Industry committee  As Mr. Chhabra noted in the California instance, some of this is about what they're being used for and what they reveal. In the case of Ontario, those of us who are citizens of this province know that our birthdate is included as the last six digits of our driver's licence number.

Industry committee  I'll turn to Ms. Angus to answer that question.

Industry committee  I'm happy to start and then turn to my colleagues. Essentially, you're right. There are some considerations that should be brought to bear on some of the pieces of paragraphs (f), (g) and (h). As we spoke about at the last meeting, it's specifically been noted by the Privacy Commissioner that in two provinces, driver's licence information is not actually deemed to be personal information.

Industry committee  To go back to first principles, it's important to note PIPEDA. One thing that will transfer over to the proposed consumer privacy protection act is an accountability principle such that collectors, users and disclosers of data will be accountable throughout the entirety of the life course of the personal information they've collected for its ongoing use and will be subject to the rules of PIPEDA as a function of those continued disclosures.

Industry committee  I'll turn to my colleagues, but I'll just say that all of the provisions of the act that relate to personal information and its usage are overseen by the Privacy Commissioner, subject to complaints and potentially subject to remedies. I will turn to my colleagues just to be more specific about the powers that the Privacy Commissioner has over the use of personal information, not just sensitive information.

Industry committee  As it relates to financial data, I'll start, and then I'll turn to my colleagues to talk a bit about the treatment of financial data and information under the GDPR, because I know that was raised as a contrasting issue. It's important to note that our system is somewhat unique in the sense that once a piece of personal information is deemed to be sensitive, it requires express consent, and it's not just express consent for it's collection; it's express consent for its collection, use and disclosure.

Industry committee  Mr. Chair, I will let my colleagues answer that question.

Industry committee  I would just like to add one thing, Mr. Chair. In Canada, the statute that regulates the establishment of a union is the Trade Unions Act. In federal parlance, the current incorporating statute for unions is the Trade Unions Act. I wouldn't have specifics as to whether or not using “trade union” rules out other unions, but certainly the Trade Unions Act extends well beyond the building trades.

Industry committee  Yes. Maybe, just for the benefit of members, I'll go through at least a couple of specific ones and then I'll turn to Mr. Chhabra. Again, to your first point, it's important that we're not making this a contrast between, as I think I said on Monday, the Wild West and Fort Knox, because essentially the whole goal of the CPPA is to elevate the obligations as it relates to the fundamental protection of the privacy of Canadians through the use of personal information.

Industry committee  Maybe just to recap a bit of the discussion we had at the last meeting, this committee has made the determination, through earlier amendments, that the preamble of the bill highlights the fundamental right to privacy, which is the interpretive lens that then gets applied to all the subsequent obligations and responsibilities in the act.

Industry committee  One of the goals of the proposed legislation is to minimize consent fatigue and to maximize consent with regard to where it is truly important and is understood to be important. If you have to expressly consent for every use of the information that you're providing to a corporate entity, then, potentially, we actually significantly raise the bar for consent fatigue.

Industry committee  Certainly, the insertion of the fundamental right to privacy in the bill itself suggests that the fundamental right to privacy applies to personal information. If we add in a category that is then now sensitive—that is, all information for which there is a fundamental right to privacy, which, by the preamble, is all personal information because of the nature of how we've set out the fundamental right to privacy—then there is no distinction anymore between personal information and sensitive information.

Industry committee  If all personal information is sensitive information, essentially there is no other means by which a corporation can ever access information except through the express consent of the individual. When we think of just the sheer volume of personal information in a commercial context that is provided, I'm not sure how one could implement it.

Industry committee  It would fundamentally shift business practices because if corporations had to rely on express consent for every single collection of personal information.... That's not how the market currently operates. Each bit of personal information derived from.... I should have warned you all in advance, but my parents are visiting from Winnipeg.

Industry committee  Exactly. It was my way of making sure that you all were nice today.