Industry committee  Roughly.

Industry committee  There isn't a definition of “exigent circumstances” that I can see.

Industry committee  Yes.

Industry committee  The Supreme Court has defined “a reasonable law” as a law that balances a state purpose—whatever the purpose of that act may be—with the interest of privacy.

Industry committee  Just so I understand the question—

Industry committee  It's just for the purpose of communicating with the next of kin, in case an individual is injured, ill or deceased. They still have to show their lawful authority for doing that. The significance is this: It doesn't actually grant lawful authority. It just says you need lawful authority to do it.

Industry committee  It would grant Telus, in your example, the right to communicate with law enforcement so they could communicate with you.

Industry committee  I think what was asked for was the OPC's recommendation. The OPC asked for a definition with respect to proposed section 44. That is the reason for proposed section 44.

Industry committee  The way Spencer has been used is that it is the test that any disclosure from a private entity to law enforcement is subject to. Therefore, every organization right now, when they get a request from law enforcement, will look at these Spencer criteria to decide whether or not they will disclose.

Industry committee  The way the GDPR works is a little bit different. There are six bases for processing data, consent being one of them. Legitimate interest is another, and lawful authority as well. I would assume that lawful authority would be defined nationally because, of course, the GDPR applies to all European member states and they would have their own jurisprudence and legislation that define lawful authority.

Industry committee  The only difference is in the third branch of the test. The Privacy Commissioner uses the words “prescribed circumstances where personal information would not attract a reasonable expectation of privacy”. I don't have the motion in front of me, but I think it says “pursuant to common law authority”, which is the wording that's used in paragraph 71 of the Spencer decision.

Industry committee  I certainly can't speak for the Privacy Commissioner, but as I read his submission on Bill C‑11, which was quoted earlier in the session, it is a test that has an “or” in it, so already it's not a cumulative test. I think the paragraph at the beginning does say “clarity is also required with respect to the impact of...R v.

Industry committee  The private sector is quite familiar with the Spencer test. That is the test they use to disclose information to law enforcement. CPC-3 does not quite mirror that test. When I look at the submission of the Privacy Commissioner for Bill C-11, I see that it more closely mirrors the Spencer test in that it has three criteria and those criteria are not cumulative.

Industry committee  Sure. Our understanding is that the private sector is already quite conservative when it comes to disclosure of information. They will typically want to see judicial authorization before they disclose, unless, obviously, law enforcement can meet the test in Spencer to show that it's “exigent”, that it is under “a reasonable law” or that there is a “common law authority” for them to collect that information.

Industry committee  Thank you. On this, I would say that what the Privacy Commissioner has called for is the Spencer test being put into the law. When I look at the paragraph you quoted on that, I see three criteria: the criterion of “exigent circumstances”, the criterion of “a reasonable law” and the criterion of “prescribed circumstances”, which are the three criteria in the Spencer decision.