Two minutes?
I also want to touch on something else that was brought up, the online behavioural advertising that you mentioned.
The Office of the Privacy Commissioner has said that it's a legitimate business objective. The other part of it is, though, that it must be based on a consent model that corresponds to the sensitivity of the information. How do we determine what is sensitive and not sensitive? What's the threshold? Is there any advice you can provide on that?