Industry trade group, the Investment Industry Association of Canada (IIAC) is pushing back on proposed privacy legislation in Quebec.

In a submission to a consultation on the province’s Bill 64, the IIAC said that it is “deeply concerned” about certain provisions in the legislation.

The group said that elements of the bill are inconsistent with existing privacy regulations and “are also extremely burdensome, virtually impossible to operationalize, and do not provide individuals with meaningful protection of their data.”

Among other things, the IIAC said that it’s “extremely concerned” with the proposed requirements in the bill for enhanced consent.

“Given the vast amount of data that is collected and used in increasingly novel and unanticipated ways as technology evolves, the principle of obtaining specific and detailed consent for each use of data that may be involved in the provision of a product or service, is unworkable and ineffective, and would be virtually impossible to operationalize,” it said.

It also warned that excessive consent requirements create opportunities for cyber criminals to “plant malware and perpetrate cyber-crime.”

Additionally, the submission argued that a provision that would provide the right to object to automated processing “is wholly unrealistic and out-of-step with the established use of technology to provide high-value, targeted services, which is only possible through the use of data analytics.”

The IIAC also cited its concerns about the sorts of penalties that could be levied for violating the proposed rules.

“Given the size of the potential penalties, the impact of these penalties would have a significant chilling effect on the use and development of technology that could enhance services for consumers,” it said.

And, it argued that establishing a new private right of action “could encourage class actions where no real damage has occurred.”

The submission also called on the Quebec government to work with the federal government, along with regulators in the other major provinces (Alberta, British Columbia, and Ontario), “to develop a harmonized privacy regulatory framework applicable across Canada.”

The existing federal and provincial privacy laws “are relatively consistent,” the IIAC said, but it cautioned that introducing inconsistencies will create uncertainty and inefficiencies, raising the cost of compliance.