The chief executives of some of Canada’s largest companies are calling on the federal government to update the country’s consumer privacy protections, and for regulators to give more weight to industry-created standards on the use of data. 

The recommendations are contained in a report from the Business Council of Canada (BCC), to be released Tuesday. It comes as Ottawa prepares to set new rules it says will expand citizens’ online rights, increase the powers of the federal privacy watchdog and stop tech giants from dominating smaller competitors.

The BCC, a lobby group representing CEOs nationwide, is “trying to lasso together consensus views on the data economy to provide the government with constructive feedback, to create jobs in an environment where there’s a lot of anxiety about the economy,” James Moore, former industry minister and author of the new report, said in an interview with The Logic.

For several years, the federal government has promised an updated regulatory framework for data use, launching consultations in June 2018. In May 2019, it announced a digital charter comprised of 10 high-level principles that will guide future legislation, as well as proposals to update Canada’s consumer privacy law. Innovation Minister Navdeep Bains’s agenda for the new Parliament includes establishing new online rights for Canadians, as well as creating rules to protect user data and to promote competition in the digital marketplace. 

The BCC’s proposals are intended to ensure “consumer confidence that their data is kept private, that they can trust the people managing their data, and that there’s accountability,” CEO Goldy Hyder told The Logic. “But it’s also about investment.” Developing a clear regulatory framework for data use with industry buy-in is “a competitive advantage in a mischievous world,” he said.

John Pecman and Chantal Bernier, formerly competition commissioner and interim federal privacy commissioner, respectively, advised Moore on the report. “People who have been inside of government looked at these proposals and assessed that [they] are reasonable, doable [and] practical,” Moore said. Other members of the advisory panel included top technology and data executives from companies like RBC, Loblaw and Air Canada, as well as tech firms like BlackBerry, Element AI, and Portag3 Ventures, a VC firm backed by Power Corporation.

The BCC’s recommendations on personal-information protections overlap with the government’s proposals to modernize the privacy law on several key issues. Both would require organizations to provide consumers with plain-language explanations of how their data will be used before seeking consent to collect it; both would allow businesses to use information for some routine activities like executing a contract or meeting legal obligations without getting explicit permission; and both support looking into data trusts—collections of information without personal identifiers attached—that companies and non-profits in sectors like health care and transportation can use to innovate.    

The council is also calling for industry-developed standards and codes of conduct to play a bigger role in how businesses’ use of data is regulated. Companies would opt into these standards, rather than be required to follow them. The Office of the Privacy Commissioner (OPC) and courts should “consider adherence to these as evidence of an organization’s due diligence or as a mitigating factor in [data breach] investigations,” the report says. It also recommends the privacy commissioner maintain a list of codes it recognizes, and that Ottawa subsidize startup and small-business participation in their development.

While the government is also proposing that following industry standards be considered evidence of a company’s due diligence, it has argued that on some digital issues self-regulation has failed, including how social media platforms use data and their role in the spread of disinformation. In December 2019, privacy commissioner Daniel Therrien said industry codes aren’t binding or enforceable, and “cannot replace state-made rules adopted in the public interest.” 

The council believes consumers aren’t opposed to this form of self-regulation. “I think the public is more informed on [data] than we give them credit [for],” said Moore. He also pointed to standards in other areas, such as the LEED building-rating system or the Gold and Red Seal professional certifications for tradespeople. “These have been created by industry, and have consumer confidence,” he said. Any industry-created data standards would also be subject to the privacy commissioner’s review under the council’s recommendations.

The report also raises concerns about competition. “To a growing extent, data is becoming concentrated in the hands of a few key players, causing imbalances in market power,” it states. It recommends the Competition Bureau be given more resources to address the issue. But the council is more cautious on data portability, which the antitrust watchdog has suggested encourages competition. The BCC says any such right should be narrowly defined; it believes people should be allowed to request their own personal information and ask one company to transfer it to another in limited circumstances, but says those rights shouldn’t apply to “proprietary business data.”

That contrasts with its earlier position on the subject. In September 2018, it offered the government a list of regulatory principles, including that firms “should compete primarily on the value they can create with data, rather than their control over it,” and could be required to give information to rivals if their exclusive access to it is unfair. 

But the companies with which the BCC consulted for this report said “it will become more difficult for them to generate a return from their data investments” if they are forced to share data with competitors, reducing the incentive to innovate. The Competition Bureau has already intervened in matters like the Toronto Real Estate Board’s restrictions on access to listings and sales-price data, noted Trevor Kennedy, the BCC’s policy director. 

The report also calls for letting businesses have the privacy commissioner sign off in advance on how they plan to use data; for governments to invest in cybersecurity and digital literacy for both individuals and businesses; and to extend to other trade agreements the provisions against data-localization rules in the USMCA and the CPTPP, something Canada’s chief trade negotiator, Steve Verheul, has said the government is already obliged to do. 

Ontario is writing its own data strategy, and the report calls for Ottawa to work with other governments to harmonize regulations across the federal and provincial levels.

The council doesn’t recommend new rules that give Canadian firms preferential treatment, or expanded restrictions on foreign direct investment and acquisitions involving intellectual property or data. Jim Balsillie, the former co-CEO of Research in Motion (now BlackBerry) has called for policymakers to pay more attention to those issues. In February, the Committee on Foreign Investment in the United States received greater powers to look into deals involving critical technologies or sensitive personal information.

Moore said the government’s powers under the Investment Act to ensure transactions benefit the country are sufficient in this area. But he also noted a “heavy-handed” position on enforcement and investment could deter foreign companies from investing in Canada and entrepreneurs from building their innovations here instead of the U.S.

Continue the conversation on The Logic Council, our subscriber-only Slack channel.