I don't have an exact answer, but I would not give extreme consideration to the right of the organization to the information in question. At the end of the day, it is the individual's information and PIPEDA is written to protect....
On February 1st, 2018. See this statement in context.