Industry committee  There are a number of provisions we have yet to get to in the CPPA that heighten the level of privacy protection for all personal information collected, used and disclosed by corporate entities in the Canadian context. They include requirements for express consent in a number of areas, as well as limitations on when and how other forms of consent can be relied upon.

Industry committee  No. We're comfortable with the idea of including a list, but an indicative and non‑exclusive list. The list needs to have both aspects so that there can be more than what's on the list and so that what's within the list is indicative, thereby giving context to the Office of the Privacy Commissioner.

Industry committee  It's about disclosures. It's about the nature of requiring express consent for every use, collection and disclosure of financial information, because the list as constructed says that such information is, by definition, sensitive, which means it cannot rely on implied consent. Therefore, the processing of financial information, which is often transferred from one collector into the hands of another as part of an accountability chain, will require the express consent of the individual.

Industry committee  I would be uncomfortable with that characterization. I suggest that the government is suggesting the definition of sensitive information should have important flexibilities to both understand context and understand cases and use cases where that information may not be sensitive.

Industry committee  It isn't about regulations. It's a definition that includes sensitive information. It's about interpreting the definition.

Industry committee  In this case, it's hard to predict the possible interpretation given the construction of the sentence. It says that the list is non‑exclusive. However, all the items on the list are included in the definition. There isn't any room for interpretation, because it's clear. As a result, we find that the commissioner should be given some context at the start of the list, and that the list should be indicative.

Industry committee  Mr. Perkins, I would note that Bill C-11 was contemplated by a previous Privacy Commissioner.

Industry committee  Yes, I am.

Industry committee  I'll turn to Mr. Chhabra to talk about the California consideration.

Industry committee  He notes the importance of context and he notes an indicative list.

Industry committee  I'll turn to Mr. Chhabra, but I'll note that one of the fundamental aspects we've tried to draw out over the course of the discussion today is the importance of some sort of context-specific interpretation tool at the outset of the list. It's something that would read like, “due to the context of its collection, use or disclosure, an individual has a high expectation of privacy and may include”.

Industry committee  As noted, the GDPR does not include financial data as sensitive information.

Industry committee  Mr. Chhabra may be able to speak to the specific formulation of the California law.

Industry committee  Our previous point was about the processing of that information. I don't know the formulation of the California law well enough to know whether it also includes an obligation for express consent and whether disclosures are wrapped up in that.

Industry committee  I think there's a lot of financial data that many of us would be uncomfortable seeing shared outside of those we know, but context does matter. I could ask you if you're you okay with me knowing how much you have left on your mortgage or how much your monthly mortgage payment is.