At the moment, clause 39 introduces an exception, but it goes in one direction only. Private sector companies can share information without restriction, but with public sector bodies. In my submission, I point this out and say that there should be protections in place, even if they are public sector bodies. My reasoning is that if it's good for the public sector, maybe it's also acceptable between private sector companies.
Obviously, there have to be security measures. For example, in Quebec, there may be exchanges in certain cases. You have to do a privacy risk assessment first, and then you have to file an agreement that has to include certain clauses. In my opinion, there's a way to strike a balance.
However, I think excluding private sector companies from the application of clause 39 here is shooting ourselves in the foot. Private sector companies have a lot of resources, ideas and data. Why deprive ourselves of this if we want to favour innovation?