Hosted by Carole Piovesan
Areas of Focus: Trust and Privacy
Highlights of Discussion
In the data-driven digital age, governments and regulators need to stop looking at economic and privacy issues separately. The way privacy is regulated directly impacts the competitiveness of Canadian firms but the economic implications seem to be separate to governments’ decisions on privacy. Balancing the issues of privacy, competitiveness and Canadian values can better support innovation and public trust.
The general public is uninformed on the implications of providing access to their data. Businesses should not be cast as rivals to customers but firms still need to take responsibility for helping individuals navigate privacy issues. This can be done through using plainer language or even infographics. If people in the public knew that providing their data could do something impactful (e.g. cure cancer), they would be much more open about sharing their information. In contrast, a backlash against providing data to firms can limit innovation.
The General Data Protection Regulation (GDPR) is setting an ad-hoc standard for many companies since they do business in the European Union. Canada’s principals based privacy regime under PIPEDA is preferred by many Canadian companies and researchers. At the same time, it is very important for Canada to maintain its adequacy status under GDPR. In advance of any legislative changes in Canada, it would be prudent to evaluate the impact of the GDPR and any lessons that could be learned. The punitive measures under GDPR are especially daunting to Canadians.
Government regulations do not move at the speed of business. This creates uncertainty to investing in new technologies and barriers to innovation. The Government needs to create more legislative certainty to promote the development of disruptive technologies, and look at how its policy toolbox can support experimentation (e.g. regulatory sandboxes).
Key Opportunities / Considerations / Challenges
It is hard trying to design the right privacy legislation and regulations – balancing what is enough protection for Canadians, with how to integrate into global privacy regimes, and not inhibit innovation.
When asking for consent to use data, it is difficult to identify what the explicit use of the data will be. Researchers often don’t know how they’ll use data before they start manipulating it and so limiting their ability to use data in different ways may limit innovation and the development of new solutions.
Although it is important to ask for consent, individuals may eventually feel overloaded by the number of times they are asked to provide it, which may devalue the process altogether. Industry must work with policymakers to simplify this process, while making it meaningful.
There is a growing expectation that firms de-identify data sets but, with the development of technology, this is becoming harder to do in practice. Some types of data are impossible to anonymize. For example, how can you anonymize the owner of a house?
Cybersecurity is an important issue that government needs to help Canadians to navigate, particularly small businesses. Too many Canadians do not take the proper precautions and are victims of cybercrime. These problems will only increase as more IoT devices are introduced into the home because they are often less cyber-secure. Small businesses are also naïve about their cybersecurity and often fail when they are hacked.
Ideas / Outcomes
Small and medium businesses face additional challenges for complying with privacy standards since they don’t have the same resources as larger firms. The Government could consider a sliding-scale of privacy standards depending on the size of firm and type of data. This would exempt smaller firms so that they could grow. The Government could also provide additional advisory services to help these firms to comply with privacy regulations.
Consider creating voluntary standards for privacy with a sliding scale for small, medium and large firms. This will empower customers by showing them who will be most responsible with their data. Firms could be further encouraged to adopt these standards through incentives (e.g. tax credits). At the end of the day, being trusted and having a good reputation for protecting data and privacy is a brand advantage for companies in the digital economy.
Data monopolies of big international firms hinder competition in Canada’s digital economy. The Government could play a convening role to help firms to pool their data in a way that respects the public’s privacy. If Canadian companies share data amongst themselves they would be more competitive. Canadian firms and researchers would also like more access to government data to help develop and commercialize innovations faster.
The Government could look into developing data trusts to handle people’s data. This will involve informed representatives controlling how firms can use personal data. It may devalue the data, since more firms can access it, but it will also provide data to more firms who can then use it to commercialize a broader range of innovations. How these trusts work must favor innovation, since similar models are already used in the healthcare space but are not timely and flexible in supporting innovation.
Firms need to be incentivized to be more cyber-secure. For instance, cyber-insurance could be mandatory for any company the Government does business with.
The Government could look at how to introduce more sandboxes to foster innovation. This encourages new partnerships by bringing companies of all sizes, universities and researchers together, and allowing them to use data with fewer restrictions in a given context.
- Bell Canada
- Centre for International Governance Innovation (CIGI)
- Compute Ontario
- Dell EMC
- Georgian Partners
- GYBO Robotics Network
- Institute for Clinical Evaluative Sciences
- Intact Financial
- Nestle Canada
- Boxx Insurance
- Servo Annex
- Shaw Communications
- TD Bank
- Toronto Public Library
- Toronto Real Estate Board
- UofT Undergraduate AI Group
- Workplace Safety & Insurance Board (WSIB)
- York University
- Self Care Analytics
- Sidewalk Labs
- University Health Network
- Entertainment Software Association of Canada
- Total System Services (TSYS)
- University of Guelph
- B Lab Canada
- Mastercard Canada
- Vector Institute
- Advancing Prosperity
- Simon Fraser University
- Thomson Reuters
- Canadian Bankers Association