The launch of the COVID-19 contact tracing application last summer kicked off a heated debate on consumer data privacy.
While many Canadian citizens welcomed the news with hope and positivity, just as many — if not more — met it with hesitation. Citizens responded with unprecedented interest in knowing what data was being collected, who would own it and how it would ultimately be used; all questions addressed with clarity and depth by Health Canada.
Between health-tracking applications, recent high-profile breaches and our rapidly consolidated reliance on digital services and platforms, this past year has certainly heightened consumers’ awareness of privacy, making them much more conscious of the personal data they share.
This increased awareness is triggering a movement among consumers to rethink the value they expect in exchange. Before the pandemic, many consumers unconsciously exchanged personal data for the benefit of personalized products and services. Now, consumers are more selective about what data they share and with whom, depending on the perceived benefit they get in return.
A recent EY survey indicates this value exchange is shifting towards a model based on shared assumptions, values and experiences — with half of respondents saying they’re more willing to share personal data if they know it’s contributing to research efforts or community wellness.
Perhaps not surprisingly, these values and expectations will vary across demographics. Millennial and Gen Z generations are more likely to share their data but, on average, they’re also much more likely to take the time to understand how a company uses their personal information compared to Gen X and Baby Boomers. These older generations place a higher premium on controlling who has access.
Regardless of generation, the willingness to share data boils down to trust. No consumer is going to actively share their personal information with an organization they don’t have confidence in.
This will be especially true as the Canadian economy starts to rebound. Getting people back into the office, stores and schools will require a new form of data collection to ensure the viable health and safety of the community. Effectively securing this data is going to rely on a strong level of trust built between public and private sectors and consumers.
Organizations that want to maximize the collection of personal data need to align policies with this value-exchange imperative
— and that means putting security and control at the heart of
their strategy.
When asked what’s the most important, a majority of consumers in the EY survey indicated secure collection and storage, and having control over what data is being shared, as their top priorities. Assessing the security of collection and storage can be challenging. Consumers are less likely than businesses to assess company security certifications or to ask questions about data protection practices. The assessment of a company’s ability to control private data under management, however, is more straightforward for the consumer.
By actively balancing transparency with data collection, organizations can strengthen trust with consumers and ultimately gain access to larger amounts of information to help inform their decisions. Organizations that cannot provide a clear benefit, assurances to the customer on data security, or transparency on data controls, may start to see customers go elsewhere.
But businesses also need to consider that any actions taken now are grounded and aligned with upcoming regulation. In Canada, Bill C-11 will enact a new privacy law, the Consumer Privacy Protection Act (CPPA), that aims to modernize protections to Canadians’ personal information and give individuals more control and transparency. While not yet law, the CPPA sends a strong signal to consumers and our trading partners that Canada is keeping trust and privacy a priority.
So, as businesses juggle to meet health and safety needs while delivering a captivating experience for returning consumers, they should start working to understand and plan for the operational impact and opportunities arising from new expectations and regulations. Planning ahead will allow companies to design and implement the necessary privacy controls that address the trust, transparency and benefits that today’s consumers are demanding. For Canadian organizations, privacy maturity will be less so a matter of compliance, and more so a matter of survival and growth with the modern consumer.
Simon Wong leads the B.C. cybersecurity practice at EY Canada. He’s an associate partner based in Vancouver. For more data privacy insights, visit www.ey.com/en_ca/cybersecurity.
