Data Portability’s Cybersecurity Paradox: When Protecting Consumer Data Restricts Competition

This article examines portability’s cybersecurity paradox: the controls that protect consumers can also shield incumbents from the competition portability is meant to enable — a tension sharpened by AI agents acting on consumers’ behalf. Drawing on the DMA, the CFPB’s 2024 open-banking rule, and other access regimes, the author proposes a five-part framework for testing security-based restrictions: identify the risk, ground the control in evidence, apply rules evenhandedly, respond propo