Industry committee  Just on the topic of the tribunal, I do support that idea. I think the current role of the Privacy Commissioner.... That office has done an incredible job, but it wears many hats. The commissioner wears the hat of an advocate and of an educator and does investigations, but what's always been said about that role is that it has no teeth, that whoever is in charge doesn't have teeth to implement fines and issue fines.

Industry committee  Other witnesses who testified here have said they should be included in the legislation. I agree with them and agree with their reasoning.

Industry committee  Again, that's something I'm not entirely qualified to comment on right now.

Industry committee  That's a really good question. I generally support the new exceptions to consent in Bill C-27 , which are similar—slightly different—to the GDPR. I agree that the application of the legitimate interest exception, whether as a stand-alone right or as an exception to applied consent, will help a contextual analysis and will help nurture innovation and allow for a difference between...how organizations look at their programs and at accountability and transparency.

Industry committee  I'd have to think about that for a minute, so perhaps one of my colleagues can start.

Industry committee  As I said in my remarks, I do believe the law can be more prescriptive in terms of making sure we get it right for children. That is something we've seen in other jurisdictions. They've done it separately in a different law with a specific children's code. I think we can make certain amendments to the law or have a separate regulation.

Industry committee  I don't think they're two separate things. I think you can have privacy by design in a privacy management program.

Industry committee  I don't have a specific definition, but I do believe we should be able to give a non-exhaustive list of examples, similar to what we've done in law 25 in Quebec.

Industry committee  Sure. Some examples we've seen are biometric data, health data, financial data and children's data. Those are the ones off the top of my head, but I could certainly submit some more examples.

Industry committee  That's definitely a risk, but I don't think that's a reason not to do it right now. PIPEDA has worked really well for 20 years. There's always going to be modernization of laws, but I think it's important to try to get that list now, with the acknowledgement that there is the possibility of updating it as things change.

Industry committee  I don't have any specific comments right now on prescriptive language. Again, that's something I'd have to go back to. I know that's something my colleague Mr. Guilmain also referred to, so maybe he has comments on that.

Industry committee  Thank you for the invitation to appear before this committee for its important review of Bill C-27. I'm a privacy lawyer and consultant based in Toronto. Having worked in the privacy field for over 15 years while raising three sons, I have a passion for children's privacy, and I will focus my remarks on this area today.