Industry committee  Would you mind repeating the question?

Industry committee  Maybe I can give you a very simple example regarding cookies. We've all heard about cookies on websites, and 10 years ago cookies were very new, something that people didn't understand. Now, 10 years later—or more like 15 to 20 years later, actually—I think this is something that is well known by reasonable persons.

Industry committee  I'm going to emphasize the obvious. I'm here in my personal capacity, to start. The second aspect is that what you are showing at the moment is the limits of consent. That's what it is. It's essentially showing a big chunk of text and expecting the individual to consent. That's the reason exemptions to consent are interesting, because you will actually focus on the important moment of a data flow.

Industry committee  That's not necessarily the case, because the balance is always in thinking about the rights and interests of the individual. It's not something that you do in a vacuum. These are analyses of proportionality and of necessity. It's a long assessment. It's not a two-pager. I think it's not only that.

Industry committee  The first months were rough. Let's be honest. I think that everyone was just trying to adjust. We have to keep in mind that it was in May 2018, so it was the first big change in the world. Just to be clear, it's been the same across the world. Brazil recently adopted its own privacy laws, Singapore....

Industry committee  Yes. I know that you've been discussing this notion of legitimate interest. When we hear “legitimate interest”, it sounds like a free pass to do whatever we want, but I want to emphasize that if you look carefully at the CPPA, there is always an aspect of assessment, of explaining why we can actually rely on legitimate interest.

Industry committee  I don't agree with that statement, quite frankly. I think you have to look at the nature of the organization. The Office of the Privacy Commissioner was created as an ombudsman would have been, and that's its role. The Privacy Tribunal would have a different, purely jurisdictional role.

Industry committee  There are a couple of things. I think the first aspect is that the idea of asking the organization to explain what they are doing on the privacy side is very similar to the GDPR, to what we are seeing at the moment. I think it's positive in itself. The second aspect is that there are some interesting legal bases and ways of making legal the processing of personal information, and I will give the example of legitimate business exemptions.

Industry committee  Yes. I would agree as well. My only problem is—and maybe I'm a bit too dry—that the title of the law itself is “consumer privacy protection act”. The notion of “consumer” is misleading at this stage. I think it's something to emphasize, even though I don't disagree with the principle of potentially having federal political parties be subject to the law.

Industry committee  If I may, I'll answer in three parts. First, there is Bill C‑27 in and of itself. I grant you, in my humble opinion, that part 3 and parts 1 and 2 are probably unrelated. That's a real problem. I won't hide the fact that, when I talk about the aspect of Bill C‑27 that I like—it's always like that in a relationship, we like or we like less—I'm talking about parts 1 and 2, to be quite honest with you.

Industry committee  Yes. I think there are two sub-aspects from my perspective. The first aspect is the transition period. I think we should not undermine the fact that, even though there are already processes in place with PIPEDA and potentially with law 25, it does take time to have something that is meaningful.

Industry committee  No.

Industry committee  It would be to the extent that we are adding sufficient triggers based on the types of information. These questions were raised as part of law 25. Clearly, the question was, what do we do with a company that...? Let's say a convenience store in La Tuque has some personal information.

Industry committee  Do you mean the 15 recommendations?

Industry committee  If I can opine on one aspect, there are some interesting ideas. I think there's a will to add an accountability obligation for companies. I think that's something that is being proposed. I have some caveats in this regard, having seen what is happening in Quebec at the moment, especially for small and medium-sized companies, which are really struggling to have accountability documentation for everything.