Ironically, GDPR is what Mendeley used to justify the encryption [0]. Obviously, complete rubbish. It would be interesting to see what happens if people start asking for their data in a portable format though.

[0] https://twitter.com/mendeley_com/status/1006915998841221120

Oh come on...

EU citizens have an explicit right to a direct transfer in to Zotero.

https://gdpr-info.eu/art-20-gdpr/

"Right to data portability"

>The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

> the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and the processing is carried out by automated means.

>In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

Good point. I'm trying to get my dump from them.