To go back to first principles, it's important to note PIPEDA. One thing that will transfer over to the proposed consumer privacy protection act is an accountability principle such that collectors, users and disclosers of data will be accountable throughout the entirety of the life course of the personal information they've collected for its ongoing use and will be subject to the rules of PIPEDA as a function of those continued disclosures. It's one of the ways in which we ensure that in a data value chain, there is accountability throughout.
It's important to note that there is already quite a degree of responsibility placed on those who use, collect and disclose personal information. What “sensitive” will do, as I noted, is require express consent, notwithstanding the accountability principle. Across the value chain, there are a huge number of data transfers and disclosures that happen between entities that are not necessarily the same entity that did the first collection.
We've talked about banking, but even with retailers or others, there are often a significant number people. Your bank is using a third party like Interac, for instance, and then needs to transfer that information back to the host financial institution. If you used a credit card, for instance, a third party payment processor is often also involved before the information gets to your bank for the purposes of payment, and then it needs to be disclosed again to the original retailer for the purposes of clearing.
By buying an apple at the grocery store, you might see six or seven disclosures of personal information related to financial information, each of which would require the express consent of an individual for the payment and clearing of that one transaction. It becomes quite a lot when one imagines the broad category of financial data and the fact that we're now going to require express consent for every single step along the value chain, as opposed to relying on the accountability provisions of both the CPPA and PIPEDA and the rules associated with the use of personal information more generally.