Mr. Robert Parker at the Access to Information, Privacy and Ethics Committee

With regard to intent versus event, we can look at some of the FTC rulings, particularly on CVS Pharmacy. One store didn't train their employees properly, didn't give patients access to their own medical information in that drugstore, and there was a $4.5-million fine for 53 events that occurred.

So the event, not the intent, was the threshold they appeared to apply in that case.