If I could add one final comment, PIPEDA has built into it, of course, the reasonable purposes concept in subsection 5(3). Irrespective of consent and other provisions, you can do only those things that a reasonable person would consider to be appropriate. That's quite a generic standard, but of course it has to be interpreted, which is the way that the commissioner and the courts have approached it.
It's not without precedent. I'm not saying it's an easy concept to scope, in terms of whether or how that type of right could be scoped, but there are standards to which you could point in terms of how that could be assessed as to what's on which side of the line.