Industry committee  Mr. Chair, the only thing I would point out to the committee is that, as Mr. Hyer points out, this eliminates a risk-based threshold and essentially replaces it with a requirement to notify individuals if the organization believes that some unauthorized person has accessed the in

Industry committee  Thank you, Mr. Chair. I would point out to the committee that this exception to the requirement for consent is very narrow. It's very specific to a data breach scenario. Experience has shown that when a data breach occurs, the ability of an organization to share the fact that in

Industry committee  Let me just point out to the committee how what is proposed is different from having the organization do an assessment of two thresholds in making that determination. As Madam Borg pointed out, the NDP amendment does create a two-step process, so an organization would first deter

Industry committee  I would just point out to the committee that there are three Green Party amendments that all relate to the data breach provisions, and as Mr. Hyer pointed out, this creates that separate threshold for notification of the Privacy Commissioner as the Liberal amendment did.

Industry committee  The amendment has two parts. Many witnesses came before this committee and talked about the threshold for when organizations would be required to report a privacy breach to the Privacy Commissioner and the thresholds for when they would be required to notify individuals. That's t

Industry committee  Thank you, Mr. Chair. To be clear, the language proposed in Bill S-4 is that the disclosure would need to be necessary to establish, manage, or terminate the employment relationship and the amendment would add “and reasonable”. We've talked about the reasonableness threshold al

Industry committee  I think Mr. Hyer explained the amendment.

Industry committee  Mr. Chair, I would just point out the difference between these amendments and the NDP's amendments. The NDP amendments propose to change the threshold. These types of disclosures would still be permissible in certain circumstances, but it changes the threshold for when the disclo

Industry committee  To the extent that they're collecting personal information, if their use of that personal information they're collecting is consistent with the purpose for which it was collected.... Monitoring keystrokes is the same as looking at the document you've typed. If they're using the d

Industry committee  Thank you, Mr. Chair. This is a recurring theme through about four of these amendments of replacing the standard as proposed in Bill S-4, which is that the investigation or the fraud prevention activities would need to be reasonable for those purposes, with the standard of the o

Industry committee  Thank you, Mr. Chair. The amendment is substantively the same as the Liberal amendment, so the analysis is the same. You have to have the knowledge and the consent of the individual in producing the information, and the personal information has to be incidental to the work produ

Industry committee  I think there are two ways in which the issues you're raising are addressed. The first is that part of PIPEDA, in section 5, provides this overarching requirement that any collection, use, and disclosure be reasonable in the circumstances. Notwithstanding whether you get someone'

Industry committee  Thank you, Mr. Chair. This issue was raised during the first statutory review of PIPEDA that was carried out in 2006-07. The recommendation of the committee at the time was that the government consult with stakeholders and the Privacy Commissioner to examine the issue of the use

Industry committee  Absolutely. This group of amendments deals with the way PIPEDA is structured. There's always an exception to collection, an exception to use, and an exception to disclosure. This group of amendments deals with exceptions to the collection and use of personal information that is

Industry committee  Thank you, Mr. Chair. As was pointed out, the amendment would essentially repeal section 7 of PIPEDA, which sets out all the exceptions to the requirement to have consent to collect, use, or disclose personal information. This would remove every exception to consent set out in t