The proposed Consumer Privacy Protection Act (CPPA) includes carve-outs to the requirement to get people’s consent to share de-identified data with government agencies if it’s for a “socially beneficial purpose,” or for corporations to use it when they have a “legitimate interest.” In a report published Tuesday, the University of Toronto-based Citizen Lab recommends requiring organizations to inform people and allow them to opt out in any such case, and giving the privacy commissioner the power to stop it. (The Logic)

Talking point: Business groups and some data lawyers argue that consumers aren’t well-served by the current system, with many simply clicking “I agree” to what’s put in front of them. But Citizen Lab authors Amanda Cutinha and Christopher Parsons note that while the carve-outs may seem helpful or benign, governments and firms could use de-identified data in harmful ways, without proper checks. They cite the case of Ottawa’s contracts with Telus and BlueDot for aggregated mobility data, which they note was legal under current privacy laws, but shows their gaps. Other digital-rights groups have also called for changes to the CPPA exemptions. Bill C-27 is currently at second reading in the House of Commons, the stage before it’s studied and can be amended by a committee.