Industry committee  I think specifically it is the Director of Public Prosecution who enforces it.

Industry committee  I'll get Chris to help me out again, but I think the particular case you're raising is moving into the Criminal Code, as opposed to being within the purview of PIPEDA. Having said that, under PIPEDA currently, a bank cannot contact anyone. The amendments we're providing for will allow them to do this within the specific context of financial abuse relating to the banking transactions.

Industry committee  I can maybe just add, though, that in terms of the offences that are under the act, there are three new ones related to data breach. There's a real demand for compliance in this respect. New offences are related to failing to report the data breach to the commissioner as required, failing to notify an individual of the data breach as required, and failing to maintain the records.

Industry committee  The Federal Court would determine the fine based on a number of...how frequently this has occurred. That is, like you said, an “up to” fine.

Industry committee  To answer your question I think the first step is always to ask if there is a warrant. The next step is to ask if there are any limited areas where consent is not required, and there are some very specific areas where that applies. That's the way the digital privacy act works. I should be clear that this law does not apply to the police.

Industry committee  Yes, that assurance is there. I will explain again. The act already sets out exceptions. Amendments are being made, but the exceptions are already there.

Industry committee  That's a very good question. We'll explain to you how that can be addressed. Generally, I think the four following criteria are now applied. Is it an issue that concerns the private sector? Is there really a risk of fraud or of a problem arising between the companies and does it affect Canadians?

Industry committee  Basically, the act and amendments impose obligations of that nature on organizations. Bill S-4 sets out new obligations.

Industry committee  These amendments were done very much in the context of the 2007 five-year review. I think there was an assessment at that time around the issues of the burden to businesses with respect to PIPEDA. I think there are five very specific, and I would add limited, amendments in this area to improve and streamline the obligations of business.

Industry committee  Correct. Work product is a concept that I think is in the bill. The issue is, can the businesses carry on their activity without sharing the work product? An example might be an inspector who has signed a bill of activity and he's put his name at the bottom. Can the businesses share the actual bill between the two companies?

Industry committee  Mr. Chair, these are decisions of the government and not decisions of officials, so I don't think it would be appropriate for me to comment on this.

Industry committee  Again, I think the model that we have here is to ensure that the Privacy Commissioner has adequate powers precisely to examine the problems. Given the current context, the bill enables Canadians to ask organizations exactly what happened to their information.

Industry committee  As I just said, I believe the bill is based on principles. It's always important to find the right balance. What the bill does is make it unnecessary to impose conditions outright. I'll ask Chris to explain further.

Industry committee  I'll start and then ask my colleagues to help me out. In brief, PIPEDA and the Privacy Act are quite different. PIPEDA applies to the private sector and its collection, use, and disclosure of personal information in the context of commercial activity. From a federal government perspective, that means specifically that the trade and commerce power is being applied as well.

Industry committee  I'll let Chris elaborate, but the short answer is that we apply to federally regulated industries and they apply to provincially regulated industries.