Various statutes on the protection of personal information apply to businesses. In addition, penalties can generally be imposed, in accordance with those statutes, if we show that harm has been caused. One of the current problems is that there is no statutory system of fines for having done something.
On May 8th, 2007. See this statement in context.