I think the concern would be, under British Columbia's PIPA, that you can't disclose personal information without the consent of the individual. Now, it's true that at the time--and this is going to the point you've made--you collected the information from your customer you could, in a notification to them, which is required under the legislation, say, and by the way, in addition to using this information in order to sell products or services to you, we may disclose it for the purposes of a business transaction, but I think some certainty was sought by the legislature, including that particular set of provisions.
On November 29th, 2006. See this statement in context.