This is interesting also, because as with proposed section 18, we're not against it per se, but we should redefine the character of the consumer.
For example, if I'm a company and I'm offering a promotion that will give a better interest rate to a customer, should I get his consent by saying, “Hey, you're going to miss out on that promotion”? Technically it's in his best interests because it may be a lower interest rate, but in the same way, it's a business advantage for me, so we should clarify the exception in the criteria. There are also some use cases we see in the U.K. that are clearly defined.
For example, there is the case of the most vulnerable Canadians. If you take care of a senior person and you are their child, maybe the senior person is not able to consent to give their data away, but maybe you can work with a non-profit that will give you a clear indication of whether this person is being defrauded or there are unusual spending habits. If this person isn't able to consent at this time because they have a mental illness—Alzheimer's disease or anything else—we should have this exception really clearly defined in the criteria.
Again, we're not against it per se, but we should be careful about the kinds of exceptions we grant, because the premise of data portability rights is about consent.