Thank you for another excellent video David! One might even say that I have a "legitimate interest" in your topic ... I am not a "real" privacy lawyer and I have definitely not done the hard work, but here are some top-of-mind thoughts inspired by your video. 1. The CPPA would also preserve the concept of implied consent. 2. t would be interesting to dig into the detail of the degree to which "legitimate interest", "implied consent"; and "business activities under sections 18(1) and (2)" overlap and/or interoperate. For example, imagine drawing a Venn diagram with three circles: "legitimate interest", "implied consent"; and "business activities under sections 18(1) and (2)". We might use the Venn diagram to see how the legal concepts interoperate, and then to try to fit real world examples into the overlapping circles. 3. To my mind, it might be potentially problematic drafting for the CPPA to use three different legal concepts to describe what is really a single concept: "collection and use that is permitted without consent". 4. For example, aren't 18(1) and (2) very close to being covered by implied consent anyway? 5. As another example, given that 18(3) and (4) immediately follow 18(1) and (2), how should the existence of 18(1) and (2) affect the interpretation of 18(3) and (4) [legitimate interest]? 6. Much of what would be considered in a GDPR concept of "legitimate interest" (as discussed in the recitals to the GDPR and as you discussed in the video) might already be caught by either implied consent or sections 18(1) and (2), So there is a risk that a judge might infer that the intention of Parliament was to create something broader. (Of course, a judge might also conclude that "legitimate interest" is a type of boots and suspenders provision that only slightly expands permitted collection and use.) 7. The three legal concepts overlap, but the rules appear to be a bit different for each. And that is where there might be some issues to explore in a future video. 8. Not asking you to do any of that work. Just some personal musing inspired by your excellent video.
Thanks, Bruce! Food for thought. There's a bizarre quirk in s. 15 that excludes implied consent where 18(2) or (3) are operating: Form of consent (5) Consent must be expressly obtained unless, subject to subsection (6), it is appropriate to rely on an individual’s implied consent, taking into account the reasonable expectations of the individual and the sensitivity of the personal information that is to be collected, used or disclosed. Business activities (6) It is not appropriate to rely on an individual’s implied consent if their personal information is collected or used for an activity described in subsection 18(2) or (3).
@@privacylawyer Thanks for pointing out 15(6)! Section 15(6) makes sense. The government appears to intend to adopt regulations to constrain the use of 18(1) and (2) and would not want a person to avoid those regulations by arguing that they were relying on implied consent. But then it is a bit puzzling that the drafters did not also expressly address either or both of (1) the relationship between "legitimate interest" and "expressly permitted (and regulated) business activities" and (2 the relationship between "legitimate interest" and "implied consent".
No consent legitimate interest for search engines (baseline existence) or public surveillance from private property if said property has been repeatedly targeted for arson are no brainers, but aren't rooted in legal obligations or free speech exceptions.
