I'd add to that. In his opening remarks, Robert pointed out the reasonable person test. Whether consent is the right vehicle is a question that you guys are measuring now. The question is, is it informed consent? Are people just clicking through that button and never reading anything? Is that happening almost 100% of the time? I would venture a guess that, yes, that's what's going on.
If you want to ensure that businesses, including the public sector, are using personal information responsibly, I would suggest that you add that reasonable person test. Would a reasonable Canadian think that this is an appropriate use of their personal information, or not? The courts have 100 years of experience dealing with the reasonable person test. It seems that in today's fast-paced world, taking the time to actually understand and read about what you're consenting to, the company is trying to be transparent. That's why these privacy policies and the end-usage legal agreements are so long. It's because we've added legal liability to the scenario, and so on. Their lawyers are saying, “We have to indemnify ourselves of legal responsibilities through these things”, but nobody reads them.
Is it informed consent? I would venture a guess to say, likely not, in 99.9% of cases. You'd be better off looking at what is a reasonable, responsible use of Canadians' personal information when it is collected.