Mr. Chair, I would offer a couple of things.
All of this is definitional, which means that it then relates to the powers and obligations that people would be scrutinized by as it relates to the enforcement of that act. The enforcement of the act is by the Office of the Privacy Commissioner.
The determination as to whether someone had actually anonymized information for the purposes of meeting the test of generally acceptable best practices would be determined by the Privacy Commissioner should there be concerns about a violation of the CPPA.
The conception of generally acceptable best practices, as I noted, appears within Quebec's law. It's also the approach that's consistent with what experts have called for.
The Canadian Anonymization Network, or CANON, is a not-for-profit organization with representatives from public, private and health sectors in Canada. It includes the participation of experts in the field of de-identification and anonymization, including Statistics Canada. They stated that the inclusion of the phrase generally accepted best practices “will help future-proof the definition of 'anonymize', as it sets a statutory obligation for organizations to consider the evolving de-identification techniques and standards that would sufficiently protect personal information for their industry and context.”