The Canadian economy is largely unrecognizable from when the Competition Act was enacted in 1985, or even from when our private-sector privacy laws were introduced about 20 years ago. To put it another way: the Competition Act was last updated in 2008, the same year that the Apple app store launched, while our private-sector privacy laws were introduced four years before Facebook launched. Canadian businesses now compete in digital environments and expect Canadian consumers to meet them there.

Significant advances in data analysis and machine learning allow firms operating in Canada to leverage the information they extract from digital market consumers to inform their business strategies and design. Firms capitalize on their ability to collect and process a consumer’s personal information, then draw broader population-level insights from that data to create new products and services, often personalized based on the consumer’s past behaviours.

Data governance models such as Canada’s private-sector privacy laws are ill-equipped to provide meaningful regulation of markets dependent on these technology platforms.

The impacts of the new mode of “platform capitalism” or “surveillance capitalism” are well-documented by scholars such as Nick Srnicek, Jathan Sadowski and Shosanna Zuboff. The reality of platform capitalism is that – like any incarnation of a capitalist economy – its enabling tools permeate multiple regulatory spheres. Therefore, just as Canada responded to potential harms to consumers from the rise of credit systems in the 20^th century, the effective management of digitally mediated markets in the 21^st century requires regulators to holistically understand and address one of the key risks to consumers: surveillance.

Contrary to the view of some commentators, market power and the impact on consumer privacy interests cannot be easily siloed to different independent regulatory authorities. The federal government recently pledged to review competition laws, but the extent of that is not clear. Without a robust competition policy that recognizes the potential harm of platform capitalism to consumer privacy rights, Canadians will continue to lack serious protection from abuses of digital market power arising from the accumulation of personal data.

Competition and privacy interact in nuanced and complex ways. That’s all the more reason to build a comprehensive policy approach rather than to silo the regulatory response. Where market power and consumer privacy interact, one finds a long list of potential consumer harms waiting to materialize. Firms use approaches such as dark patterns and opt-out mechanisms to extract more personal data from users than users want to provide. The accumulation of sensitive consumer data refines targeted advertising, giving firms unprecedented insight into the consumer psyche. When a digital company knows how a consumer is feeling, where they are and what they’re doing, they can leverage that data to manipulate similar populations into purchases they might not have made otherwise. These uses of consumer data can lead to higher prices and limit the choices available to Canadians.

Lack of competition between technology companies also places privacy regulation in the hands of a few dominant firms. Data protection legislation falls short of contemplating the complex realities of digital markets. Often privacy “choices” are not choices at all. When consumers have to choose between joining a network where their friends are hanging out or preserving their privacy long term, they are not facing a genuine choice. When a few dominant companies set the industry standard for privacy protection, allowing the collection of sensitive personal information and its use to predict individual and population behaviour, consumers do not have a genuine choice.

Data-related market power has also given way to “privacy-washing.” Privacy-washing captures a recent trend among tech companies to use “higher privacy” standards to justify closing down their systems and limiting competition. An example of this is Apple’s recent changes to its app tracking transparency feature, which requires apps to collect consent upfront to track users across apps and websites. This design choice carried implications for ad-targeting capabilities of other digital firms, such as Facebook and Google, as well as the applications that live on Apple’s ecosystem. The increase in privacy is certainly a welcome change, but the power to determine privacy standards should rest with regulators, not corporations. In this case, Apple acted like a regulator in the absence of stronger rules around data sharing and consumer consent.

Even on consumer privacy laws, Canada is lagging far behind other jurisdictions. Bill C-11 –  which died when the September 2021 federal election was called – was an effort to bring the private sector privacy regime in line with obligations under European General Data Protection Regulation – but was heavily criticized by experts as inadequate to respond to the mass collection and use of personal data by private companies. While Canadians can only hope that any bill reintroduced in lieu of C-11 will adequately respond to expert concerns, no data-privacy law can unilaterally address all the privacy harms that Canadian consumers face.

Private sector privacy laws have as their objective simply the balancing of individual privacy interests and legitimate business interests of commercial actors via rudimentary data governance principles. This means that the goal of privacy legislation is to allow consumers some individual autonomy and protection when their information is handled by commercial actors.

In no way do Canada’s private sector privacy laws protect consumers against broader societal level harms from uses of their information when it is analyzed by firms or shared to develop news products and services. In Canada, privacy is understood as a right that is connected to individual autonomy and human dignity. To actualize the broad interests protected under a “right to privacy,” legislators need to also ensure that consumers are engaging in fair markets that penalize unfair, unreasonable, deceptive, misleading or harmful consumer surveillance tactics. Canadian consumers are also entitled to markets that encourage innovative data-sharing practices that reflect their best interests.

Canada’s private-sector privacy laws, which place necessary data-governance obligations on companies once information is collected through consent or some other basis, are not the appropriate policy tool for creating a competitive digital environment.

Further, the federal government’s ability to use consumer privacy law to create a competitive digital environment is limited because there are important constitutional limits on the scope of these laws. In short, under Canada’s division of powers between the federal and provincial governments, the federal government can craft privacy legislation only when that falls within its power to regulate trade. The federal government is thus limited in its approach to privacy issues and cannot take a holistic approach to the multiple harms that consumers face, so it must co-ordinate with the provinces.

To date, provinces have not played a role in competition regulation and many provinces do not have their own privacy-sector privacy laws. Our modern digital economy requires the provinces and the federal government to work together – and through the constitutional difficulties – to protect consumers.

Modern competition policy should address data dominance and improve consumer privacy. Linking privacy considerations to competition law more closely could take many forms. For instance, competition authorities should be obligated to consider privacy implications for consumers when they review mergers. Regulators could also consider data silos as a remedy under the act, informed by the European Commission’s condition to protect user privacy and competition in the Fitbit-Google merger. Additionally, there are opportunities for the privacy and competition commissioners to collaborate more closely when reviewing market consolidations.

Competition policy must consider privacy implications because antitrust and privacy protections are instruments to protect consumers from the potential abuses of dominant digitally driven firms. In reconciling with platform capitalism, it is imperative that Canadian decision-makers update the suite of legislative tools at their disposal to promote consumer welfare and ensure robust competition across markets. New privacy legislation should immediately prompt a comprehensive review of the Competition Act. Only a clear set of rules in privacy and competition, acting in tandem, can ensure fair competition in online marketplaces.

This article is part of the Canada’s Competition Law is Overdue for an Overhaul special feature series.