Industry committee  I think that's fair.

Industry committee  The business processes that I understand are currently in operation in the financial services sector have multiple players within them requiring multiple disclosures per transaction, and if each one of those disclosures is subject to express consent, that would be a very different financial services experience than what we have currently.

Industry committee  I'll start. Then my colleagues will likely want to weigh in. As noted, because financial data will now be deemed sensitive information, consumer-directed financing, as it's understood, will rely on the data portability obligations that are found within later sections of the CPPA, which would have a direct one-service provider for consumers to provide their information to another service provider.

Industry committee  That's right. The overall structure of the consumer privacy protection act makes significant improvements to the existing Personal Information Protection and Electronic Documents Act in the treatment of both personal information generally and sensitive information. Some of what would be wrapped up in requiring express consent at this point will be further contemplated.

Industry committee  I'll turn to the team. They can point to some sections that deal with the treatment of personal information and the important guardrails around it.

Industry committee  The commissioner indicated in previous fora that he believes it's important that we have a definition of “sensitive”, that it list the categories that are likely to be sensitive and that it include context for collection, use or disclosure to allow for context to be laid out through his guidance.

Industry committee  By the drafting of the list currently and including these broad concepts, yes, it would extend well beyond what is currently deemed sensitive under both Quebec's law and the GDPR.

Industry committee  I'll let my colleagues weigh in as well. The value chain for the processing of financial information in particular is a multi-stage value chain. It involves multiple players outside the initial collector because there are people in the value chain for financial services who do very different things.

Industry committee  I'll start, and then I'll turn to Mr. Chhabra. As Mr. Chhabra noted, “sensitive” comes up in a number of places in the bill, the most important of which notes what you can't rely on as a use of information if the information is deemed sensitive, which is the example he just went through with Mr.

Industry committee  To continue to highlight why the context.... The commissioner is only able to interpret that which is within the law, and right now, some of the proposals include a specific reference to context. This proposal does not. This proposal lists a set of information, decrees them sensitive and, because of other parts of the law, decrees that sensitive information requires express consent.

Industry committee  The parts of the bill we'll get to, hopefully, lay out what the rules related to sensitive information are, including around consent. That's where it will state that sensitive information—or at least the current version says sensitive information—requires express consent.

Industry committee  What's on the list remains part of the list.

Industry committee  Do you mean under the Access to Information Act?

Industry committee  I'll have to refer to my colleagues, but to quickly go back to the previous point, there is no reading in of context in the proposed subamendment. It is a determinative list. It specifically states that sensitive information is this list. There is no paragraph that indicates “due to the context of its collection, use or disclosure”, for instance, which is what appears in the other versions of this, so there is no context and it is all financial information.

Industry committee  However, in the subamendment you've created, you're altering the rules by which he has the ability to interpret that, so there is no context. He's—