Industry committee  By the drafting of the list currently and including these broad concepts, yes, it would extend well beyond what is currently deemed sensitive under both Quebec's law and the GDPR.

Industry committee  I'll let my colleagues weigh in as well. The value chain for the processing of financial information in particular is a multi-stage value chain. It involves multiple players outside the initial collector because there are people in the value chain for financial services who do

Industry committee  I'll start, and then I'll turn to Mr. Chhabra. As Mr. Chhabra noted, “sensitive” comes up in a number of places in the bill, the most important of which notes what you can't rely on as a use of information if the information is deemed sensitive, which is the example he just went

Industry committee  To continue to highlight why the context.... The commissioner is only able to interpret that which is within the law, and right now, some of the proposals include a specific reference to context. This proposal does not. This proposal lists a set of information, decrees them sensi

Industry committee  The parts of the bill we'll get to, hopefully, lay out what the rules related to sensitive information are, including around consent. That's where it will state that sensitive information—or at least the current version says sensitive information—requires express consent.

Industry committee  What's on the list remains part of the list.

Industry committee  Do you mean under the Access to Information Act?

Industry committee  I'll have to refer to my colleagues, but to quickly go back to the previous point, there is no reading in of context in the proposed subamendment. It is a determinative list. It specifically states that sensitive information is this list. There is no paragraph that indicates “due

Industry committee  However, in the subamendment you've created, you're altering the rules by which he has the ability to interpret that, so there is no context. He's—

Industry committee  As Mr. Chhabra noted in the California instance, some of this is about what they're being used for and what they reveal. In the case of Ontario, those of us who are citizens of this province know that our birthdate is included as the last six digits of our driver's licence numbe

Industry committee  I'll turn to Ms. Angus to answer that question.

Industry committee  I'm happy to start and then turn to my colleagues. Essentially, you're right. There are some considerations that should be brought to bear on some of the pieces of paragraphs (f), (g) and (h). As we spoke about at the last meeting, it's specifically been noted by the Privacy Co

Industry committee  To go back to first principles, it's important to note PIPEDA. One thing that will transfer over to the proposed consumer privacy protection act is an accountability principle such that collectors, users and disclosers of data will be accountable throughout the entirety of the li

Industry committee  I'll turn to my colleagues, but I'll just say that all of the provisions of the act that relate to personal information and its usage are overseen by the Privacy Commissioner, subject to complaints and potentially subject to remedies. I will turn to my colleagues just to be mor

Industry committee  As it relates to financial data, I'll start, and then I'll turn to my colleagues to talk a bit about the treatment of financial data and information under the GDPR, because I know that was raised as a contrasting issue. It's important to note that our system is somewhat unique i