Yet they're actually part of them, and that's the basic point we have here. You're either siding with the decision of people having de-identified and anonymized information being protected from themselves or having it industry led by Google and others and their associations, some of which actually have other funding and so forth.
What's interesting is this issue with regard to the Quebec consistency. I think it's an important one and a distinction that the Privacy Commissioner has addressed. Also, it's been addressed by testimony from Diane Poitras, the former president of Quebec's commission on information. Specifically on Quebec legislation, the relevant provision in section 23 is this:
Where the purposes for which information was collected or used are achieved, the person carrying on an enterprise must destroy the information, or anonymize it to use it for serious and legitimate purposes, subject to any preservation period provided...by an Act. For the purposes of this Act, information concerning a natural person is anonymized if it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows a person to be de-identified directly or indirectly. Information anonymized under this Act [can] be anonymized according to generally accepted best practices and [according to the] criteria and terms [determined] by regulation.
Part of that in the testimony we received from the Privacy Commissioner also was that they wanted to fall on the side of caution at that moment, but what's interesting from Ms. Poitras, the former president of Quebec's commission, as I mentioned, is that she stated in response to a question:
If I understood correctly, part of your question was whether we had any concerns about [the] interoperability. There are a couple of things I have concerns about. Among other things, there are important distinctions in the regimes applicable to anonymized data and de-identified information.
The door was left open to actually improve the situation, even for the residents of Quebec, with regard to having empowerment over some of their data, and there's quite a comfort level that having this difference is okay.
What we are really talking about at the end of the day here is whether or not best practices, which would be industry led, policed and determined, would be used against the OPC, because best practices, if there is a distinction or difference, will be used against the Office of the Privacy Commissioner with regard to that.
Basically, at the end of the day, this boils down to having faith in whether the Privacy Commissioner should have control over this measure or whether or not we want it to be industry led. I'm going to side with the Privacy Commissioner.
Thank you, Mr. Chair.