For access, there has to be a source of request. And there can also be complaints about the way personal information is being handled. But to be honest, privacy, like access to information, is a records management problem. And the major source of expense for companies--more than administering the act as such, although there is a lot of paper in administering the act--is that you get a request, and in small business you have to have someone send the request to the people concerned, get the information back, reproduce it, review it to see if there are exemptions, arrange to release it. It's labour intensive, but you also need to find your records. And particularly in small businesses and in some large businesses, including government, that is your major problem: finding the records. You need a good records management program to properly handle privacy.
On December 4th, 2006. See this statement in context.