As you probably know, the law is based on the CSA model code for the protection of personal information, which was developed as a voluntary instrument by various stakeholders, including business.
It's a management standard, so it's quite easy to apply. It wasn't developed as a law for big business or little business; it works for everybody. If you're a small business, your privacy policy can be one page. If you're a huge organization, your privacy policy is probably thicker than this binder. It's that sort of thing. So it's not difficult for small business to comply with the law. A lot of them are trying to comply, and I think part of where we could possibly do a bit better is in education and in working with small business.