Industry Committee on May 6th, 2024

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

Thank you.

The officials are confirming that. I don't want to eventually see this at the scrutiny of regulations committee, where we'd have to quibble over whether it is the same.

In regard to this, I'd like to ask Mr. Garon something.

Referring to something that has not yet been identified is always a bit of a tricky thing. When you say there's an equal expectation of privacy and say “not limited to”, what kinds of things could this be referring to? We are counting on an interpretation by future bureaucrats and the minister responsible that allows them to determine what would have that status. I'm always a little loath, particularly after the Bill C-22 debacle, to give too much power of interpretation for future decisions without clarity as to what we're giving consent to.

[Jean-Denis Garon, Bloc, Mirabel, QC]

First, we include a list. Second, we're adding “but is not limited to”, for a very simple reason, which is that if this legislation had been in place 10 years ago, biometric data would not have been included. We would not have thought about it. Technology is changing rapidly.

The Supreme Court's interpretation of “reasonable expectation of privacy” is, as I understand it, subject to a legal test. We are introducing the notion of a “high expectation of privacy”. This concept could be interpreted later by the courts so as to expand the list as changes occur in the environment in which consumers and citizens operate.

In principle, this would enable the courts to interpret the notion of “high expectation of privacy” and expand the list as needed.

However, I don't think that it would change the minister's regulatory authority.

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

I have respect for the work that's being done here. Obviously, I'm not a regular member. I'm not going to comment because this may have come up before.

This is why we usually have five- or 10-year reviews written into legislation. If other subjects are deemed important five or 10 years from now, I'd like them to originate from parliamentarians' review of things. That keeps the ball in Parliament's court rather than with someone who is making a recommendation and a minister who may have a much different value system from some of the parliamentarians elected to Parliament.

That being said, thank you, Mr. Chair.

I appreciate Mr. Garon's interventions today.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Albas.

Five- to 10-year reviews are a lofty ideal that isn't always respected. Mr. Masse could attest to that, but it's a nice ideal, indeed.

Mr. Turnbull, the floor is yours.

[Ryan Turnbull, Liberal, Whitby, ON]

Thanks, Mr. Chair.

I want to thank Mr. Garon for putting something forward that attempts to combine numerous points that both parties had been making in the debate to find a path forward. I appreciate that. I also appreciate Mr. Masse's willingness to allow some of his thinking to be incorporated into an amendment, which is great.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Mr. Chair, I would like to comment.

[The Chair, Liberal, Joël Lightbound]

Just a moment, Mr. Turnbull.

Mr. Garon, you have the floor.

[Jean-Denis Garon, Bloc, Mirabel, QC]

I just wanted to say that there is no French interpretation.

[The Chair, Liberal, Joël Lightbound]

Okay.

Apparently, there is no interpretation.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Mr. Chair, the interpretation is working now.

[The Chair, Liberal, Joël Lightbound]

Mr. Turnbull, can you start from the top, please?

[Ryan Turnbull, Liberal, Whitby, ON]

I was just expressing my appreciation for your work, Mr. Garon, and also for Mr. Masse allowing you to incorporate some of his thinking into the subamendment that you've proposed. This is great. It sounds like we're off to a constructive start.

I have a couple of questions.

One of the debates that we got into last time was around financial data. I know you've included it in your list. Intuitively, I think that financial data seems like it would be sensitive information. However, both the Privacy Commissioner and the Supreme Court disagree with that. They've said that the degree of sensitivity of specific financial information is a contextual determination. I could go on and quote them.

The Supreme Court decision of RBC v. Trang in 2016 has stated explicitly that in not all cases is financial information actually deemed sensitive, or the degree of sensitivity differs depending on the context of its use. Maybe I can go to Mr. Schaan to back me up on this, so that you're not just taking my word for it. The experts and officials are here with us for good reason.

Mr. Schaan, can you add anything to what I've said?

[Mark Schaan]

As it relates to financial data, I'll start, and then I'll turn to my colleagues to talk a bit about the treatment of financial data and information under the GDPR, because I know that was raised as a contrasting issue.

It's important to note that our system is somewhat unique in the sense that once a piece of personal information is deemed to be sensitive, it requires express consent, and it's not just express consent for it's collection; it's express consent for its collection, use and disclosure. That means express consent is required for its initial gathering from an individual and for its ongoing use. Then, when it needs to be disclosed to a party who is not the party who collected it, including in the process of business practices, express consent is required again.

Financial data and information is an extremely wide category. It includes transaction data. It includes information related to whether or not you hold more than one mortgage. It relates to a whole host of information that is, essentially, personal information that ties you to any type of financial transaction, of which there are many.

This would require express consent for every single collection, use and disclosure of that information. As an example, if I have an ongoing payment history with my bank and they need to use a third party processor, as many do for the purpose of continuing to use the transaction data, that would require express consent for every single one of the disclosures along the chain. It's not just when I first sign up for my bank account or even make the transaction; it is going to be required at every single step of the way. It is quite a broad category.

I think it's important to note the distinction between this express consent obligation and the varieties of ways in which processing and data information processing are allowed under the GDPR. For that, I'll turn to my colleagues, who can further enunciate why it hasn't gummed up the EU system. In part, it's because it's not understood in the same ways.

I'll turn it over to my colleagues.

[Runa Angus]

I'll take the question on the GDPR.

The GDPR refers not to sensitive information, but to special categories of personal data. Those special categories, in article 9 of the GDPR, refer to:

...racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation....

Those are the categories in the GDPR. As Mr. Schaan said, financial data is not on the list of sensitive information for the GDPR.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you for that.

Help me understand this. We went through it last time, but what I'm asking myself is, so what? Why shouldn't we? Mr. Garon or somebody else might say that financial information is really important so we want it to be protected. The financial system wouldn't to come to its knees and be completely in ruin if we were to pass this particular subamendment, but I want to push back a bit on that and ask what the implications would be for the everyday, average citizen who is relying, potentially, on those third parties and on the financial information to be transferred in a way that doesn't present an imposition on the services they use and consume on a regular basis.

Mr. Schaan, I'll turn to you, and you can redirect to someone else on your team, if need be. Help us understand the impact of this. You've already said, to some degree, that express consent would be required at every single point along the chain of disclosure, but can you give us more detail on how this might impact everyday citizens?

[Mark Schaan]

To go back to first principles, it's important to note PIPEDA. One thing that will transfer over to the proposed consumer privacy protection act is an accountability principle such that collectors, users and disclosers of data will be accountable throughout the entirety of the life course of the personal information they've collected for its ongoing use and will be subject to the rules of PIPEDA as a function of those continued disclosures. It's one of the ways in which we ensure that in a data value chain, there is accountability throughout.

It's important to note that there is already quite a degree of responsibility placed on those who use, collect and disclose personal information. What “sensitive” will do, as I noted, is require express consent, notwithstanding the accountability principle. Across the value chain, there are a huge number of data transfers and disclosures that happen between entities that are not necessarily the same entity that did the first collection.

We've talked about banking, but even with retailers or others, there are often a significant number people. Your bank is using a third party like Interac, for instance, and then needs to transfer that information back to the host financial institution. If you used a credit card, for instance, a third party payment processor is often also involved before the information gets to your bank for the purposes of payment, and then it needs to be disclosed again to the original retailer for the purposes of clearing.

By buying an apple at the grocery store, you might see six or seven disclosures of personal information related to financial information, each of which would require the express consent of an individual for the payment and clearing of that one transaction. It becomes quite a lot when one imagines the broad category of financial data and the fact that we're now going to require express consent for every single step along the value chain, as opposed to relying on the accountability provisions of both the CPPA and PIPEDA and the rules associated with the use of personal information more generally.

[Ryan Turnbull, Liberal, Whitby, ON]

We made the point in the last meeting we had that just because personal information doesn't all qualify as sensitive information doesn't mean that it isn't still protected and held to a very high standard. The CPPA is designed to do that. Obviously that part of the bill hasn't been contemplated by the committee yet, because it comes later. We're still on the definitions. We haven't gone into that, so it may not be as present in people's minds, but I think your point is well taken, Mr. Schaan, that the accountability principle is already baked into this bill.

Is financial information transfer already overseen by the Privacy Commissioner as well? Are there ways in which the Privacy Commissioner already has a role to play in overseeing that?

[Mark Schaan]

I'll turn to my colleagues, but I'll just say that all of the provisions of the act that relate to personal information and its usage are overseen by the Privacy Commissioner, subject to complaints and potentially subject to remedies.

I will turn to my colleagues just to be more specific about the powers that the Privacy Commissioner has over the use of personal information, not just sensitive information.

[Runa Angus]

As Mr. Schaan just said, the Privacy Commissioner has oversight over all collection, disclosure and use of personal information, which would include sensitive information. It would obviously include financial data as well.

The commissioner does a contextual analysis. Information that's not sensitive in one context may be sensitive in another context. Information together may become sensitive where individual categories are not sensitive. That's how the Privacy Commissioner looks at personal information. He determines whether it's sensitive or not and requires obligations that are commensurate with the sensitivity of the information.

The office absolutely looks at financial information. There are many cases where they have said that financial information is sensitive, and there are cases where they've said in another context that it's not sensitive.

[Ryan Turnbull, Liberal, Whitby, ON]

Including all financial data as sensitive information—which is what this subamendment would do in the bill—would remove the Privacy Commissioner's discretion and his ability to issue guidance and use context as a way of determining the sensitivity of that financial data.

Is that correct?

[Runa Angus]

That's correct.

[Ryan Turnbull, Liberal, Whitby, ON]

I see the answer is yes, but the microphone wasn't turned on.

To go back quickly, the GDPR categories that Ms. Angus read out did not include some of the things that are included in the list that Mr. Garon has presented in his subamendment. If I'm not mistaken, they only included up to paragraph (e), so paragraphs (a), (b), (c), (d) and (e). If we're really trying for interoperability and using the EU's GDPR as our standard—and that's part of the argument—then essentially we would be eliminating paragraphs (f), (g) and (h). When I read them, those were the things that seemed to carry some pretty high, potentially unintended, consequences.

Could we verify that the GDPR includes paragraphs (a), (b), (c), (d) and (e), but not (f), (g) and (h)? If I'm wrong, please feel free to correct me.

[Mark Schaan]

I'm happy to start and then turn to my colleagues.

Essentially, you're right. There are some considerations that should be brought to bear on some of the pieces of paragraphs (f), (g) and (h).

As we spoke about at the last meeting, it's specifically been noted by the Privacy Commissioner that in two provinces, driver's licence information is not actually deemed to be personal information. It's important to segregate the driver's licence—because that's not what this amendment says—from the driver's licence number, which is what is specified. There's lots of personal information on our driver's licence, for sure, but what's being requested to be considered sensitive is the driver's licence number, which in two provinces has already been deemed by the Privacy Commissioner to not be personal information. Therefore, giving it the status of sensitive information not only heightens that, but actually requires express consent.

We've already been over financial data, but passwords often also have context that potentially should be considered.

With that, I will turn to my colleagues to further elucidate some of the issues in the back end of the list.

[Samir Chhabra, Director General, Strategy and Innovation Policy Sector, Department of Industry]

As Mr. Schaan pointed out, the context dependency for any analysis of sensitivity of any information is critical. It's a cornerstone of the OPC's submission to this committee that we start with a context analysis of collection, use or disclosure of any information. That's really important because, while there may be some scenarios where it is somewhat rare for a category to be considered sensitive or not sensitive, the contextual piece is what gives the commissioner the ability to ensure that privacy is being protected at the highest level.

With regard to the EU's GDPR, as Mr. Schaan already pointed out, financial data is not included in Quebec's Law 25, nor is it included in the EU or U.K. GDPR. Similarly, the aspect of passwords is not included in any other jurisdictions—save for California, where it's referenced in a very specific manner, which is that your login information for a sensitive use case would be considered sensitive information because it's what the password and the user credentials give access to. That's the nature of the sensitivity there.

Including passwords overall, of course, as we explained the last time we spoke at committee, is simply because it introduces a degree of non-neutrality in dealing with technologies that could also be problematic in some cases.

As Mr. Schaan already pointed out, a driver's licence has been specifically ruled not to be personal information by the OPC in two provinces, so adding the designation of sensitive personal information to something that the OPC himself has said is not personal information at all would be somewhat of a conflict.

[Runa Angus]

I'll perhaps add a technical point.

The amendment also refers to social security information as being sensitive. Social security is not recognized in the Canadian system. It might be social insurance numbers, for example, that have been recognized by the OPC on many occasions as sensitive, but social security is not really a concept that exists in Canadian law.