It is more than time that Canada legislates. I have made that point many times. The GDPR, the European regulation, is certainly a good standard to compare ourselves with, but I think it's important for each country to develop its own legislation. There might be cultural or constitutional reasons that certain rules would be different, but certainly the European model is a good model. I've made a number of recommendations inspired by that model.
The main point is that it is high time—it is past time—to legislate.