Industry committee  We have to remember that when we talk about personal information writ large, it's not just about sensitive information. All the obligations, whether about security safeguards or about retention and disposal, as my colleague said, are applied to all personal information. It's the degree that changes.

Industry committee  I'll have to look at that and get back to you, because the crux of that case was specifically about the sensitivity of that information.

Industry committee  I'll perhaps add a technical point. The amendment also refers to social security information as being sensitive. Social security is not recognized in the Canadian system. It might be social insurance numbers, for example, that have been recognized by the OPC on many occasions as sensitive, but social security is not really a concept that exists in Canadian law.

Industry committee  That is correct.

Industry committee  That case was specifically about mortgage discharge statements and whether two banks could share a mortgage discharge statement with each other. What the Supreme Court decided is that they could because it wasn't sensitive information in that case.

Industry committee  That's correct.

Industry committee  As Mr. Schaan just said, the Privacy Commissioner has oversight over all collection, disclosure and use of personal information, which would include sensitive information. It would obviously include financial data as well. The commissioner does a contextual analysis. Information that's not sensitive in one context may be sensitive in another context.

Industry committee  I'll take the question on the GDPR. The GDPR refers not to sensitive information, but to special categories of personal data. Those special categories, in article 9 of the GDPR, refer to: ...racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation....

Industry committee  I think the word “notamment” is fine. Indeed, “ notamment” is translated as “included”.

Industry committee  They're transparency requirements. Essentially, organizations using automated decision-making systems, ADS, have to tell users that they're using them. Once a decision is made using such a system, an individual can also ask for that decision to be explained. How exactly was that personal information used to make a certain decision using an ADS?

Industry committee  I would like to add something. Since inferred information is included in the definition of personal information and there is a proximity between the concept of inferred information and the concept of profiling, that concept would, therefore, also be included. As my colleague just said, if this information is used to create a profile, it is also used to infer information about an individual based on their membership in a group.

Industry committee  From my perspective, these are not sections that grant lawful authority. If that clarity is needed, I don't see any legal issue with that. I think what needs to be clear is that proposed sections 44, 43 and 33 and proposed subsection 47(1) don't actually grant authority. They are not reasonable laws for the purpose of the definition.

Industry committee  It is the same reason, but this is for administering law. Obviously, if something happens, there is administrative work that institutions need to do, whether that's producing a death certificate or other documents. That's what proposed section 43 is for. Again, I will note that the Privacy Commissioner did not ask for a definition of “lawful authority” for these, but the same definition could be used for proposed sections 33, 43 and 44.

Industry committee  The definition wouldn't exclude it. The definition would apply to every place in the act where “lawful authority” is mentioned.

Industry committee  What I'm going to do is take Spencer, because Supreme Court justices are smarter than I am. What Spencer says is that common-law authority is the “authority of the police to ask questions relating to matters that are not subject to a reasonable expectation of privacy.”