One of the goals of the proposed legislation is to minimize consent fatigue and to maximize consent with regard to where it is truly important and is understood to be important. If you have to expressly consent for every use of the information that you're providing to a corporate entity, then, potentially, we actually significantly raise the bar for consent fatigue. People get tired of saying yes or no, even if it's in plain language.
By trying to actually constrain it to that for which it is most necessary.... We understand the intent of CPC-7, which is to try to say, “Let's put some flesh on the bones of what is actually sensitive and where those cases are.” We have noted that, potentially, the categories might be too broad or might lack some of that context, and that maybe there's a better way of getting it. The construct that there is sensitive information.... It clearly exists. What kinds of contours can we put around it without boxing out the possibility of saying that everything requires consent or that consent is always the case for every single type of information, even though there are different uses of types of information, some of which might be sensitive and some of which might not be?