Industry committee  I would extend your question to a discussion that occurred a few minutes ago. I think here we're into the use of data for social good. It's an example of the use of data for social good. As Mr. Fraser said, there are similar provisions in the current act. I think these are good provisions, provided that we really deal with the social good.

Industry committee  No. Proposed section 39 does. That's why I expanded your question to deal with social good and included proposed section 35, statistical purposes, and proposed section 39, socially beneficial purposes. I would say that legitimate interests are the true domain of corporations. I think that latitude given to companies can be defensible.

Industry committee  Yes.

Industry committee  This has been interpreted, so far, as essentially in the domain of public interest statistical purposes, as opposed to purely commercial.

Industry committee  I understand.

Industry committee  Over the past 20 years, we have clearly seen that there are significant limits to self-regulation. That is why it is currently necessary to amend the legislation and to provide for penalties, among other things. In terms of artificial intelligence, again, it's not emerging technology, but its application is now becoming much more important.

Industry committee  You may be referring to whether the law should be principles-based or rules-based, for instance—

Industry committee  I think on the aspect of risk, it's a bit of both. Currently, PIPEDA is principles-based—there are some rules, but rules are few. CPPA would certainly keep principles but adopt many more rules. I think an effective system has both principles and rules that are at a sufficient level of generality that they can still be relevant even if the technology or the business context changes over time.

Industry committee  I think you could include rules on disclosure by political parties and others on use. The worst possible case was that of Cambridge Analytica, a company that authored certain practices aimed at influencing voters. If political parties were subject to privacy laws and these practices continued to be used, at least penalties could be imposed on those who obtain this type of information.

Industry committee  My answer to that would be pay attention to the provisions that define purposes for which businesses can use information. Right now, I think it is fairly open-ended. There are not many, if any, limitations, except under proposed section 12. If the provisions that define original purposes or new purposes were to say that only specific and explicit purposes are lawful, then I think that would be a step forward.

Industry committee  Certainly that's the six-million-dollar question currently. It goes to the history of technology and legislation, the fact that many decades ago, the consent model was seen to be the best model—which assumes a lot of control. I think we've not left that world. There is still value in people controlling their information to the extent possible, but realistically, we know that we're no longer in that world.

Industry committee  Indeed, the concept of sensitive information is currently undefined under the current law and would be under the proposed law. That normally leads to what is called the “contextual application” of what is sensitive: It's what kind of information is at play. Is it financial? Does it concern children or health?

Industry committee  Implied consent is certainly open to broad interpretation and is sometimes abused, but it is a concept that exists under most, if not all, privacy laws that I know of. It is a recognition of the fact that in today's technological environment, you cannot realistically ask people to consent explicitly to every use of information that will be made.

Industry committee  Part of the reason I am recommending that section 12 be amended to take into account the best interests of the child is because of the Convention on the Rights of the Child. However, I am not an expert in Canadian constitutional law when it comes to the division of powers. What rights should a child have under the various proceedings?

Industry committee  Again, interoperability was mentioned previously. There are laws in many other jurisdictions in Europe and within Canada—there's British Columbia and now Quebec—that provide that privacy laws actually do apply to political parties. That is a recognition of the fact that information held by political parties is almost always sensitive information.