Industry committee  Bill C‑27 gives individuals the right to request that personal information about them that is presented in a form that still makes it possible for them to be identified be deleted from a database. However, as we discussed in the beginning, if that information is anonymized, there is no more information about an individual, so there is no need to make such a request.

Industry committee  That's a good question. As we were saying about the previous amendment, personal information refers not only to information used to identify an individual, but to all information that relates to that individual. So that really includes the concept of profiling. If information about an individual is kept in a database and is used to create a profile, or even if certain providers use it for marketing or advertising purposes, it is still personal information about an individual, so that individual still has all the privacy rights and remedies.

Industry committee  Indeed. Unfortunately, the construction of NDP-4, as Mr. Chhabra says, uses “used to identify them”, as opposed to the current definition, which is “about” them. “About” does more than “used to identify” does. “About” suggests a generality around you, which is where inferred information got read in by the courts.

Industry committee  CPC-5 avoids that challenge. NDP-5 also avoids that challenge. BQ-1 and NDP-4 shift the construction. BQ-1 introduces this construct of group rights, which I think would vastly alter the definition of “personal information” that is currently understood in our jurisdiction or others.

Industry committee  Amendments CPC-5 and NDP-5 both codify the inclusion of inferred information without breasting a definition of personal information being solely that which is used to identify, because, again, identification is only one half of the battle here. It's also the inference or the generalities about someone that go beyond just the pure precision of identifying.

Industry committee  I think they are both workable. We have amendment CPC-5 in front of us.

Industry committee  Yes. The current interpretation by both the OPC and the courts is that personal information as defined in PIPEDA currently, which is being ported to CPPA, includes inferred information.

Industry committee  That's correct. It takes the current legal and regulatory approach and ensures that it's legislated.

Industry committee  I think in the formulation in CPC-5 that's not necessary, because it still says, “about an...individual” and so—

Industry committee  No.

Industry committee  I'll turn to my colleague, but you're right: Currently our worry about NDP-4 is that it would be seen as a closed list because it has “includes” and then lists things, as opposed to something like “includes but is not limited to”. I turn to Mr. Chhabra.

Industry committee  Right now, that work of the lengthy California description is being done by the word “about” in the current PIPEDA, and “about” has been sufficient, from a court perspective, to get at a wide range of inferred and direct information about individuals. It's how the court ruled on information related to inferred data.

Industry committee  Mr. Chair, I want to thank the member for his question. As we understand it, CPC-5 codifies the existing interpretation of “personal information” by the OPC—which, as the member has noted, has also been codified by the Supreme Court—that includes inferred information, so we see this as consistent with the current approach.

Industry committee  “Inferred information”, as codified in this way, would be consistent with a number of international best practices on the understanding of personal information, including California, but also the EU's GDPR and Quebec's law 25.

Industry committee  Mr. Chair, I think this is one zone in which the devil will very much be in the details. I think we've had discussions at this committee before about exhaustive versus non-exhaustive lists, and where lists are indicative but not exclusive. Insofar as an amendment suggests what personal information is, we see that as actually limiting because right now the definition, including with this amendment, will still be quite broadly interpretable in the sense that it means information about an identifiable individual, and then the amendment would amend that definition to ensure that it expressly captures “inferred”.