One of the problems with the lack of transparency is that you don't really know where the illegality might be. There are certainly a lot of grey areas here.
In response to your question, however, I would make just two quick points.
It's very important for the committee to note that Cambridge Analytica is one of several companies that do this. Claiming to have 5,000 data points on citizens is actually not uncommon. There are several companies I could point to in the United States that do similar things. The thing that brought Cambridge Analytica to public and media attention was its use of psychographics, which I think most Canadians would really feel crossed the line. However, again, I'm not sure that it would actually be illegal.
In my judgment, the 10 PIPEDA principles provide the guidance here. In the paper I submitted to the committee, I've gone through all 10 principles and explained how our political organizations can, and should, comply with all of them. The parties already do, to some extent, but it's not complete. My plea is not only for transparency here, but also for uniformity, whereby there would be a common agreement among our major federal political parties on what is acceptable practice, online and off-line, with respect to all the sources of personal information captured on Canadians.