Industry committee  Actually, we did not provide any recommendations relating to that one. What is the concern about that one?

Industry committee  I'm not sure that that would be a provision that our members would be looking to leverage for the internal research and analysis that they do.

Industry committee  There are a number that are actually quite substantive. PIPEDA is very principles-based. Organizations have been able to scale what they do according to the circumstance. The CPPA takes inspiration from the GDPR and the law in Quebec, and some of the key concepts are very prescriptive.

Industry committee  Yes. Some of these requirements—any changes to consent and anything that requires changes to a system—can have a very long runway, particularly in larger, complex organizations. Even printing out new consent forms and ordering paper can be very time-consuming, as well as getting access to legal experts to make sure you understand the requirements, particularly if there are differences between federal and provincial requirements—and technology resources as well.

Industry committee  It would depend. Certainly a code of practice could be beneficial if there were a certain area where there was a potential for differing interpretations of what is required. It could set out rules that organizations would follow. Basically, there would be additional trust provided by the Privacy Commissioner, to say this is the type of approach that would be supported under the CPPA.

Industry committee  No, it's not under the Canadian Bankers Association. The banking industry does have some codes of practice, and I think it's also with respect to credit practices.

Industry committee  With respect to a code of practice, we understand, too, that there might be certain very narrow scenarios that could really benefit from a code of practice. For example, information sharing could be something that's very specific. Generally speaking, for the banking sector, each of our banks has very robust privacy management programs already in place under PIPEDA, so we wouldn't necessarily look to create a code of practice for all compliance for the CPPA, although we could see some very good benefit for small and medium-sized businesses, for example.

Industry committee  Are you asking what the net new obligations are compared with those of today?

Industry committee  We believe the CPPA takes what's best from PIPEDA and strengthens it. We also think that it's very important that the federal law be a guiding principle when the provinces start their privacy reform. Obviously, Quebec has done theirs already, but we know there are other provinces that are looking to do their own thing.

Industry committee  It would be, with some targeted amendments, which we have put out in our proposal.

Industry committee  We believe that PIPEDA actually had a lot of elements around this. It already had organizations considering what was reasonable and what would be reasonable uses relating to personal information. That was in the Privacy Commissioner's guidance a lot. Now we see the CPPA taking those good things from PIPEDA and encoding the Privacy Commissioner's guidance around appropriate uses and reasonability.

Industry committee  Thank you for the question. With the money-laundering piece, certainly when we look at other jurisdictions, Canada is behind with respect to combatting money laundering and terrorist financing. Other case studies are already in play in Europe, Estonia, Netherlands and the U.K. There is also information sharing in the U.S.

Industry committee  I would like to thank the committee for the opportunity to speak on Bill C-27, the consumer privacy protection act, or CPPA. My name is Lorraine Krugel, and I am vice-president of privacy and data for the Canadian Bankers Association. The CBA is the voice of more than 60 banks operating in Canada, employing more than 280,000 Canadians and helping to drive Canada’s economic growth and prosperity.