We're a heavily survey-based organization. Really the only place we've surveyed is Alberta, but our other avenue is that we have counsellors across the country who deal with member inquiries on a daily basis. We have had probably thousands of calls over the course of the last three years from small businesses on this issue. I did go through a lot of those logs in preparation for this, and I would say, as I mentioned in my opening remarks, that the bulk of the calls came in 2004, with its implementation, when people were trying to understand what they had to do.
We continue to get calls, though, on a fairly regular basis. Now I would say 90% of those calls are about compliance and about how to write a privacy policy, essentially. They just want to understand what they need to do to put it down on paper and to make sure they're compliant with the law.
This is why I hesitate to put in prescriptive information, because then instead of thinking about what they need to do to really protect personal information--which is what the principle approach, I think, does--they'll just make sure that the privacy policy adheres to the specific rules that are put into the legislation and not necessarily think what they can do best in their firm. The principle approach allows them to think about how they can best deal with the information, and so we try to guide them through that process. When it becomes clear to us they have lots of personal information to protect, we suggest they see a consultant to help them put it together.