Industry Committee on May 6th, 2024

[Samir Chhabra]

Thank you for that.

The commissioner has been clear about the interest in having a context-based definition as the foundation for any definition that the committee chooses to adopt. I also think it's worth pointing out that the commissioner issued guidance on this issue several times, including most recently in 2022.

For greater certainty about what we're talking about here, it should be really clear that not including something in this list as part of the definition does not obviate the commissioner's ability to include it and to provide a much more detailed context-based definition or parameters around what will make certain types of information sensitive in a given context, including many types of financial information, which can also be included via OPC guidance. I think the issue before the committee right now is about whether the unintended impacts that could occur by listing an item strictly in the definitions will be worth the effort to do so. The consideration is what that offers over and above what the commissioner is able to do via guidance.

[Ryan Turnbull, Liberal, Whitby, ON]

Mr. Garon has said that, potentially, consent fatigue is not really a thing. I think if we make this a subamendment, it will become a thing. It will become a much bigger issue for the average Canadian. I trust that the systems we have in place are protective, and I understand that sometimes they break down. Sometimes there are breaches of privacy. Those are things that the Privacy Commissioner will be able to deal with.

Are there aspects of this bill that we haven't contemplated yet that can assure the members of this committee that certain types of information included in paragraphs (f), (g) and (h) are protected but not necessarily always deemed sensitive? I think that's the heart of the issue for me. I hear ideological arguments about protecting information that members want to deem “sensitive” to ensure that it's held close and really protected.

I get the desire to do that. I get the motivation behind it. There's a good motivation behind it. However, think about the ramifications or the unintended consequences of that when not being able to consider context. I think that's really the issue. Also, the bill itself is designing a framework to ensure that paragraphs (f), (g) and (h) still come with requirements that are significantly robust and perhaps more robust than in the past.

Mr. Schaan, can you speak to that? I ask because I feel like this is the missing piece. We're stuck on a definition. We're trying to do something in the definition that the rest of the bill will deal with in due course, but we haven't gotten there yet. I don't mean this in a disparaging way at all, but we're not there yet in the bill. We haven't looked ahead and necessarily gotten to that point.

Mr. Schaan, can you give us some detail on how the bill, in later phases or stages, raises the bar and the requirements for personal information and suggests that not all of it needs to be deemed sensitive for it to be protected?

[Mark Schaan]

That's right. The overall structure of the consumer privacy protection act makes significant improvements to the existing Personal Information Protection and Electronic Documents Act in the treatment of both personal information generally and sensitive information. Some of what would be wrapped up in requiring express consent at this point will be further contemplated. For instance, what are the obligations for the general protection of personal information? What sorts of privacy programs do you need in place to ensure that you've done things like having effective controls? Have you left yourself vulnerable to cyber-risks or other aspects, for instance? Those are the sorts of things that will get covered in a privacy program.

There will also be further considerations about what it takes, and when you are allowed, to make a disclosure. When am I allowed to move financial data, for instance, from one payment process to another, and what are the guardrails around that?

There will be, as contemplated in the act, a very high standard set for the treatment of personal information writ large, including in a number of the instances that would get wrapped up in what it currently contemplates and tries to do through sensitive information. By making it sensitive, we are requiring its express consent, therefore taking away the flexibility of the context-specific reading that the Privacy Commissioner has asked for. It also suggests that all of the other things that will come later that protect that information won't be doing anything, when in fact they very much will.

I don't know if my colleagues want to weigh in.

[Ryan Turnbull, Liberal, Whitby, ON]

I'm looking for the specific section that deals with personal information and the requirements around it that would perhaps reassure committee members. I'm struggling to find it in my binder, but I know I've read it and can definitely find it.

[Mark Schaan]

I'll turn to the team. They can point to some sections that deal with the treatment of personal information and the important guardrails around it.

[Samir Chhabra]

As I mentioned earlier, there are 17 instances where sensitive information is specifically mentioned, including in proposed subsection 15(5), which talks about the form of consent. It appears under “Retention and Disposal of Personal Information”, in proposed subsection 53(2). It also appears under “Security Safeguards”, in proposed subsection 57(1), and again in proposed paragraph 58(8)(a).

It's really throughout the entire act. If we're looking for areas of the act that speak to the responsibilities and accountabilities of data holders, it is quite well spread out.

My colleague might have a few other references for you.

[Runa Angus]

We have to remember that when we talk about personal information writ large, it's not just about sensitive information. All the obligations, whether about security safeguards or about retention and disposal, as my colleague said, are applied to all personal information. It's the degree that changes.

With respect to any personal information, there is obviously the appropriate purpose. You can't collect, use or disclose any personal information unless you have an appropriate purpose for doing so, and that's an obligation that applies to all personal information, not just sensitive personal information. You can't use information just because you want to. That's an obligation that applies in all contexts.

[Ryan Turnbull, Liberal, Whitby, ON]

Okay. Thank you.

I know that members opposite have mentioned open banking. What impact would this subamendment have on open banking? It seems to me that it would have a pretty big impact on the possibility of moving forward with an open banking system.

[Mark Schaan]

I'll start. Then my colleagues will likely want to weigh in.

As noted, because financial data will now be deemed sensitive information, consumer-directed financing, as it's understood, will rely on the data portability obligations that are found within later sections of the CPPA, which would have a direct one-service provider for consumers to provide their information to another service provider. However, that doesn't obviate or shift away the realities of the financial services sector that then would follow.

That new fintech player is probably more reliant than others on third party processors or other aspects, because they've made their niche in one aspect of financial innovation, which is potentially providing services, but that doesn't mean they're going to have the whole back end that would normally be accompanied by a larger financial services provider. Every single one of those disclosures will require the express consent of their client, which means that when they want to provide a seamless financial services environment for their client, they will be going back to their client on numerous occasions to reseek their consent for the continued disclosure of financial information.

I don't know if Samir and Runa want to weigh in.

[Samir Chhabra]

I'll add to that.

Having had the opportunity to speak to some of the experts in the open banking or consumer-driven banking space in recent days, I'm comfortable sharing that when considering specific issues related to consent, authorization and authentication—which are each different steps in the value chain that all need to be appropriately managed for different purposes within the consumer-driven banking system—insisting that all financial data become sensitive information changes the calibration of the work that's under way there. I think it would be entirely reasonable to say that it's likely to slow down the advancement of the work that's currently being contemplated. There's an important distinction to be made between express consent when sensitive or personal information is being managed and elements that, while still being designated as personal information, may not attract a level of sensitivity given the context of the use or disclosure that's being made to enable open banking, which in some cases is about transferring information to enable services to be provided.

The point here is that's it's a bit like an iceberg. We need to understand that express consent is visible and available to all of us as consumers in the system, but there's a lot of work that needs to go on in the plumbing, if you will, to share data that wouldn't be sensitive given the context, in order to enable the provision of services that we see at the consumer level.

[Ryan Turnbull, Liberal, Whitby, ON]

Is some financial information always sensitive? Is there an argument there? I'm playing devil's advocate. Is there some portion of all financial information that should always be deemed sensitive? If not, then this is really problematic.

It's even more problematic than I initially thought, but is there a way to determine that a category of financial information would always be deemed sensitive without considering context, or does context always matter? I know it's a difficult question, but I thought I'd put it to the officials anyway.

[Mark Schaan]

I think there's a lot of financial data that many of us would be uncomfortable seeing shared outside of those we know, but context does matter. I could ask you if you're you okay with me knowing how much you have left on your mortgage or how much your monthly mortgage payment is. You would probably not want a wide body of people to know that. However, let's say I told you that when paying your mortgage, when you send the transfer—either automatically or, if you have to do it manually, through your electronic banking app—it was going to pass through six different processors to ultimately move from the part of the bank that has your savings account to the part of the bank that holds your mortgage, assuming that's even in the same financial institution. If I told you that it was going to pass through six or eight hands and asked, as it's probably pretty sensitive, “Do you want to make sure that you know about every single one of them?”.... I think if people knew that those disclosures were managed by a privacy program where there needed to be a clear rationale for why that information was being shared, and knew that the original collector was still ultimately accountable for its treatment and the privacy obligations throughout the entirety of the value chain, many people would say they're comfortable, they don't want say yes eight times and they want that information just to flow.

I think that's what makes it so tricky to say that in all instances this information is always sensitive, because in many cases it's not sensitive within a given context.

[Ryan Turnbull, Liberal, Whitby, ON]

If I were to summarize what you've said, it's that context always matters with regard to financial data. Is that not the underlying point you've made with your example?

[Mark Schaan]

I think that's fair.

[Ryan Turnbull, Liberal, Whitby, ON]

Would the seamless financial services environment that you described be a thing of the past if this subamendment passes?

[Mark Schaan]

The business processes that I understand are currently in operation in the financial services sector have multiple players within them requiring multiple disclosures per transaction, and if each one of those disclosures is subject to express consent, that would be a very different financial services experience than what we have currently.

[Ryan Turnbull, Liberal, Whitby, ON]

I'm glad to hear you didn't use the apple example. I noticed that triggered my colleague Mr. Vis earlier.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

It did.

[Ryan Turnbull, Liberal, Whitby, ON]

Thanks for the clarifications. We appreciate it.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Turnbull.

Mr. Perkins, you have the floor.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Mr. Chair.

Thank you, officials.

Before I ask a couple questions on this, which I don't believe I've talked to yet, I note that this is the third meeting we've had on CPC-7, most of which has been driven by the government's desire to amend and change it. I note this only because the government suggested that clause-by-clause would take four meetings and the government is the one pushing to make it longer.

Mr. Schaan, I'm a little concerned by your testimony earlier about the Privacy Commissioner. Bill C-11, which was the predecessor to this bill, attempted to make Privacy Act changes in the last Parliament, and I would like to read from the Privacy Commissioner's submission on it to committee, if I could:

While the OPC and the courts have provided some interpretations of sensitive information, it would be preferable to have a legislative definition that sets out a general principle and is context-specific, followed by an explicitly non-exhaustive list of examples (such as those included in article 9 of the GDPR). This would provide greater certainty for organizations and consumers as to the interpretation of the term. For instance, such a definition might read:

Sensitive information means personal information for which an individual has a heightened expectation of privacy, or for which collection, use or disclosure creates a heightened risk of harm to the individual. This may include, but is not limited to—

Does that sound familiar? It's in MP Garon's subamendment.

—information revealing racial or ethnic origin, gender identity, sexual orientation, political opinions, or religious or philosophical beliefs; genetic information; biometric information for the purpose of uniquely identifying an individual; financial information; information concerning health; or information revealing an individual’s geolocation.

That was for the last bill, so it comes as a surprise to me, Mr. Schaan, that you said the Privacy Commissioner has not asked for that. It's right in his brief.

[Mark Schaan]

Mr. Perkins, I would note that Bill C-11 was contemplated by a previous Privacy Commissioner.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Oh, okay. Then it doesn't matter that the Office of the Privacy Commissioner said that.

Let me go forward. Are you aware of the California privacy law?

[Mark Schaan]

Yes, I am.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

You're aware that the particular clauses that irritate the government are actually in that law.