Surveillance Pricing: When Competition Law meets Privacy

#Governance #Sovereignty #AI #DataProvenance #Cybersecurity #Privacy #Authenticity #Ethics

The Competition Bureau settled a privacy case against Facebook in 2020 -- five years before the Privacy Commissioner’s case reached the Supreme Court. The 2024 amendments to the Competition Act mean that was just the beginning. In The Governance Gap , the foundational document for The Privacy Briefing , I argued that the defining operational risk of the AI decade is the distance between what organizations have adopted and the governance they have in place. That gap is where liability accumulates -- quietly, until it doesn’t. This series applies that framework to a specific convergence most executives and boards have not mapped: the intersection of privacy law and competition law. The Competition Act amendments of 2022–2024 have turned privacy notices and programs into competition enforcement targets, and algorithmic pricing into a joint privacy-competition exposure. The governance gap, in this context, is the space between a privacy program that satisfies PIPEDA and a compliance architecture that accounts for the Competition Act’s parallel authority over the same conduct. The Facebook Precedent: Enforcing Privacy Promises In May 2020, Facebook paid $9.5 million to settle a Competition Bureau investigation into misleading privacy claims. The Bureau concluded that Facebook told users they could control who accessed their personal information -- while sharing that information with third-party developers in ways that contradicted those claims. The consent agreement imposed a 10-year compliance monitoring regime and required senior management to personally acknowledge the commitments. The Office of the Privacy Commissioner investigated the same conduct. That case -- Canada (Privacy Commissioner) v. Facebook, Inc., now before the Supreme Court of Canada (docket 41538) -- is still being litigated in 2026. The Federal Court of Appeal overturned the trial court in September 2024, finding that Facebook failed to obtain meaningful consent under PIPEDA. Oral arguments were heard on March 19, 2026. The contrast is instructive. The Competition Bureau achieved enforceable compliance outcomes on privacy misrepresentations -- financial penalty, structural remedies, personal accountability for senior management -- while the Privacy Commissioner spent six years establishing the evidentiary standard for meaningful consent. This is not a criticism of the OPC. It is an outcome of our current privacy law and its enforcement architecture. What is Changing – Competition Law comes to the Fore Between 2022 and 2024, Parliament overhauled the Competition Act through three rounds of amendments -- the most significant changes since the modern Act replaced the Combines Investigation Act in 1986. Three changes matter for boards, executives and privacy and AI practitioners: Private rights of action. Since June 20, 2025, private parties can bring applications to the Competition Tribunal for civil deceptive marketing, anti-competitive agreements, and abuse of dominance. The threshold to seek leave to commence an action is low. The Commissioner has encouraged the Tribunal to apply a “liberal” interpretation that screens out only clearly frivolous claims. Competitors, consumer groups, and plaintiffs’ counsel no longer need to wait for the Bureau to act. Amplified penalties. Administrative monetary penalties for civil misleading representations now reach the greater of $10 million or three times the value of the benefit derived from the conduct -- or 3% of annual worldwide gross revenues if the benefit cannot be determined. For abuse of dominance, the ceiling is $25 million on the first contravention. Previously, no monetary penalties existed for many of these civil provisions. Broader scope. Section 90.1 now covers commercial agreements between non-competitors where any part of the agreement has a significant purpose of preventing or lessening competition. This catches vertical agreements -- including data-sharing arrangements, platform terms, and vendor contracts -- for the first time. Your Privacy Notice Is Now a Competition Law Document The Facebook settlement established a principle that many outside the privacy profession have not internalized: privacy representations are commercial representations. The Competition Act’s prohibition on false or misleading claims (ss. 74.01, 74.011) applies to statements about data collection, use, and disclosure the same way it applies to statements about product quality or price. The Bureau’s Commissioner said it plainly: the Bureau will not hesitate to act on misleading claims about personal data, whether the company is a multinational or a small business. This is not revolutionary – the FTC in the United States has long relied upon s. 5 of the FTC Act to prevent unfair and deceptive practices; Canada is just catching up. Privacy and cybersecurity governance is not a new liability for directors and management -- it is a new expression of a duty that has always existed. The same principle applies here. The Competition Act’s authority over misleading representations is not new. What is new is the recognition that privacy claims are commercial representations within its scope -- and there is an enforcement architecture to act on that recognition. The analysis may run deeper still. In a recent paper , Thibault Schrepel argues that AI recommendation architectures do not merely distort consumer preferences — they may constitute them. A consumer whose information environment is shaped by an AI system does not have suppressed preferences waiting to be recovered through better disclosure. The preferences themselves are constructed through the interaction. If Schrepel is right, the 'general impression' test under the Competition Act may need to extend beyond the privacy notice itself to the architecture the notice purports to describe. A notice that says 'you are in control' while the underlying system determines what the consumer sees, wants, and pays is not just a misleading representation about privacy. It is a misleading representation about the consumer's entire decision-making environment. The Bureau's own investigation into algorithmic pricing in the rental housing market illustrates the point — the question was not just whether RealPage's tool coordinated individual rent recommendations, but whether landlords who subscribed to it were participating in a market structure from which competitive exit became progressively harder The operative test is the “general impression” of the representation -- not just its literal meaning. A privacy notice that is technically accurate in its individual clauses but creates a misleading overall impression about user control is exposed. The FCA’s decision in the OPC action reinforced this from the Privacy side: lengthy privacy policies have limited value in establishing meaningful consent. Individual autonomy -- the ability to make informed decisions about personal data -- requires more than disclosure buried in 4,500 words of terms of service. From the competition side, the same wordiness creates a misleading impression about the simplicity and effectiveness of user controls. What changes the equation fundamentally is the private right of action. A company that competes by being transparent about its data practices now has standing that did not exist before June 2025 to challenge a rival whose privacy notice overstates protections it doesn’t deliver. Not Just a Big-Company Problem Competition law carries a reputation as a large-enterprise concern. The amended Act dismantles that assumption. The private right of action is available regardless of the respondent’s market share. The expanded s. 90.1 applies to agreements between businesses of any size. The deceptive marketing provisions have always applied to “free” digital products — including those of startups and SMEs. Consider the following examples: · a mid-size e-commerce company that tells customers it “never sells your data” while sharing browsing behaviour with a third-party advertising network. · a SaaS platform whose privacy notice describes “anonymized analytics” while feeding identifiable usage patterns into a pricing optimization algorithm. These are the kinds of discrepancies between privacy notice language and operational reality that privacy audits can uncover and remediate. Under the amended Competition Act, they are also potential grounds for a Tribunal application by any directly and substantially affected party. The Pending Supreme Court Decision The SCC’s pending decision in Facebook v. Privacy Commissioner will shape both regimes simultaneously. If the Court upholds the FCA’s objective “reasonable person” standard for meaningful consent, it raises the bar for privacy notices across the board. Every notice that falls short constitutes both a PIPEDA compliance failure and a potential misleading representation under the Competition Act. Facebook’s reply factum argues that PIPEDA reflects a “self-regulatory model” requiring “flexibility, common sense.” The OPC and interveners -- including the OIPC-BC, the CCLA, and CIPPIC -- argue that meaningful consent is a substantive requirement that cannot be satisfied by lengthy, unread policies. The Competition Act, however, has always tested against the general impression received -- not the effort made. The Governance Gap: Competition & Privacy The Governance Gap warns that accountability has accelerated faster than most governance structures have adapted. The Competition Act amendments are a case study. Privacy officers and in-house counsel have assumed that privacy compliance is a problem of privacy law. That assumption is the governance gap in practice. A privacy notice reviewed only against PIPEDA, provincial statutes, and perhaps the GDPR carries an unmanaged competition-law risk: A data-sharing arrangement may create exposure under s. 90.1. An AI governance disclosure that uses aspirational language without evidence to back it up, invites challenge under the deceptive marketing provisions. The structural point is simple: the Competition Act provides enforcement tools that privacy commissioners do not which include penalties linked to worldwide revenues, and private rights of action. While the original Facebook settlement prompted some expectations that the Competition Tribunal would flex an FTC-like muscle, that did not transpire – but now the tools are in the hands of the private sector. In Part 2, we will examine where AI-driven pricing -- including dynamic pricing, personalized pricing, and algorithmic recommendations -- creates competition exposure at the intersection of AI, Data Provenance, and Sovereignty.

Grant Thornton released its 2026 AI Impact Survey in April, drawing on responses from nearly one thousand senior business leaders surveyed earlier this year. Three in four boards approved major AI investments. The investment moved through governance with a confidence the rest of the survey does not support. Only 52% percent of boards set clear AI governance expectations. 54% integrated AI risks and opportunities into ongoing board or committee oversight. Grant Thornton's framing was direct: guardrails arrive after the incident, not before. The survey calls the resulting exposure the "AI proof gap." The gap is the Governance Gap I described in the Privacy Briefing's foundational paper. The survey gives it numbers. Governance Debt, Measured in Percentages The Governance Gap identified adoption without governance as the point at which liability accumulates quietly; the statistics speak for themselves. The April survey supplies the metric. The 23% spread between boards approving investments in AI and those failing to put in place governance is the adoption-accountability split. 78% cannot defend the deployment against an independent audit within 90 days, which is the "proof deficit" expressed in concrete terms. Forty-six percent of leaders report that AI underperforms because controls and compliance are not working, while only eleven percent believe risk and compliance should be the primary focus of the program. The organization recognizes the symptom and treats it as something other than governance. The picture that emerges is governance debt: obligations incurred at the point of adoption and unpaid since. Time and effort alone will not retire it. The Board Is Being Briefed by the Wrong Function The single most consequential finding in the survey for a board audience is the split between operating leaders and technology leaders on agentic AI risk. Fifty-four percent of chief operating officers are concerned about regulatory and compliance uncertainty related to agentic AI. Only twenty percent of chief information officers and chief technology officers share that concern. The implication reaches beyond agentic systems. The function closest to the operational consequences of AI deployment — the function that will answer for the discriminatory outcome or the regulator's inquiry — sees a different risk profile than the function that owns the technology and typically briefs the board on it. Directors approving AI investments on the basis of technology-function reporting are being informed by the function with the least exposure to the downstream consequences. That is a governance problem before it is a technology problem. Fiduciary oversight depends on receiving information from the people who carry the operational risk. The current reporting structure is not delivering that information. Centralized Review Bodies Cannot Scale Through an AI Rollout Grant Thornton's diagnosis of the governance-model problem pointed to a familiar pattern. Centralized AI review committees become bottlenecks that slow execution without reducing risk. The prescribed fix sets policy and risk criteria centrally and delegates assessment to trained reviewers at the division or regional level, calibrated to the risk profile of each deployment. The model transfers directly from the privacy impact assessment discipline that privacy programs have refined over the last two decades. An AI impact assessment asks the same governance questions a mature PIA (privacy impact assessment) asks — business purpose, accountability for decisions, training data provenance, explainability, human oversight — applied to a different system class. The discipline extends; it does not require reinvention. The regulatory direction reinforces the point. Automated decision disclosure obligations are in force or emerging across multiple jurisdictions, and accountability principles in general privacy law have already been interpreted by regulators as extending to algorithmic systems. Tiered risk-based AI regulation has become the dominant legislative model, which means boards inherit it through vendor contracts whether or not their own jurisdiction has enacted comparable legislation. Delegated assessment calibrated to risk is how accountability survives AI scale. A centralized body staffed to approve a dozen deployments cannot handle five hundred. Agentic AI Compounds What Organizations Cannot Already Explain Nearly three in four organizations have given agentic AI systems access to their data and their processes. Twenty percent have a tested incident response plan for when an agent fails. Five percent permit fully autonomous execution of high-stakes decisions, a figure that sounds reassuring until the next number is added: sixty percent permit agentic automation of moderate-risk tasks, which is where most operational harm accumulates day to day. Each unmonitored agent expands the surface area of decisions the organization cannot explain. The foundational Briefing paper argued that a well-constructed data subject access request functions as a penetration test of an AI-enabled organization's governance program. The right to know what data trained a model and to challenge or correct an automated decision already exists in law and is already being asserted. Agentic systems multiply the instances of decisions the organization will have to account for, without multiplying the infrastructure available to account for them. Agentic deployments will produce a regulatory inquiry or a claim that demands explanation. What the organization will be able to produce when one arrives is the only open question. What the Board Owes, and Owes Now The foundational paper sets out a thirty-, ninety-, and one-hundred-eighty-day sequence of governance actions. The survey data supports three additions specific to the board's own posture: Require the chief operating officer, not only the chief information officer or chief technology officer, to present to the board on AI risk. The fifty-four to twenty percent divergence in concern is itself the reason. Directors must hear from the function that will answer for the operational failure, alongside the function that selected the technology. Commission an independent AI governance readiness assessment against a published standard. NIST AI RMF and ISO/IEC 42001 offer credible baselines, as do tiered risk-based frameworks in force across multiple jurisdictions. The ninety-day audit-failure figure is the exposure metric the board should be measuring its program against, because a regulator, claimant, or insurer will eventually measure it against something comparable. Move AI from investment-committee approval to continuing board or committee oversight. The finding that only fifty-four percent of organizations have integrated AI risk and opportunity into ongoing oversight identifies the structural failure the survey measures. Approval of an investment is a discrete transaction. Oversight of the resulting risk is a continuing function, and nearly half of boards have not established one for AI. The Return Depends on What You Can Prove The strongest finding in the survey is the performance differential. Organizations with fully integrated AI are nearly four times more likely to report AI-driven revenue growth than those still piloting — 58% compared with 15%. The organizations pulling ahead built the governance that supports the deployment. Governance functions as the infrastructure that makes AI performance sustainable, and the organizations that skipped that layer are underperforming the ones that did not. Boards that approved the investment already own the outcome. Whether they can prove it when asked is what the survey actually measures.

I am looking forward to the next IAPP Canada Symposium, as I always do, and this time I am wondering if now Canadian companies are finally going to start doing something about the GDPR. I spoke two years ago about the state of our laws ; I spoke last year about what Canadian companies need to do with regard to complying with the GDPR . The reason for the title is simple; we have been very comfortable with our ‘adequacy’ finding, but the transfer of data under our adequacy finding is not by itself adequate to deal with the requirements of GDPR. In contrast, there is work being frantically done in the US and the EU to address GDPR compliance. Until this point, the understanding that GDPR means something consequential for Canada, has not seemed to instigate more than conversations about possibly getting someone on board to take charge. But time is running out; as of May 15, 2017 there are only 263 working days, not including vacations, between now and May 25, 2018 when GDPR comes into effect. If a Canadian company is doing business in Europe, then yes it can (with certain qualifications) bring personal data without need of model clause agreements or other mechanisms. However, that does not meet all the requirements of the GDPR. Canadian companies must if collecting information from EU residents act in all respects as a European company would – notably: The right to be forgotten – Canadian companies have to be able to act on a request by a European customer Record keeping requirements – you will need to have your Article 30 records of processing, just as any EU company would Data protection impact assessments – you will need processes to meet Article 35’s requirements when you trigger its requirements, and document your DPIAs Appointment of DPO where warranted – you may need to have someone appointed as a DPO, perhaps in individual countries, where your business is primarily processing personal data, and the expectations for this may rise depending on national derogations Onward transfers – Article 28 of the GDPR requires adequate protection for onward transfers from Canada elsewhere, as well as restrictions without the controller’s approval Representative office in Europe – if you don’t have a physical presence there, you will need to appoint a representative office Data breach reporting – new for a lot of Canadian organizations, you will need to report within 72 hours a data breach to your lead regulator (and of course, you know who that is, right?) Enforcement – fines of up to 4% of global revenue or EU20 million, whichever is greater If you are a data processor – a service provider to an EU company – then you are not off the hook. The obligations will be passed on by contract to you in any event through data transfer agreements as your customer are obliged to do so – and you are also subject to the requirements of the GDPR directly, for pretty much the same things I have set out above. The fines will be 2% of global revenue or EU10 million, but note this doesn’t let your client (the processor) off the hook – you can both be found liable independently. What can Canadian companies do? There are no silver bullets; this is going to require work. You need to update your privacy program to address the requirements of the GDPR. Some Canadian companies, because they have been doing what they should under PIPEDA or provincial laws, will be in a good position with some additional activities and capabilities. For the rest, it is quickly going to become a question of what they can do in the time that remains, and it means prioritizing based upon risk. In any event, if you don’t have a plan, now is the time to get moving on it.

Following on my (apparently) popular nightmare subject-access request and letter from a DPA… The GDPR provides for a number of remedies for individuals in regards to their personal data, that will put companies through their paces: rectification; the right to be forgotten and erasure; data portability; and objection to and restrictions on processing. The natural next step when someone has written you an annoying letter to find out what a company knows about a data subject, and how it is handling their personal data, is for the author to start exercising those rights. This gets harder to do in the natural flow of a letter, because of course, the exercise of these rights can arise in so many scenarios. I wanted to highlight individual elements of what data subjects can ask under the GDPR. They may not all come at once, but through the death of a thousand paper cuts, in a series of postcards from hell: 1. Let’s get rectified. Based on the information that you have provided to me in my subject-access request, it appears you have collected a profile on me based on my purchases. The fact that I am buying a lot of toilet paper is no one’s concern but my own; and it is not due to anything other than I have a lot of guests, not as is implied in the profile, that I am having some kind of organic issues. Please rectify this as soon as possible, as I now understand why I am receiving invitations to purchase medication. 2. Transfer this. I note that you have been transferring my personal data, namely my meal choices on flights, to the United States, and you have indicated that the basis on which you are making that transfer is based upon the EU-US PNR Agreement . The inferences being drawn from my being a vegetarian are that I am in a suspect group and am being profiled on that basis, which is why I am routinely pulled aside for “random” searches whenever I visit the United States. I request that you delete all information concerning my meal choices that you have collected on me. 3. Your vendor is infectious. I request you delete my contact information from your customer service vendor in India. I had one interaction to get support for my software a year ago – and now I routinely get calls from India insisting my Windows computer is infected (I own a Macintosh), so your outsourced vendor is not keeping my information confidential. Please confirm that you have followed up with any organization with whom my contact details have been shared with by your vendor. And in future, please restrict processing of my data to my software subscription maintenance. 4. Let my data go. I have been using your free budget management program on the Internet and now that I understand you are storing my financial and purchase data in countries which have a high rate of identity theft, I no longer wish you to have my data. Prior to deleting it, I would like to ask you to provide all my data in a CSV format that I can use to export to a system which stores its data in the European Union. Please use the attached schema which will support the import into the new system I wish to use. 5. Taking a gamble you have it right. I have been receiving direct mail from you both by the post and in my e-mail. I am in risk management and I attend conferences on privacy and risk management. I assume that is how you got my contact information, but I do not understand how this got linked to gambling. I don’t find gambling interesting and I don’t know why you would assume that I would want your magazine on gambling, or your e-mails to let me know about gambling events, and the connection with gambling is embarrassing and potentially damaging to my career. Stop sending me anything more and remove my name and address from your lists in relation to gambling. ( Yes, the last one happened to me ).