The Commission may prescribe —

(a) circumstances and conditions on which the data subject may exercise the right of data portability; and

(b) the obligations it would impose on a data controller or data processor, or categories of data controllers or data processors, including in relation to costs and timing.