You're talking about consumers.
I would agree with what John stated, that the intention of this legislation is to ensure informed consent, which means the knowledge, the full knowledge of individuals about what the business is doing with their personal information. That is not stated clearly enough either in the legislation, speaking to the organizations, or in the organizations' privacy policies to consumers, in many cases. Businesses need to do a much better job conveying that to individuals, and the act needs to communicate better to the organizations.