In certain circumstances, there are organizations called investigative bodies, such as a law society, where they have concerns regarding clients lists or privilege being breached. Right now, under PIPEDA, they can be prescribed in legislation, in the regulations as an organization that can share information between, perhaps, two law firms, to understand whether a breach actually has taken place.
What we're proposing in this particular amendment is to align with what other provinces have done to streamline the administrative burden by not prescribing the organization in legislation, by having a four-part test to make sure that it's only under limited circumstances, and it's not a fact-finding mission. There has to be evidence of something happening, and the information being requested has to be in line with the investigation that's happening, and there has to be proof that asking for consent would compromise the investigation in and of itself. So there are measures in place to make sure that there is appropriately focused...and there is nothing preventing an individual from asking for the information later on how it was being used, or making a complaint to the Privacy Commissioner about how their information is being used. The general oversight provisions still apply.