Industry committee  By the drafting of the list currently and including these broad concepts, yes, it would extend well beyond what is currently deemed sensitive under both Quebec's law and the GDPR.

Industry committee  I'll let my colleagues weigh in as well. The value chain for the processing of financial information in particular is a multi-stage value chain. It involves multiple players outside the initial collector because there are people in the value chain for financial services who do very different things.

Industry committee  I'll start, and then I'll turn to Mr. Chhabra. As Mr. Chhabra noted, “sensitive” comes up in a number of places in the bill, the most important of which notes what you can't rely on as a use of information if the information is deemed sensitive, which is the example he just went through with Mr.

Industry committee  To continue to highlight why the context.... The commissioner is only able to interpret that which is within the law, and right now, some of the proposals include a specific reference to context. This proposal does not. This proposal lists a set of information, decrees them sensitive and, because of other parts of the law, decrees that sensitive information requires express consent.

Industry committee  The parts of the bill we'll get to, hopefully, lay out what the rules related to sensitive information are, including around consent. That's where it will state that sensitive information—or at least the current version says sensitive information—requires express consent.

Industry committee  What's on the list remains part of the list.

Industry committee  Do you mean under the Access to Information Act?

Industry committee  I'll have to refer to my colleagues, but to quickly go back to the previous point, there is no reading in of context in the proposed subamendment. It is a determinative list. It specifically states that sensitive information is this list. There is no paragraph that indicates “due to the context of its collection, use or disclosure”, for instance, which is what appears in the other versions of this, so there is no context and it is all financial information.

Industry committee  However, in the subamendment you've created, you're altering the rules by which he has the ability to interpret that, so there is no context. He's—

Industry committee  As Mr. Chhabra noted in the California instance, some of this is about what they're being used for and what they reveal. In the case of Ontario, those of us who are citizens of this province know that our birthdate is included as the last six digits of our driver's licence number.

Industry committee  I'll turn to Ms. Angus to answer that question.

Industry committee  I'm happy to start and then turn to my colleagues. Essentially, you're right. There are some considerations that should be brought to bear on some of the pieces of paragraphs (f), (g) and (h). As we spoke about at the last meeting, it's specifically been noted by the Privacy Commissioner that in two provinces, driver's licence information is not actually deemed to be personal information.

Industry committee  To go back to first principles, it's important to note PIPEDA. One thing that will transfer over to the proposed consumer privacy protection act is an accountability principle such that collectors, users and disclosers of data will be accountable throughout the entirety of the life course of the personal information they've collected for its ongoing use and will be subject to the rules of PIPEDA as a function of those continued disclosures.

Industry committee  I'll turn to my colleagues, but I'll just say that all of the provisions of the act that relate to personal information and its usage are overseen by the Privacy Commissioner, subject to complaints and potentially subject to remedies. I will turn to my colleagues just to be more specific about the powers that the Privacy Commissioner has over the use of personal information, not just sensitive information.

Industry committee  As it relates to financial data, I'll start, and then I'll turn to my colleagues to talk a bit about the treatment of financial data and information under the GDPR, because I know that was raised as a contrasting issue. It's important to note that our system is somewhat unique in the sense that once a piece of personal information is deemed to be sensitive, it requires express consent, and it's not just express consent for it's collection; it's express consent for its collection, use and disclosure.