Industry committee  To add, I think that's part of the rationale in Bill S-4 and the additional powers that were given to the commissioner with that longer period of time to go to court. Under PIPEDA previously, it would have been 45 days, but Bill S-4 extends that to a year. It gives the commission

Industry committee  Yes.

Industry committee  It may also be useful to consider NDP-16 and NDP-18. I think they're all part of the same order-making framework. Just on the context of order-making powers, it was an issue that was discussed during the first parliamentary review. During the review they found that the current

Industry committee  The amendment is drafted to cover more than just the disclosures. It covers the collection, use, and disclosure any time anyone collected any personal information of any kind, any time we use any kind of personal information, and any time it's disclosed. All three of those things

Industry committee  This would require all organizations covered by PIPEDA that make any disclosures to law enforcement, any government agency, or any investigative body, for that matter, to record all those exchanges and to notify individuals within 60 days and make a public report every quarter.

Industry committee  If the NGO were selling products or something like that and there was a commercial aspect to it, it would apply. Generally if it's outside the commercial frame, PIPEDA does not apply. If it's in a provincial jurisdiction, it may apply.

Industry committee  Privacy falls across so many pieces of legislation. Even the cyberbullying act has very specific pieces of privacy legislation there identifying specific uses or not for intimate images. That's another example of the other pieces of legislation that touch on privacy issues.

Industry committee  Yes, with any possession or creation of identity documents, as soon as you're getting into that kind of criminal activity, you're getting into identity theft issues that are covered by the Criminal Code.

Industry committee  When you're getting into credit card fraud and identity theft, that falls to the Criminal Code. Like the deputy said, there's a very specific amendment here. If you're a teller in a rural bank and you have a regular elderly customer coming in with somebody and you clearly see t

Industry committee  As we go through this, there are lots of things that have to be established through regulation. We're quite conscious of the fact that these data breach provisions apply, from the local dry cleaner down the street all the way up to a big bank or a telecommunications provider. We'

Industry committee  To bring the data breach provisions into force we're going to have to pass regulations, so we'll need to consult on the regulations and go through that. Then after that's done it's the role of the Privacy Commissioner to help provide guidance to companies about how to comply in t

Industry committee  It's specified in the law as “as soon as feasible”. For us that means once you've closed the breach, you're not at risk by informing folks. If the breach is ongoing, by going around informing people it could be further exasperated, so once you've clearly identified the breach and

Industry committee  No.

Industry committee  For those specific provisions, currently under PIPEDA there's a regime called the investigative body regime. It lists a number of entities that are allowed to do these activities now. The range of entities that are there are, for example, the bank crime prevention organization th

Industry committee  They are completely separate pieces and not related. The anti-terror law is about exchange of information within government. This is about private sector privacy rules. They're quite separate pieces.