In British Columbia, the equivalent act to PIPEDA applies to all entities, including non-profit organizations, because all organizations engaged in commercial or other activities compile information that includes some information of a delicate nature. Those organizations should be subject to the same provisions.
With regard to third-party organizations—I was in the room when you discussed that kind of organization in Ontario—I think the act should apply to all organizations engaged in commercial or other activities that compile, use or transmit personal information.