Your Data, Your Control

How data portability can unlock competition and empower consumers

January 15, 2026

• Copyright and permission to reproduce

  For information on the Competition Bureau's activities, please contact:

  Information Centre
  Competition Bureau
  50 Victoria Street
  Gatineau QC  K1A 0C9

  Telephone: 819-997-4282
  Telephone (toll-free in Canada): 1-800-348-5358
  TTY (for hearing impaired): 1-866-694-8389
  Fax: 819-997-0324
  Website: www.competitionbureau.canada.ca

  This publication can be made available in alternative formats upon request. Contact the Competition Bureau's Information Centre at the numbers listed above.

  Permission to reproduce

  Except as otherwise specifically noted, the information in this publication may be reproduced, in part or in whole and by any means, without charge or further permission from the Competition Bureau, provided that due diligence is exercised in ensuring the accuracy of the information reproduced; that the Competition Bureau is identified as the source institution; and that the reproduction is not represented as an official version of the information reproduced or as having been made in affiliation with, or with the endorsement of, the Competition Bureau.

  For permission to reproduce the information in this publication for commercial purposes, please fill out the Application for Crown Copyright Clearance or contact the ISED Citizen Services Centre mentioned below.

  ISED Citizen Services Centre
  Innovation, Science and Economic Development Canada
  C.D. Howe Building
  235 Queen Street
  Ottawa, ON  K1A 0H5
  Canada

  Telephone (toll-free in Canada): 1-800-328-6189
  Telephone (international): 613-954-5031
  TTY (for hearing impaired): 1-866-694-8389
  Business hours: 8:30 a.m. to 5:00 p.m. (Eastern Time)
  Email: ISED@ised-isde.gc.ca

  © His Majesty the King in Right of Canada, as represented by the Minister of Industry, 2026.

  Date: 2026-01-15

  Aussi offert en français sous le titre Vos données, votre contrôle : comment la portabilité des données peut stimuler la concurrence et donner plus de pouvoir aux consommateurs.

Table of contents

Executive summary

Data portability gives consumers the power to transfer their personal information easily and safely between service providers. This creates more freedom, choice, and convenience. When consumers can take their data with them, it increases competition and fuels innovation across sectors. Canada continues to make progress, particularly in the banking and health sectors. But we have more work to do to unlock data portability’s full potential. In this report, we will inform Canadians and policymakers about the potential value of data portability and offer key design considerations to develop a Canadian framework.

We used the insurance industry as a test case to help us assess the potential benefits that data portability could have for Canadians. We worked with a behavioural economist and surveyed Canadians to determine awareness, preferences and concerns about data portability and its uses. We also looked at international experiences, such as open banking in the United Kingdom and the Consumer Data Right in Australia. This helped us understand how data portability could affect competition, consumer behaviour and economic growth.

We found that data portability offers real benefits for consumers and businesses. However, it also presents challenges for privacy, security, and market dynamics. We must address these challenges to be sure that data portability is successfully adopted and implemented in a way that promotes fair competition and innovation. However, we must also safeguard consumer interests. This report finds that:

• Consumers can save in significant ways. In the insurance market alone, introducing data portability could save Canadians between $1.10 billion and $3.83 billion in both time and money on their annual costs. This includes up to $1.57 billion in monetary savings from switching to less expensive insurance plans and an estimated $2.26 billion in value from time savings.
• Behavioural barriers limit adoption. Consumers may prefer methods they know, or they may want to avoid switches they think will be costly. They may also be concerned about their privacy and not be aware of the benefits. These behavioural barriers could prevent them from adopting and using data portability.
• Smart design is critical. To be successful, we must define clear and fair rules around data. We need to ensure strong interoperability, which is the ability of different systems, platforms, or applications to operate together and share information smoothly, mitigate challenges and prioritize user-friendly tools.
• Global lessons matter. International examples show the benefits of data portability. They also highlight challenges to implementing it, such as how complex the system is, issues with data format and how costly implementation can be.

Empowering Canadians to control their own data could transform our digital economy. If we enable data portability, businesses will need to innovate and compete more strongly. This will improve services and provide consumers with more choice.

We encourage policymakers to develop dynamic regulations that balance competition and innovation with privacy protection. These regulations should allow both established companies and smaller enterprises to thrive. By leveraging evidence-based findings and global insights, we can create a data portability system designed for Canada’s unique needs. It can drive economic growth while putting Canadians in control of their digital footprint.

Who we are

The Competition Bureau is an independent law enforcement agency that protects and promotes competition for the benefit of Canadian consumers and businesses.^Footnote1 We administer and enforce Canada’s Competition Act and advocate for rules and regulations that promote competition at all levels of government.

What is the Competition Act?

The Competition Act’s purpose is to maintain and encourage competition in Canada.

• It contains both criminal and civil provisions.
• It applies to almost all economic activity in Canada.

We have a history of advocating for competition and enforcing laws that protect a competitive marketplace. We have used this experience to build our knowledge of competition across sectors and markets of the Canadian economy.

The Bureau’s advocacy activities encouraging data access and use

The Bureau has regularly championed data portability and access to data, noting how important they are to encourage competitive markets. This has been the case across several sectors.

• We published a market study on technology-led innovation in 2017, and we conducted post-report advocacy on Canada’s progress in FinTech in 2018.
• We have supported competition within the financial sector, especially highlighting how important data portability is to implement consumer-driven banking. In 2019, we made a submission to Finance Canada on open banking. We made a submission to the Advisory Committee on Open Banking in 2021 and again in 2024 as part of our submission to the consultation on Strengthening Competition in the Financial Sector.
• In 2022, as part of our Digital Health care market study, we published a report on unlocking the power of health data.
• More recently, in 2023, we co-created the Canadian Digital Regulators Forum, which focuses on information sharing and collaboration on digital market issues such as data portability.

The case for data portability

Consumer switching, or the threat of it, lies at the heart of the competitive process. Consumer switching drives rivalry among firms to win over and retain customers. This in turn enables innovation and economic growth.

In a digital economy fuelled by data, it can be difficult to switch providers, especially when it involves moving our data. This can make it harder for new firms to compete, and easier for existing firms to grow complacent.

We launched this study as part of our goal to encourage policymakers and regulators to adopt pro-competitive policies that drive Canada’s economic growth. The study focuses on how data portability could enhance competition and empower consumers in the digital age.

Why competition matters

Competition drives economic growth. It encourages businesses to innovate and become more productive. Consumers benefit because it lowers prices, increases choice, and improves quality. When businesses operate in a healthy competitive market, consumers get to choose the best option available to meet their needs and their price point.

What this report does

Data portability is not yet a familiar term for many Canadians. This report explains the concept of data portability and the value it has for Canadians and the economy. It explores how establishing a framework to enable data portability could improve competition and benefit Canadian consumers and the economy.

The report also provides recommendations to policymakers to encourage the adoption of data portability in Canada.

It focuses on the effects data portability will have on two key areas:

• Competition – showing the impact it can have on competitive outcomes
• Consumers – highlighting its value from a consumer’s perspective and the factors that could influence its adoption

Questions answered in this report

The report focuses on addressing three basic sets of questions:

Questions about the right to control your information

• What is data portability and what role does it play in the digital ecosystems?
• How does data portability benefit consumers and market competition?
• What behavioural barriers prevent consumers from using their right?

Questions about the value of data portability

• How will consumers benefit, financially and in time spent (i.e., consumer welfare gains), if we implement Canadian data portability?
• What do Canadians know and understand about the risks of adopting data portability?
• What factors would drive Canadians to adopt data portability?

Questions about design principles and implementation strategy

• How can we design a data portability framework that balances the interests of all stakeholders?
• How should the main technical, legal, and operational elements be structured for a pro-competition data portability regime?
• What lessons can we learn from how other jurisdictions have implemented data portability?

How we conducted this study

We studied academic publications, policy reports and comparative analyses of data portability regimes worldwide.^Footnote2 We interviewed Canadian and international regulatory bodies to understand their experiences in implementing and overseeing data portability.

To better understand Canadians’ views and preferences on data portability, we also commissioned a public opinion survey. We partnered with a public opinion research expert to field the survey. A copy of their final report can be accessed here — Estimating consumer value of Canadian data portability.

Analyzing complex consumer choices requires special expertise. Accordingly, we worked with Professor Claire Tsai Jan, a leading behavioural economist at the University of Toronto, to design and conduct the survey. The expert also provided quantitative analysis to estimate the value of data portability for Canadians and how they feel about it.

In this report, we provide a detailed account of the findings from our experts. The methodology for this work is included in Annex A, and a summary of the survey findings is included in Annex B.

Data portability explained

Data portability is the right a person has to obtain and transfer their personal data in an easy and secure way from one data holder (the sender) to another (the receiver). It empowers consumers and businesses to enhance their choice and autonomy in digital markets.^Footnote3 As digital services increasingly collect and use our data, understanding what data portability is and how it works within these ecosystems becomes essential for both consumers and policymakers.

In this part, we explore what data portability means in practice, how it benefits consumers through enhanced choice and convenience, and how it can potentially stimulate market competition by reducing switching barriers. This prepares us for our later discussions on the impact for Canadian consumers, competition, firms, and implementation.

What is data portability?

Data portability – A consumer right to digital autonomy

Data portability commonly refers to a person’s ability to transfer their data to themselves or to a third party in a structured, machine-readable format. This can happen in several ways.

• Manual transfers: Also called ad hoc transfers, manual transfers require the consumer to mediate, manually downloading and uploading data between services. This creates friction but offers explicit and direct control.
• One-time direct transfers: These are transfers between service providers at the user’s request. One-time direct transfers establish a direct connection between services for a single data exchange and provide a snapshot without ongoing updates.
• Continuous transfers: Continuous transfers offer more convenience by establishing ongoing access after initial authorization, which eliminates repetitive user intervention. It also requires user permission and enables the receiver to access current information from the sender without further user action.

The success of data portability often depends on interoperability. Interoperability is when different technological systems can share and use information. It is needed to allow continuous, real-time data sharing between platforms.

• Description of Figure 1: Modes of data portability: manual, direct, and continuous approaches

  This diagram shows three ways that data can be transferred to another party. The modes are manual, direct, and continuous. At the centre, individuals give their consent to a Data Holder (DH), as indicated by arrows pointing from the individual to the DH. From there, the diagram branches out to illustrate the three methods: manual transfer; individuals access and share their own Personal Data (PD) with a third party, direct transfer; the Data Holder sends the data to a third party after receiving a specific request from the individual and continuous transfer; the Personal Data is transmitted in real time to a third party, as authorized by the individual.

Data portability — An element of data governance

Data portability is one aspect of data governance. Data governance is the set of policies and rules that determine how data is collected, stored, processed, shared, and disposed of within and across organizations, sectors and national boundaries.^Footnote4 As the data economy grows, new rules define user rights, set standards and enforce protections. Different types of regulations address different issues. For example:

• Competition policy addresses anti-competitive activity, such as collusion, abuses of market power and anti-competitive mergers.
• Privacy requirements protect peoples’ rights by governing how their personal information is collected, used, disclosed, retained, and safeguarded against misuse, unauthorized access or sharing of their personal data.
• Interoperability mandates require data sharing across platforms and systems.
• Safety and security protocols address data breaches, security safeguards and cybersecurity risks.

These issues often overlap and require a coordinated approach. Our study focuses on how data portability could potentially increase competition, but it is important to note how it is impacted by and connected to other data regulations.

Competition, regulation, and digital markets

Markets should operate freely. Regulations should be reserved for instances where competition cannot achieve optimal consumer outcomes. When regulation is necessary, it must be precise. If regulation is poorly designed, innovation may suffer. Rules must be evidence-based, proportionate and focused on specific market failures rather than imposing broad restrictions.

Digital markets have unique characteristics that can sometimes make it difficult to stay competitive. This could lead to one firm or small group of firms controlling the market. This is called “tipping,” and it is most likely to occur in markets where firms benefit from:

• Strong network effects that allow established digital products to dominate, even over new and higher-quality options.
• Economies of scale and scope that favour the largest firms, making it difficult for new entrants to compete effectively.
• Access to large volumes of data that enables established firms (incumbents) to maintain their market position and hinder competitors.

Without appropriate safeguards, dominant platforms may strengthen their positions in various ways. For example, they may monopolize data by controlling exclusive access to valuable consumer information or putting up barriers to interoperability by preventing different systems from working together seamlessly. They can also engage in self-preferencing, where they favour their own products over competitors on their platforms.

That is why data use and access, including data portability and interoperability is a possible key area where regulations may be needed to ensure we bring more competition into the market.

Data portability puts consumers in control and strengthens market competition

A consumer’s ability to switch is at the heart of the competitive process. In the digital economy, this often means being able to take your data to a new service provider. When there is no seamless data transfer between platforms, consumers may have fewer choices, face higher costs when they switch providers and relay on fewer firms with less competitive services.

Data portability addresses these challenges by making data transfers between service providers easier. This changes consumers from passive data subjects to active participants in the digital ecosystem. It allows them to securely share their information with third-party services, supports seamless data transfer across platforms, and creates opportunities for innovative solutions.

• Description of Figure 2: Examples of applications of data portability in everyday life

  Infographic illustrating five everyday examples of data portability uses between social media platforms, digital medical records, financial service providers, game consoles and cloud storage.

  • In the first scenario, a social media user’s digital life is shown: two identical images of a person are shown with icons (a thumbs up, a heart, and a plus sign) representing likes, loves, and friend additions, connected by a double-headed arrow to indicate transferring followers, photos, posts, and friend lists between social platforms.
  • The second scenario shows two identical images of a patient in a hospital bed, complete with a medical chart and pulse indicator, linked by a double-headed arrow to represent the sharing of medical history between healthcare providers for continuous care.
  • The third scenario features two identical smartphones displaying a bank building onscreen, labeled 'Fintech A' and 'Fintech B', connected by a double-headed arrow, illustrating a financial customer transferring transaction history and budgeting data between apps.
  • The fourth scenario depicts two identical joysticks with a double-headed arrow between them, symbolizing a gamer moving in-game progress, purchases, and profiles from one platform to another.
  • Finally, the fifth scenario depicts two identical images of computers connected to a cloud by circular arrows with a double-headed arrow drawn between the two to show bidirectional transfer of data. This symbolizes a business transferring stored data and files from one cloud service to another.

Behavioural barriers can prevent us from adopting data portability

Imagine saving money and time spent searching and filling in forms simply by moving your data between service providers with a single click. Data portability promises exactly this for Canadian consumers who are trapped by the invisible chains of habit and hassle.

Despite the potential benefits, many Canadians hesitate to switch providers. The Bureau’s 2021 Switch Week survey revealed that only one in four Canadians switch providers, although they could save about $1,860 each year by changing or renegotiating their telecom, banking and insurance plans.

Several barriers contribute to Canadians not making the switch, including:

• feeling loyal to a brand,
• not knowing how to switch services,
• being unsure about the benefits of switching, and
• believing there are hassles related to the process.

A consumer-behaviour survey by Abacus revealed that Canadians are satisfied with their financial providers because they have emotional ties and the providers are familiar, not because of financial reasons. Notably, younger generations are more open to switching, particularly if the processes were simplified.

To understand why people might not use data portability, we looked at how people feel about new technologies to uncover decision-making patterns. Even if a new technology offers clear advantages, people may still not want to use it because of psychological barriers to change. This is particularly true for data portability, which involves new technologies, many stakeholders, and different applications.

Behavioural science suggests that several psychological factors often overlap. This may make consumers unwilling or slow to adopt new technologies. Psychological factors include:

• familiarity bias (preferring methods they know),
• status quo bias (resisting change even when new options are better), and
• consumer inertia (avoiding switches they think are costly).

All these factors together make people reluctant to embrace new technologies.

Understanding these factors helps us design effective data portability solutions that meet consumer needs and preferences.

Conclusion

The right to data portability can empower consumers, enhance market competition, and drive innovation. If we address technological and behavioural barriers, we can significantly improve the digital economy. This will allow individuals to take control of their personal information and make informed choices among service providers.

Data portability promises significant value for Canadians

Understanding what drives consumers to embrace new technologies is essential for successful innovation. This section explores the human side of data portability. It examines how Canadians make decisions about switching service providers and what they currently understand about data portability.

We uncover the key factors that motivate adoption and measure the actual benefits for consumers.^Footnote5 We estimate the potential time and money savings to show how data portability goes from a concept to practical tool that enhances everyday consumer welfare and creates value for Canadians.

Understanding consumer choices through experiments and surveys

Our methods

Our study used a behavioural economics approach. This approach allows us to explore how consumers make decisions in the real world using two methods: behavioural experiments and public opinion surveys. Together, these methods can predict how consumers are likely to behave and what factors may influence their choices. They also helped provide robust estimates of data portability’s value to consumers.

Insurance: An ideal sector for data portability testing

To test how Canadians would respond to data portability services, we first needed to find an appropriate sector for our case study. We wanted to select an industry that is both well-positioned and likely to implement data portability solutions successfully once relevant regulations are established. This allowed us to test realistic consumer reactions in a situation that is very similar to future implementation scenarios.

Our analysis showed the insurance sector, especially home insurance, was a good candidate for our data portability study. Insurance is a recurring annual expense for many households. Shopping for or switching insurance plans can take time but could lead to savings. Insurance is also seen as a part of a broader concept of “open finance,” a natural extension of open banking.

Recent studies highlighted how our selection is needed and relevant. The High Price of Prudence study by C.D. Howe found that Canadian consumers pay much higher property and casualty insurance premiums than consumers in other developed nations.^Footnote6 The Canadian Federation of Independent Business study Insuring Main Street identified insurance costs as a major concern for businesses, especially small ones.^Footnote7

For details about our research method and sector selection, see Annex A.

Testing data portability in practice

We collected survey responses from 3,046 Canadians who currently pay for insurance. The sample represented the Canadian population in terms of gender, age, geography, income and distribution across provinces and territories.

We asked participants about their preferences during a simulation exercise on shopping for home insurance. This exercise included getting quotes, comparing products, choosing an insurance policy, and purchasing home insurance. They were then asked if they would join our hypothetical data portability application, which we called Open Insurance (OI). OI is a data portability service that allows people to securely share their insurance data held by their current insurance provider with other insurance providers or third-party apps of their choice. Before making their decision, they were given information about the benefits of joining OI and how it works.

Participants were randomly assigned to eight different OI regime designs with three key differences:

• Savings: Either a low saving (0.5%) or a high saving (5%) of annual insurance spending.^Footnote8
• Who designs, oversees, and manages the system: Either the government or a partnership of insurance companies.^Footnote9
• Main benefit emphasized: Either the communication platform, which is a tool for easy product comparison to gather information all in one place, or the transaction platform, which is a one-stop insurance shop that allows participants to access and purchase better value and improved services easily all in one place.^Footnote10

Each participant was then asked how much time they felt they save from joining OI, how willing they were to share personal data with a third-party app and what their previous knowledge and views about data portability were. Their feedback helped us understand what consumers think about when joining a data portability enabled platform.

Through this experiment, we also measured the monetary value consumers place on data portability, and we explored policy options to help create data portability that is consumer friendly and enhances competition for Canadians. For details on the survey design and analysis, see Annex B.

Below are the main findings of our survey:

Consumer preferences and switching behaviour

• Description of Figure 3: Consumers’ switching

  Two pie charts displaying the percentage of participants who switched providers in the last three years and the percentage of participants who considered switching in the past year.

  Pie chart 1 displays the question ‘Did you switch providers in the last three years?’ with legends ‘yes’ (18%) and ‘no’ (82%).

  Pie chart 2 displays the question ‘Have you considered switching in the past year?’ with legends ‘yes’ (25%) and ‘no’ (75%).

Percentage of participants who switched providers in the last three years

• 18% of participants switched providers in the last three years.
• Switching activity is highest in Quebec at 23%.
• 65% of those who switched found switching ‘easy’, while 10% found it ‘difficult’.

Percentage of participants who considered switching in the past year

• 25% considered switching in the past year.

• Description of Figure 4: Concern for data privacy

  Vertical bar chart titled ‘Concern for data privacy’.

  The x-axis shows responses on a five-point scale from ‘Not at all concerned’ to ‘Very concerned’. The y-axis show the count of respondents ranging from 0 to 1,200. The chart shows a clear upward trend, with few respondents selecting 1 or 2, more selecting 3 and 4, and the largest number selecting 5.

• Privacy is a major concern for two-thirds of surveyed Canadians, with 40% being ‘very’ concerned.
• Results vary by location and age groups.

• Description of Figure 5: Knowledge of data portability

  Vertical bar chart titled ‘Knowledge of data portability’.

  The x-axis shows responses on a five-point scale from ‘Not at all knowledgeable’ to ‘Very knowledgeable’. The y-axis show the count of respondents ranging from 0 to 1,500. The largest group of respondents selected ‘Not at all knowledgeable’ (1), followed by progressively smaller numbers for 2, 3, 4, and 5, indicating generally low awareness of data portability.

• About 70% of participants report having no knowledge of data portability, though awareness differs among demographics

• Description of Figure 6: Perception of risk

  Vertical bar chart titled ‘Perception of risk’.

  The x-axis shows responses on a five-point scale from ‘Not at all risky’ to ‘Very risky’. The y-axis show the count of respondents ranging from 0 to 1,000. Most respondents selected the midpoint (3), with fewer selecting 4, and progressively fewer selecting 2 or 1. The smallest share rated risk as ‘Not at all risky’.

• About 43% of participants view data portability as relatively risky.
• Another 40% are not sure and see a moderate risk.
• About 15% think it is low risk.

Adoption drivers

Time and monetary savings

Savings are the main reason consumers decide to join OI. We found that the adoption rate increased from about 46% to 54% when the money savings rate went from 0.5% of annual insurance spending to 5%.^Footnote11 Also, when we asked participants to rank features influencing their decision to join OI, they considered the savings rate most important.^Footnote12

Increased time savings improve the likelihood of adoption. Participants decided to join OI based on how much time they could save. This shows that saving time matters for consumers. More participants adopt OI when they estimate that they save more hours. Our analysis predicts a 5.1% increase in adoption is likely for each additional hour saved.

Participants’ awareness and trust

One of the most important factors in the adoption rate was whether participants were aware of data portability and how much risk they believe there is to join a data portability system. When we examined participants’ attitude toward data portability, we saw that when they had more knowledge of OI and felt there was less risk, they were more likely to adopt it. For example, participants who felt “very knowledgeable” about data portability were 37% more likely to join OI than those who were “not at all knowledgeable.” Similarly, participants who viewed OI as “very risky” were 65% less likely to join than those who viewed it as “not at all risky.”

If consumers trust the oversight body, they are more willing to share personal information. Our survey showed that participants are more willing to share their personal data with participating apps on OI when they can save more money and when the platform is overseen by the government. This suggests that consumers value both meaningful benefits and a sense of data security, particularly when a trusted entity is overseeing their personal information.

Estimating the potential value of Open Insurance

Canadians could save money and time by joining OI. We estimated how much Canadian households value OI by measuring how much money and time Canadians save by joining OI when shopping for insurance plans.

On average, a Canadian household spends $3,804 on all insurance products every year. The top 10% spending $7,200. If the simulated savings rate was 0.5% (conservative), a participant can save $19.02 a year. If the rate was 5% (optimistic), the savings could be about $190.21. On average, Canadian households can save about $128.37 every year.^Footnote13

We also asked participants about how much time they feel they could save with OI. They reported that they felt they saved five hours shopping for insurance on average. By using economic analysis, we estimated the monetary value for the time savings. We found that this time saved is worth $185.31 on average per household, per year.

Scaling the average savings of both these estimates to Canadian households (HH) above the poverty line,^Footnote14 we determined that the total value that OI may provide to Canadians is $3.83 billion in time and money.

This estimate has two components:

• Monetary savings: Canadians can save up to $1.57 billion by switching to less expensive insurance plans.
• Time savings: Canadians can save 61.08 million hours, which we estimate to be valued at $2.26 billion.

We then estimated the value of OI based on the average adoption rate in each regime. The potential value of OI depends on how much consumers can save per year on insurance, how much time they could save and how likely they are to adopt data portability.

Insurance consumers have different opinions

The survey responses show different opinions among the participants. For example, some participants were eager to join OI, while others were hesitant. Some participants made their decision based on financial savings, while others decided based on the key benefit of OI. To understand these perspectives, the Bureau’s behavioural economics expert conducted a cluster analysis and found three main types of consumers:

Decisions that participants make about sharing their data informs us about how Canadians value their personal information and how these changes across different consumer groups. For data portability to succeed, firms may want to consider several strategies. First, they can design systems that address different consumer needs when developing their products. Second, they should offer fair and responsible rewards—such as savings—for consumers who share their personal information. Finally, it is also important to increase consumers’ awareness and understanding of data portability. Reducing the perceived risks associated with participation can help encourage wider adoption.

Conclusion

Our experiment identified key factors influencing consumer adoption of data portability and established habits. The findings reveal that data portability offers consumers significant financial and time savings, which strongly motivates adoption. Moreover, increased awareness and trust in the data portability ecosystem are critical drivers of adoption. Consumers are more likely to join and share their personal data when they understand the benefits and feel secure about data management. Considering these factors that drive adoption, data portability can become a practical tool for empowering Canadians in the digital economy.

Balancing opportunities and challenges of data portability

To realize data portability’s full potential, we need to navigate a complex landscape of opportunities and challenges. Data portability promises significant consumer benefits through enhanced choice and competition. It also raises critical issues related to privacy, security and market dynamics that cannot be overlooked. Similarly, businesses may leverage data portability to attract customers and challenge established firms (incumbents), but other factors that could influence outcomes should also be considered.

This section explores the critical design elements needed to develop a balanced, effective data portability framework. Such a framework would empower consumers and enable businesses to innovate and compete more effectively. It would also put in place appropriate protections to prevent unplanned consequences.

Data portability drives competition and innovation, but not without challenges

Data portability and interoperability can create a more competitive marketplace, but it can also result in some obstacles.

Pro-competitive effects of data portability

Reducing switching costs

Data portability and interoperability make it easier for consumers to switch service providers, which encourages businesses to compete more actively for their customers. Switching costs are lowered because consumers do not need to re-enter their information or start over with a new provider, ensuring a smoother transition. For example, it allows a customer’s transaction history to be copied seamlessly from one financial institution to another.

Consumer mobility, beyond the switch

The threat of switching raises competitive pressure. Removing barriers to consumer mobility empowers market competition. When consumers can confidently move between providers, the threat of switching forces companies to compete harder to retain or win back customers.

Switching is not an end goal. While consumer mobility is important, excessive switching can be a problem. Frequent changes can lead to consumer fatigue, increased search costs and disrupted service relationships. For businesses, high customer turnover can weaken customer experience, investment, create unstable revenue models and increase acquisition costs. There is not value in switching itself. But the potential for change keeps markets responding to consumer needs.

Switching can be a market health indicator. Switching rates reveal market dynamics:

• Low rates may indicate there are barriers to competition
• Moderate rates suggest the market is active
• Extremely high rates might indicate the market is not stable or customers are not satisfied

There is no ideal level; each case requires us to carefully analyze the specific sector.

Encouraging firm entry

Data portability and interoperability also help new businesses enter the market by reducing consumer lock-in. When customers can easily transfer their data, they are more open to trying alternative providers. This makes competition more dynamic. It encourages new companies to enter the market and offer better services, knowing they have a fair chance to attract customers from existing providers.^Footnote15

Promoting innovation

Data portability can drive innovation by allowing multiple companies to access and use the same consumer data without lowering its value. This allows companies to go from simply collecting data to analyzing and applying it in new ways.^Footnote16 Research shows that in competitive markets, data portability can push established companies to invest more in data-driven innovation.^Footnote17 In platform markets, it can also stimulate competition in related industries, such as smart home products and internet-connected appliances.^Footnote18 Finally, more access to data creates new opportunities for innovators to develop products and services tailored to consumer needs.

Sharing data-enabled learning and network effects

Data-enabled learning is a process where more users create more data, which leads to better services and attracts even more users. Companies with large amounts of data and users benefit from data-enabled learning. Often, these services become more valuable as the user base grows, creating a positive feedback loop. This cycle makes established firms (incumbents) stronger because it makes their offerings more appealing. However, with data portability and interoperability, these benefits can be shared across the market. This would allow more businesses to innovate and compete rather than having only the established players benefit.^Footnote19

Challenges data portability may create for competition

Enhancing the advantages of established (incumbent) firms

Data portability makes it easier for consumers to switch providers. It could also lead to more data being shared with established firms, making their market position stronger. This effect, known as the demand-expansion effect, can make it harder for new firms to enter.^Footnote20 Additionally, the technology framework businesses need to compete effectively may create barriers for some businesses. Established firms may have advanced capabilities to process data in house. This gives them a major advantage when data portability is introduced, as they can handle and use incoming data efficiently. This could make it more challenging for smaller or newer firms to compete equally.

Discouraging innovation

If we apply data portability too broadly, firms may be less likely to innovate in how they collect, process, and use consumer data. Businesses are more likely to invest in new data-driven services when they can expect a reasonable return. However, if others can access the data and quickly develop similar products, they are less motivated to invest in innovation. Data portability allows the benefits of innovation to be distributed across the market. So established firms (incumbents) may only regain part of the returns on their investments. This could potentially discourage them from further developing and improving their products or services.

Collusion

Full-scale interoperability could create a highly interconnected network of digital platforms. This may make coordinating behaviours easier, which could lead to explicit or tacit forms of competitor collaboration. If pricing information is included in a data-sharing framework, greater transparency could make it easier for companies to observe and respond to each other's pricing strategies. As a result, firms may begin to mirror each other’s prices or naturally settle into roles as price leaders or followers. This would reduce competition and potentially lead to higher prices for consumers. Parallel price increases combined with facilitating practices could lead to tacit agreement.

Maximizing consumers’ benefits and managing risks

There are other benefits and risks for consumers that can result from data portability.

Consumers benefit from data portability

Multihoming

Data portability and interoperability can help consumers use multiple service providers operating in the same industry at the same time. This practice, known as multihoming, allows consumers to benefit from price differences among service providers. Multihoming can also increase competition because firms use similar application programming interfaces (APIs). This makes it easier for consumers to open new accounts and integrate them with their existing ones.

Other direct and indirect consumer benefits

Data portability policies often include rules that ensure data privacy and security. These rules can either be aligned with existing privacy laws or be introduced as new protections.^Footnote21 Since people value their data privacy, this is an added benefit for consumers. For example, if we fully implemented data portability and interoperability, we would not need data scraping. This would limit security risks caused by this form of collecting data from websites. Also, consumer privacy and competition can reinforce one another. Firms may compete across multiple dimensions, including privacy terms. For example, the Competition Act was updated in 2022 to expand the list of factors to determine an impact on competition. It now expressly includes effects on non-price competition, such as consumer privacy.

Screen scraping, tolerated risk until a better solution is adopted

Screen scraping collects data from websites. It is like a digital copy-paste tool that automatically pulls information from websites, transforming what you see on the screen into a format that a computer can easily use and analyze. For example, while consumer-driven banking is still developing, some third-party financial services use screen scraping to gather data. This method fills the current gap, but it poses security, privacy, and liability risks for both consumers and institutions:

• Security risks: Direct access to bank login credentials is risky. It exposes users to having their personal financial information used, stolen, or deleted. It can also increase their legal risk since it may violate account terms, expose deposits to risk and leave users liable for losses.
• Data integrity: Data accuracy can be compromised as web structures change.
• Compliance issues: Programs may not comply with data protection regulations.

Once fully launched, a consumer-driven banking regime would provide a safer and more efficient environment for financial data sharing, reducing the need for screen scraping.

Third-party providers can offer additional value to consumers. Aggregated platforms are software solutions designed to centralize and manage all the information related to products in one place. For example, Product Information Management Systems (PIMS) are aggregated platforms that centralize product descriptions, specifications, pricing, images, and other relevant data. Other examples of such a platform are those that help users understand their consumption patterns, such as monthly electricity use or financial spending. Additionally, third-party apps help save time by streamlining access and updates to bank accounts or credit cards (e.g., UK Open Banking Hub).

Potential risks of data portability for consumers

Price discrimination

Price discrimination is when a firm charges different consumers different prices for the same product or service based on the consumers’ willingness to pay. They do this even though the cost of providing it to an additional consumer remains the same.^Footnote22 Data portability can lead to less price discrimination by giving consumers more control over their data and reducing how much information others have. But its overall impact will depend on market dynamics and on adequate regulatory oversight. On the one hand, when firms have more detailed consumer data, they can more accurately predict what each consumer is willing to pay. This is known as consumers’ maximum willingness to pay. It enables firms to set personalized prices at each individual’s maximum level, allowing them to get the highest possible amount from each consumer for the same product or service. On the other hand, if data portability enhances rivalry, it could encourage firms to be more competitive with their prices, benefiting consumers in the long run.

Moreover, firms are more able to build comprehensive consumer profiles by collecting data from multiple platforms. One way they do this is by using web cookies. This raises questions about privacy and market power. Data portability has the potential to shift the balance of power towards competitive and consumer-friendly outcomes. But this depends on how much the regulations ensure that portability does not accidentally enable new forms of monopolistic behaviour or data practices that exploit consumers.

Non-price risks: data breaches

Even though data portability regimes are often accompanied by privacy legislation, there may be increased privacy risks. Data portability exposes consumer data to more stakeholders, making data breaches more likely. Maintaining a highly interoperable system usually requires a firm to invest in data security. There are also challenges related to improper retention and deletion of data. It is possible to have potential inaccuracies when combining multiple datasets. Furthermore, companies may use personal information to create new datasets, making it difficult to ensure the original data is completely deleted as retention policies require.

How data portability impacts businesses, from startups to giants

Data portability can help firms attract new customers and boost competition. It has different effects based on the firm’s size.

Expanding customer reach

With data portability, firms can more easily access markets. Customer acquisition costs may go down, particularly for new companies. By reducing switching costs, new firms can enter the market more easily, as they do not have to pay for user transitions. When data moves more easily, firms can target customers more effectively. This further lowers customer acquisition costs. These changes can enhance competition within industries using data portability.

Firm size and data portability: small and medium-sized enterprises

Data portability may make the cost of investment and compliance higher for small and medium-sized firms. Smaller businesses do not always have the resources for sophisticated data formatting and transfer capabilities, which can make it harder for them to compete. As data portability regimes become more complex, setup costs may rise. This could potentially exclude smaller players from the digital ecosystem. Considering the experience of the finance sector, this can sometimes lead to partnerships between new entrants and established firms. For example, new companies using financial technology to deliver financial services and products, or “fintechs,” might collaborate with financial institutions to access resources and customers. However, established firms may later copy the fintechs’ innovations and marginalize these smaller partners, making it harder to sustain long-term competition. At the same time, sectors like payment systems have shown that small and medium-sized firms can thrive and innovate when regulations are tailored to firm size and function, such as through a lower compliance cost for non-bank payment providers.^Footnote23 Requirements can be introduced gradually or scaled.^Footnote24 This phased or proportionate approach can be according to firm size, resources and impact. And it can help support smaller businesses while giving larger institutions more responsibility, ensuring fairer competition.

Data portability can create important advantages for competition, consumers, and businesses. And these advantages can outweigh the challenges involved. Ultimately, we need to recognize both its promise and the need to carefully address the risks. Then we can implement data portability in ways that deliver real value for everyone involved.

Balancing the advantages and the potential risks is possible

Effective data portability requires a framework that naturally promotes market competition, protects consumer interests and supports technological innovation while being able to adapt to future developments. Though it may sound complex, it is achievable:

• An evidence-based approach is essential, with decisions grounded in a rigorous and deep understanding of market dynamics.
• The framework should avoid both overly strict rules that make compliance more expensive and rules so weak that data portability becomes meaningless.
• Regulations should have clear objectives and strategically target specific aspects where market incentives alone cannot deliver best outcomes—such as data security and data standardization.
• Regulations should be technology-neutral, allowing for emerging technological capabilities while avoiding overly prescriptive guidelines that could stifle innovation or overwhelm smaller market participants.
• The framework should be adaptable, incorporating feedback loops, milestone reviews and actions that ensure compliance, so it remains effective.

Conclusion

Data portability is a powerful tool for promoting competition and innovation. It could deliver significant benefits to consumers and firms. However, its potential risks highlight the need for well-designed frameworks that avoid unintended consequences. Policymakers should find a careful balance to ensure that data portability achieves its core goals of empowering consumers, fostering competition, and driving innovation while reducing challenges that may arise.

Smart design features to ensure success

Understanding the key building blocks of data portability is essential to successfully design and implement it. We examine the roles and responsibilities of key stakeholder, focusing on competition-friendly frameworks and user consent principles that enable secure, efficient data exchange. Our objective is to help establish flexible and forward-thinking data portability regimes that allow competition, technological innovation, consumer empowerment and regulatory efficacy to work together.

Creating a trusted framework: consent, fair play, and oversight

Data portability frameworks identify several actors and assign rights and obligations for data handling (see Defining stakeholders in a data portability framework). Some data portability frameworks, such as open banking frameworks, also create bodies that set standards and manage accreditation mechanisms to make efficient data portability easier and to ensure trusted data transfer.^Footnote25 These bodies reduce risks and build confidence in data portability systems by:

• verifying technical capabilities,
• ensuring compliance with security and privacy requirements, and
• maintaining a trusted environment for data exchange.

However, they may also create barriers for new or smaller players by, possibly without meaning to, making compliance too expensive or requirements too strict.

Defining stakeholders in a data portability framework

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to any individual whose personal information is collected, used or disclosed by a private-sector organization in Canada. Organizations under PIPEDA, including associations, partnerships, individuals and trade unions, may collect personal information directly or process it on behalf of others as service providers. When using third-party service providers, organizations must ensure that these providers operate under their instructions and comply with privacy obligations. Currently, PIPEDA provides a right of access to one’s data, but not an explicit right to data portability.

Some sector-specific or market-based frameworks extend data portability rights to businesses as well as individuals. For example, the proposed Consumer-Driven Banking Framework (CDBF) will provide such rights to both consumers and business clients.

Under the EU General Data Protection Regulation (GDPR), similar roles are defined but there is an express data portability right. Data subjects are individuals whose personal data is handled by:

• data controllers, who decide how and why data is processed, and
• data processors, who act on the behalf of controllers.

Data controllers must protect personal data and ensure privacy compliance. An example of this is when online marketplaces process customer data. Data processors, such as cloud service providers, process data according to the controller’s instructions. Sometimes, controllers and processors may share responsibilities. In certain jurisdictions, large technology companies (gatekeepers) have more data portability duties. For example, the EU Digital Markets Act (DMA) requires digital gatekeepers to enable users to transfer personal data directly between services in a machine-readable format.

Intermediaries can play a vital role in data portability. They make secure and standardized data transfers easier. Intermediaries include data aggregators, consent management platforms and API service providers, which help bridge technical and organizational gaps and ensure data moves according to standards and proper user consent. Intermediaries are not a distinct legal category; their obligations depend on their function and contractual arrangements. They must always safeguard personal information and respect applicable privacy and consent laws.

Data portability regulations may also require additional governance bodies, such as standard-setting bodies, to establish rules. This makes data sharing consistent and secure. Accreditation bodies may also be required to certify organizations for compliance with technical data sharing, security practices or complaints handling. This is, for example, anticipated under the CDBF, where a standard-setting body would establish rules to ensure consistent and secure data sharing. The Financial Consumer Agency of Canada (FCAC) is also expected to evaluate and accredit organizations for compliance with certain requirements, such as:

• technical standard certification for data sharing,
• security standard certification,
• complaints handling, and
• national security.

It is further planned that the FCAC will supervise participating organizations after they have joined the framework to ensure they follow consistent data sharing standards.^Footnote26

For more details on how they can affect competition, see Competition Bureau comments to the Advisory Committee on Open Banking and Strengthening Competition in the Financial Sector: Submission by the Competition Bureau. More generally, collaboration between competitors, such as through joint research and development (R&D) initiatives or participation in trade associations, is typically guided by Competitor Collaboration Guidelines.

• Description of Figure 7: Data portability actors and relevant bodies

  Infographic summarizing data portability actors and relevant bodies.

  On the left side, a pyramid-style diagram depicts a group of individuals labeled as 'Individuals' or 'Data Subjects', with a round-table diagram below showing three people labeled 'Business'. Together, these are grouped under the title 'Subjects.'

  From 'Subjects', two separate arrows emerge: one, a double-headed arrow labeled 'Data Flows' that is distinct and not connected to the other, and another arrow labeled 'Consent' or 'Authorization'.

  At the center right, two computers are shown, each connected to a cloud by circular arrows. The first computer is titled 'Organizations or Data Controllers' (current data holders), while the second is labeled 'Data Recipient or New Service Provider.' Circular arrows between them depict data flows. Below the first computer (representing Organizations/Data Controllers), a downward bidirectional arrow represents data flows to a third-party service provider labeled 'Data Processors.'

  At the midpoint of the circular arrow connecting the two computers, a diagram of a computer screen displays a pie chart and bar graph to indicate data, and is titled 'Intermediaries or Aggregators.' All these elements are enclosed within a dashed rectangle.

  On the right side outside the rectangle, a list notes various governance bodies, standard bodies, accreditation bodies, and regulators.

Note: This is a simplified illustration of the main actors typically found under data portability frameworks. PIPEDA actors are shown for reference. However, PIPEDA does not currently provide a data portability right. Data regulations may also identify additional stakeholders, such as data controllers designated as gatekeepers. Finally, the governance (organizational) structures depicted may be less prevalent in market-led approaches compared to regulation-led frameworks.

User consent is essential for data portability. It allows individuals more control over who can access their data. Regulations across jurisdictions vary from strict consent requirements to flexible frameworks focused on how data is handled. These rules ensure that users can securely and efficiently consent to transferring data to who they choose and be protected while doing so. There are some exemptions to this requirement, such as tasks in the public interest, official authority and cases affecting the rights of others. There are also different ways to get consent. One-time consent allows users to give permission once, with data shared until they revoke their consent. Dynamic consent requires notifying users and getting their permission before making significant changes to privacy practices, while also occasionally reminding them to review and update their privacy preferences.^Footnote27

Who owns your data? Understanding data ownership vs. stewardship

Data ownership means having control over data. This includes having control over who can access, share, and use or monetize it. The concept of data ownership is not clearly defined in a single statute but is governed by a framework of privacy laws such as PIPEDA. Instead of ownership, the law focuses on the rights to manage how personal data is handled. PIPEDA gives individuals rights over their personal information, like accessing, correcting, and controlling how it is used. It applies to private-sector organizations in Canada, requiring them to follow 10 fair information principles like accountability, consent and safeguarding, including encryption, security audits and data retention schedules.

Additionally, the Privacy Act ensures that federal government institutions handle personal information properly.

Service providers should clearly inform users about their rights and how data will be used. Under PIPEDA, meaningful consent is required for the collection, use and disclosure of personal information.^Footnote28 Quebec’s Act to modernize legislative provisions as regards the protection of personal information (Law 25) requires consent for data portability to be explicit, informed, purpose-specific and freely given. This ensures users control their data over time. Authorization is another way to give consent. For example, under the EU’s PSD2 regulation on open banking, granting permission for access is considered consent. It is an authorization given by the user for a specific action or data access, which may not meet the same higher GDPR standard for consent.^Footnote29 Users can withdraw consent at any time, putting a stop to any new data transfers for portability.^Footnote30

Considerations for a practical data portability framework: data types and format

Creating a balanced and accessible data portability framework involves considering both data types and formats. Establishing clear standards ensures that data can be securely and efficiently shared, interpreted, and used across various systems and platforms.

Understanding data types subject to data portability

Data portability regimes primarily focus on categorizing and protecting different types of data. For example, under PIPEDA personal information, which identifies or can potentially identify an individual, forms the core of privacy regulations.^Footnote31 This includes sensitive information such as health records, financial data, and biometric details, which require more protection. Non-personal information includes information that is anonymous, combined (aggregated) and not directly linked to an individual. The distinction between personal and non-personal information is subtle. Regulations usually determine if information is identifiable based on whether it could reasonably be used, alone or with other data, to identify an individual.^Footnote32

Data portability frameworks will define the scope of portable data they each cover. The OECD identifies four main data types:^Footnote33

1. Provided or volunteered data: Information directly submitted by consumers (e.g., account registration details).
2. Observed data: Information collected during service usage (including user-generated content).
3. Inferred, generated, or derived data: Information derived from provided and observed data. Generated data is produced, often synthetically or automatically, from certain processes. Derived data involves creating new data by transforming or combining existing data sources. The three are often used interchangeably.
4. Acquired data: Information obtained from third parties through commercial or non-commercial means.

• Description of Figure 8: Data type by origin and data user rights

  Infographic illustration of a hierarchical tree diagram showing types of data, connected by lines to demonstrate hierarchy. Below each type a box that indicates consent and rights that may be relevant to the type of data in question.

  The tree begins with a single root node labeled “Data,” which splits into two branches: “Personal, including sensitive data,” and “Non-personal.”

  Each of these further divides into smaller nodes representing specific examples or attributes, with lines showing hierarchical relationships.

  There are four nodes showing types of personal data: “provided,” “observed,” “inferred,” and “acquired.”

  There are three nodes showing types of non-personal data: “pseudonymized,” “anonymized or aggregated,” and “non-personal.” The “pseudonymized” node is also connected to the personal data branch with a dashed line, indicating that it may become personal data if the anonymization is reversed.

  Below the tree, three boxes represent the type of consent and rights associated with each data type:

  Below “provided” and “observed” data, consent or authorization from the data subject is required, and these are covered by data user rights under privacy laws, such as data portability rights.

  Below “inferred” and “acquired” data, consent of the data subject is not required, and these may be covered by proprietary or intellectual property rights.

  Below “pseudonymized,” “anonymized or aggregated,” and “non-personal” data, consent of the data subject is not required, and coverage is provided under other regulations (e.g., EU free flow of non-personal data or OPC rules).

The value and portability of these data types vary based on their origin, sensitivity, and competitive advantage. Provided data and some observed data are typically subject to portability rights. Inferred and acquired data often have more competitive value but also face more portability restrictions due to intellectual property protections. For example, Europe’s GDPR clearly covers both provided and observed data but excludes derived data. Whereas other frameworks may be narrower or broader.^Footnote34 Regulations such as the EU Digital Markets Act cover real-time access to data generated through the use of core platform services. This includes transaction data, user preferences and other relevant information.

In Canada, under the CDBF, any information that an individual directly provides to their financial institution regarding key financial products is subject to open banking. This information can include bank deposit accounts, investment accounts, lending products and payment products. However, this does not include data that is derived or generated by analyzing or inferring from the original account or transaction data (i.e., derived data is excluded).^Footnote35 Canada Health Infoway focuses on personal health information (PHI) and categories of identifiable, de-identified and aggregate data.^Footnote36

“Proprietary” data, access, and the requirement for reciprocity

Data can be classified as public domain or proprietary. Public domain data is generally considered freely accessible and is not protected by intellectual property rights. However, under PIPEDA, publicly available personal information has specific regulations, and privacy may still need to be respected, even if data is accessible to the public.

Proprietary data is created using specific analytics and algorithms. It is protected by intellectual property, trade secrets and contracts, and it is often subject to market exchanges like data licensing.

Reciprocity means that service providers agree to share information with each other. It encourages information flow, promoting competition and more participation. Information sharing should not include commercially sensitive or confidential information, as this could breach provisions of the Competition Act, such as sections 45 or 90.1.

It is essential to clearly define “proprietary” and “non-proprietary” data since non-proprietary data can be shared between service providers, while proprietary data may not. The Bureau’s experience, such as in the Toronto Real Estate Board (TREB) case, shows that businesses could claim data is proprietary so they can restrict competition. Regulators must find proof of such claims with credible evidence. Reciprocity can also be required by data portability regulations, such as under the CDBF. Under that framework, all accredited entities are equally required to honour consumer-permissioned data sharing requests, enabling reciprocal access to data among participants. The government might decide to broaden the rules in the future to cover more types of data, entities, entry processes (e.g., tiered accreditation), and extra features like letting users initiate payments.

The type of information that data portability laws cover can have a big impact on competition. A broad scope may increase competition by giving more firms access to important data. However, firms might invest less in collecting and developing new datasets if they need to share the benefits of their investments with other companies in the industry. A careful balance needs to be maintained: Sharing both generated and proprietary data can boost competition in the short term by encouraging new entries and innovation. But it might also discourage long-term investments due to potential negative impacts. This nuanced approach shows how complex balancing individual privacy rights, economic incentives and innovation can be.

Data sharing made simple: The role of formats and access

Effective data sharing depends on how data is formatted and organized for access. Using clear structures and standardized formats makes data more secure and easier to share. This facilitates secure transfers, lowers entry barriers, promotes broader participation, and enhances competition.

What makes data sharable? Data characteristics and accessibility

To understand what makes data easy or difficult to share, we must consider key characteristics:

• Data structure defines how information is organized and stored efficiently.
• Syntax consists of rules for writing code, similar to programming grammar.
• A scheme outlines the organization of data in a database, detailing data types and relationships.
• Data semantics refers to the meaning and interpretation of data so that it is correctly understood and used by a receiving system. It ensures that data transferred between systems is meaningful and consistently interpreted according to shared definitions or standards.

These characteristics play an essential role in making data portability interoperable and effective.

High levels of interoperability ensure effective data portability

Data interoperability is key to enhancing how digital systems work together to share and access data. Interoperability can be horizontal or vertical.

• Horizontal interoperability lets products from competing service providers communicate. For example, video game platforms allow gamers to interact across platforms. This boosts user experience, lowers switching costs and fosters competition.
• Vertical interoperability connects complementary products, such as smart lighting systems and home automation software. This enhances innovation, reduces switching costs and delivers higher-quality services through improved compatibility.

Interoperability is often described in levels, with each level building on the one before to enable richer, more useful connections.^Footnote37 Interoperability levels refer to the different layers or categories in which systems, organizations or devices can exchange and use information effectively. These levels are often discussed in technology, healthcare, government and other fields to clarify how systems work together. High levels of interoperability allow consumers to access multiple services seamlessly. Based on some of the most widely used frameworks, these levels can range from very basic to very advanced (see Annex C Interoperability levels – Consumers’ perspectives).^Footnote38 We can group these into three main levels based on how they will be experienced from a consumer’s perspective, as follows:

Level 1: Data is moved manually. At this most basic level, data subjects transfer their data themselves. They download their data from one company and manually send it to another.

Level 2: Data can be moved and understood. At this level, companies can set up their systems to share information in a format each can use. For example, a doctor can send prescription details electronically to the pharmacy, and their computers understand the file format. Usually, a system can view and download the data but not make changes. This is called read access.

Level 3: Data can be accessed across different service providers and correctly interpreted by each of them (all levels of data interoperability). At this level, information flows easily and is understood the same way by all the different systems, even across fields like health, banking, or utilities. For example, if a user submits a change of address to one service, it may be automatically reflected in other connected services, if the user permits. This level usually enables both viewing and updating information. This is called read and write access. It relies on clear rules, trust, and agreements between organizations to keep data safe.

• Description of Figure 9: Data interoperability levels from consumers’ perspective

  Infographic illustration of data interoperability levels from the consumers’ perspective.

  At the top of the figure, a definition of interoperability as “Technical ability of two or more systems (IS) to exchange information.”

  Below the definition, the figure shows three laptop computers, each representing an information system (IS).

  IS1 and IS2 are aligned on the same horizontal level, indicating that they operate within the same market. A bidirectional arrow connects IS1 and IS2, illustrating that data flows between them.

  IS2 is positioned above IS3, indicating a different level of the chain within the market as indicated with the word vertical. Another bidirectional arrow connects IS2 and IS3 to show data flows between these systems as well.

  Below the diagram, explanatory text lists the three levels of data interoperability that a consumer may experience:

  • Level 1: Data is moved manually.
  • Level 2: Data can be moved and understood.
  • Level 3: Data is accessed and interpreted correctly across different service providers.

API is a key enabler of seamless continuous communication between service providers. An API is like a messenger that helps two different apps or programs talk to each other and share information. For example, when you use a food delivery app, the app asks a restaurant’s system for their menu using an API, and the restaurant sends the menu back for you to pick from. It provides a system for applications to interact seamlessly, without requiring detailed knowledge of each application’s internal architecture. An OECD working paper (2021) recommends that policymakers supports the adoption of APIs to address the lack of interoperable specifications in digital markets. This lack of interoperability can hinder seamless access to and sharing of data across digital services and platforms, making it difficult for consumers and businesses to fully benefit from data portability. It also found that APIs would help implement safeguards and reduce the need for data scraping.

Countries adopt different interoperability strategies influenced by technical standards, regulations, and economic incentives (see Table 4). As each level increases data interoperability, data becomes:

• easier to share,
• better understood between systems,
• more useful to users and service providers, and
• more seamlessly integrated into the services used.

Enhanced interoperability gives consumers more choice and innovation. But it also introduces challenges such as implementation costs and security risks. So, the data portability system we choose should aim to reduce costs for participating service providers and mitigate security risks.

Interoperability levels and implementation challenges

Interoperability faces different challenges depending on its level.

• Functional interoperability is the most basic and easiest form to implement. But despite this, it may be too expensive to implement.
• Structural interoperability’s main challenge is that it requires communication and coordination across firms within an industry to establish a standardized data format. This form of interoperability often needs government help (e.g., fines for non-compliance).
• Semantic interoperability requires an important commitment for both firms and the government. Its main challenge is that it requires significant investment in time and resources. For instance, this form of interoperability usually requires a centralized and shared API. This comes with large set-up costs and legislative oversight requirements.
• Organizational interoperability is an ongoing process that requires both firms and the government to continue to commit as they work to uphold and improve the data interoperability network over time. This process is especially important for achieving cross-sectoral interoperability, enabling seamless data exchange and collaboration within and across different industries and sectors.

Sometimes data formats are not properly aligned, often due to outdated or legacy systems. When this happens, intermediary technology firms (such as data aggregators) can connect them by translating between incompatible formats and enabling data sharing. However, if a system fails to meet the required security protocols, even intermediaries cannot or should not establish a connection. This reflects the “bad neighbour” problem: A weak or less secure system can introduce risk and liability into the entire network. So, even if a technical connection is possible, it is often not allowed for security reasons.

Conclusion

We have identified key features that make up data portability systems and have offered a simplified framework for discussions about policy. Our framework emphasizes:

• how important it is to establish clear governance,
• what the specific responsibilities are, and
• how to create balanced incentives that empower consumers and encourage firms to continue their digital innovation.

The success of data portability depends on thoughtful design that ensures seamless data formatting, interoperability, and transparent access mechanisms.

As digital markets evolve, our approach recognizes that data portability is a technical challenge. It is also a complex ecosystem that needs to be continually refined.

Data portability in action: Learning from global experiences

Data portability regimes use different methods for managing personal data in different jurisdictions. We examined data portability regimes in various jurisdictions, especially in the EU, the US and Australia, and in various sectors, like telecommunications and banking.^Footnote39 We chose these jurisdictions because they have advanced data portability systems, high interoperability, and/or strong economic connections to Canada. This makes their laws and regulations relevant to Canadian enterprises. This section also explores the challenges for implementing and the lessons learned.

Data portability regimes around the world offer a range of choices

By the end of 2024, about sixty countries, six US states and one Canadian province had adopted data portability rights. Data portability rights have widely spread around the world, especially following the adoption of the GDPR. The EU’s GDPR is a regulation on information privacy. It is considered the first legislation to declare a general data portability right for users to retrieve and transfer their personal data from one operator to another.

• Description of Figure 10: Data portability right around the world (2024)

  Map highlighting countries and jurisdictions that have adopted some form of data portability right as of 2024. Regions with data portability regulations include:

  United States: California, Connecticut, Colorado, Iowa, Virginia, and Utah.

  Canada: Quebec.

  Latin America and the Caribbean: Brazil, Belize, Ecuador, Mexico, Panama, Barbados, Jamaica.

  Europe: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Republic of Ireland, Italy, Lithuania, Latvia, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Iceland, Liechtenstein, Norway, Switzerland, United Kingdom, Kosovo, North Macedonia, Serbia.

  Australia

  Africa: Benin, Cape Verde, Kenya, Republic of the Congo, Rwanda, Zambia.

  Asia and the Middle East: China, Indonesia, Mongolia, Philippines, Thailand, Oman, Saudi Arabia, United Arab Emirates, Singapore.

Data portability in the EU context

The EU adopts a centralized approach to data portability regulations. It was developed at the EU level and applied to all member states. These regulations stem from consumer rights, digital market rules and sector-specific regulations.

Effective since 2018, the GDPR allows users to receive personal data in machine-readable format and transfer it between service providers. This makes individuals more empowered in the digital economy and increases public awareness about data rights. However, practical use is limited because implemented in pieces of fragmented implementation and challenges facing international data transfer. Following the Draghi report on EU competitiveness, the EU Commission is looking into simplification proposals to easing reporting requirements under the GDPR.

The DMA focuses on competition and views data as an economic asset. It targets dominant platforms that provide core services (gatekeepers), covering both personal and non-personal data to improve market competition. Unlike GDPR, DMA provides real-time data access and continuous data porting for user data generated through activities.

In banking, the Payment Services Directive 2 (PSD2) promotes open banking by requiring banks to share customer data with authorized providers to stimulate innovation and competition.

There are many data portability approaches worldwide, from market-driven initiatives to government mandated ones.^Footnote40 These approaches aim to make moving and accessing data across platforms and industries easier. They vary in terms of data types, user rights, interoperability levels and standardization.^Footnote41 These approaches can happen at the same time i.e., are not mutually exclusive.

• Description of Figure 11: Data portability regimes by origin and scope

  Infographic of a hierarchical tree diagram illustrating types of data portability regimes, with connecting lines representing some examples. At the top, the root node is labeled 'Data Portability Regimes,' branching into two main categories: 'Government-led' and 'Market-led.'

  The 'Government-led' branch divides into three sections:

  • 'Horizontal,' which further splits into two examples: competition laws (such as the DMA) and privacy laws (such as the GDPR).
  • 'Sector-specific,' which splits into examples like telecom sector and number portability, finance and open banking, and health sector and HIPAA.
  • 'Horizontal regulations with sectoral application,' with an example such as the Australian CDR.

  The 'Market-led' branch divides into two nodes:

  • Examples of 'My Data' programs, such as Blue Button in health and Green Button in energy.
  • Example of the 'Data Transfer Project.'"

Government-led initiatives are driven by legal mandates and regulation. These can be general laws designed to protect consumer rights, enhance privacy, and promote competition. Some government-led initiatives are tailored to specific industries, and they address the unique requirements of those industries. Examples include:

• number portability in telecommunications,
• financial services regulations like open banking, and
• healthcare initiatives like the US Health Insurance Portability and Accountability Act of 1996 (HIPAA).

A hybrid approach would include legislation that sets a comprehensive framework that is implemented gradually across sectors. For example, Australia’s Consumer Data Right (CDR) started with banking and is expanding to energy and telecommunications.

Australia: An economy-wide approach to data portability

Introduced in 2019, Australia’s CDR enables consumers to share their data and control how it is shared. The CDR has progressed, particularly in the banking sector, where over 99 % of customers can now share their data. They plan to expand into the energy and telecommunications sectors. Both the government and industry have invested heavily to fortify the system’s safety, security, and privacy.

However, early adopters raised concerns about data quality and implementation issues, with 92 % of data holders reporting reliability problems. The ACCC consultation on data quality revealed several factors that impact CDR data quality and how to address them. It found that, even though the ACCC imposed penalties for non-compliance, they needed to enforce more measures to ensure consistent implementation and data reliability. Also, the Statutory Review of the Consumer Data Right Report found that challenges include:

• high compliance costs,
• limited adoption by consumers, and
• complex regulations that possibly limit innovation, especially for smaller entities.

The quick sector rollout may not have left enough time for the system to mature and for stakeholders to learn from initial implementations.

To address these issues, the Australian government conducted extensive consultations and announced a CDR reset in August 2024.

Market-led initiatives are typically initiated by industries without direct regulations. The Data Transfer Initiative (previously known as Data Transfer Project) is a good example. It enables data portability among major tech companies like Google, Meta, Microsoft, and Apple. There are also government and private sector collaborations, where government calls for consumer data access to be implemented through voluntary market commitments, such as the US Blue Button initiative in healthcare and Green button initiative in energy. These initiatives are driven by industry collaboration and technological innovation.

Drawing insights from global experiences

Data portability has been reasonably successful in other countries. For example, we could consider the UK Open Banking as the most mature data portability system. The open banking system has over 12 million active users, comprises 336 regulated firms and is estimated to be worth £4 billion to the UK economy. It was also estimated to have created over 4,800 skilled jobs. It is reported that the benefits have spread to other cities, such as Manchester and Leeds, and are not limited to just London.

Open banking in the UK and beyond

Open banking in the UK is a leading data portability regime aimed at boosting competition and innovation in banking services through secure data sharing. It stemmed from a 2016 retail banking market investigation report by the Competition and Markets Authority (CMA), which required major banks to offer APIs for secure data sharing. The aim was to enhance consumer control, foster new financial products, and increase transparency and choice in banking.

The remedy was implemented in phases starting from 2016 with standardized APIs for data sharing. The Open Banking Implementation Entity (OBIE) was created by the CMA to ensure the delivery of these mandates. It was funded by the UK’s nine largest current account providers (CMA9) and overseen by the CMA, the Financial Conduct Authority and His Majesty’s Treasury.

By January 2018, the CMA banks provided access to customer accounts and payment initiation services with strong security measures to third-party providers. From 2019 to 2020, the APIs expanded to include more data types and transitioned from screen scraping to APIs. Continuous updates to API standards and protocols focus on consumer adoption and trust. In 2023, the CMA announced the Implementation Roadmap for Open Banking was complete, and the OBIE became Open Banking Limited.

• Description of Figure 12: UK Open Banking Phased Adoption

  Infographic showing the timeline of open banking adoption in the UK, organized in six connected phases. Each phase is represented by a labelled box connected with arrows to indicate progression:

  2016–2018: Initial Stages – Regulatory review, CMA mandating CMA9 banks to develop open banking, establishment of OBIE, and development of API standards.

  2018: Phase 1 – CMA9 banks release APIs for third-party providers (TPPs) to access account information with customer consent; consumer education about open banking.

  2018: Phase 2 – Banks enable APIs for TPPs to initiate direct payments; implementation of Strong Customer Authentication and other security measures.

  2019–2020: Phase 3 – APIs expand to include loans and savings data; fintech ecosystem grows with new financial products.

  2020–Present: Continuous Improvement – Ongoing API updates, security enhancements, improved user interfaces, and consumer trust campaigns.

  Next Step: Open Finance (connected by a dashed arrow) – Potential expansion to mortgages, pensions, insurance, and investments; regulatory exploration to support broader data sharing while ensuring security and efficiency.

The UK’s open banking landscape achieved notable milestones. A Bank of England study titled “Customer data access and fintech entry: early evidence from open banking” indicates that open banking enhances consumer welfare by making access to financial advice and credit easier, although it may result in higher prices for some users. Despite successes, there are still challenges in regulation, costs, data limitations and consumer trust, with ongoing efforts to address them. As of October 2023, Open Banking Impact Report notes that 1 in 9 (11%) British consumers in the UK is an active open banking user. The design and implementation of open banking, however, came with many challenges, as detailed in the CMA’s Open Banking Lessons Learned Review.

The international adoption of open banking for financial innovation and inclusion

A recent report on the Global State of Open Banking and Open Finance shows that open banking is being implemented globally in 95 jurisdictions. Among these, 54 are government-led and 28 are market-driven. Different countries are at different stages of adopting open banking frameworks. The UK and the EU have had established frameworks for nearly ten years, focusing on consumer protection and financial stability. Since 2018, Canada has been working toward developing open banking, renaming it consumer-driven banking. The Consumer-Driven Banking Act and the Budget 2025: Canada's Consumer-Driven Banking Framework paved the way for its planned launch in 2026, which will be overseen by the Bank of Canada.

Data portability can also disrupt established firms (incumbents) in ways that were not possible before. For example, the Financial Conduct Authority (FCA) in the UK, the body responsible for overseeing open banking, is considering introducing Variable Recurring Payments (VRPs). VRPs are a type of payment system that allows customers to authorize third parties to make recurring payments from their bank account on their behalf. This may offer an alternative to traditional card payments.

To have similar success, it is important to build the optimal data portability regime fit for Canadians. We highlight some of the issues to consider, drawing on the experience of other jurisdictions, namely the EU, the UK, the US, and Australia. We also consider Canadian frameworks in the telecommunications, banking, and healthcare sectors. Our discussion will focus on the shared themes and issues that emerge across these jurisdictions, grouping examples together to provide a comparison.

Political will, navigating levels of government and diverse stakeholders

Data portability requires a lot of harmonizing and effective coordinating across different governance structures. Both federal and more centralized systems show how complex it is to achieve this. For example, in the US, multi-layered legal frameworks, such as sector-specific and state laws, create challenges for adopting a comprehensive federal approach to data portability.^Footnote42 Similarly, Canada faces challenges due to the structure of our federation and issues over scope and jurisdiction. For example, we have seen that building a digital health infrastructure requires many federal, provincial, and municipal actors to collaborate, which makes progressing toward unified solutions more complex. Even in more centralized systems, like the EU’s GDPR, enforcing consistent data protection and portability remains complex.^Footnote43

Data portability in healthcare sector: A collaborative Pan-Canadian interoperability roadmap

The Infoway Connecting You to Modern Health Care: Shared Pan-Canadian Interoperability Roadmap project aims to overcome key health data challenges by establishing national standards for secure health information sharing. The initiative focuses on addressing fragmented health records and patient access barriers. It plans to do this with strategic improvements in Electronic Medical Records, patient summaries and data exchange processes. The roadmap features a two-phase approach: an initial 24-month period of system upgrades and standardization, followed by a 3–5-year effort to enhance clinical data exchange and electronic health infrastructure.

The plan proposes a collaborative national framework that breaks down interoperability barriers, enabling seamless information exchange across different healthcare settings. By making this enhanced data flow easier, the framework aims to dramatically improve clinical decision-making, patient engagement and overall health outcomes.

Achieving this vision will require coordinated efforts across multiple levels. Provinces, territories, federal agencies, technology vendors and other key healthcare stakeholders must work together to transform the current fragmented information landscape into an integrated, patient-centric system.

In other circumstances, laws may be needed to establish user data rights in certain industries, such as in the insurance sector. Take Canada’s insurance sector as an example. Under the Bank Act, banks are not allowed to share customer data with affiliated insurance companies. These regulations are intended to prevent practices such as banks pressuring consumers to buy the bank’s insurance at the point of sale or engaging in cross selling that could leave non-integrated insurers disadvantaged. But they may also create unintended effects. Specifically, while these rules aim to promote competition and consumer protection, they might also limit the scope of data portability and integrated financial services. Notably, insurance companies do not have the same restriction on data sharing, creating an asymmetry in data governance across financial institutions.

The need for collaboration also extends to various groups of stakeholders. The experience in the telecom industry shows that to successfully implement portability, different stakeholders must cooperate. Cooperation between a federal regulator (government) and operators (private sector) is particularly important.

While the specific governance structures in our examples are different, each faces coordination challenges based on the need to harmonize laws, manage overlapping jurisdictions and build consensus among stakeholders. Addressing these issues requires legal harmonization and a broad collaboration among all the different actors.

System complexities and operational costs

Complicated regulations can prevent innovation and create heavy compliance burdens, particularly for smaller businesses. We see this challenge in Australia, where complex consent processes under the CDR framework may make users less likely to participate and lead to high drop-out rates.^Footnote44

The cost of implementing data portability can be unpredictable and substantial. For example, in the UK, the initial cost estimate for open banking was 20 million British pounds. But the actual cost reached 150 million British pounds.^Footnote45 In Australia, the government gave an additional AUS$88.8 million over two years to support the CDR across various sectors. This further highlight how unpredictable these expenses can be.^Footnote46

As these examples show, we need to make significant investments in secure, capable systems. But operational costs may present barriers, which shows why we need to streamline processes and stakeholders need to efficiently coordinate.

Interoperability levels and data issues: quality, volume, and limitations

Some experiences suggest that general data portability regimes with low interoperability, such as the GDPR in the EU, are less effective in practice. In contrast, regimes with high interoperability and a central API, such as Level 3 with read/write access, are more successful as. We see this with open banking in the UK or with PSD2 in the EU.

Access and data sharing challenges also vary across jurisdictions. In Australia, the ACCC found, under their consultation on data quality, that inadequate data quality is preventing reliable comparisons of products. In the US health sector, where there is a high-volume of data, Medicare information creates data management challenges. This is because it presents complex organizational and technological challenges for effective information handling and analysis.^Footnote47 Similarly, the UK’s open banking faces gaps in data availability concerning “other parties” using open banking data. This prevents comprehensive market analysis and the development of a fully integrated ecosystem.^Footnote48

These experiences show that both the design of the data portability regime and the quality and availability of data are critical to achieving intended outcomes.

Consumer behaviour: switching, trust and perceived risks

While the evidence across regions is still emerging, what we have seen already suggests that data portability positively affects consumer switching. Over 6.5 million consumers and businesses in the UK were using open banking-enabled products by 2023, according to a report by the Implementation Trustee of Open Banking Limited (OBL). This expansion has led to more switching and increased competition among financial providers. Additionally, the CMA also noted in its report that, as the open banking system matured and its roadmap was completed, consumer switching behaviour increased. This made both comparisons and switching between financial providers easier.

Outside the UK, we see similar positive trends in other jurisdictions. The EU’s PSD2^Footnote49 and Australia’s CDR^Footnote50 have both shown promising trends for consumer mobility and competition in financial services. Even if switching rates remain modest, the credible threat of switching motivates providers to offer better terms to keep customers.

Open banking has also stimulated fintech innovation, particularly in the UK. The Future Development of Open Banking in the UK report shows that open banking has led to fintech innovation, enhanced services, increased choices and reduced costs. To help consumers make better decisions, the FCA created tools like comparison sites and finance management apps. Though consumer switching remains a key goal, data portability also unlocks innovative solutions in the sector.

What do Canadians think about data portability and switching in the financial sector?

In 2023, the FCAC commissioned a national survey to assess Canadians’ awareness, understanding and expectations regarding open banking and related fintech services. The survey titled “Open Banking and Consumer Protection: Canadians’ Awareness and Expectations” collected responses from a sample of 5,470 adults across Canada. It found that:

Awareness is low: Only 9 % of Canadians surveyed had heard of open banking. Awareness was particularly low among seniors, women, francophones, and lower-income groups.

Interest and understanding are limited: Just 15 % said they would use open banking after being given a definition; most (52 %) would not. Many are unsure what open banking involves or mistakenly believe it already exists in Canada.

Consumer protections are critical: Canadians expect strong safeguards—70 % want “full protection from any losses.” Respondents strongly supported clear consent, data security and regulatory oversight. Over 80 % mistakenly assume protections for fintechs are the same as for banks.

Screen scraping is unpopular: Most Canadians neither use nor would consider using services that require sharing their banking passwords with third parties (screen scraping). This highlight support for safer data-sharing methods.

Education and clear protections matter: The success of open banking in Canada will depend on strong consumer protections, trusted oversight and clear consumer education about risks, rights, and differences between banks and fintechs.

A more recent nationwide survey titled “Redefining Loyalty: Understanding Canadians' Relationship with Financial Institutions (2024)” was conducted by Abacus Data. It surveyed 3,550 Canadians, aged 18 and above, and examined their attitudes towards financial services, especially the framework for “open banking.” It uncovered key points about the current consumer landscape of banking services in Canada. Below are some of the most relevant excerpts about switching:

Canadians’ willingness to switch financial providers
Most Canadians (66%) do not plan to switch financial providers within the next two years, especially those aged 60 and above (84%). Younger Canadians are more open to switching, with 25% of those aged 18 to 44 considering it.

Factors influencing choice of financial institutions
Canadians choose financial institutions for convenience (38%), reputation (29%), and long-standing relationships (27%). Low charges and fees are important to them (29%). Only a small portion identified products, rates, or service offerings as their main reason to choose a financial institution.

Barriers to switching financial providers
The main barrier to switching is inconvenience (35%), followed by difficulties in transferring deposits (21%), updating account information (20%), loyalty (21%), and concerns about fees (20%). Younger Canadians (18 to 30) often fear the unknown, indicating there are gaps in their financial literacy.

However, consumer trust and understanding continue to be challenges for data portability adoption. Research from a UK-based digital consultancy firm reveals that 84% of consumers think open banking is unsafe, and 58% do not understand it. Open Banking UK launched a YouTube campaign to address these concerns.

Privacy safeguards are crucial for secure data transfers. Without them, data portability could be misused or result in unauthorized access. Regulations in multiple regions focus on this balance. The EU’s GDPR and California Consumer Privacy Act of 2018 (CCPA) both focus on protecting personal information during transfers to maintain consumer trust. Australia’s CDR focuses on security elements where compliance is an ongoing responsibility. This includes a requirement that firms apply state-of-the-art security systems that guard against unauthorized access and data breaches.^Footnote51 Concurrently, Australia is developing a Digital ID law to enhance privacy and resist dark patterns. Dark patterns are manipulative user interface techniques designed to mislead or force users to make choices they might not otherwise make.

Privacy is the biggest concern for Canadians as well. A survey by the Office of the Privacy Commissioner revealed that 93% of individuals are worried about data protection, and 38% are extremely concerned.^Footnote52 Federal and provincial policymakers are actively developing strong regulations to make data portability with safe data sharing possible. Recent legislative efforts highlight this commitment. The Digital Charter Implementation Act, 2022 (Bill C-27) and the Connected Care for Canadians Act (Bill C-72) were introduced in the previous session of Parliament. More recently, the Budget 2025 Implementation Act Bill C-15 provided a data-mobility right in the PIPEDA to facilitate economy-wide data sharing. Quebec also took a proactive step by adopting Law 25 in 2024, which makes individual data protection rights stronger.

These examples show there is a growing national consensus on how important protecting personal information is while making responsible data sharing in the digital age easier.

Privacy by design, a Canadian homegrown solution to privacy concerns

Privacy by Design (PbD) is a proactive approach to privacy that started in Canada and emphasizes preventive measures. It involves including privacy considerations into the design and operation of IT systems, network infrastructure and business processes. PbD has been widely adopted by privacy commissioners and organizations as a framework for developing privacy policies and systems.

There are seven foundational principles for PbD. These have become the foundation of privacy practices worldwide. They include being proactive not reactive, privacy as the default setting, and end-to-end security (i.e., of information, from creation to final deletion, using robust security measures).

Scaling data portability in comparative regimes

The UK is the most advanced example in sectoral data portability. It has started addressing the issue of scalability and expanding and adapting data portability frameworks across various sectors beyond banking. Learning from the open banking initiative, UK policymakers have focused on ensuring that regulations, technical expertise, and dedicated resources remain central to successfully implement the open banking solution. Currently, the strategy to expand centers on growing open banking and moving towards open finance. The FCA and HM Treasury are working on scalable regulations for secure data sharing and open finance. This will allow consumers to securely share their financial data with various service providers and receive enhanced services and financial products. The UK government passed the Data (Use and Access) Act 2025 to make this data-driven ecosystem easier. These new laws strengthen data protection and privacy while establishing clear legal grounds for data use and access across sectors. It is an important step towards modernizing the UK’s data governance and enabling trusted data portability and innovation.

What is next for open banking? Open finance

Open finance extends data-sharing principles to more financial services like mortgages, pensions, insurance, and investments. The UK government and regulatory bodies, including the FCA, are actively exploring the frameworks and requirements needed to support the rollout of open finance, ensuring the ecosystem stays secure, efficient and beneficial for consumers.

Table 5: Open banking vs Open finance

	Open banking	Open finance
Scope	Banking services like fund transfers, account balances and payment initiation	Extends secure, consent-based data sharing to all financial services and sectors, including insurance, pensions, and investments
Data coverage	Provides data related to standard banking activities conducted by customers, such as money transfers and balance inquiries	Offers access to a consumer’s financial details, including assets, liabilities, portfolios, and preferences
Relevant entities	Banks are the primary API providers authorized to collect and process consumer data	Other financial institutions (beyond banks) and third-party providers can also offer APIs, expanding the ecosystem

In contrast, Australia recently paused the expansion of data portability under their CDR to allow the system to mature across the banking and energy sectors and to implement lessons learned to date. This “resetting” of the system was prompted by the Federal Treasury independent report (August 2024) on compliance costs and a consultation to reduce participation barriers. Australia’s experience highlights that successful data portability initiatives depend on effective government-led implementation and on aligning political will with readiness in the sector and stakeholder capacity. We need to balance the momentum of data reform with the practical demands of the digital economy. To do this, we need to learn from earlier phases of implementation and remain responsive to ongoing challenges.

Together, these examples show how important local experience, combining strong regulations with technical innovation, and timing expansion to maximize both participation and trust are to adapting frameworks.

Conclusion

Various methods have been used worldwide to introduce and enhance data portability. To create an effective framework, we need to make choices tailored to different sectors of the economy. Other systems show that data portability requires a flexible approach, as one solution does not fit all scenarios. Strong regulations, manageable implementation costs and a robust data portability scheme are key factors for success. For such a system to be effective, consumers need to participate. This is why it is important to ensure a secure data-sharing environment.

Towards a Canadian data portability framework

Data portability has the potential to positively affect competition, drive innovation and help new players enter the market. It promotes a competitive, consumer-centric, and innovative environment across various sectors. So, it is essential for policymakers to develop and implement a comprehensive data portability framework in Canada.

To ensure data portability succeeds, policymakers must make privacy and security considerations a priority. They can do this by establishing effective safeguards and strong regulations. We can learn from how other jurisdictions successfully implemented data portability, and we can design a framework that increases benefits while reducing risks.

In conclusion:

Data portability can unlock significant savings for Canadians.

Our experiment simulated data portability in the insurance sector. It estimated savings between $1.10 billion and $3.83 billion in time and money on their annual costs. This includes up to $1.57 billion in monetary savings from switching to less expensive insurance plans and an estimated $2.26 billion in value from time savings. Savings are the most important factor that drives adoption. Adoption also depends on building both awareness and trust. Individuals are much more likely to participate when they feel informed and have confidence in the framework’s governance.

Data portability offers significant advantages for competition, consumers, and firms, but it comes with its own set of challenges.

Data portability boosts competition by making switching easier, by encouraging new players to enter the market and by driving innovation. However, it can also reduce the motivation to invest, raise price discrimination, facilitate coordinated behaviour, and increase privacy risks. Firms gain new customers, but they may also face high compliance costs, especially smaller ones.

Policymakers should thoughtfully consider how to develop a robust Canadian data portability framework to maximise its benefits.

A well-designed data portability framework relies on clearly defined building blocks. These include defining stakeholder roles, strong user consent rules and competition-friendly policies that promotes secure, efficient data exchange. It is particularly important to align federal, provincial, and territorial regulatory requirements, especially in sectors where fragmented rules are a challenge. This can reduce compliance burdens, avoid regulatory gaps, and ensure Canadians benefit fully from national initiatives. Better alignment would also provide businesses with more certainty and promote more competitive, innovative, and user-friendly digital services across the country.

Data portability is increasingly being adopted internationally to empower consumers, foster competition and stimulate innovation, yet regimes vary.

Many countries adopted regulations to support data portability, highlighting that we increasingly agree about its overall benefits. Learning from these experiences can help reduce similar obstacles.

Annexes

A. Methodology

This Annex provides additional details on the methodology used by the Bureau in conducting this study.

Objectives

The project aims to quantify the value of data portability for Canadians, focusing on the insurance sector. Using a behavioural survey and a randomized controlled trial, it explores consumer valuation of 'Open Insurance' (OI) which allows free data transfer between insurance providers to reduce switching costs and boost competition.

The study aims to project the economy-wide valuation of data portability legislation by assessing savings required for consumer adoption.

Key focuses include understanding:

1. How consumers value the ability/option to transfer their data—without frictions—to other competitors within the same industry.
2. The gain in surplus from increased competition within an industry because of data portability legislation.
3. Any effects on other relevant metrics, for example, knowledge of data portability, perceived risk of data portability, history of switching, etc.

Stage 1: Consumer-centric approach to sector selection

We looked at different industries from a consumer's point of view to identify which industries are best placed and most likely to implement data portability once appropriate legislation is in place.

We based our evaluation on the following criteria:

• Economic importance (annual industry revenues);
• Products and / or services needed to complete a major activity in consumers’ lives;
• The value that data portability would bring to consumers e.g., to generate savings and improve efficiency for consumers;
• Feasibility of implementing data portability in the sector; and
• Frequency of purchasing and/or comparison shopping.

We aimed to focus on an industry close to consumer banking to promote data portability, with finance-centric sectors being early adopters. Insurance emerged as the most suitable due to its potential to follow Open Banking, economic significance, and being an annual purchase frequency.

Stage 2: Identifying factors impacting consumer behaviour.

We looked at potential barriers to adoption and mitigating strategies. From a behavioural perspective, we identified the following key factors:

• Ease of use
• Perceived cost savings
• Consumer tech-savviness
• Privacy and fraud concerns

Taking these barriers into consideration, we examined the consumers' Decision-Making Process (DMP) to identify barriers to data portability adoption and estimate its perceived value. Data portability is expected to influence the middle stages of the DMP, particularly the post-purchase "Switching" stage. The Bureau used semi-structured interviews to investigate factors influencing Canadian consumers' adoption of data portability and their perceptions of personal and consumer data. Three key factors were identified:

• Perceptions of savings in three areas: money, time, and effort
• Trust in public vs. private sector oversight of data portability application programming interfaces (API)
• Preference for communication API framing that emphasize the convenience of gathering information in one place over transaction API framing that emphasize one-stop shopping.

These factors are crucial for consumer acceptance of data portability.

Stage 3: Public opinion survey

Our public opinion survey combined behavioural surveys and randomized controlled trials (RCTs) to understand consumer responses to potential policy changes:

• Behavioural surveys: These reveal consumer sentiments about policies, showing their willingness to pay or be compensated for specific changes.
• Randomized Controlled Trials (RCTs): These are scientific methods method used to test how well a policy works. They measure the direct effects of policy changes on behaviour by randomly assigning participants into two groups: one gets the new policy (intervention group) and the other gets a standard policy (control group). By comparing the two, researchers can see the impact of the new policy.
• We use RCTs in policy experiments to:
  • Eliminate selection bias: Randomly assigning participants helps eliminate selection bias, ensuring that the groups are similar. This makes the results more reliable.
  • Establish causality: RCTs are the best way to show cause-and-effect relationships because randomization rules out other factors that could affect the results.
  • Evaluate effectiveness and inform decisions: By comparing both groups, RCTs provide compelling evidence on how well a policy or program works, which helps make more effective and efficient public policies.
  • Provide transparency and enable replicability: The structured design of RCTs allows for others to check and repeat the research, ensuring that findings can be independently verified.

B. Summary of the public opinion survey

Survey design

The survey was divided into four key sections:

Section 1: A mock insurance application that walks consumers through the process of purchasing home/condo/renters’ insurance. This application has been designed to replicate the process that the average Canadian undertakes when purchasing or renewing an insurance product. The intention of this application is to capture the following information:

• Information on the participant’s monthly insurance purchase.
• Framing the insurance purchase process for participants who will then assess the degree to which Open Insurance (OI) can improve their experience; and
• Documenting the participant’s decision-making process across various insurance quotes.

Section 2: Participants are assigned to groups. Section 2 Provides the consumer with detailed information on OI and explains how it works and what benefits it may bring to Canadian consumers. Participants rate the importance of these various aspects of adoption. They are then asked if they would join OI, which offers secure apps and services to help manage their insurance better.

Section 3: In this section, participants are placed in a hypothetical scenario where they can choose which personal information, they would be willing to share with a third party if it were easy to transfer between services. To understand how much people value their data, participants are divided into two groups: a low bonus group ($2.40 off annual insurance expenses for each data type shared) and a high bonus group ($6.00 off annual insurance expenses for each data type shared). This setup helps measure how different incentives and data portability influence consumers’ willingness to share personal information.

Section 4: The last section asks a series of questions that help to determine the following:

• Consumer perceptions around data portability
• Additional demographic questions

• Description of Figure 13: Stages of the data portability public opinion survey

  Flowchart showing the six stages of the data portability opinion survey with arrows connecting each stage in sequence.

  The stages are:

  1. Screen questions on insurance spending,
  2. Section 1: Simulation, participants enter information to get quotes, choose plan, enter more infomation to purchase,
  3. Section 2: RCT, adoption of OI (one of eight regimes per participant),
  4. Section 3: Willingness to share data entered in Stage 1,
  5. Adoption of OI and estimate time savings,
  6. Section 4: Prior knowledge, perceived risk, and data privacy concerns.

Independent variables

We included three types of variables in the RCT:

• Savings from joining OI (low savings vs. high savings): participants are assigned either a low amount of hypothetical savings (0.5% of annual spending on all insurance plans per year) or a high amount of hypothetical savings (5% of annual spending on all insurance plans per year). This setup helps us see how different levels of savings affect the decision to join data portability.
• Oversight (public vs. private): participants are randomly placed into one of two groups, where the data portability regime is either managed by the government (i.e., Government of Canada designs, oversees and manages the OI system to ensure safety and security, and oversees accreditation) or by the industry (i.e., the OI system is managed by a partnership of insurance providers). This helps us understand how people’s decisions to use data portability might change depending on who is in charge.
• Framing (transaction vs. communication): participants are shown different marketing messages that either highlight the benefits of one-stop shopping, emphasizing ease of access and purchase of better value and improved services all in one place (transaction frame), or the messages focus on the ability to gather information about products and services conveniently in one place (communication frame). This helps us explore how the way the platform is presented—or "framed"—can affect whether people choose to use it or not.

Participants

A representative sample of 3,046 Canadians participated in the study, with approximately 380 participants evaluating each of the eight possible regime combinations.

Results of the randomized control trial^Footnote53

a. Estimated monetary savings of OI

Joining OI can help Canadians save both money and time on their insurance. On average, a Canadian household spends about $3,804 on all insurance products each year, with the median spending being around $3,540. Some households spend a lot more, with 10% of households spending $7,200 or more annually.

• Description of Figure 14: RCT participants’ household distribution of insurance spending

  Histogram titled ‘RCT participants’ household distribution of insurance spending.

  The x-axis shows annual insurance spending per household in dollars, ranging from $0 to over $10,000. The y-axis shows count of households. The distribution is right-skewed, with most households spending between $1,000 and $5,000 annually. The median spending, marked by a dashed line, is $3,804. A callout box indicates potential annual savings of $19.02 at the 0.5% level and $190.21 at the 5% level.

Using data from our RCT —household annual spending on insurance reported by participants in our RCT and the simulated savings rate at 0.5% (conservative) and 5% (optimistic), we found that the average household could save $128.37 annually with OI. Scaling for all eligible Canadian households, the total potential savings on is estimated at $1.57 billion.

Monetary value of estimated time savings

Participants estimated that OI would save them an average of five hours when shopping for insurance plans. Those willing to join reported even higher average time savings of 6.5 hours. While 15.5% of participants felt they would not save any time, 4.2% believed they would save more than 20 hours per year.

• Description of Figure 15: Distribution of RCT participants’ estimated time saving

  Histogram titled ‘Distribution of RCT participants’ estimated time saving.’

  The x-axis shows estimated time saved in hours, ranging from 0 to over 20. The y-axis shows the count of participants. The distribution is right-skewed, with most participants estimating little to no time saved and progressively fewer reporting higher savings. A dashed line marks the average estimated time savings at 5.0 hours.

To determine the monetary value of the time saved by Canadians with OI, we developed an economic model based on participants' adoption decisions. This model calculates how much money participants would need to be compensated for an hour saved. We found that, on average, participants save $185.31 worth of time through OI.

Value of OI to all eligible Canadian households

Our RCT helped us estimate the benefits of OI. We looked at savings on insurance costs and the value of time saved when shopping for insurance plans. Using data from the trial, we calculated these savings across all eligible Canadian households.

Canada has about 14.9 million households, but not all are eligible to purchase insurance. By focusing on the 12.2 million households above the poverty line, we scaled our average savings per household. We found that each household could save around $128.37 on insurance costs and $185.31 in time savings.

In total, OI could provide a value of $3.83 billion to Canadians if all eligible households joined. This includes both the money saved on insurance and the value of time saved through easier shopping for insurance plans. According to Statistics Canada, there are 14,978,941 households, 81.56% of which are above the poverty line. By assuming that all households which are above the poverty line are eligible to purchase insurance plans, we scaled our per-household estimates by 12.2 million (81.56% of the 14.9 million households) to derive a Canada-wide total value of OI. This is the outcome of the addition of the estimated monetary savings and value of time savings multiplied by the number of households including only those above the poverty line. ($128.37 + $184.98) × 14,978,941 HH × 81.56% = $3.83 billion. Beyond that, Canadians would also benefit from ongoing time savings as reduced search and switching costs make it easier to compare and change providers.

b. Adoption rates across RCT regimes

The strongest predictor of whether participants chose to join OI was the savings rate. The adoption rate increased from 46.4% in the low (0.5%) savings condition to 53.8% in the high (5%) savings condition, representing a 16% increase.

To ensure the robustness of the results, we conducted reduced form regressions and seemingly unrelated regressions (SUR) to estimate the effect of savings rate and observed similar patterns. Overall, the four high-saving regimes had a greater likelihood of adoption, because they offer a higher expected value of joining OI through the monetary savings channel.

The best-performing regime had these key features:

• High annual savings rate (5%)
• Government oversight
• Message highlighted "one-stop shopping" as the main benefit

The second-best performing regime had these key features:

• High annual savings rate (5%)
• Industry oversight
• Message highlighted "ease of comparing options" as the main benefit

The hierarchy of these two regimes could be due to the fact that Canadians are may be more hesitant to provide their sensitive information to private firms when purchasing insurance products since their personal information could be used to increase their insurance premiums. However, people may also value the efficiency private firms can provide in building user-friendly platforms to gather information and compare products.

• Description of Figure 16: Adoption rate in each of the eight OI regimes tested in the RCT

  Figure titled ‘Adoption rate in each of the eight OI regimes tested in the RCT.’ The chart shows eight treatment conditions combining two savings levels (0.5% and 5%), two oversight types (public and private), and two framing types (communication and transaction).

  The x-axis shows the percentage of participants joining Open Insurance, ranging from 30% to 70%. Average adoption across 0.5% savings regimes is 46%, and across 5% savings regimes is 54%. The best-performing regimes are marked with blue triangles.

  Error bars represent 95% confidence intervals.

The impact of oversight and marketing was only seen when savings were higher (5%). This suggests savings need to reach a certain level to influence adoption.

We found further evidence of the importance of the savings rate when participants ranked the importance of each feature of the RCT OI regimes that influenced their decision to join. The saving rate was ranked as the most important feature, followed by the framing of the key benefit of OI, and oversight. This ranking was less pronounced when savings were only 0.5%.

• Description of Figure 17: Top factors for joining OI: savings rate, benefits, and oversight

  Grouped bar chart showing the top factors influencing participants to join OI: savings rate, and oversight and framing.

  For each factor, Savings, Oversight, and Framing, three bars represent different subgroups. The tallest bars appear in the ‘Savings’ and ‘Oversight’ categories, indicating these factors had the highest adoption rates, followed by the ‘benefits’ represented under Framing. The Y-axis shows adoption rates as percentages, up to 50%. A legend with three fill patterns distinguishes the subgroups as first, second and third.

Adoption-based value of OI across RCT regimes

Our RCT regimes allow us to estimate a range of potential values of OI, which are heavily influenced by annual insurance spending savings rate, anticipated time savings, and the likelihood of adoption. We found:

1. In regimes with low savings (0.5%), the average household values OI at $90.88.
2. In regimes with high savings (5%), the average household values OI at $167.38.

Differences across groups are influenced by participants’ decision to join OI, their estimated value of time savings, and their annual spending on insurance. OI has the highest value in the regime where the platform is overseen by the Government of Canada, with marketing communications highlighting “one-stop shopping” as the key benefit. It has the second-highest value in the regime with Industry-led oversight and “comparing options with ease” as the key benefit highlighted in marketing messaging. These values are driven by the higher adoption rates of the two best performing regimes.

• Description of Figure 18: Monetary and time savings value across OI regimes

  Dot plot showing the combined monetary and time savings value for households across eight OI regimes.

  The regimes differ by savings rate (0.5% or 5%), oversight type (private or public), and framing (communication or transaction).

  Each regime is listed on the Y-axis, and the X-axis shows household value in dollars, ranging from $75 to $175. For regimes with 0.5% savings, average household value is $90.88, shown near the left side. For 5% savings regimes, the average value is $167.36, indicated by blue triangles and a dashed blue line on the right. Note in the lower left corner indicates that intervals are at 90% confidence.

Based on our findings, we estimated the total value of OI for eligible Canadian households. We scaled our per-household estimates to the total number of eligible Canadian households willing to opt in. The most promising regime—high savings, public oversight, and ease of transaction—suggests the average household values OI at $185.32. With an adoption rate of 58.7%, this leads to a total value of $2.26 billion. As more Canadians learn about OI and the adoption rate increases, this total value could approach $3.83 billion, based on a 5% savings rate.

Individual differences: effects of knowledge, risk, and age

The RCT showed that better knowledge of data portability increases the chance of joining OI by 5.5%, while less perceived risk increases it by 17.4%. Younger people and those who prefer low-risk options are more likely to adopt OI, while concerns about privacy, gender, geography, employment, education, or income have no significant impact.

Types of insurance consumers in Canada

The responses provided in the RCT show a diversity of opinions among insurance consumers in Canada. Given these varying perspectives, we classify the types of Canadian insurance consumers to better understand how preferences vary among consumer groups. To accomplish this task, we performed a cluster analysis that quantitatively identifies survey participants who had similar attitudes toward data portability in general; this in turn assists with the identification of various types of consumers using characteristics that can be easily comprehended. This analysis identified three main types of insurance customers in Canada. We identified three types of consumers:

• Saving seekers (mean age = 46.4, adoption rate: 63%): They are sensitive to savings and most likely to join OI. They do not feel knowledgeable about data portability, but they also perceive it to be low risk.
• Knowledge consumers (mean age = 44.6, adoption rate: 55%): The participants are familiar with the concept of data portability and consider joining it to be moderately risky. They are more likely to switch insurance providers.
• Privacy conscious consumers (mean age = 53.3, adoption rate: 41%): They are older in age and are least likely to join OI. They are far more sensitive to data privacy and the risk of DP. %).

How consumer preferences influence valuation analyses

Valuation analysis helps determine how much consumers value a product or service. It becomes complicated when different consumer groups have varying preferences and concerns. For example, some consumers might prioritize privacy and feel they lack knowledge about data portability, making them less sensitive to savings. Others might not worry about data privacy or their knowledge level, making security-focused marketing less effective for them.

c. Willingness to share personal information

In the RCT, we had participants decide how much personal information to share with a third-party app via OI in exchange for potential savings on their insurance spending. Participants first went through a simulation of shopping for home insurance, providing thirty pieces of personal information, including optional personal data like name and phone number. In the second part of the study, they learned about OI and chose to share their information for potential savings.

On average, participants shared 45% of their personal data. They were more willing to share their data when the savings were high, and the platform was overseen by the government. This study helps us understand how Canadians value their personal information under different OI regimes.

Likelihood of sharing personal data across RCT regimes

Our RCT design also allowed us to compare the likelihood of participants sharing their personal information under each of the eight regimes. It showed that participants were more likely to share personal information when savings were high and when the platform was overseen by the government. High savings increased data sharing by 2.7%, and government oversight increased sharing by 2.1%.

• Description of Figure 19: Average proportion of data points shared in each OI regime

  Dot plot showing the average proportion of eligible data points shared for each of eight OI regimes, organized by saving rate (0.5% or 5%), oversight type (private or public), and framing method (communication or transaction).

  The X-axis shows percentage of eligible data points shared, ranging from 40% to 55%. Black dots and horizontal lines display group averages. Blue triangles indicate the best performing regimes under the 5% savings rate, with the highest average proportions shared, around 50%. Notes indicate that 95% confidence intervals are shown.

For example, over 5% more participants were willing to share their email addresses and phone numbers under government oversight compared to industry oversight. Marketing communication framing had less impact on data sharing, as consumers base their decision on financial benefits.

• Description of Figure 20: Personal data sharing rates increased most by high savings and government oversight (Top 3 data fields by condition)

  Dot plot comparing the increase in personal data sharing rates across three conditions: savings level (high vs low), oversight (public vs private), and framing (communication vs transaction).

  For each condition, the top three data fields by significance are shown with their respective sharing rates and confidence intervals. Under high savings, the largest increases in sharing were for apartment number, interest in bundle discount, and time spent in home. Under government oversight, participants more frequently shared email address, phone number, and apartment number. Under communication framing, the highest rates were for apartment number, street name, and postal code. Horizontal lines represent confidence intervals, and a note indicates all values shown are statistically significant at the p < .01 level.

Further research is needed to explore hybrid oversight models (combining government and private sector approaches) or third-party oversight for potentially higher adoption rates.

C. Interoperability levels – Consumers’ perspectives

The table below illustrates interoperability levels with real-world examples across several sectors for each level of interoperability, from simply moving data, to fully integrated, cross-sector collaboration:

D. Comparing open banking frameworks