Industry Committee on April 29th, 2024

[Ryan Williams, Conservative, Bay of Quinte, ON]

You might have answered my question already, but with this new definition, is personal information still regulated to appropriately reflect the inclusion of inferred information as it exists in the California privacy act and Australia's Privacy Act?

[Mark Schaan]

“Inferred information”, as codified in this way, would be consistent with a number of international best practices on the understanding of personal information, including California, but also the EU's GDPR and Quebec's law 25.

[Ryan Williams, Conservative, Bay of Quinte, ON]

I know we're looking at this clause, but also that, as before, the discussion was that if this clause were to go through it would take away the other three amendments...clauses. Given the discussion that I introduced of looking at the California section of the privacy act, identifying certain use cases for personal data, would that fall in line with what you think would strengthen this bill?

[Mark Schaan]

Mr. Chair, I think this is one zone in which the devil will very much be in the details. I think we've had discussions at this committee before about exhaustive versus non-exhaustive lists, and where lists are indicative but not exclusive. Insofar as an amendment suggests what personal information is, we see that as actually limiting because right now the definition, including with this amendment, will still be quite broadly interpretable in the sense that it means information about an identifiable individual, and then the amendment would amend that definition to ensure that it expressly captures “inferred”. However, if it started to go into a list of potential technologies or zones, it would very much depend on the construction, because sometimes, due to the construction of some of those amendments, it actually becomes a definitive list, which means it's not further expandable over time. You have to word it appropriately to ensure that this is indicative and illustrative, not exhaustive. This is a zone in which OPC guidance and jurisprudence can often fill that gap—particularly as it could then keep up with the times and the technology—rather than hardwiring things into the legislation that might not stay current.

[Ryan Williams, Conservative, Bay of Quinte, ON]

I agree with that because I think that in the past we've disagreed within regulation, which may not define. However, could we use the words “such as”? Is there language that would allow that list not to be limited and exhaustive, as you point out?

[Mark Schaan]

In broad strokes, things that say “includes but are not limited to” can be helpful in some of those indications. However, I'd have to see the specific wording because the challenge is that you want to make sure you aren't narrowing or closing to just the things that you are then about to list.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Through you, Mr. Chair, we have NDP-4. We bring this up now because if we pass this first motion, we eliminate it. It does have wording in that, including:

individual that can be used to identify them, directly or indirectly, and includes their name, an identification number, location data, an online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

However, what we're looking for, then, is something that says, “such as” or “could include”. Isn't that right? That's probably the wording we're looking for.

[Mark Schaan]

I'll turn to my colleague, but you're right: Currently our worry about NDP-4 is that it would be seen as a closed list because it has “includes” and then lists things, as opposed to something like “includes but is not limited to”.

I turn to Mr. Chhabra.

[Samir Chhabra, Director General, Marketplace Framework Policy Branch, Department of Industry]

I think it's important to recognize as well that the formulation of the list can be done in a way that unintentionally narrows. In this case what we're looking at specifically, in addition to the issues that Mr. Schaan mentioned, is that it might unintentionally reduce the range of personal information because it specifies only that which is used to identify an individual. That could exclude a series of very important buckets of information that are currently considered as being personal information under the act. An individual conducting certain types of searches or visiting certain types of websites online might not be information that identifies that individual, but it is about that individual.

The current definition of personal information is information about an identifiable individual, versus here in NDP-4, which has information “that can be used to identify them, directly or indirectly”. This goes back to Mr. Schaan's point about constructing the definitions in the manner that is the most inclusive and as broadly as possible to allow for jurisprudence to evolve and for the OPC to issue guidance to enable better understanding within the industry about what's meant, but without locking us in at the legislative level.

[Ryan Williams, Conservative, Bay of Quinte, ON]

If you go back to the California code, it says, “Personal information includes, but is not limited to” any information that directly “identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household”. It's a longer definition before they list the examples.

Should we be looking for that kind of a definition? Again, we're talking about “inferred” on one side. However, again, when we look down the list, I think it is the Bloc amendment that talks about including “an identifiable individual or group”.

If we look at the California code, we see that they've really nailed that first part of the definition. Would that be something that would encompass all of the amendments that we looked at?

[Mark Schaan]

Right now, that work of the lengthy California description is being done by the word “about” in the current PIPEDA, and “about” has been sufficient, from a court perspective, to get at a wide range of inferred and direct information about individuals. It's how the court ruled on information related to inferred data. It's how the court ruled on things like IP addresses. Therefore, “about” has been sufficient, jurisprudentially and from a guidance perspective, to get to all of the things that California has tried to do with a much longer list.

Of course, the problem of going to a much longer list is twofold. First, you're shifting from “about” to something else. The courts have tended to have a rational kind of approach to say, “You did that on purpose,” so clearly.... What is it that's different between “about” and this new list that suggests you weren't happy about “about”? Second, the worry then, of course, is whether—because it's now a much longer list—it is exhaustive. Is it now seen as potentially overly narrowing, whereas that was all being done by “about” and got to good places, both through the OPC and the courts?

This is always the concern with potentially inserting something that adds more words: it potentially doesn't actually do more work than “about” already does in the current definition.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Chair, I'm going to let others chime in so that we can see what the other parties are thinking.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Williams.

I'll just make a point of clarification, which you've mentioned. If CPC-5 is adopted, BQ-1 cannot be moved, but NDP-4 and NDP-5 could still be moved.

Mr. Masse.

[Brian Masse, NDP, Windsor West, ON]

Thanks, Mr. Chair.

I think we're playing a game of snakes and ladders here as we go back and forth with all the different numbers. I think what's happening here is that we're trying to make it better, but we don't want to make it worse. I appreciate the Conservatives' bringing this amendment forward. If we go with NDP-4, though, and insert “but not limited to”, would that be a better fix?

[Mark Schaan]

No.

[Brian Masse, NDP, Windsor West, ON]

Okay. That's what I want to hear. We're trying to get to the same place here, so please be frank.

[Mark Schaan]

Indeed.

Unfortunately, the construction of NDP-4, as Mr. Chhabra says, uses “used to identify them”, as opposed to the current definition, which is “about” them. “About” does more than “used to identify” does. “About” suggests a generality around you, which is where inferred information got read in by the courts. Therefore, if we go back to “identify”, if it was individuals that can be used.... The construction is challenging because you need to keep “about” somewhere in there so that you can get at the broader construct.

[Brian Masse, NDP, Windsor West, ON]

If we're looking to bolster what we're trying to do here, which amendment should we be constructing on? We've ruled out NDP-4, which is fine.

Again, I think we're all trying to get to the same spot.

[Mark Schaan]

CPC-5 avoids that challenge. NDP-5 also avoids that challenge. BQ-1 and NDP-4 shift the construction. BQ-1 introduces this construct of group rights, which I think would vastly alter the definition of “personal information” that is currently understood in our jurisdiction or others.

[Brian Masse, NDP, Windsor West, ON]

So we're really looking—and please say no if I'm wrong—at the one currently in front of us, NDP-5, as being the better of the options going forward.

[Mark Schaan]

Amendments CPC-5 and NDP-5 both codify the inclusion of inferred information without breasting a definition of personal information being solely that which is used to identify, because, again, identification is only one half of the battle here. It's also the inference or the generalities about someone that go beyond just the pure precision of identifying.

[Brian Masse, NDP, Windsor West, ON]

From those two choices, is there one that's preferable?

[Mark Schaan]

I think they are both workable. We have amendment CPC-5 in front of us.

[Brian Masse, NDP, Windsor West, ON]

That's fine. Again, it's about getting the result. I think NDP-5 is better, but we all want to get to the same space.

Thank you very much. That has been very helpful. I will turn the floor back to the chair.

[The Chair, Liberal, Joël Lightbound]

Thank you.

Mr. Turnbull, the floor is yours.