This is a tricky question, because for any start-up the research used potentially will lead to business use cases. We don't know whether that dataset collected under the research umbrella would then be carried forward for other projects that are money-making for them. I think we have to imply similar principles. If it's currently PIPEDA, it should be applied equally to research data use and use for business. The only research exception I would make, essentially, is for independent vetted researchers and journalists, and that actually goes to earlier questions about what we can do to mandate access to that type of data that companies are already collecting, so that you have more independent audit of that data.
Those things can be done. The platforms will tell you that if there's a privacy or IP concern, they cannot share data with researchers. I've heard that said so many times, but in fact there are many ways to share this type of data using privacy-preserving technology, so that researchers can report it.