Industry Committee on May 6th, 2024

[Ryan Turnbull, Liberal, Whitby, ON]

Similarly, regarding the passport number, I assume by the way it's structured here, with the language of “government identifiers, such as their social security, passport or driver's license numbers”, that it's really only referring to the numbers.

Is a passport number also sensitive? It's the same argument for a driver's licence. I assume passports have lots of personal information in them that should have a high bar, but is the number of the passport sensitive information? It seems that's the intention here.

Does the same argument that you made, Mr. Schaan, for driver's licence numbers also apply to passport numbers?

[Mark Schaan]

As Mr. Chhabra noted in the California instance, some of this is about what they're being used for and what they reveal.

In the case of Ontario, those of us who are citizens of this province know that our birthdate is included as the last six digits of our driver's licence number. That's not the case in a number of other provinces, so again, this is where context will matter.

In many of those instances, because of what you can potentially use a passport number for and the link back to the individual, it would probably be deemed personal information worth protecting. However, in and of itself, it doesn't necessarily suggest that the combination of numbers and letters is sensitive information, because, again, that's what it's for.

I think giving broad ambit to the commissioner to lay out and provide guidance around what can and cannot be done with this type of information and what protections need to be put around it—including, for instance, suggesting that express consent is the best approach in some of these contexts—is more important than just a broad categorization. Again, within that categorization are uses, contexts or, in fact, instances where it's not even necessarily personal information in and of itself.

[Ryan Turnbull, Liberal, Whitby, ON]

Really, by including these in here, we're saying that context doesn't matter. In terms of determining sensitivity, we're saying to forget context; it's always sensitive information.

That's really the heart of the problem, as I see it, with some of the things that may not always be deemed sensitive. If the Supreme Court of Canada is saying that financial information is not always sensitive, perhaps we should listen to that.

Just to clarify a last point regarding paragraphs (f), (g) and (h), social security, passport and driver's licence numbers, passwords and financial data are not deemed sensitive in the GDPR or in Quebec's Law 25. Is that correct?

[Runa Angus]

That is correct.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Turnbull.

Mr. Vis, the floor is yours.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you, Mr. Chair.

I am very much enjoying what I think is a really relevant debate.

Going back to Royal Bank of Canada v. Trang in 2016, Mr. Schaan, could you please clarify if that case was ultimately about express consent or implied consent with respect to the sharing of information included in one's mortgage?

[Mark Schaan]

I'll turn to Ms. Angus to answer that question.

[Runa Angus]

That case was specifically about mortgage discharge statements and whether two banks could share a mortgage discharge statement with each other. What the Supreme Court decided is that they could because it wasn't sensitive information in that case.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

To my question, was it about an individual's relationship with the bank and having express consent to share that information, or did it establish a scenario of implied consent?

[Runa Angus]

I'll have to look at that and get back to you, because the crux of that case was specifically about the sensitivity of that information.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

All right. The way I understand that court case is that when the Trangs defaulted on their mortgage, they went to another bank and it said, “No, we can't share this information; it's sensitive.” However, the Supreme Court ruled they had given implied consent when they signed with the first bank and provided their personal information. Therefore, in the context of the sensitivity of information with respect to their mortgage, a bank was allowed to have access to that information because they provided implied consent when they signed up and got money from the bank in the first place.

I state that because I ultimately believe the argument being made by the department right now is factually incorrect. To state that you would have to provide express consent to buy an apple undermines a complete commercial relationship that exists already between every banking customer in Canada and the banks. Frankly, I think it's a bit of an irresponsible argument that's not well backed up.

I'll just make that point, and I say it with the most respect, because the interpretation bulletin on sensitive information—

[Ryan Turnbull, Liberal, Whitby, ON]

It didn't sound respectful.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

I'm sorry; what's that, Mr. Turnbull?

[Ryan Turnbull, Liberal, Whitby, ON]

I said it didn't sound respectful, but that's okay.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Okay. Thank you for your opinion.

[Ryan Turnbull, Liberal, Whitby, ON]

No problem.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Under the interpretation, financial information is sensitive information. As the court in Trang notes, “financial information is one of the types of private information that falls at the heart of a person’s ‘biographical core’.... However, the degree of sensitivity of specific financial information is a contextual determination.” My understanding, based on the Privacy Commissioner's interpretation, is that you can still list information as sensitive and allow for a contextual argument to be made in the operationalization of the law.

What the department is saying right now is that they're predetermining the application and operationalization of sensitive information within the apple context that was provided today. I think that's a little over the top because we have well-defined processes in Canada between every banking customer and the bank that allow for sensitive information to be treated wisely. I don't see the basis of that...in addition to the nature of the Supreme Court ruling, which was about implied consent.

I'll ask you another question. In freedom of information in Canada, is financial information deemed sensitive or not under the freedom of information act?

[Mark Schaan]

Do you mean under the Access to Information Act?

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Yes, sorry, the Access to Information Act, section 20.

[Mark Schaan]

I'll have to refer to my colleagues, but to quickly go back to the previous point, there is no reading in of context in the proposed subamendment. It is a determinative list. It specifically states that sensitive information is this list. There is no paragraph that indicates “due to the context of its collection, use or disclosure”, for instance, which is what appears in the other versions of this, so there is no context and it is all financial information. It doesn't matter whether previously it would have been collected under implied consent or utilized thereafter with implied consent, because, essentially, by making it sensitive, we've required that it has express consent and it has express consent across every single aspect of the value chain.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

To push back, the Privacy Commissioner says, “However, the degree of sensitivity of specific financial information is a contextual determination.” He's stating there that financial information is sensitive, but it's also contextual. That's the point I'm trying to make, Mr. Schaan.

[Mark Schaan]

However, in the subamendment you've created, you're altering the rules by which he has the ability to interpret that, so there is no context. He's—

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

We could state the whole thing about the applicability of PIPEDA in the context of a brand new piece of legislation. Maybe the courts are going to make a completely different determination because we have a brand new law. We haven't even gone into a debate about that and the application of some of the previous rulings the Privacy Commissioner has made and, by extension, maybe the Supreme Court will make one day.

[Mark Schaan]

To continue to highlight why the context.... The commissioner is only able to interpret that which is within the law, and right now, some of the proposals include a specific reference to context. This proposal does not. This proposal lists a set of information, decrees them sensitive and, because of other parts of the law, decrees that sensitive information requires express consent.