Consultation on Big Data and Innovation Discussion Paper

Submission to the Competition Bureau

November 17, 2017

Competition Promotion Branch
Competition Bureau
50 Victoria Street
Gatineau, Quebec K1A 0C9

Re: Consultation on Big Data and Innovation Discussion Paper

Introduction

The Office of the Privacy Commissioner of Canada (OPC) appreciates the opportunity to provide a submission to the Competition Bureau (CB) in relation to its discussion paper: Big data and Innovation: Implications for Competition Policy in Canada.^{Footnote 1}

Our Office understands that Big Data poses particular challenges in today’s digital economy. We have singled out this issue in our Office’s strategic privacy priorities^{Footnote 2} and in our work on improving the consent model in today’s digital economy.^{Footnote 3} In our position on consent, we acknowledge that consent in big data situations may be difficult if not impractical, and thus we have recommended that Parliament consider new exceptions to consent.^{Footnote 4}

The Competition Bureau’s discussion paper argues that the collection, use, and disclosure of personal information in Big Data raises questions with respect to competition regulation analysis. Our Office’s explicit mandate relates to the collection, use and disclosure of personal information under Canada’s federal privacy sector privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA). This places our Office in a unique position to engage in a meaningful dialogue with the Competition Bureau on these challenges.

Our Office agrees with the position in the discussion paper that a number of regulators see Big Data as a challenge from a variety of consumer protection perspectives. Just as high velocity and volumes of data have privacy implications – there are risks associated for other consumer protection regulators. As a result, our Office would be pleased to discuss how the OPC and the Competition Bureau could cooperate in addressing these emerging challenges, in an effort to help business better understand their compliance obligations to better protect and develop the trust of individuals as it pertains to Canada’s digital economy.

This offer of collaboration dovetails with the suggestion in the discussion paper that, in today’s world of Big Data, even though privacy-related analysis may be distinct from competition analysis, there are areas that may be of mutual interest between regulators, such as the OPC and Competition Bureau. That such areas of mutual interest exist is already well demonstrated through our joint responsibility for enforcing Canada’s Anti-spam Legislation, together with our colleagues from the Canadian Radio-television and Telecommunications Commission (CRTC).

We also note that there is an increasing global interest with respect to the discussions about privacy, consumer protection and competition – which is evidenced by international initiatives such as the Digital Clearing House^{Footnote 5} and the connection between the International Consumer Protection and Enforcement Network (ICPEN) and the Global Privacy Enforcement Network (GPEN).^{Footnote 6}

While privacy and competition regulatory analysis is distinct, there are common challenges for how Big Data factors into this analysis. This has already required greater collaboration among regulators. For example, “Freemium” business models and companies that use personal information are challenging how businesses address privacy and consumer protection. This new environment has implications for a number of different regulators.

Our Office continues to work with our international counterparts, and in addition we have collaborated with international competition/consumer protection authorities.^{Footnote 7} As well, we look forward to our ongoing and continued discussions with the Competition Bureau.^{Footnote 8}

Collection, Use and Disclosure of Personal Information

The discussion paper makes a number of references to deceptive marketing and the collection, use, and disclosure of personal information and how this could factor in to competition regulatory analysis.

These issues are core concepts with respect to privacy protection that currently exist in PIPEDA. As the purpose of PIPEDA states:^{Footnote 9}

The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

A key cornerstone of PIPEDA is the requirement for an organization to obtain individuals’ informed consent for the collection, use and disclosure of their personal information. In order for that consent to be valid, an organization must provide the individual with information that would be reasonably expected for the individual to ‘understand the nature, purpose and consequences of their decision.^{Footnote 10} In so doing, the organization is explicitly prohibited from obtaining consent through deception.^{Footnote 11}

As well, and especially important with respect to Big Data, given the ease in which information can be collected, used, disclosed in today’s economy, are legislative limits to collection. An organization shall limit collection of personal information to only that which is necessary for its identified purposes and only by fair and lawful means.^{Footnote 12} This principle is further elaborated as follows:

The requirement that personal information be collected by fair and lawful means is intended to prevent organizations from collecting information by misleading or deceiving individuals about the purpose for which information is being collected. This requirement implies that consent with respect to collection must not be obtained through deception.^{Footnote 13}

These particular compliance obligations have been the subject of a number of OPC investigations and findings and our Office would be pleased to share the results with the Competition Bureau.

Therefore, as the Competition Bureau contemplates how the privacy-related issues with these OPC oversight areas could play a role in competition analysis, there is an opportunity for our Office to discuss our insights, our collaboration with international and domestic partners, and our research with the Competition Bureau.

Addressing Emerging Challenges Through Collaboration

As noted in the opening of this submission, there are a number of recent global initiatives looking at the increasing intersection between privacy, consumer protection and competition-related issues. It is through these new collaborative partnerships that a dialogue is beginning on the intersection between privacy and competition-related issues, which is an important first step in framing, identifying, and strategizing about addressing emerging challenges. For example:

• The Digital Clearing House has brought together agencies from the fields of privacy, consumer protection and competition from many countries to explore the implications of big data and the need for reflection by legislators and regulators on these intersecting issues.^{Footnote 14}
• ICPEN and GPEN began a formal collaboration earlier this year.^{Footnote 15}
• At the latest International Conference of Data Protection and Privacy Commissioners (ICDPPC) a "Resolution on Collaboration between Data Protection Authorities and Consumer Protection Authorities for Better Protection of Citizens and Consumers in the Digital Economy" was adopted.

As part of this international community of data protection regulators and others, the OPC has been actively participating in discussions on many of the emerging issues identified in the Competition Bureau’s discussion paper. It is clear that while much of the discussion about the relationship between privacy and competition oversight is indeed nascent, it is an important first step in fostering a dialogue on the core challenges for regulators across the spectrum of consumer issues. The common challenge is to create an open, dynamic and innovative economy while at the same time building the foundational elements to foster trust and transparency.

For example, areas of interest for regulators involved in consumer protection issues include addressing the challenges related to market power and algorithmic transparency by new and emerging business models.

From a privacy perspective, these issues are relevant as they play a central role when looking at contemplating valid consent and how informed individuals are about what is happening to their personal information. The Internet of Things, for example, already involves seemingly invisible sharing of information amongst interconnected devices. Advances in artificial intelligence and predictive analytics pushes business practices such as algorithmic transparency further to the background, which raises questions of how informed and aware individuals are about these practices and whether they have the information and ability to meaningfully exert their desired control choices.

While the discussion paper highlights that the objective of competition regulatory analysis differs from that of privacy, privacy plays a central role in many of the issues identified in the Competition Bureau’s discussion paper.

As our Office looks to engage with other regulators domestically and internationally on this issue, we look forward to enhanced discussions with the Competition Bureau as it pursues the objectives outlined in the discussion paper.

Concluding Remarks

Our Office believes the Competition Bureau’s discussion paper outlines a number of key issues related to challenges with today’s digital economy. We also concur with the statement in the discussion paper that Big Data has policy implications beyond competition, including the specific reference to privacy as one of those areas.^{Footnote 16}

As the Competition Bureau continues to explore the implications of Big Data through the lens of competition, we understand from the discussion paper that the Competition Bureau may look at privacy obligations, but would not be attempting to regulate how privacy obligations are met which would be in our Office’s purview. We support this approach and believe our Office is well positioned to engage with the Competition Bureau on privacy-related oversight matters.

Our Office appreciates the opportunity to provide comments to the Competition Bureau and would be pleased to discuss these and any other matters of mutual interest at your convenience.

Sincerely,