Industry Committee on May 6th, 2024

[Mark Schaan]

I'll turn to Mr. Chhabra to talk about the California consideration.

[Samir Chhabra]

I think it's really important to point out that the testimony being referenced speaks to the interest of having an example provided in the definition.

I want to make it clear that what we're reacting to in front of us with the amendment does not provide examples. It doesn't say “may include”, for example. It says “includes”. That's entirely different from offering a context-dependent definition followed by some indicative examples. In that way, it's completely different from what we're contemplating here.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

I can tell you, as a guy who worked for five years at the head office of a Canadian bank and sat in focus group meetings with individuals and customers, that many customers don't even share their information with their spouse. Believe me, financial and health information are among the most sensitive information, and people want protection.

In addition, are you aware that in the United States there is the American data privacy and protection act going through Congress, which does exactly this? It's a bipartisan bill.

[Mark Schaan]

I'll turn to Mr. Chhabra, but I'll note that one of the fundamental aspects we've tried to draw out over the course of the discussion today is the importance of some sort of context-specific interpretation tool at the outset of the list. It's something that would read like, “due to the context of its collection, use or disclosure, an individual has a high expectation of privacy and may include”. One aspect is context. The second is whether that's deemed to include, by definition, all component members of a class of information or it's indicative.

Those are two very important points that we're getting at. I think in the current formulation, there isn't the same understanding of the context of collection, use or disclosure, and the list can be added to, but is definitive in its contents.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Have the California law and the GDPR law meant that every time somebody uses a debit card they're required to provide permission?

[Mark Schaan]

As noted, the GDPR does not include financial data as sensitive information.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

California does, and they have more population than all of Canada.

Are they asking, every time they use a debit card, for permission?

[Mark Schaan]

Mr. Chhabra may be able to speak to the specific formulation of the California law.

[Runa Angus]

California does include financial information as sensitive information, but as for whether that means that when you use a debit card you need express consent, it's you using the debit card, so I don't think.... By using the debit card, you're consenting to it.

[Mark Schaan]

Our previous point was about the processing of that information. I don't know the formulation of the California law well enough to know whether it also includes an obligation for express consent and whether disclosures are wrapped up in that.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Mr. Schaan, the current Privacy Commissioner, in the appendix to his submission on Bill C-27, also asks for the list.

[Mark Schaan]

He notes the importance of context and he notes an indicative list.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

The government believes in the right of a large financial institution, as an example, to use your personal financial information in a way that isn't considered sensitive. That's the side it wants to be on, not the protection of an individual's privacy and the requirement for permission, which they can get as a blanket permission. It's not a difficult thing. We all give blanket permissions for privacy and the use of data when we subscribe to banking services.

[Mark Schaan]

I would be uncomfortable with that characterization. I suggest that the government is suggesting the definition of sensitive information should have important flexibilities to both understand context and understand cases and use cases where that information may not be sensitive.

I would note that we are not suggesting the personal information protections afforded to non-sensitive personal information should ever result in a violation of someone's privacy or affect their fundamental right to privacy. I think that's comparing two very different things.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

I'd argue that, by the time this bill passes, we'll already be out of step with California and we'll be out of step with the United States, given where they're going with regard to the American data privacy and protection act.

That's it for my questions, Mr. Chair.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Perkins.

Mr. Généreux, you have the floor.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Thank you, Mr. Chair.

I want to thank the witnesses for joining us.

While we were debating these issues, an article came out on TVA Nouvelles. This article reports that Hyundai was hit by a data leak and that there has been a 225% increase in this type of leak since last year.

Our colleague from the NDP spoke about the information that cars collect. I'm happy to still be driving around in a 2009 car. No one knows where I'm headed with this car. That's reassuring.

Mr. Turnbull is concerned that, if amendment CPC‑7 were passed, as amended by the subamendment, people would be required to give consent at every stage of a value chain process.

Legislation is implemented by regulation once it has been passed. Can these regulations be drafted in a way that avoids multiple authorization requests at each stage?

[Mark Schaan]

It isn't about regulations. It's a definition that includes sensitive information. It's about interpreting the definition.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Let me remind you that the government has moved 50 amendments to the bill, and that a number of subamendments must be reviewed. Obviously, the bill is full of flaws, to say the least, and we're trying to correct them.

If we add a list of these types of items, even a non‑exhaustive list that allows for possible interpretation, will these items be implemented by regulation, thereby providing the leeway needed to implement the bill?

[Mark Schaan]

In this case, it's hard to predict the possible interpretation given the construction of the sentence. It says that the list is non‑exclusive. However, all the items on the list are included in the definition. There isn't any room for interpretation, because it's clear.

As a result, we find that the commissioner should be given some context at the start of the list, and that the list should be indicative.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

I gather that you don't want the CPC‑7 amendment at all, and that you don't want a list.

Is that right?

[Mark Schaan]

No. We're comfortable with the idea of including a list, but an indicative and non‑exclusive list.

The list needs to have both aspects so that there can be more than what's on the list and so that what's within the list is indicative, thereby giving context to the Office of the Privacy Commissioner. Then it can indicate the context in which information would and would not be understood to be sensitive.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Généreux.

Mr. Williams, you have the floor.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you.

I want to touch on the financial aspects we've been talking about, specifically open banking. Strong data protection is a selling point for open banking. That's why it's being looked at for Canada. It's allowing better data protection technology to come into effect.

Mr. Chhabra, you've spent some time talking about open banking. I've spent thousands of hours talking to individuals on that and trying to push forward...specifically because they believe the API and the framework that's going to be developed are going to make them more competitive against standard banks in the whole process. We've seen that in Australia and the U.K.

You indicated that you already talked to some of these groups. I'm still unclear as to how listing financial data as sensitive is going to hurt our financial institutions in Canada. I think it's going to strengthen them. If there is increased consumer protection and technology that will protect that data, and if we are ensuring that consumers of Canadian technology in Canada are going to have greater protection of that data, I'm not sure why we would see that as a disadvantage, specifically since up to now the only thing that's been produced in the budget is to grant the framework for open banking, with more consultation with the industry.

If we're developing an API that's going to be used across the whole spectrum in open banking, why would this put our open banking system and framework at a disadvantage compared to those of other countries?