I'm telling you that, for example, the federal act does not provide for a system of fines. You have to prove damage has been caused. That's part of the problem of defining identity theft. Throwing away information without shredding it isn't, in itself, something for which you should be directly punished. If one of the federal or provincial commissioners heard about the incident, he would intervene in order to say that you absolutely have to change the way you do things, or else he will prosecute you, institute proceedings against you.
On May 8th, 2007. See this statement in context.