Industry committee  Exactly. For my mom's Fitbit, each piece of data is a piece of personal information related to her activity. If she was required to provide express consent every time that personal information was provided back to the organization, she'd be on her watch all day clicking “yes” because every single one of those pieces of information requires express consent.

Industry committee  Mr. Chair, indeed I think the desire here is to make sure there are appropriate protections in place for information that is truly sensitive. The challenge, of course, when putting out a list is that we've assured ourselves that every instance of the utilization of the categories in that list would always meet the test of requiring express consent.

Industry committee  That's right. What CPPA aims to do in broad strokes is to ensure that there is a high threshold of privacy protection for all personal information utilized in a commercial context and that there is significant and meaningful enforcement of obligations related to commercial entities that interact with personal information.

Industry committee  That is correct.

Industry committee  I'll start and then I'll turn to my colleague. I think that generally the broad ambition of making sure the information that is quite personal in nature holds a high degree of protection by commercial actors is a shared ambition for the entirety of this piece of law. The rationale for why we have a definition of “personal information” and what's being proposed here as “sensitive information” is that there is some information that is personal in nature that is not sensitive.

Industry committee  That would be very much dependent on the use cases related to what was consented to and how.

Industry committee  Again, this is not knowing what the initial service agreement was with the individual. When the information was actually collected, when the account for your four-year-old was first generated they had to tell you in plain language, which Bill C-27 will require, “This is what we're going to do with your information, are you comfortable with that?”

Industry committee  Continued guidance and jurisprudence help flesh out the responsibilities that will be borne out or that are being identified and adopted through this piece of legislation. By making the broad parameter that children's information or the information of those under the age of 18 is sensitive, thus requiring a higher bar for its treatment, protection and use will get fleshed out by guidance and by jurisprudence as to how companies have to interact with that obligation.

Industry committee  We don't see any confusion. It adds an interpretation that already exists within the law, but is not at odds with the current interpretation.

Industry committee  We feel that the definition proposed in the bill already includes the notion of profiling, but it would not be a bad thing to add that concept to it. It would be all the more useful, since other amendments that the Conservatives wish to propose are based on the concept of profiling.

Industry committee  That's correct.

Industry committee  That's right.

Industry committee  Obviously, profiling as a function of taking personal information, automating that in some ways and then using that to market to an individual would require the individual to be informed of the fact that there's an automated decision-making system at play and also to know what personal information is being utilized to make that determination.

Industry committee  That's correct.

Industry committee  Although there is no definition of the term “profiling” in the bill, we feel that this concept is already included in the obligations and requirements for automated decision systems. However, if there was a desire to explicitly state that automated decisions include possible profiling, I think that would be a good addition to the bill.