending data portability rights far beyond the scope initially established by the Second Payment Services Directive (PSD2). Under FIDA, consumers gain extensive rights to authorize third-party access to previously siloed financial data, thereby promoting competition among incumbent institutions and new entrants. Yet, FIDA’s ambition hinges on structured collaboration among competitors—raising significant competition law concerns under Article 101 TFEU. FIDA explicitly recognizes this risk. Its governance framework, particularly Article 10, clearly incorporates key principles of EU competition law, closely aligning financial data sharing schemes with the European Commission’s Guidelines on the applicability of Article 101 to horizontal cooperation agreements. However, FIDA does not directly regulate or prescribe the substance of the standards themselves. This raises an important question: can a governance framework alone, without mandatory substantive standards, effectively prevent competition risks in the schemes? This article argues that the absence of prescribed substantive standards under FIDA could lead to competition issues similar to those observed under PSD2, where fragmented technical interfaces caused interoperability failures, insufficient incentives, discouraged investment in data-sharing infrastructure, and market trust declined, thereby limiting consumer uptake. This risk holds implications beyond financial services, serving as an important reference point for the broader EU agenda on sectoral data spaces and open data initiatives, where similar governance challenges and competition risks are likely to emerge.

The integration of Digital Twin (DT) technologies and Life Cycle Assessment (LCA) in the construction sector presents significant opportunities for improving resource efficiency, enhancing material traceability, and supporting circular economy strategies. However, the lack of standardized methodologies and data interoperability remains a major barrier to effective implementation. This study introduces the Forest to Building Digital Framework (F2BDF), a structured approach that combines DT technologies, actor-based LCA, and supply chain management digital tools to optimize the environmental performance of wood construction. The research is among the earliest to develop a digital system throughout the life cycle from the extraction of raw materials to the construction. The framework is built on a hierarchical structure where digitalized different actors’ subsystems within the supply chain generate real-time production data, feeding into a centralized backbone network. These data are the foundation for a decision support module designed to assess environmental impacts and evaluate circularity scenarios. The study integrates geospatial analysis (GIS), real-time manufacturing data (CAx and BIM), and digital product information. The validation process in an industrial setting exhibits how enhanced data integration can support real-time sustainability assessments with primary foreground data and optimize resource utilization. The results included enhanced material circularity options, data portability, and building materials tracking, as well as semi-automatically contributing to achieving more dynamic and actor-based LCA information. By digitizing multiple stakeholders and making product, production, and transportation data accessible via APIs (Application Programming Interfaces), widespread digital frameworks can offer a scalable solution for improving sustainability across the wood construction sector.

Bank adoption of external application programming interfaces (APIs) enables bank customers to share their data more efficiently and securely with other third-party financial institutions and FinTechs, thus enabling open banking and bank data portability. Analyzing determinants of API adoption by U.S. banks from 2007 to 2022, we show that banks that adopt APIs tend to be larger and face lower competitive pressures. The announcement of President Biden’s executive order in July 2021 encouraged increased bank data portability and led to an acceleration in bank API adoption. Banks that adopt APIs experience an increase in Return on Assets ( ROA ) and Tobin’s Q and a decrease in loan loss provisions, particularly after President Biden’s executive order. We find that APIs’ ability to facilitate data access and sharing improves bank information flows and supports banks’ loan and deposit services which form the foundation of notable improvements in bank performance. Overall, our results on the determinants and implications of API adoption have important policy implications for the discussion on open banking regulation and bank data portability.