March 25, 2019, 9:30 AM International Meeting of NAICS code Experts Statistics Canada Simon Goldberg Room, RH Coats building  100 Tunney’s Pasture Driveway With research contributions by Ben Wright, Carleton University and Dustin Moores, University of Ottawa

1. March 25, 2019, 9:30 AM
International Meeting of NAICS code Experts
Statistics Canada
Simon Goldberg Room, RH Coats building
100 Tunney’s Pasture Driveway
Coding Data Brokers
Dr. Tracey P. Lauriault
Assistant Professor, Critical Media and Big Data
Carleton University
Research Associate, Centre for Law, Technology and
Society (CLTS)
Tracey.Lauriault@Carleton.ca
orcid.org/0000-0003-1847-2738
@TraceyLauriault
Johann Kwan
Articling Student,
Samuelson-Glushko
Canadian Internet Policy and Public Interest
Clinic (CIPPIC), CLTS
University of Ottawa

2. Public Research

3. Corporate Surveillance

4. Who’s brokering

5. Data Brokers are a Unique Kind of Company
 3 Broad
Categories of
Products
 Marketing
 Risk
mitigation
 People
search
 CIPPIC
 US FTC
 Canadian
Companies
 New Players
 Data
Management
Platforms
 Deloitte (Formerly Cornerstone)
 Performance Marketing (Data Append Marketing Lists Data Analytics)
 Canada Direct
 List Development & Sourcing (Marketing Lists)
 InfoCanada
 Sales Leads & Mailing Lists
 Data Processing & Cleansing (Data Append)
 Profiling Intelligence (Marketing Analytics)
 Email Data Hygiene (Data Append)
 Social Attribution Intelligence
 Environics Analytics
 OriginsCanada (Marketing Analytics)
 Prizm5 Segmentation (Marketing Analytics)
 Geocoding
 Site Analysis
 Enhanced PCCF (Data Append)
 Data Products (Marketing Lists)
 Dimensions (Analytics)
 QuickMatch (Risk Mitigation)
Dustin Moores, Fall 2017, Research
Conducted as an Ottawa
University Law Student and a
Student Intern with CIPPIC

6. CIPPIC’s Research

7. Some #s
Acxiom,
According to Week 2012 23000 servers
50 Trillion transactions a year
Detailed entries for 190 Million Consumers
144 Million households in the US
+/- 1500 data points per person (NYTimes 2012)
US $300 Billion dollar industry w/Acxiom recording US $1.1
Billion in 2011
Sells these data too Wells Fargo, HSBC, automakers and
Torch Concepts w/contracts DoD
(Roderick 2012)
Roderick, Leanne (2014) Discipline and Power in the Digital Age: The Case of the US Consumer Data Broker
Industry, Critical Sociology, 40(5) 729–746.

8. Law – California Consumer Privacy Act
 CCPA (California Civil Code Section 1798) with the Right to:
 know what personal information is being collected
 know whether it is being sold or disclosed, and to whom
 the deletion of personal information
 opt out of the sale of personal information
 access their personal information
 equal service and price regardless of the exercise of above rights
 Applies to:
 (A) Has annual gross revenues in excess of twenty-five million dollars ($25,000,000), as
adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185.
 (B) Alone or in combination, annually buys, receives for the business’s commercial purposes,
sells, or shares for commercial purposes, alone or in combination, the personal information
of 50,000 or more consumers, households, or devices.
 (C) Derives 50 percent or more of its annual revenues from selling consumers’ personal
information.
 This is a quickly growing field,
 these companies do nothing else,
 therefore there is a pressing need to be able to classify and track this industry.

9. Regulation – EU GDPR
Core principles (Article 5)
 Personal data shall be
 Processed lawfully
 For specified, explicit, and
legitimate purposes
 Adequate, relevant and limited
to what is necessary
 Accurate and where necessary,
kept up to date.
 Kept in a form which permits
identification for no longer than
is necessary
 Processed securely
Rights
 Right of access (Article 15)
 Gives citizens the right to
access personal data
 And the right to know how the
data is being processed
 Right of erasure (Article 17)
 Right to restriction of
processing (Article 18)
 Right to object to processing
(Article 21)
 Includes profiling
 Specific right to object for the
use of marketing.
 Right not to be subject to a
decision based solely on
automated processing,
including profiling (Article 22)
Responsibilities
 Record keeping requirements
(Article 30)
 Must be made available to
supervisory authorities on
request
 Security (Articles 32-34)
 Requirement to notify on the
event of a breach
 Impact assessment (Article 35)
 When using new technologies
that have the likelihood of risk
to rights and freedoms, a
processor must carry out
assessment of the impact of
the activities.
 Data Protection Officer
 Must appoint DPO with
responsibilities to ensure
compliance (Articles 37-39)

10. Law – Canada
 Provincial credit reporting
acts

11. Government Contracting

12. Codes - GSIN
Contract History Database of Public Service Procurement Canada
 Good and Services Identification Numbers (GSIN)
 Preliminary assessment:
 D317E – Automated News Services, Data Services or Other Information Services
(including Buying Data, the Electronic Equivalent of Books, Periodicals, and Newspapers
etc.) – Information Products
 D317B – Automated News Services, Data Services or Other Information Services,
(including Buying Data, the Electronic Equivalent of Books, Periodicals, and Newspapers
etc.) – Information Retrieval Services, Database.
 T0001 – Market Research and Public Opinion Services (Formerly Telephone and Field
Interview Services including Focus Testing, Syndicated and Attitude Surveys)
 Surely others
Ben Wright (2018) Unpublished Honours Research Essay, Expectations vs. Reality:
Privacy and Personal Data Use in the Canadian data Brokerage Industry, Arthur
Kroeger School of Public Policy, Carleton University.

13. Company Databases
Ben Wright (2018)
Unpublished Honours
Research Essay,
Expectations vs. Reality:
Privacy and Personal
Data Use in the
Canadian data
Brokerage Industry,
Arthur Kroeger School
of Public Policy,
Carleton University.

14. Company Databases
Ben Wright (2018) Unpublished Honours Research Essay, Expectations vs. Reality:
Privacy and Personal Data Use in the Canadian data Brokerage Industry, Arthur
Kroeger School of Public Policy, Carleton University.

15. Canadian Data Brokers
Ben Wright (2018) Unpublished Honours Research Essay,
Expectations vs. Reality: Privacy and Personal Data Use in
the Canadian data Brokerage Industry, Arthur Kroeger
School of Public Policy, Carleton University.

16. NAICS 2017 Canada 3.0
561450 – Credit Bureaus
511140 – Directory and Mailing List Publishers
518210 – Data Processing, Hosting and Related Services
519190 – All Other Information Services
541910 – Marketing Research and Public Opinion Polling
5418 – 541899, 541870, 541860
5415-5419 Series

17. Conclusion
 Distinct kind of industry and their
primary business:
 is the trading of personal information
 analyze and trade in consumer
information
 There is public concern about
these companies
 Laws & regulation are emerging:
 CCPA's explicit application to any
company that derives “50 percent or
more of its annual revenues from
selling consumers’ personal
information.”
 Without a way to track and classify
those companies by revenue,
application of laws like this and
research into the industry’s effects is
made exponentially harder.
 Classification systems are
inadequate
 The NAICs codes do not
adequately capture these distinct
companies
 We need:
 A sub-classification,
 or a whole new class