Regulating the Future Flows of Big Data Overseas

The relevance of big data and artificial intelligence transcends process improvements in law alone, and will increasingly become the a significant subject matter within law. The impetus for this will be the increased reliance that private industries place on the collection, use and disclosure of consumer information.

Ramona Pringle of the CBC recently stated,

There was a time that oil companies ruled the globe, but “black gold” is no longer the world’s most valuable resource — it’s been surpassed by data.

“Data is clearly the new oil,” says Jonathan Taplin, director emeritus of the USC Annenberg Innovation Lab and the author of Move Fast and Break Things: How Google, Facebook and Amazon Cornered Culture and Undermined Democracy.

The Economist made a similar analogy earlier this year,


The type of data increasingly being used in this new economy is not the demographic data of the past, such as names and and demographic information, but are rather a raw flood of other unstructured streams of web traffic and clicks, photos videos from social media, geolocation from apps or mobile use, and a variety of other information from connected devices.

The explosion of available information is so significant, that it’s estimated that over 90% of all the data available was created in the past few years alone. Only a few academics who have transitioned to the private sector have demonstrated the ability to deal with this mass of unstructured data.

It’s not the flows of data that are a commodity, because they lack the fungibility for external parties in using data sets means that it’s usually cheaper and easier to develop your own data internally than to purchase it from someone else. This information is not just being used by large corporations, but is increasingly being used by smaller companies as well for risk management, customer retention, research and development, improving marketing and targeting, understanding consumer needs, and analyzing social behaviours.

The Economist notes that big data also has some important differences from the oil and gas industry,


Contractual deals in the sales of data, especially where personal data involved, have proven incredibly complicated from a legal perspective. But because the majority of the unstructured personal data is provided by users for free in return for services, such as use of a social media platform, these legal restrictions are less applicable. The growth of artificial intelligence now makes this data more usable than they were one or two decades ago.

Anti-competition measures have been proposed, but I’ve already indicated this may not be necessary. Lee Rickwood points out that our current regulatory framework is still largely effective,

The Canadian cloud has been seen as one of the most attractive data destinations: national privacy policies and provincial rules and regulations in this country provide good protections for an individual’s personal information, as well as important data held or used by public institutions such as schools, universities, hospitals, government-owned utilities and government-operated service providers.

The real challenge, as Pringle notes, is that the largest regulatory burden is that the larges of the big data collectors dwarf entire nations in size and resources. They are by their very nature interjurisdictional,

Based on the companies’ sheer scale alone, it is increasingly difficult for countries to enforce any kind of regulation, especially as the tech giants start pushing for rules that free them from local restrictions, says Open Media‘s Meghan Sali.

“Take, for example, NAFTA, where big tech companies are pushing to include legislation that stops countries from making rules that require the local storage of data,” Sali says. “When data is stored in Canada, it’s a lot easier to legislate its uses and address privacy concerns.”

For many Canadian lawyers, the question of where clients’ data is stored has been one of the primary concerns when adopting new technology. The United States recently filed notice during the ongoing NAFTA negotiations that the Office of the U.S. Trade Representative wants to end restrictions on cross-border data flows and any requirements for local installation of computing facilities.

However, at the same time other jurisdictions are taking significant steps to further strengthen individual consumer rights. The European Union approved the General Data Protection Regulation (GDPR) last year, and will come into enforcement on May 25, 2018. The main changes include an extra-territorial applicability, applying to companies even outside of the EU, significant penalties, and stronger consent requirements.

The GDPR rights include a breach notification, right to access, a right to erasure, data portability and privacy by design. It’s worth noting that the concept of privacy by design originated in Canada, through the Information and Privacy Commissioner of Ontario. With the Supreme Court of Canada’s recent decision in Google Inc. v. Equustek Solutions Inc., Canadian jurisprudence and values bring us closer to the EU on privacy issues than with the U.S.

The solution Pringle points to is a political one, where public interest restricts how data is used and sold in the marketplace,

Government could also help by managing crucial parts of the data economy as public infrastructure — a measure that has seen great success through the Community Broadband initiative, whereby government subsidies have helped build local fiber optic networks.

In other words, if the Radio-television and Telecommunications Commission (CRTC) is going to claim that every Canadian has a right to high-speed internet, then perhaps network infrastructure should be treated like roads and highways and bridges, as opposed to resting it in the hands of corporate giants.

That might mean being “very difficult” in our own NAFTA positions, but also dealing with the possibility that the future of our data use lies with similarly minded countries.

Comments are closed.