Data Portability Revisited: Toward the Human-Centric, AI-Driven Data Ecosystems of Tomorrow
Authors: Mark Fenwick, Michael Fertik, Paulius Jurcys, Timo Minssen
Organizations: Graduate School of Law, Kyushu University, Japan · Heroic Ventures · Vilnius University Law Faculty · Center for Advanced Studies in Biomedical Innovation Law (CeBIL), Copenhagen University Faculty of Law
This Article critically examines the contemporary regulatory framework and discourse surrounding data portability in the United States. Using recent regulatory developments in the European Union as an illustration, this Article suggests that although data access and portability are identified as vital issues in multiple policy instruments, in its current iteration, at least, legal conceptions of portability continue to reinforce the interests of service providers and data controller enterprises rather than individual end users. This Article argues that a paradigm shift toward a more human-centric data approach to data governance must occur, under which data would be recognized as fundamental to an individual's identity in a digital age. Therefore, it should be placed in the hands of individuals rather than service providers or data controller enterprises. This Article considers technical and market trends in the European Union that reveal and facilitate such a change. It suggests that regulatory frameworks should better align with these technological and market developments to encourage change-inducing trends among market actors. In short, this Article identifies a transformative approach to data portability that empowers individuals with the freedom and ability to aggregate their data in secure personal spaces under their control or dominion. Such a human-centric perspective on data portability is crucial in building Artificial Intelligence (AI)-powered applications for individual consumers that can pave the way for the human-centric, AI-driven data ecosystems of the future.
The EU AI Act constitutes an important development in shaping the Union's digital regulatory architecture. The Act places fundamental rights at the heart of a risk-based governance framework. The article examines how the AI Act institutionalises a human-centric approach to AI and how the AI Act's provisions explicitly and implicitly embed the protection of rights enshrined in the EU Charter of Fundamental Rights. It argues that fundamental rights function not merely as aspirational goals, but as legal thresholds and procedural triggers across the lifecycle of an AI system. The analysis suggests that the AI Act has the potential to serve as a model for rights-preserving AI systems, while acknowledging that challenges will emerge at the level of implementation.
Georgios Pavlidis
Associate Professor of International and EU Law, Director of the Jean Monnet Center of Excellence AI-2-TRACE-CRIME, Neapolis University Pafos (NUP), School of Law
Artificial intelligence reaches the land registry not as another tool but as a value chain that turns data into intelligence and intelligence into economic value. This paper argues that the decisive legal move is to place validity, a functional, second-order concept, at the centre of that chain. Rights, liability and supervision organise around it. It traces three impacts.Registry information becomes smart data, governed simultaneously by registry law, the GDPR, the European data acts and the AI Act. Control emerges as the operative concept for digital representations of real estate, whose proprietary effect depends on anchoring to the register. In a hybrid society of human and artificial agents, the registry becomes the public node of validity, with blockchain complementing rather than replacing it. Across three legal cultures, the registra's value migrates from processing documents to guaranteeing validated data,making validity an asset for the UNO Sustainable Development Goals.
Pompeu Casanovas, Carmen Pastor Sempere, Marina Echebarria Saenz
IIIA-CSIC · University of Alicante · University of Valladolid
This paper examines where final authority should sit once capable AI systems are embedded in organizational workflows. It compares two governance models. The first, frontier-provider sovereignty, assigns privileged authority to the provider of the most capable models and is reflected in contemporary arguments for frontier-model testing, release gating, transparency duties, and compute-related controls. The second, action-centered deployer sovereignty, places final authority over high-impact actions with the organization that authorizes the action, embeds it in a business process, and bears the downstream legal, operational, and commercial consequences. The paper combines comparative reading of public governance frameworks with implementation-informed analysis of runtime heterogeneity and enterprise control requirements. It compares EU AI Act guidance, the NIST AI Risk Management Framework, Singapore's Model AI Governance Framework for Agentic AI, recent Japanese AI policy instruments, and Canada's voluntary code and managerial guidance. Across these materials, the paper finds stronger support for distributed operational accountability than for unilateral frontier-provider control. It further argues that rapid enterprise adoption, declining provider transparency, and widening control gaps increase the value of a portable governance layer centered on governed action rather than on provider-native session objects. The conclusion is layered rather than absolutist: strong upstream authority remains justified for frontier capability gating, but final authority over concrete enterprise action is better located with the deployer and consequence-bearer.