THE GLOBE AND MAIL/ISTOCK
Vass Bednar is the founder of Regs to Riches, a senior fellow at CIGI, and the executive director of McMaster University’s MPP in Digital Society Program.
It is strangely charming that Canada’s cautionary case study in surveillance capitalism comes from Tim Hortons.
This summer, Canada’s Privacy Commissioner found that the Tim Hortons app violated privacy laws by collecting “vast amounts” of its users’ sensitive geolocation data, resulting in a class-action lawsuit. In what feels like a parody, not only has the company proposed a settlement that partially consists of offering affected customers a free coffee and a donut, somehow Tims was also named the most trusted brand in Canada by a consumer survey earlier this year.
I find the incongruity infuriating – how can a company that took advantage of its customers’ loyalty still be so beloved?
Tim Hortons isn’t alone in this respect. Elsewhere, the world’s largest technology firms are demonstrating similar durability when it comes to maintaining public trust against all odds, given how they gorge on our data in surprising and unanticipated ways. For instance, Apple’s recent changes to its privacy rules seem to have actually served as a way to open up space for its own ad business. And Twitter’s former top security executive recently filed a damning whistle-blower report on the app’s privacy vulnerabilities and its potential threat to U.S. national security. Its stock price took a dip, but its user base quickly carried on with business as usual. Tech firms are only too happy to allow these incidents to remain blips on the radar, lest they compromise a company’s ability to continue generating advertising profit or exert their dominance over competitors.
I’ve watched this malaise with growing concern, wondering why so few people seem to be alarmed by how firms use our data, and by the associated implications for market competition. It might be because we are distracted by more practical matters these days (inflation and interest rates, to name just two). But I also believe that, in cases like that of Tim Hortons, our collective shrug toward bad data-usage behaviour in Canada stems from the fact that the country’s largest tech firms don’t necessarily present to us as “tech companies” on the surface. Instead, some of our oldest and largest Canadian companies are quietly adopting and emulating big-tech strategies to their benefit, without necessarily being clear about exactly what it is they plan to do with all of the personal information they are gathering.
Most large Canadian companies that have managed to evolve from being “classic” retailers into successful 21st-century businesses rely on the data they collect from customers to make business decisions. Consider the number of loyalty programs you might currently be registered for – for example, collecting points from The Bay, Canadian Tire or Tim Hortons. I call out these brands specifically because, in addition to operating brick-and-mortar locations, they all also rely on the information they collect about their customers to generate greater returns.
The Bay, Mark’s Work Wearhouse, and Canadian Tire are also all emulating the practices of Amazon’s Marketplace ecosystem, wherein third-party sellers are able to register accounts on a retailer’s website and sell to customers directly. In Amazon’s case, Marketplace has now generated major antitrust lawsuits, as the company has been accused of giving its own private-label products self-preferential treatment and disadvantaging independent third-party sellers. The potential for gatekeeping and anti-competitive behaviour in this type of online ecosystem is something Canadian companies should be careful not to replicate.
While large Canadian retailers are not necessarily abusing their dominance – which would be a violation of the Competition Act – there seem to be indicators that they are exploiting our trust by incentivizing us to share increasing amounts of personal data that will inform future business evolutions and entrench their market power. Without realizing it, we are often asked to trade our personal data – a name, an e-mail address, a phone number – in order to sign up for programs that purport to make our lives better by providing convenience and monetary value (in exchanging points for purchases, for example). What we need to be wary of, however, is that these benefits may be coming at an unexpected price, especially since most retailers aren’t adequately telegraphing what they may be doing with our data (as in the case of the Tim Hortons app) or how they intend to operate with it in the future.
Consider, for example, the idea that Loblaw is technically one of Canada’s biggest tech firms.
As the largest owner of grocery stores and drugstores in Canada, Loblaw’s emulation of big-tech business models is at once both obvious and obscured by the evolving structure of the company. According to its 2021 annual report, the company’s PC Optimum loyalty points program boasts 15 million active users – almost half the population of Canada. Last year, the company issued over 300 billion PC Optimum points to customers, who in turn redeemed their points for $1-billion worth of products. Think of the amount of user data generated by that many transactions, and the sheer amount of information one company has about the shopping habits of nearly half the Canadian population.
As a tech-policy expert, what concerns me most is the consolidation of user data. Unlike the U.S., Canada has fewer new big tech companies emerging on a regular basis (our small group of unicorns, including companies like Wealthsimple and FreshBooks, are exceptions to this rule), which means we need to be paying more attention to the ways in which our data is used in cases of vertical integration. The fact that Loblaw Cos. Ltd. owns a range of entities including No Frills, Zehrs, and Real Canadian Superstore under the umbrella of one owner acts to obscure the size and reach of the firm, which likely contributes to our collective discounting of the idea that it might be one of Canada’s largest tech players.
Some of the company’s more recent acquisitions have indicated Loblaw may be intending to consolidate market power in the Canadian health care space. Canada’s Competition Bureau barely blinked when Loblaw purchased Lifemark Health Group in May. Lifemark was a leading provider of outpatient physiotherapy, chiropractic, mental-health, and other rehabilitation services in Canada. Loblaw also has a strategic partnership with dentalcorp, Canada’s largest network of dental practices. Loblaw’s PC Health app initially purported it would be able to sign Canadians up for a COVID-19 vaccine (which it eventually did not do, citing evolving requirements for the vaccine program), but nevertheless provided an opportunity for Loblaw to use vaccination as a customer acquisition strategy during the pandemic. Loblaw also has medical clinics that are part of the primary-care system in Ontario.
This all comes on the heels of the company’s 2014 purchase of Shoppers Drug Mart, which supercharged the PC Optimum loyalty program by allowing the firm to merge insights from users’ grocery shopping data with information about their health care consumption.
As this company expands further into the health and dental spaces, it is also worth remembering that Loblaw owns and operates an online marketplace that sells advertising space to third parties. Other Loblaw evolutions are even more intriguing, such as the expansion of the No Name trademark to medical cannabis products. The Loblaw ecosystem even has a venture capital fund, Wittington Ventures.
It seems as if the firm is building a personal health flywheel that integrates grocery suggestions with drugstore rewards and connects financial information to medical and dental needs. While many may appreciate the ease and convenience of such predictions, others will be miffed that this evolution wasn’t telegraphed. Coupled with their PC Financial banking ecosystem, and their PC Insider subscription service, Loblaw’s knowledge of their customers is Google-esque.
The recently proposed federal privacy bill in Canada (C-27) may have implications for retailers’ loyalty programs and data – the algorithmic engine that connects many companies’ various entities – by enforcing a stronger consent-based regime for the collection, use and disclosure of personal information. Better transparency on what Loblaw and other retailers are doing with our data and intend to do with our data is imperative.
I do wonder, however, whether a tech backlash (or “tech lash,” as it’s known in policy circles) will ever meaningfully manifest here in Canada. Are we simply too used to these classic brand names that are now using our data in opaque ways? Do we not have enough “big” technology firms to feel we have to worry about these issues?
If a tech lash does occur in Canada, at its core will be the tactics of firms that appear to offer us so much for free, only to reveal the true price – privacy and market competition – inadvertently.
Companies that are not fully transparent with consumers don’t deserve our loyalty – or our data. The question is whether there will ever be ethical alternatives and if our institutions have the courage to curb such behaviours.
Canada has been spoiled by the assumption that big-tech policy problems are only the product of American firms. We must start to acknowledge and confront the big-tech tactics in our own backyard.