In the legislation, PIPEDA doesn't really address the issue of business transfers. I believe that by contrast legislation in B.C. and Alberta addresses them, and so there's a gap there. I think we need some clarity around what organizations should or should not be permitted to do.
At our company, we filled the gap by putting an explanation into our privacy policy that, should our company be acquired, this is what we would require of the acquiring company.