—and I'll try to set it out.
Firstly, I'll say that when you collect data, it's an addictive process. It's easy to do. You collect large amounts of data and you can't lose what you don't have. When I say “go slowly”, I want to reiterate that I see people on their worst days very often dealing with breach management. I see the outcome and aspects of the failure to do the things that I am advising to do.
How to balance out the issues of what data to collect, why you're collecting it, making sure that there is consent for its use are the real keys to answering your question, I think.
When we have historical data, consent to use might be very difficult to derive. I can't tell you what consent I gave to the data I gave to the federal government five years ago. I don't remember and can't tell you. I don't remember signing anything away. It was probably in the fine print. You can make a studied case that I did somehow give you, the government, my consent to do that, but if I didn't have clarity about that, if it weren't communicated correctly to me, then I am going to be very unhappy with you when you use the data exactly the way you said you might.
I think that communication and clear consent is probably at the centre of the Statistics Canada case in particular. But I would say, don't collect data you don't need, and be very clear about how you're going to use it and get clear consent for how you're going to use it if it's personal information.