Industry committee  The discussion has evolved. What was your question?

Industry committee  Mr. Therrien is reluctant to speak because this involves the division of powers. Many of these issues fall under provincial jurisdiction. In Quebec, for example, the Civil Code governs the rights of the child. I don't think those laws need to go beyond dealing with consent and protecting the data of children held by private sector organizations.

Industry committee  Mr. Fraser, do you have anything to add?

Industry committee  Mr. Therrien, I don't want you to quarrel, but what do you think of his answer?

Industry committee  Earlier, Mr. Fraser said that, in his view, the tribunal should be an independent body of the commissioner's office, not an internal body managed or promoted by the commissioner under the law. What is the fundamental difference? I understand there are two visions in relation to this: Mr.

Industry committee  I think so too. In fact, you'll note from my brief that I'm actually proposing that the “legitimate interest” consent exception be more aligned with the GDPR.

Industry committee  I don't think we need to go further than the European law. I guess my other comments really have to do with making sure that we're not hampering innovation.

Industry committee  When you say “go too far”, I'm assuming you're talking about protecting privacy—

Industry committee  What I can say is that of the four recommendations I'm getting, three out of four are actually proposing that our law be more aligned with the laws of Europe or Quebec, which are actually more stringent. It's also an issue with interoperability and making sure that our requirements are harmonized, especially when they make sense.

Industry committee  I'll start, if that's okay. The Privacy Commissioner's office has been working so far as an ombudsman model, and it also has an advisory branch. That's quite useful. This means that when there's an investigation, there's a conversation. There's a dialogue. In some cases, businesses can go knocking on their door and say: “Hey, what do you think about this business model?

Industry committee  At the moment, clause 39 introduces an exception, but it goes in one direction only. Private sector companies can share information without restriction, but with public sector bodies. In my submission, I point this out and say that there should be protections in place, even if they are public sector bodies.

Industry committee  As I told you, there could be a privacy impact assessment. Risks would be identified and how to reduce them. Organizations wishing to exchange data could be required to provide this assessment to the Office of the Privacy Commissioner of Canada, allowing oversight of projects where data is exchanged.

Industry committee  The Quebec and federal provisions are certainly similar. Those in Quebec are probably a little more stringent in some respects and include additional requirements, such as profiling in section 8.1 of the Quebec law, as well as the need to perform risk factor assessments before transferring data outside Quebec.

Industry committee  I should probably start by clarifying that statement. One of the underlying principles of privacy is that individuals retain control over their personal information. That idea goes back to the early 1970s, before the Internet came along. Things have obviously changed since then.

Industry committee  Are you talking about security?