Industry committee  Spencer is a three-part test where any satisfaction of one of the tests can constitute lawful authority for the disclosure of the information. One, is it an emergency? Is it exigent circumstances? Is this information absolutely dire so that it needs to be accessed in this moment?

Industry committee  It reads: Administering law—request of government institution An organization may disclose an individual's personal information without their knowledge or consent to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that the disclosure is requested for the purpose of administering federal or provincial law.

Industry committee  What proposed section 44 does in the government amendment is to say that for law enforcement in these particular zones, you can't rely on the CPPA itself for a definition of lawful authority. When we're suggesting that you can rely on a reasonable law to be able to have lawful access as a function of law enforcement, that means you can't come back to proposed section 44, which says that law enforcement does these things.

Industry committee  It's called “Communication with next of kin or authorized representative”.

Industry committee  I think the case law is now what guides organizations in how they use personal information. However, adding this kind of definition to the act would, in a way, further confirm the test set forth in Spencer.

Industry committee  As Ms. Angus said, the addition of a new definition that includes, in a single sentence, the three criteria of the test established in Spencer, without stating that they are three separate parts but only one has to be satisfied, creates a new, more restrictive test for organizations.

Industry committee  I'll turn to Ms. Angus.

Industry committee  We need to make it clearer that the Spencer test has exigent circumstances or reasonable law or information that would not attract a reasonable expectation of privacy. If it actually ensured that it recognized that those were three mechanisms that law enforcement had to access information, it would be consistent with the current jurisprudence, which is the test that the Privacy Commissioner thought was useful.

Industry committee  I think it provides greater clarity as to the uses of personal information by law enforcement. I think it's important, though, that, as Ms. Angus noted, the Spencer test is not a cumulative one. Law enforcement does not need to meet all three aspects of the test. Law enforcement needs only to meet any of the three aspects of the test.

Industry committee  In the IP case, they could not rely on any of the three, as I understand it, which is why it was seen to be personal information, because it was not understood to be foreseeable that.... It was that an individual has a reasonable expectation of privacy when it comes to their IP address.

Industry committee  I want to thank the member for that question. I think our abiding consideration would be that we note and acknowledge the import of R. v. Spencer as a fundamental precept that needs to be understood as it relates to the ongoing interpretation and implementation of the CPPA, in much the same way as it has shaped the implementation of PIPEDA.

Industry committee  No, I think jurisprudence is helpful. I would suggest that, if there is to be a legal definition of “lawful authority” added, it must conform to the legal test set out in Spencer.

Industry committee  I would defer to Ms. Angus to ensure the legal test established in Spencer is articulated.

Industry committee  To the best of my knowledge, yes.

Industry committee  I come from Winnipeg, but I'm not a Franco-Manitoban. I think amendments NDP-3 and CPC-2 mean the same thing.