There are a number of provisions we have yet to get to in the CPPA that heighten the level of privacy protection for all personal information collected, used and disclosed by corporate entities in the Canadian context. They include requirements for express consent in a number of areas, as well as limitations on when and how other forms of consent can be relied upon. The CPPA also puts in place a very significant enforcement regime over the uses of both those exceptions, as well as the privacy protection programs that need to be in place. For instance, there's the scrutiny of the security measures that a company must put in place to ensure they're not exposed to breaches or vulnerabilities. There's the enforcement of exceptions. Where an exception to consent, if it's relied upon, is found by the Privacy Commissioner to not have been reasonable, it's moved into an unlawful usage of personal information, which means that it's subject to the most significant fines under the administrative monetary penalties regime.
It's a very robust overall approach to the treatment of personal information, of which sensitive information is a subset that has a heightened level of privacy protections. However, the one that's the most important for this conversation is express consent.