If Canada hopes to create a fair, thriving, and open data economy, it must further clarify who owns that data, how and by whom it can be used, and how best to secure it along every point of contact.
General wisdom dictates that personal information should belong to the individual about whom the information concerns. More importantly, when this is information is shared with a third party – be it the government, businesses, on the internet or mobile applications – it is done with the 'understanding' it is being licensed out for a specific purpose. These concepts already underpin existing legislation like Personal Information Protection and Electronic Documents Act (PIPEDA) and numerous provincial regulations. Yet, this current framework is not necessarily acknowledged or enforced in any meaningful way. At least, not enough to deter bad actors from collecting, using and abusing data as they see fit.
There are also uncertainties around whether or not data ownership changes depending on the nature and structure of data being used. Consider that commercial and industrial information can be treated as a secret, and that personal data may be aggregated to form a new asset that can be claimed as intellectual property, even if private citizens may not have provided (or were not aware they provided) consent to such secondary use. Once more, while we have somewhat adequate laws and guidelines in place for intellectual property, they are often poorly understood, communicated, and enforced.
There are several ways to move forward. One would be to re-examine our current legal framework and send a clear message that misuse of personal data comes with a price. The other is to explore frameworks, like that of the Creative Commons copyright license, to define how content can be used on a case-by-case basis in simple terms. A similar system for data would see the creation of data use certification levels (e.g. the highest of which would allow secure, trustworthy, and routinely audited organizations to collect data from any citizen for any purpose; the lowest of which would allow the bare minimum of data collection; and middle of which to collect specific information for specific purposes). Under a system like this, both organizations and citizens would have a quick and clear way to determine their data rights.
Certainly, if open data is the goal, then we need to move forward with measures that balance data economy growth with the need to respect Canadians' rights.