Funding Spotlight: The Impact of data portability on competition, privacy, and welfare

Assistant Professor Dr. Hooman Hidaji is Principal Investigator for a Social Sciences and Humanities Research Council (SSHRC) Insight Grant along with BTMA Co-investigators Assistant Professor Dr. Vaarun Vijairaghavan and Distinguished Professor Dr. Barrie R. Nault. The awarded project looks at consequences of data portability regulations (DPR)—regulations that mandate online platforms to allow consumers/users to download data with the intention of being able to ‘port’ or move it to a smaller or competing platform. Regulatory decisions for online platform data portability are already being established in the EU^[1], are emerging in the US^[2], and may have implications for firms in Canada.

In a market where firm size and capability dominates participation by a few firms, such as Facebook or Strava, regulators were looking for a way to support smaller firms by improving choice for the consumer. Hidaji explains,

"The intention of DPRs, according to policymakers and regulators, are generally to give access and ownership of personal consumer data to consumers with the intention of fostering competition and improving surplus. However, our findings thus far point to a much more nuanced impact from data portability—in some circumstances some improvements may occur, but the opposite may occur in other cases."

These findings are outlined in the working paper entitled Regulation of Data Portability Through Fines and Investments. Using an analytical approach and game theory, the research team models possible outcomes. 

"The analytical modelling approach in this study allows us to study a phenomenon which has not yet had its impact, or theoretically viable privacy mechanisms. Given that DPR is a relatively new regulation, its effects cannot yet be determined.

We can capture nuances that are important to understand, while abstracting from the details, allowing us to understand the mechanisms by which DPR impacts platforms and consumers—our constructs such as firm participation and market concentration have widely-used equivalents in economics and can be readily measured."

                                      _________________________________________________________

our findings thus far point to a much more nuanced impact from data portability—in some circumstances some improvements may occur, but the opposite may occur in other cases

                                      _________________________________________________________

Regulators use specific 'tools' to enforce the DPRs such as investing in portability infrastructure to offset costs of compliance by firms and imposing fines on firms that don’t comply. In the analytical model used, a firm has a choice of output (how much to produce), it decides if it should participate in the market and then it decides whether to comply with the regulations or not comply and pay the fine. 

While being able to ‘port’ data from one application or online service to another seems harmless enough for the consumer, research findings suggest that DPRs may reduce competition and decrease market size, which ultimately gives the consumer less choice. 

"Imposing DPR through fines and investments reduces participation (competition) and makes the market more concentrated. Additionally, DPR may negatively impact a market entrant’s profit and market share where a dominant platform already has a foothold."  

The effects of DPRs on firms are seen in revenue loss for fines paid or loss of appeal for non-portable data; gains or loss in revenue as result of platform data portability; and other costs related to compliance.

As result, not all firms will be able to comply and participate, causing market exit of smaller, less capable firms. Whereas more capable firms with larger shares of the market may benefit from portability. As result, regulations decrease output for smaller platforms and increase output for firms that already have larger market shares—the exact opposite goal of the regulations. However, there is potential for DPRs to expand market participation under the right conditions,

"Multi-homing of platforms or cross-industry porting of data are conditions under which DPR may result in market expansion."

Although Canada does not have legislated DPR, findings can be used by Canadian regulators. However, issues of privacy and the Canadian Consumer Privacy Protection Act (CPPA) may be implicated in any emerging Canadian regulations. 

"Data portability has limited privacy implications, as it is mostly a competition law, with implications for privacy. The most significant is that consumers get ownership of some of their data. On the other hand, where DPR negatively impacts participation and market concentration, it empowers dominant platforms, which may have negative consequences for data collection and privacy."

In the final phase of this research project, the team will be examining data portability regulation across jurisdictions, surveying experts, and estimating models to explain changes in industry concentration and output. Hidaji also has an additional working paper solely authored entitled Implications of Data Portability related to the grant project.

_________________________________

_{[1] EU’s General Data Protection Regulation (GDPR)}

_{[2]California Consumer Privacy Act (CCPA)}