That's exactly what the change to the Public Safety Act dictates, that they can collect this information at your request, which is one thing, but would have some controls, or the organization may now collect information on its own initiative and then make subsequent disclosures under PIPEDA. Even though PIPEDA binds them to keep your information sacred as its primary obligation, it also may hand that information over to you, which may result in a charge and a deportation to a country, because they suspect some Muslim guy is a terrorist because of what he said in the lunchroom.
On February 20th, 2007. See this statement in context.