Law 25 : The good, the bad, according to Oli
Some speak of a revolution. Others sigh that it’s too little, and far too late, swearing it’s nothing more than a sad stab in the dark. Their opinions, despite being diametrically opposed, both refer to the new provincial Law 25 – the infamous Law Modernizing Legislative Provisions for the Protection of Personal Information in the Private Sector.
Bill 64 – renamed Law 25 upon adoption in September 2021 — aims to do exactly what its laborious title tells: modernize Quebec laws that pertain to the protection of the personal information of Quebecers. Modernize because such provisions already exist but date back to… pre-modernity; that is, before the advent of the Internet, obviously.
The Roads to Modernity in Cyber Security
In September 2021, determined to enter modernity – over a quarter of a century after the invention of the Web – the Quebec government adopts Law 25 to extend the protection of citizens’ information to the digital sphere. Now, in addition to being protected within the geographical borders of the province, their personal information will also be safeguarded within the more theoretical and highly malleable boundaries of their backlit screens. In theory, at least.
By personal information, the very data it aims to protect, Law 25 refers to “any information relating to a natural person and allowing for their identification.” Your name or banking information, for example; but also the more mundane information left behind on the trails of the Internet – digital Hansel breadcrumbs of sorts – which reveal nothing in isolation but, when pieced together – voilà! – unveil to advertisers the royal path to our subconscious, or perhaps our unconscious; it’s not exactly clear.
Cold Sweats
The sentiment among critics of Law 25 is that this path to the subconscious, or the unconscious – or both at the same time – is certainly not about to be abandoned by companies whose business models depend on it, such as Google, who is more or less its genitor. And that it would take more than a provincial law, in short, to change the course of such gargantuan behemoths.
In concrete terms, the law imposes several changes on Quebec companies, changes being implemented gradually over time. Some rules have been in place since September, such as the requirement for every company, whether small or gigantic, to designate a ‘privacy officer’ within their ranks. Other measures, however, only come into effect next September.
One of these measures pertains to Web cookies and has stirred up much debate and perhaps an equal amount of anxiety in the world of digital marketing. Starting from September 2023, every website operating in Quebec will have to obtain explicit approval from an Internet user to have the right to collect and use their cookies. This marks a shift in the paradigm in which the Internet has lived for a long time: the lawless silicone Wild West where fleece-clad cowboys named Zuckerberg or Brin gather our data as glorious loot to sell – at a high price – to marketers who, like a lung needs oxygen, depend on it to survive.
Law 25 : The Beginning of an Era?
After September, this era of unscrupulous monetization of our actions and behaviors by the Internet giants comes to an end in Quebec. Hence the reflex of some to call this law a revolution, at least in the digital realm.
But as we’ve mentioned, this “revolution” in data privacy doesn’t seem that way to some; at least not in its current form. That’s the view of Olivier J. Bergeron, a sort of Clint Eastwood of the digital frontier and co-founder of Click & Mortar. Olivier looks at Law 25 with a certain curiosity but considers it a rather feeble obstacle to the surveillance capitalism model inherent in the GAFAM companies. Not only that, but he also fears detrimental revenue losses for Quebec’s small and medium-sized enterprises.
He discussed this in a blog post earlier this year, and now he takes the time to nuance his opinion and explain where it comes from.
C&M : Hi Oli! It’s important in life to start with the positive: in your opinion, what are the good sides of this Law 25?
O : One good side is the feeling of “finally!” Finally, the legal sphere of society is taking an interest in the digital jungle, showing its teeth and setting boundaries. It has been over twenty years since Google invented what is now known as surveillance capitalism. And for twenty years, they have had a completely free playing field; they have plundered and monetized data as they pleased.
Yes, this law has been long-awaited, and even though it is not perfect in our eyes, we cannot be unhappy about the announcement of such a change.
Another positive aspect I see is that it will likely raise awareness. The current discourse revolves around people in the digital marketing industry, who suddenly fear becoming irrelevant. But eventually, people will come across a Quebec website that presents them with an “opt-in” message for cookies. Initially, it may bother them, but afterward, it is likely to generate reflection and empower citizens. It will enlighten people about Google’s business model: how do they actually make billions of dollars?
C&M : It’s also important at times to be critical. In your opinion, what are the shortcomings of Law 25?
O : My discourse here differs a bit from the prevalent one in digital marketing, as I don’t only see the shortcomings of this law through a lens that personally affects me as a digital marketer.
What needs to be understood is that there was marketing in the Roman Colosseum two hundred years before Christ, and there will still be marketing even without Web cookies. Cookies are just a detail. Fundamentally, there will always be people who want to advertise to influence others.
That being said, regarding the shortcomings of the law itself… a law like this is a way to redistribute the power that has developed in the digital world. It’s a good step, but it annoys me that the law doesn’t redistribute enough between the small local players and the GAFAM. Moreover, if you read the academics who have studied the GDPR, what they say is that it’s challenging to have the same law applied to Facebook and, say, a local fruits and vegetables market. It doesn’t really make sense in reality.
Small players without many resources will have to invest more, pay for necessary tools, educate themselves, become compliant, and in the short term, it may reduce the profitability of their digital marketing or at least complicate the analysis of results. It requires an investment of a lot of time and money, and they are not the ones endangering our free will. It’s not the fruit stand on the corner that scares me. But it’s for them, the small businesses, that this law weighs heavily.
Furthermore, is the law strong enough for Google and Facebook, which are inherently opaque and have a massive legal defense? They will always conduct a cost-benefit analysis. If the fine is worth paying, they will pay it.
C&M : You observe that the GAFAM easily circumvents legislation in Europe, and as a result, you suggest that perhaps the law should be tightened to make it truly enforceable. How can we establish laws for the protection of information that even the most powerful players are forced to comply with?
O : That’s the million-dollar question. If you look at what some experts say, one solution could be to audit their algorithms. It’s similar to auditing the finances of a publicly traded company: every year, an auditing firm comes and examines your numbers, verifying the accuracy of your representation. It’s done to protect the public in the end.
Many voices are starting to argue that the same kind of practices should be applied to Google or Facebook, which are so opaque that we rely solely on what they tell us, and we have to wait for whistleblowers like Frances Haugen to sound the alarm. That’s when legislation wakes up and takes action.
Without claiming to have all the answers, a solution seems to lie in the human resources, in the workforce that works to enforce the legislation. When I looked at the cases of fines… yes, fines are imposed, but there are so many open litigations, and it takes years and years to reach a conclusion. Why? Because on one side, Facebook has 200 lawyers while the European Union and the GDPR have 15, and they face every possible obstacle. It’s a David versus Goliath situation. The persecuted player has more means to defend themselves than the police trying to apprehend them. So it’s difficult to make something truly hurtful for them.
C&M : You seem to believe that the legislation surrounding Law 25 carries the risk to harm Quebec’s small and medium-sized enterprises. What is the nature of these risks?
O : Yes, and I’m not making this up. A study from the University of Oxford looked into the causality between GDPR and the revenue and profitability of businesses. The study noticed a decrease in profitability. Why? Well, because the law acts as an administrative tax: buying another tool, training employees, educating oneself. In the end, it’s not the SMEs that monetize our data and influence our behavior.
With legislation like Law 25, I don’t think it’s black or white, like “you over there can, but you there cannot.” I rather think of a modular application. For example, I’m thinking of our local news media or any media participating in the advertising sales game. To give them more power, it would be interesting to grant them more rights on our territory than Google or Facebook. That way, we might see a budget migration opposite to that of the past twenty years, where all budgets migrated to Google and Facebook simply because it works, it performs. Already, Law 25 puts hurdles in their path: it will be less possible to analyze user behavior.
These companies were sold a dream in the early 2000s with the Internet, like, “Get indexed on Google, make a Facebook post, and 10,000 people will come read your article…” But here we are in 2023, and Google monetizes your audience better than you do, and so does Facebook. You can no longer be profitable because they have eaten up all the advertising budgets and have access to all the data from your site. That’s precisely where I see a missed opportunity, a missed rendezvous.
But why not give more power to La Presse or Le Devoir to access personal data? Then it would be possible for them to reach better audiences, and consequently, there would be a shift in the media mix in Quebec. It would be positive to redistribute the pie to players with an important mission, like the ones I just gave as an example.
There are all sorts of subsidies for these players, that’s true; they say, “You are important, and we want to help you,” but in reality, that aid is nothing but a band-aid. Now we have the opportunity to create a structure that would genuinely help them.
C&M : You mention that one of the shortcomings of this legislation is that it is applied to the mass of Quebec companies without distinction. Instead, you propose a “micro-targeting, similar to what is used in digital marketing.” What would this look like in practice?
O : It’s actually a nod to what we’ve been doing in the past ten years [in digital marketing], which is targeting an ultra-niche audience of around 500 people, for example, specifically targeting students from HEC. With Law 25, this kind of micro-targeting will disappear since the data will simply no longer be available.
The idea behind this is that Law 25 is like a mass advertisement on the side of a highway. And the message would be, essentially, “Everyone must comply with Law 25 in the same way.” However, if we had a more modularly applied law that said, “For Web giants, here are the rules, for media companies, here are the rules, for small businesses, here are the rules,” we would have a more useful ecosystem for our economy in the end than with an all-encompassing law.
C&M : You seem to want to make a final statement.
O : Indeed. I want to say that yes, Law 25 has its limitations, and we may not be entirely happy about that.
However, I still believe that this law will create some sort of rebalancing between our local media and the Web giants, who will no longer show sexy performances in our advertising reports. So, I’m delighted that it pushes us to explore avenues that go beyond the reflexes of purely performance-driven marketers. For that, at least, I am pleased.
At Click & Mortar, we’ll be happy to talk to you, give you our opinion, and above all help you get your data talking!
