Introduction: The Banality of Data Theft
There’s a certain kind of managerial audacity that thrives in the shadows between law and laziness. It rarely announces itself as innovation or even risk-taking. More often, it’s dressed up as “efficiency”, a refusal to ask for permission because permission implies the possibility of refusal. So when an agency decides to raid its clients’ Google Analytics accounts to pad award submissions and portfolio case studies, the logic is insultingly simple: if we ask, they could say no; if we don’t ask, they’ll never know. This is not cunning. It’s cowardice.
The violation here is double. First, it’s legal: a straightforward breach of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), which requires meaningful consent for the collection, use, and disclosure of personal information (Office of the Privacy Commissioner of Canada, 2019). Consent is not a decorative clause tucked into a contract; it is the floor of lawful data governance. Second, and more corrosively, it’s relational. Data is not inert “stuff” lying around to be picked up and repurposed. It is the residue of relationships: between clients and their audiences, between organizations and the publics they claim to serve. To seize it without consent is to fracture those relationships at their root. It is, in the natural law sense, a denial of agency, dignity, and moral reciprocity.
Agencies often hide these betrayals behind the optics of metrics. Numbers are paraded as proof of excellence, submissions are burnished into award bait, and case studies become promotional theatre. But underneath the glossy veneer lies a pathology: the belief that outcomes matter more than ethics, that appearances outweigh accountability, that the ends will always justify the means. This essay examines that pathology. It argues that stealing client analytics is not merely an administrative shortcut; it is a structural betrayal, one that reveals how easily organizations abandon both the law of the land and the law of trust when vanity metrics beckon.
PIPEDA and the Illusion of Low Stakes
Canadian privacy law sets a floor so low that any organization tripping over it should be disqualified from claiming professional legitimacy. The Personal Information Protection and Electronic Documents Act (PIPEDA) requires organizations to obtain meaningful consent before they collect, use, or disclose personal information. “Meaningful” here is not the managerial euphemism some agencies pretend it to be. The Office of the Privacy Commissioner (OPC) has been unambiguous: consent must be informed, voluntary, specific, and unambiguous (OPC, 2019). Clients must be told what data will be collected, why it is being collected, how it will be used, and with whom it will be shared. They must also retain the ability to refuse without penalty. Consent, in other words, is not a decorative clause hidden in a contract; it is the legal and ethical foundation of data governance.
Predictably, this is where the excuses begin. Agencies often invoke the fiction that “aggregated metrics” or “anonymous user flows” somehow fall outside the scope of privacy obligations, as if stripping names from a dataset magically renders it harmless. Yet Canadian jurisprudence has made clear that identifiability is not so easily erased. In Gordon v. Canada (Minister of Health), the Federal Court articulated what has become the touchstone for regulatory practice: information qualifies as personal if there is a serious possibility that an individual could be identified from the data alone or in combination with other available sources (2008 FC 258). The OPC has consistently reiterated this principle in its case summaries, including Case Summary #2009-018, noting that even information that appears non-identifiable at first glance may fall under PIPEDA if re-identification is reasonably possible. The OPC’s own research project on non-identifiable data went further, stating plainly that “information for which there is no serious possibility in the circumstances that it could be associated with an identifiable individual” is the only category of data that falls outside PIPEDA’s scope (CANON-OPC Report, 2021). The standard, then, is not perfection but probability: if re-identification is seriously possible, the data remains personal.
Seen through this lens, the appropriation of client Google Analytics data without consent is not a legal grey zone. It is a textbook violation. The aggregation of user flows or campaign metrics does not automatically transform personal data into a free-for-all. To treat it as such is to ignore the very tests Canadian regulators have applied for over a decade. What is at stake is not just a failure of compliance but a deliberate act of negligence masquerading as expedience.
The illusion of low stakes persists because enforcement in Canada has historically been uneven, with fines capped at $100,000 per violation under PIPEDA. For executives conditioned by risk-calculus thinking, such penalties can appear negligible compared to the perceived rewards of polishing an award submission or inflating a case study. But this reasoning betrays a profound ethical illiteracy. PIPEDA was never intended to catalogue every possible harm; it was designed to establish the minimum conditions of lawful practice. Meeting those conditions is not evidence of excellence. It is evidence of avoiding the most obvious forms of malpractice. When agencies cannot even clear that threshold, they reveal not innovation but incompetence.
To misrepresent analytics theft as harmless is therefore to misread both the letter and the spirit of Canadian privacy law. The “serious possibility” test leaves no room for comfort. The OPC’s own reports make clear that anonymization and aggregation are not silver bullets. The very act of bypassing consent collapses the legitimacy of data use, exposing the agency not only to regulatory sanction but to the reputational consequences of betraying the most basic condition of professional trust. What emerges is a pathology of institutional arrogance: the conviction that law is optional if enforcement is inconsistent, that client data is free until someone says otherwise, and that the bare minimum can be treated as an aspirational maximum.
Data as Relationship, Not Commodity
If PIPEDA establishes the legal minimum, the deeper failure lies in how organizations conceptualize data itself. Too often, analytics is treated as inert raw material: numbers waiting to be mined, processed, and repurposed for institutional self-promotion. This extractive logic is not accidental; it is the by-product of a wider political economy that positions data as the “new oil,” a resource to be captured rather than a relationship to be stewarded. Nick Couldry and Ulises Mejias describe this shift as “data colonialism”: the appropriation of human life through continuous extraction, where everyday interactions are converted into flows of value for institutions that did not generate them (2019, 3–8). In this frame, the theft of client analytics is not a one-off shortcut but a structural betrayal, echoing the same logic that drives platform surveillance and corporate hoarding of personal information.
The problem is that analytics is never just numbers. Each click, view, and interaction encodes a relationship: between clients and their audiences, between organizations and the communities they claim to serve, between institutions and the broader public whose trust sustains them. To treat that relational record as free for the taking is to deny the agency of every actor involved. It is to reduce human interaction to exploitable residue. This is not only bad governance; it is a collapse of the moral order that makes governance meaningful.
Indigenous data governance offers a direct counterpoint. The First Nations principles of OCAP®—Ownership, Control, Access, Possession—assert that data about First Nations is not a commodity but a relational trust. Communities retain inherent rights to determine how their information is collected, used, and shared (First Nations Information Governance Centre, 2014). While these principles were developed to protect First Nations sovereignty, the ethical insight they embody is universal: data belongs first to those who generate it. To appropriate analytics without consent is to commit a form of epistemic extraction that mirrors colonial patterns, treating relationships as resources and erasing the autonomy of those to whom the data pertains.
Feminist ethics of care provides further reinforcement. As Carol Gilligan and Joan Tronto have argued, ethical responsibility is not only about abstract rules but about attending to the needs, agency, and dignity of others within relationships of interdependence (Tronto, 1993). Consent in this light is not bureaucratic paperwork but a practice of recognition. It acknowledges the other as a subject with the capacity to refuse, not as an object to be mined. When agencies bypass consent to seize client analytics, they are not simply breaking a contract; they are refusing to recognize the client as a partner. They are reframing the client as raw material to be processed for institutional vanity.
This is why the theft of analytics is so corrosive. It does not only violate legal codes. It undermines the relational fabric on which professional life depends. It tells clients that their agency is negotiable, that their data is only as sacred as the convenience of the agency handling it, and that their trust is expendable in the pursuit of awards and self-promotion. Consent here is not ancillary to data governance; it is the very condition that transforms numbers into legitimate knowledge. Without it, analytics ceases to be relational record and becomes evidence of exploitation.
Natural Law and the Moral Foundations of Consent
If PIPEDA establishes the legal floor, and relational ethics expose the deeper harm of treating data as inert resource, then natural law illuminates why consent cannot be treated as optional in the first place. Long before privacy regulators were issuing compliance guidelines, philosophers of natural law argued that legitimacy depends on the recognition of human dignity, autonomy, and agency. Consent is not a technicality of modern statute; it is a moral obligation embedded in the very conditions of social trust.
Aquinas wrote that laws not aligned with justice are not laws but corruptions of law (Summa Theologica, I-II, Q.95). Locke carried this into modern politics, arguing that power is valid only insofar as it is granted by the governed, and that the withdrawal of consent voids authority (Second Treatise of Government, ch. VIII). Kant sharpened this moral obligation: to treat another person merely as a means, without their consent, is to violate the categorical imperative (Groundwork of the Metaphysics of Morals, 1785). Applied to data governance, the theft of analytics is not a trivial oversight but a categorical failure: it reduces clients to instruments for vanity metrics, denying them recognition as partners in trust.
My own research on early-modern Scotland demonstrates how deeply this principle ran in traditions of constitutional thought. Figures like John Mair argued that rulers governed only by the community’s consent, and that consent could be revoked when rulers betrayed their obligations. George Buchanan went further: in De Iure Regni apud Scotos (1579), he insisted that sovereignty was conditional, held in trust for the common good, and that a ruler who violated that trust was no king but a tyrant, subject to resistance or even removal. Consent here was not abstract theory. It was the hinge between legitimacy and ambition: power exercised with consent was authority; power exercised without it was usurpation.
The Scottish discourse reveals what natural law insists more broadly: authority without consent collapses into illegitimacy. Ambition was condemned precisely because it represented the pursuit of power without communal recognition, whether by nobles who bypassed kinship networks or rulers who ignored counsel. Consent, by contrast, operated as the structuring principle not only of politics but of everyday relationships of power and hierarchy.
Translated into the data ethics context, the analogy is blunt. To seize client analytics without consent is to act ambitiously in the worst early modern sense: to grasp at authority without warrant, to elevate institutional vanity above relational trust. Just as sixteenth-century Scots condemned ambition as structurally illegitimate, modern data governance should condemn non-consensual analytics as structurally unethical. The natural law tradition, reinforced by the constitutionalist traditions I’ve traced, makes the stakes clear: without consent, there is no legitimacy. There is only exploitation masquerading as authority.
Institutional Pathologies: Metrics Theatre and Optics Culture
If natural law teaches us that legitimacy requires consent, institutional culture shows us why that lesson is so often ignored. Agencies do not stumble into analytics theft by accident; they are shaped into it by a professional economy that rewards appearances over accountability. In this culture, numbers are less a record of reality than a currency of optics. What matters is not what data reveals, but what it can be made to symbolize in a case study or an award submission.
Sara Ahmed has described this phenomenon in the context of diversity work, showing how institutions deploy “non-performative” speech acts, statements of commitment that function as evidence of change without requiring transformation (Ahmed, 2012, 119). The same pathology animates “metrics theater”: the pursuit of data points as aesthetic artifacts. When an agency lifts client analytics without permission, it is not because the numbers have inherent value. It is because those numbers, once aestheticized, can be paraded as proof of excellence. The violation of consent is not incidental; it is rendered invisible by a culture that treats numbers as self-justifying tokens of credibility.
Anthropologists of audit culture have long observed how neoliberal institutions govern by numbers. Marilyn Strathern (2000) showed how practices of performance measurement reshape entire organizations, forcing workers to conform to indicators that bear little resemblance to their actual labor. Cris Shore and Susan Wright (2015) extended this to argue that audit cultures are not neutral but disciplinary: they restructure relationships by making what is countable the only form of value. In this context, the theft of analytics is not an aberration. It is an unsurprising extension of an institutional logic that prizes the countable above the consensual, and optics above ethics.
My doctoral work on early-modern Scottish political culture shows that this pathology is not new. Ambition was condemned because it masked private gain under the language of public service. Nobles who pursued power outside the structures of counsel and consent were not seen as innovators; they were cast as destabilizers of the commonweal. The charge of ambition was less about personal desire than about the optics of power: how the pursuit of self-interest undercut the appearance of legitimacy. Contemporary metrics theater operates in the same register. Agencies cloak their pursuit of awards and recognition in the language of excellence and innovation, but the reality is a hollow performance: a scramble for optics that corrodes the very relationships it pretends to celebrate.
The consequences of this culture are cumulative. When the metric becomes the goal, ethical obligations are recast as obstacles. Consent is not honored but avoided, because the possibility of refusal would disrupt the aesthetic script. Transparency is not valued but feared, because the revelation of method would expose the artifice. Trust is not cultivated but consumed, another raw material sacrificed for the sake of the performance. What emerges is a pathology of self-interested ambition rebranded as achievement: a world where institutions congratulate themselves for their numbers while quietly eroding the conditions of trust that make numbers meaningful at all.
Consequences Beyond Fines
The defenders of analytics theft often comfort themselves with risk calculus. They glance at PIPEDA’s penalty structure—fines capped at $100,000 per violation—and conclude that the odds of enforcement are low, the costs manageable, and the rewards of fabricated metrics worth the gamble. But this is a misreading of both law and consequence. Legal sanctions are only one form of accountability. The deeper costs unfold in the erosion of reputation, the collapse of trust, and the institutional rot that follows.
Trust is not a marketing slogan; it is a form of capital. Business ethics scholars like R. Hosmer have long argued that trust is the connective tissue of organizations, the condition that allows transactions to proceed without suspicion or constant verification (Hosmer, 1995). Interest holder theorists from Edward Freeman onward have emphasized that long-term legitimacy requires respecting the interests of all parties, not only shareholders but clients, employees, and communities (Freeman, 1984). The theft of client analytics severs these threads. It tells clients they are not interest holders but exploitable resources, not partners but means to an end. No award or case study can compensate for the loss of that relational capital.
The reputational fallout is not theoretical. In a sector where credibility is the only real commodity, discovery of analytics theft corrodes every relationship at once. Clients who suspect their data has been misused will not only withdraw but warn others. Prospective partners, aware of the violation, will hesitate before entrusting their own information. Regulators, once alerted, will not confine their scrutiny to a single incident but will probe patterns of behavior. In this context, the agency’s attempt to burnish its image with illicit metrics becomes self-defeating: the very act of inflating credibility detonates it.
My dissertation’s treatment of illegitimate ambition resonates here. In early-modern Scotland, figures who sought power outside the bounds of counsel and consent were condemned not only for the immediate breach but for the broader destabilization they introduced into the polity. Ambition was corrosive because it rendered all authority suspect: if one actor could pursue power without legitimacy, what prevented others from doing the same? The result was not isolated scandal but systemic mistrust. The theft of client analytics functions in the same way. It does not merely poison one relationship; it signals to all others that legitimacy is negotiable, that authority can be exercised without recognition. The trust required for professional life collapses into suspicion.
Even internally, the rot spreads. When employees see their leaders normalize data theft, the message is clear: the rules are ornamental, ethics are negotiable, and appearances are everything. Some will comply; others will leave; none will invest genuine loyalty in an institution that cannot distinguish between legitimacy and expedience. What begins as a shortcut to an award ends as a culture of cynicism, in which no one believes in the integrity of the enterprise because its leaders have already demonstrated that integrity is dispensable.
The true cost of analytics theft, then, is not the fine but the fallout. It is the reputational hemorrhage that no rebrand can staunch, the suspicion that metastasizes through every client relationship, the corrosion of internal morale, and the collapse of legitimacy. To mistake the absence of immediate sanction for safety is to ignore the natural law insight we’ve already traced: authority without consent is not merely unlawful. It is unsustainable.
Conclusion: Reclaiming Consent as Ethical Praxis
At first glance, the theft of client analytics may look like a minor indiscretion, a shortcut taken to impress award juries or embellish a case study. But examined closely, it reveals the entire architecture of institutional pathology. It violates PIPEDA’s most basic requirements. It collapses the relational fabric that makes data meaningful. It transgresses the natural law principle that authority without consent is no authority at all. And it exemplifies the audit-driven vanity culture that confuses metrics with legitimacy.
This is not a compliance failure alone. It is a moral and structural betrayal. When agencies bypass consent, they do more than break a statute: they declare to clients that their agency is negotiable, that their trust is expendable, and that the relationship itself is collateral damage in the pursuit of optics. The consequences (legal, reputational, relational, and cultural) are not abstractions. They are the slow corrosion of legitimacy that no award or portfolio spread can conceal.
What, then, is required? Not more euphemisms about “best practices.” Not more risk calculations about the odds of regulatory enforcement. What is required is a reclamation of consent as the core praxis of data governance. Consent must be treated not as paperwork but as recognition, not as procedural friction but as the ethical foundation of partnership. It is what transforms analytics from exploitation into stewardship, from resource extraction into relational accountability.
My historical work on ambition underscores the point: power without consent was condemned not simply as unlawful, but as destabilizing, corrosive, illegitimate. Modern agencies would do well to remember that lesson. Consent is not an obstacle to be avoided. It is the very condition that distinguishes legitimacy from ambition, stewardship from theft. The path forward is not metrics at any cost, but accountability at every step. Agencies must resist the seduction of audit culture and commit instead to relational ethics: to ask, to disclose, to invite refusal, and to honor it. To govern data as if it were not inert matter but the trace of human dignity. For when organizations stop asking for consent, they do not merely break the law. They dismantle the trust that makes law unnecessary in the first place.
References
Primary Sources
Aquinas, Thomas. Summa Theologica. I–II, Q.91–95.
Buchanan, George. De Iure Regni apud Scotos. Edinburgh, 1579.
Kant, Immanuel. Groundwork of the Metaphysics of Morals. 1785.
Locke, John. Two Treatises of Government. London: Awnsham Churchill, 1690.
Mair, John. Historia Maioris Britanniae. Paris, 1521.
Secondary Sources
Books
Ahmed, Sara. On Being Included: Racism and Diversity in Institutional Life. Durham, NC: Duke University Press, 2012.
Couldry, Nick, and Ulises A. Mejias. The Costs of Connection: How Data Is Colonizing Human Life and Appropriating It for Capitalism. Stanford, CA: Stanford University Press, 2019.
Freeman, R. Edward. Strategic Management: A Stakeholder Approach. Boston: Pitman, 1984.
Strathern, Marilyn. Audit Cultures: Anthropological Studies in Accountability, Ethics and the Academy. London: Routledge, 2000.
Tronto, Joan C. Moral Boundaries: A Political Argument for an Ethic of Care. New York: Routledge, 1993.
Journal Articles
Hosmer, LaRue Tone. “Trust: The Connecting Link Between Organizational Theory and Philosophical Ethics.” Academy of Management Review 20, no. 2 (1995): 379–403.
Shore, Cris. and Susan Wright. “Governing by numbers: audit culture, rankings and the new world order,” Social Anthropology, 23 (2015): 22–28. doi: 10.1111/1469-8676.12098.
Reports and Case Law
First Nations Information Governance Centre. The First Nations Principles of OCAP®. Ottawa: FNIGC, 2014.
Gordon v. Canada (Minister of Health), 2008 FC 258.
Office of the Privacy Commissioner of Canada. “Guidelines for Obtaining Meaningful Consent.” Ottawa: OPC, 2019. https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/
Office of the Privacy Commissioner of Canada. Practices for Generating Non-Identifiable Data (CANON–OPC Report). Ottawa: OPC, 2021. https://deidentify.ca/wp-content/uploads/2021/08/CANON-OPC-Project-Final-Report-v9.pdf
Web Sources
Dentons. “Best Practices in Data Management: What Organizations Should Know About De-Identifying Information in Canada.” Dentons Data, 2023. https://www.dentonsdata.com/best-practices-in-data-management-what-organizations-should-know-about-de-identifying-information-in-canada/
Unpublished Theses and Dissertations
Baer-Tsarfati, Lisa. Condemnation and Control: Ambition, Authority, and Political Discourse in Early Modern Scotland. PhD dissertation, University of Guelph, forthcoming 2025.