That's exactly it. PIPEDA is really just legislating good business practice that has been recognized by businesses.
I can certainly say, for myself, that when we were coming up with these recommendations, I was taking the kinds of concerns you're raising now very much into consideration. The last thing we want to do is create more bureaucracy and more expense from it, but what we want to do is make it more effective, in an efficient way. We've tried to design the recommendations here in a way that doesn't require more expense or effort on anyone's part. They will for sure on the part of the Privacy Commissioner, and they will require expense on the part of private businesses that are not currently up to shape in terms of their privacy protection practices, but they should be.