The private sector is quite familiar with the Spencer test. That is the test they use to disclose information to law enforcement. CPC-3 does not quite mirror that test. When I look at the submission of the Privacy Commissioner for Bill C-11, I see that it more closely mirrors the Spencer test in that it has three criteria and those criteria are not cumulative. The way that I read the Privacy Commissioner's submission, there's a clear “or” in there, which is not there in CPC-3. Therefore, this would be a significantly narrower test for organizations.
On April 17th, 2024. See this statement in context.