Centre for International Governance Innovation

Report Part Title: Data Governance

Report Title: Emerging Technologies, Game Changers and the Impact on National Security
Report Author(s): Daniel Araya and Maithili Mavinkurve
Published by: Centre for International Governance Innovation (2022)
Stable URL: https://www.jstor.org/stable/resrep45135.10

JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide
range of content in a trusted digital archive. We use information technology and tools to increase productivity and
facilitate new forms of scholarship. For more information about JSTOR, please contact [email protected].

Your use of the JSTOR archive indicates your acceptance of the Terms & Conditions of Use, available at
https://about.jstor.org/terms

Centre for International Governance Innovation is collaborating with JSTOR to digitize,

This content downloaded from 196.200.131.44 on Thu, 04 Jan 2024 11:26:11 +00:00
All use subject to https://about.jstor.org/terms
processed within Canada. Canadian domestic
internet traffic should remain within Canada.
Data Governance
As data regulations, laws and infrastructure evolve,
countries will need to balance their national What we require today are governing systems
security concerns with economic and political that provide new data standards, new regulatory
considerations. Ensuring sovereignty over data systems and a new legal infrastructure for guiding
and key cyber-infrastructure is now increasingly the evolution of data-driven technologies.
critical to protecting citizens. Citizen data and Given Canada’s history, economy and values, it
sensitive corporate data are at the centre of a is clear that Canadian national security strategy
struggle between national security and economic should provide appropriate interoperability
growth.13 This is challenging because data must and governance standards to support a globally
flow across borders as well as within them. articulated data economy. This approach requires
a national security strategy that supports
Data is now a form of capital. Accumulating and collaboration across departments (i.e., ISED,
monetizing Canadian data is critical to future Global Affairs Canada) and across domestic and
economic growth. To offer one compelling example, international fronts on matters related to data
the genetic testing company 23andMe collects and data-driven EDT. The public service will
vast amounts of genetic data from ordinary also require education in developing a uniquely
Canadians through the use of home-based saliva Canadian model of data governance even as
collection kits. The company’s current market cap Canadian policy makers learn from other countries.
is $3.2 billion, with 2020 revenues at $475 million.
Even as Canadian genomic data freely transits the Data governance remains a daunting challenge.
Canadian border with little or no oversight, the There are at least three broad models for data
decision to simply “give up” this data undermines governance practised across the world’s largest
Canadian sovereignty and future prosperity. economies today, in the European Union, China
and the United States. Despite these varying
The asymmetry at play between large data approaches, many countries are now requiring
platform companies and individual consumers that data on their citizens be stored or processed
means that ordinary Canadians are at a within their borders. This rapidly changing
substantial disadvantage. Without public global regulatory landscape around data places a
oversight, platform companies can act in ways particular burden on industry. Chief information
that are harmful to Canada and Canadians. security officers and legal and compliance teams
As Facebook whistle-blower Frances Haugen are now required to carry the weight of these global
observed, “Until we bring in a counterweight, regulatory challenges, even as their businesses
these [platforms] will be operated for the aim to capitalize on revenue from data.14
shareholders’ interest and not the public interest”
(Haugen, quoted in Waterson and Milmo 2021). The European Union:
Data for the Purpose of
Citizen Advancement
In 2018, the European Union released a data
sovereignty regulation known as the General Data
Protection Regulation (GDPR), which has quickly
become a global standard. The GDPR prioritizes
13 Cross-border data transfers have been recently challenged between data privacy and places EU citizens squarely in
the European Union and the United States are proving to be a growing control of their own data. Ursula von der Leyen,
problem both for economic growth and security. The Court of Justice of
the European Union (CJEU) issued a verdict on July 16, 2020, ruling
president of the European Commission, has pledged
that the EU-US Privacy Shield was invalid. This shield allowed companies
to transfer data between the United States and the European Union;
however, the CJEU invalidated it due to concerns around surveillance
by the US government. This case is known as Schrems II (see 14 These teams must verify that data exists only where it is allowed as well
https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II). Due to as show the lineage of data. This task is already monumental, but coupled
national security concerns, cross-border data flows are under heavy with digital transformation efforts to move data to the cloud, it becomes
scrutiny. There is also concern that the ruling could put an excessive expensive as well. Until best practices are established or new tools
burden on companies with respect to managing the data of EU citizens made available, we can expect many industries to invest heavily in data
when there are cross-border transfers required. protection and compliance.

Emerging Technologies, Game Changers and the Impact on National Security 9

This content downloaded from 196.200.131.44 on Thu, 04 Jan 2024 11:26:11 +00:00
All use subject to https://about.jstor.org/terms
 that the European Union will attain “technological deliberately commoditized the personal data of
sovereignty” in critical areas of the digital economy. users to drive enormous profits. The United States
For many EU member states, concern is growing is home to the world’s largest cloud providers
that countries are slowly losing both sovereignty (for example, Amazon Web Services, Microsoft
and control over their data, inhibiting the ability of and Google); therefore, the US government faces
nation-states to innovate and/or shape democratic a significant challenge with regard to protecting
norms and values in the digital arena.15 citizen data, maintaining trust in its democracy
and holding technology firms accountable while
China: Data for the Purpose also ensuring a thriving technology industry.

of State Advancement
In early 2021, China passed its Data Security Law
(Bloomberg News 2021). This law strengthens the
control that the Chinese government has over
data collected within China.16 Protection of the Canada’s Approach
state and its governance is China’s top priority,
effectively giving the Chinese government the to Digital Trust, Data
power to fine or close firms that mishandle “core
state data.” As such, the law requires that major Sovereignty and EDT
decisions involving data security are to be made by
national security officials. In November 2021, China The real value of data is found in its quantity
put into effect its data protection law, the Personal and quality for driving innovation. Data is the
Information Protection Law (PIPL) (Bagchi 2021), “operational exhaust” of digital systems running
overseeing the collection of citizen data by private at scale today. For this reason, the proliferation of
businesses. Widely regarded as China’s version surveillance systems deployed by governments
of the GDPR, the PIPL provides rules overseeing and the private sector to monitor populations is
how businesses can collect, process and transfer now a routine feature of a data-driven society.
the personal information of Chinese citizens.
In November 2020, the Canadian government

The United States: Data for proposed the Digital Charter Implementation Act
(part of Bill C-11) (ISED 2020), signalling that it is
the Purpose of Economic taking some steps to establish data protection
Advancement rights for Canadians. In particular, the Consumer
The United States currently has no federal-level Privacy Protection Act, an update to the Personal
data protection laws. Certain states are crafting Information Protection and Electronic Documents
their own consumer data privacy regulations, Act, focuses on individuals having more control
such as the California Consumer Privacy Act.17 over their personal information. Canada is aiming
Consequently, the US government has struggled to to build a foundation of “trust” in the digital age.
constrain the accumulating wealth and power of its Critics of Bill C-11 (Kenyon 2021; Cofone 2020;
big tech firms. By building tools that enable a form Scassa 2021) argue that the legislation does not
of “surveillance capitalism,” US tech firms have represent human rights principles in the digital
era, due to its lack of clarity in the areas of de-
identification, meaningful consent or data mobility.
15 Although the promotion of democratic values is at the forefront of EU
data and digital messaging, its foundation is underpinned by the potential With regard to AI, Canada has released a
for building economic strength. A core feature of the European Union’s Directive on Automated Decision-Making18 with
Digital Strategy is the concept of a Digital Single Market (see
www.europarl.europa.eu/factsheets/en/sheet/43/the-ubiquitous-digital-
the purpose of ensuring that deployed AI-based
single-market), introduced in 2019. The Digital Single Market is intended technology reduces harm to Canada and to
to promote e-commerce across the European Union’s digital economy. It Canadians. The objective is to ensure that such
requires that data flows freely across the European Union, thus forcing
a regulatory framework around data connectivity, safeguarding privacy,
technology is deployed in a manner that reduces
cybersecurity and cross-border data access. It also offers a window into risks to Canadians and federal institutions, and
what needs to come across international markets. leads to more efficient, accurate, consistent and
16 Additionally, the Cyberspace Administration of China has released a draft
of regulations on data classification as it relates to national security.

17 See https://oag.ca.gov/privacy/ccpa. 18 See www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=32592.

10 Reimagining a Canadian National Security Strategy

This content downloaded from 196.200.131.44 on Thu, 04 Jan 2024 11:26:11 +00:00
All use subject to https://about.jstor.org/terms