Consent is provided in principle only, but consent is not only a principle. It's a key aspect of privacy. I just wanted to make that clear.
The Act respecting the protection of personal information in the private sector clearly states that consent must be obtained from the person concerned as regularly as possible, and not necessarily without the person's knowledge or from a third party. If consent must be obtained from the third party, it can be done with the consent of the person concerned, or, under some circumstances, without the person's knowledge.
In its recent five-year report, the Commission d'accès à l'information also asked that consent be modified with regard to a person entering a public space or a store with surveillance cameras, for example. The people concerned must be informed about this collection of information and they must know they're in a monitored location. This type of collection of information without a person's knowledge must be shared with the person so that they know they'll be filmed when they enter that location. It's a form of implied or express consent.