Competition Bureau Canada report on Data Portability

Last week the Canadian Competition Bureau released the report Your Data, Your Control: How data portability can unlock competition and empower consumers. The surprisingly readable report centers around an experiment exploring data portability in the insurance sector, calculating that “introducing data portability could save Canadians “between $1.10 billion and $3.83 billion in both time and money on their annual costs.” I decided to read the report to understand how the Canadian federal government thinks about data portability in general, with an eye towards other digital spaces like social media, cloud, AI, and the types of stuff I am interested in. What follows are some highlights from the paper and some questions for the Canadian Competition Bureau on where to go next.

What is data portability?

The paper spends a significant amount of time in the first chapter breaking down data portability in an easy to read manner. The very first sentences are:

Data portability gives consumers the power to transfer their personal information easily and safely between service providers. This creates more freedom, choice, and convenience. When consumers can take their data with them, it increases competition and fuels innovation across sectors (pp. 5)

Portability is obviously considered a good thing. And not just for consumers.

With data portability, firms can more easily access markets. Customer acquisition costs may go down, particularly for new companies.

Other examples such as if a firm wants to transfer its records from one provider to another demonstrate that data portability benefits more than just individuals.

The paper describes data portability success cases such as mobile number portability, open banking, and digital health records.

It also covers industry-led and regulation-mandated cases. To give an example that is not in the paper: in the 1990s telecoms in Canada worked together to allow people to text between carriers. This didn’t happen in Japan until way later — you actually had to use a mobile EMAIL to contact friends on other carriers! The Canadian providers needed to attract more cellphone customers overall so they worked together. However, it took government intervention to allow you to keep your phone number when you wanted to move cellphone providers.

This kind of nuance around how to “design a data portability framework that balances the interests of all stakeholders” was quite useful to read about. The Competition Bureau is worried about imposing rules that could end up harming Canadians. For example they identify consumer switching as key to competition, but also present the dangers of too much portability:

Data portability makes it easier for consumers to switch providers. It could also lead to more data being shared with established firms, making their market position stronger. This effect, known as the demand-expansion effect, can make it harder for new firms to enter.

If data portability rules make certain key information effectively transparent, firms could more easily collude and lock up a market, or even collect information on consumers that aren’t their customer (ahem looking at you Facebook). Furthermore, larger firms might be the only ones that can afford to implement porting capabilities locking out smaller firms. And if data portability rules are too rigid and sweeping, “firms may be less likely to innovate in how they collect, process, and use consumer data.” The paper covers many economic, security, and privacy risks that need to be balanced when designing data portability policy and makes note of the EU looking into easing reporting rules originally mandated in the GDPR.

Who has the right

Data portability is the right a person has to obtain and transfer their personal data in an easy and secure way from one data holder (the sender) to another (the receiver)… Data portability commonly refers to a person’s ability to transfer their data to themselves or to a third party in a structured, machine-readable format. (pp 11)

That second sentence is the only line in the paper mentioning people transferring data to “themselves.” Otherwise it only describes situations of porting data from one third party to another. User-owned data in the sense of what we worked on at Fission, in the wider Local First movement, or Tim Berners-Lee’s Solid, is not even hinted at. It’s all about corporate-controlled APIs and common formats.

However, I would like to point out the use of “right” in that sentence. Later in the paper they do a comparative analysis of data portability regimes in a number of countries, presenting a map showing all the jurisdictions that enshrine a “right to data portability”:

In Canada it is only the province of Quebec that has such a right. PIPEDA does not enshrine a right to data portability. Makes me wonder why all Canadians can’t enjoy this right? 🤔 I am not sure if this is the case, but the report notes that the structure of Canada’s federation can be a challenge to implementing regulations like these.

What about Interop?

The paper identifies 3 levels of data portability:

1. Level 1: Manually move all your data from one system to another, possibly by re-entering it in, or downloading bits and uploading bits in a piecemeal manner.
2. Level 2: Download data from one service and immediately upload to the other service since the format is recognized.
3. Level 3: A convenient API or service-to-service integration.

(Mastodon is an example of how there are levels to these levels. 🙃)

Meaningful data portability depends on interoperability. Basic data downloads do not offer as much value as seamless, API-driven continuous exchange that truly empowers consumers while balancing security and implementation costs. (pp 36)

The best kind of data portability is interoperability.

The OECD agrees. And the Competition Bureau thinks:

That is why data use and access, including data portability and interoperability is a possible key area where regulations may be needed to ensure we bring more competition into the market. (pp 14)

In fact, they say:

Structural interoperability’s main challenge is that it requires communication and coordination across firms within an industry to establish a standardized data format. This form of interoperability often needs government help (e.g., fines for non-compliance). (pp 47)

(Emphasis mine.) Why does “government help” need to be punitive? Couldn’t they support the standards process which is often already captured by big corporations? (Yes, yes, I can hear you frustratedly screaming “ITU!” in frustration both with me and with them and their member nations shenanigans 😄)

But I digress. The paper touches on interop here and there, but it is focused on a data portability framework and not necessarily regulating interoperability.

I get twisted over the intertwingling of the concepts of data-portability and interoperability. I don’t want just a simple way to switch mobile providers or social media services: I want the ability to switch providers and still be able to communicate with the friends I left behind. Mere data portability does not go far enough.

Concluding remarks

I am reading this report with social media and other consumer digital experiences other than insurance (or banking or health) in mind. Although easy to read, and nuanced in its explanation of the various trade-offs to consider, I came away with a few fundamental questions.

1. The very final chapter “Towards a Canadian data portability framework” is just over a page long and though it opens with “it is essential for policymakers to develop and implement a comprehensive data portability framework in Canada” there are no next steps. Basically it is “ya’ll should think about this, and look at all the other countries who have.” This tells me that Canadian regulators recognize they are behind on the topic.¹
2. The Competition Bureau says for data portability policy “to be successful … We need to ensure strong interoperability… (pp 5).” So why are we targeting portability rather than interop? Why not go for the whole biscuit? This signals that either the Competition Bureau is not thinking ambitiously enough, or (probably more likely) there are some political reasons that contribute to such incrementalism and narrow scoping. I would love to hear the inside scoop on this from someone like Keldon Bester!
3. There was no discussion about how to actually implement this kind of legislation. The paper basically just recommends that it should be done, but no discussion on the “how” or on what has blocked it from being done already.

Would the government ever mandate social media interop? Would they regulate social media (other than bad “save the children” policies or requests for encryption backdoors)? I think they might be convinced. This report centers consumer pricing as a primary KPI, and the Bureau is also obviously concerned with competition and innovation. But they also consider factors like time costs, privacy, security, and consumer empowerment and control:

Empowering Canadians to control their own data could transform our digital economy. … It can drive economic growth while putting Canadians in control of their digital footprint. (pp 6)

I would very much like to see a study about consumer empowerment, time savings, economic and innovation impacts of social media in Canada.

To wrap this already long post up, there are a number of other issues covered in the paper that I have not included here, including: difference between user data and derived data; horizontal and vertical interop; economic and psychological reasons why people don’t switch providers (reasons like loyalty, perceived effort etc but the amazing finding that privacy-conscious consumers were least likely to participate!); how public understanding of data portability is lacking (70% of participants reported having no knowledge of data portability); how people often don’t trust automated migration services out of fears of security and privacy (43% of participants viewed data portability as risky); a suggestion that a trusted oversight body could help with adoption;

I am no competition legal expert, yet I found this report to be clear and concise and to bring up some provocative points. It is not exactly a muscular manifesto for taking action, but if you are even slightly interested in these topics it is worth the read.

---

1. ADDENDUM: I suppose I should also point out this recent news about the federal government cutting 24 jobs from the Competition Bureau which won’t help. ↩︎